diff --git a/.buildkite/pipelines/hourly.yml b/.buildkite/pipelines/hourly.yml
index b03a46b5b5c66..4b2b17d272d17 100644
--- a/.buildkite/pipelines/hourly.yml
+++ b/.buildkite/pipelines/hourly.yml
@@ -147,6 +147,13 @@ steps:
     key: linting
     timeout_in_minutes: 90
 
+  - command: .buildkite/scripts/steps/lint_with_types.sh
+    label: 'Linting (with types)'
+    agents:
+      queue: c2-16
+    key: linting_with_types
+    timeout_in_minutes: 90
+
   - command: .buildkite/scripts/steps/checks.sh
     label: 'Checks'
     agents:
diff --git a/.buildkite/pipelines/pull_request/base.yml b/.buildkite/pipelines/pull_request/base.yml
index 1013a841dfd27..0f2a4a1026af8 100644
--- a/.buildkite/pipelines/pull_request/base.yml
+++ b/.buildkite/pipelines/pull_request/base.yml
@@ -145,6 +145,13 @@ steps:
     key: linting
     timeout_in_minutes: 90
 
+  - command: .buildkite/scripts/steps/lint_with_types.sh
+    label: 'Linting (with types)'
+    agents:
+      queue: c2-16
+    key: linting_with_types
+    timeout_in_minutes: 90
+
   - command: .buildkite/scripts/steps/checks.sh
     label: 'Checks'
     agents:
diff --git a/.buildkite/scripts/bootstrap.sh b/.buildkite/scripts/bootstrap.sh
index df38c105d2fd3..272cd0a086170 100755
--- a/.buildkite/scripts/bootstrap.sh
+++ b/.buildkite/scripts/bootstrap.sh
@@ -6,7 +6,17 @@ source .buildkite/scripts/common/util.sh
 source .buildkite/scripts/common/setup_bazel.sh
 
 echo "--- yarn install and bootstrap"
-retry 2 15 yarn kbn bootstrap
+if ! yarn kbn bootstrap; then
+  echo "bootstrap failed, trying again in 15 seconds"
+  sleep 15
+
+  # Most bootstrap failures will result in a problem inside node_modules that does not get fixed on the next bootstrap
+  # So, we should just delete node_modules in between attempts
+  rm -rf node_modules
+
+  echo "--- yarn install and bootstrap, attempt 2"
+  yarn kbn bootstrap
+fi
 
 ###
 ### upload ts-refs-cache artifacts as quickly as possible so they are available for download
diff --git a/.buildkite/scripts/steps/lint_with_types.sh b/.buildkite/scripts/steps/lint_with_types.sh
new file mode 100755
index 0000000000000..81d5ef03f4989
--- /dev/null
+++ b/.buildkite/scripts/steps/lint_with_types.sh
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+source .buildkite/scripts/common/util.sh
+
+export BUILD_TS_REFS_DISABLE=false
+.buildkite/scripts/bootstrap.sh
+
+echo '--- Lint: eslint (with types)'
+checks-reporter-with-killswitch "Lint: eslint (with types)" \
+  node scripts/eslint_with_types
diff --git a/.eslintrc.js b/.eslintrc.js
index 60f3ae1528fbc..00c96e5cf0491 100644
--- a/.eslintrc.js
+++ b/.eslintrc.js
@@ -902,17 +902,6 @@ module.exports = {
       },
     },
 
-    /**
-     * Cases overrides
-     */
-    {
-      files: ['x-pack/plugins/cases/**/*.{js,mjs,ts,tsx}'],
-      rules: {
-        'no-duplicate-imports': 'off',
-        '@typescript-eslint/no-duplicate-imports': ['error'],
-      },
-    },
-
     /**
      * Security Solution overrides. These rules below are maintained and owned by
      * the people within the security-solution-platform team. Please see ping them
@@ -928,6 +917,8 @@ module.exports = {
         'x-pack/plugins/security_solution/common/**/*.{js,mjs,ts,tsx}',
         'x-pack/plugins/timelines/public/**/*.{js,mjs,ts,tsx}',
         'x-pack/plugins/timelines/common/**/*.{js,mjs,ts,tsx}',
+        'x-pack/plugins/cases/public/**/*.{js,mjs,ts,tsx}',
+        'x-pack/plugins/cases/common/**/*.{js,mjs,ts,tsx}',
       ],
       rules: {
         'import/no-nodejs-modules': 'error',
@@ -949,10 +940,12 @@ module.exports = {
       files: [
         'x-pack/plugins/security_solution/**/*.{ts,tsx}',
         'x-pack/plugins/timelines/**/*.{ts,tsx}',
+        'x-pack/plugins/cases/**/*.{ts,tsx}',
       ],
       excludedFiles: [
         'x-pack/plugins/security_solution/**/*.{test,mock,test_helper}.{ts,tsx}',
         'x-pack/plugins/timelines/**/*.{test,mock,test_helper}.{ts,tsx}',
+        'x-pack/plugins/cases/**/*.{test,mock,test_helper}.{ts,tsx}',
       ],
       rules: {
         '@typescript-eslint/no-non-null-assertion': 'error',
@@ -963,6 +956,7 @@ module.exports = {
       files: [
         'x-pack/plugins/security_solution/**/*.{ts,tsx}',
         'x-pack/plugins/timelines/**/*.{ts,tsx}',
+        'x-pack/plugins/cases/**/*.{ts,tsx}',
       ],
       rules: {
         '@typescript-eslint/no-this-alias': 'error',
@@ -985,6 +979,7 @@ module.exports = {
       files: [
         'x-pack/plugins/security_solution/**/*.{js,mjs,ts,tsx}',
         'x-pack/plugins/timelines/**/*.{js,mjs,ts,tsx}',
+        'x-pack/plugins/cases/**/*.{js,mjs,ts,tsx}',
       ],
       plugins: ['eslint-plugin-node', 'react'],
       env: {
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 227041522ac78..e807885e17294 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -232,6 +232,7 @@
 /src/core/  @elastic/kibana-core
 /src/plugins/saved_objects_tagging_oss  @elastic/kibana-core
 /config/kibana.yml @elastic/kibana-core
+/typings/ @elastic/kibana-core
 /x-pack/plugins/banners/  @elastic/kibana-core
 /x-pack/plugins/features/  @elastic/kibana-core
 /x-pack/plugins/licensing/  @elastic/kibana-core
diff --git a/.gitignore b/.gitignore
index c08ae529c2c36..cd79644e5d060 100644
--- a/.gitignore
+++ b/.gitignore
@@ -19,6 +19,7 @@ target
 .idea
 *.iml
 *.log
+types.eslint.config.js
 
 # Ignore example plugin builds
 /examples/*/build
diff --git a/dev_docs/contributing/how_we_use_github.mdx b/dev_docs/contributing/how_we_use_github.mdx
index ff7901fdf08da..3b455b7682c33 100644
--- a/dev_docs/contributing/how_we_use_github.mdx
+++ b/dev_docs/contributing/how_we_use_github.mdx
@@ -37,6 +37,28 @@ Pull requests are made into the master branch and then backported when it is saf
 - Resolve merge conflicts by rebasing the target branch over your feature branch, and force-pushing (see below for instructions).
 - When merging, we’ll squash your commits into a single commit.
 
+### Commit using your `@elastic.co` email address
+
+In order to assist with developer tooling we ask that all Elastic engineers use their `@elastic.co` email address when committing to the Kibana repo. We have implemented a CI check that validates any PR opened by a member of the `@elastic` organization has at least one commit that is attributed to an `@elastic.co` email address. If you have a PR that is failing because of this check you can fix your PR by following these steps:
+
+ 1. Ensure that you don't have any staged changes
+ 1. Checkout the branch for your PR
+ 1. Update the git config for your current repository to commit with your `@elastic.co` email:
+
+    ```bash
+    git config --local user.email YOUR_ELASTIC_EMAIL@elastic.co
+    ```
+
+ 1. Create a commit using the new email address
+
+    ```bash
+    git commit -m 'commit using @elastic.co' --allow-empty
+    ```
+
+ 1. Push the new commit to your PR and the status should now be green
+
+**Note:** If doing this prevents your commits from being attributed to your Github account then make sure to add your `@elastic.co` address at [https://github.com/settings/emails](https://github.com/settings/emails).
+
 ### Rebasing and fixing merge conflicts
 
 Rebasing can be tricky, and fixing merge conflicts can be even trickier because it involves force pushing. This is all compounded by the fact that attempting to push a rebased branch remotely will be rejected by git, and you’ll be prompted to do a pull, which is not at all what you should do (this will really mess up your branch’s history).
diff --git a/docs/CHANGELOG.asciidoc b/docs/CHANGELOG.asciidoc
index 9fce6285bfa3d..8111172893795 100644
--- a/docs/CHANGELOG.asciidoc
+++ b/docs/CHANGELOG.asciidoc
@@ -846,7 +846,7 @@ The default values for the session timeout `xpack.security.session.{lifespan|idl
 *Impact* +
 Use the following default values:
 
-* `xpack.security.session.idleTimeout: 1h`
+* `xpack.security.session.idleTimeout: 8h`
 * `xpack.security.session.lifespan: 30d`
 ====
 
diff --git a/docs/api/dashboard-api.asciidoc b/docs/api/dashboard-api.asciidoc
index 94511c3154fe0..e6f54dd9156ec 100644
--- a/docs/api/dashboard-api.asciidoc
+++ b/docs/api/dashboard-api.asciidoc
@@ -1,7 +1,7 @@
 [[dashboard-api]]
 == Import and export dashboard APIs
 
-deprecated::[7.15.0,These experimental APIs have been deprecated in favor of <<saved-objects-api-import>> and <<saved-objects-api-export>>.]
+deprecated::[7.15.0,Both of these APIs have been deprecated in favor of <<saved-objects-api-import>> and <<saved-objects-api-export>>.]
 
 Import and export dashboards with the corresponding saved objects, such as visualizations, saved
 searches, and index patterns.
diff --git a/docs/api/dashboard/export-dashboard.asciidoc b/docs/api/dashboard/export-dashboard.asciidoc
index 098ec976569bd..3a20eff0a54d2 100644
--- a/docs/api/dashboard/export-dashboard.asciidoc
+++ b/docs/api/dashboard/export-dashboard.asciidoc
@@ -6,7 +6,7 @@
 
 deprecated::[7.15.0,Use <<saved-objects-api-export>> instead.]
 
-experimental[] Export dashboards and corresponding saved objects.
+Export dashboards and corresponding saved objects.
 
 [[dashboard-api-export-request]]
 ==== Request
diff --git a/docs/api/dashboard/import-dashboard.asciidoc b/docs/api/dashboard/import-dashboard.asciidoc
index 41eb47500c8d7..e4817d6cb7ee9 100644
--- a/docs/api/dashboard/import-dashboard.asciidoc
+++ b/docs/api/dashboard/import-dashboard.asciidoc
@@ -6,7 +6,7 @@
 
 deprecated::[7.15.0,Use <<saved-objects-api-import>> instead.]
 
-experimental[] Import dashboards and corresponding saved objects.
+Import dashboards and corresponding saved objects.
 
 [[dashboard-api-import-request]]
 ==== Request
diff --git a/docs/developer/contributing/development-github.asciidoc b/docs/developer/contributing/development-github.asciidoc
index c5a3d942f2af3..44736bf4027c1 100644
--- a/docs/developer/contributing/development-github.asciidoc
+++ b/docs/developer/contributing/development-github.asciidoc
@@ -42,6 +42,28 @@ explanation of _why_ you made the changes that you did.
 feature branch, and force-pushing (see below for instructions).
 * When merging, we'll squash your commits into a single commit.
 
+[discrete]
+==== Commit using your `@elastic.co` email address
+
+In order to assist with developer tooling we ask that all Elastic engineers use their `@elastic.co` email address when committing to the Kibana repo. We have implemented a CI check that validates any PR opened by a member of the `@elastic` organization has at least one commit that is attributed to an `@elastic.co` email address. If you have a PR that is failing because of this check you can fix your PR by following these steps:
+
+ 1. Ensure that you don't have any staged changes
+ 2. Checkout the branch for your PR
+ 3. Update the git config for your current repository to commit with your `@elastic.co` email:
++
+["source","shell"]
+-----------
+git config --local user.email YOUR_ELASTIC_EMAIL@elastic.co
+-----------
+ 4. Create a commit using the new email address
++
+["source","shell"]
+-----------
+git commit -m 'commit using @elastic.co' --allow-empty
+-----------
++
+ 5. Push the new commit to your PR and the status should now be green
+
 [discrete]
 ==== Rebasing and fixing merge conflicts
 
diff --git a/docs/maps/asset-tracking-tutorial.asciidoc b/docs/maps/asset-tracking-tutorial.asciidoc
index 4ba045681e148..ff62f5c019b74 100644
--- a/docs/maps/asset-tracking-tutorial.asciidoc
+++ b/docs/maps/asset-tracking-tutorial.asciidoc
@@ -156,16 +156,16 @@ image::maps/images/asset-tracking-tutorial/logstash_output.png[]
 . Leave the terminal window open and Logstash running throughout this tutorial.
 
 [float]
-==== Step 3: Create a {kib} index pattern for the tri_met_tracks {es} index
+==== Step 3: Create a data view for the tri_met_tracks {es} index
 
-. In Kibana, open the main menu, and click *Stack Management > Index Patterns*.
-. Click *Create index pattern*.
-. Give the index pattern a name: *tri_met_tracks**.
+. In {kib}, open the main menu, and click *Stack Management > Data Views*.
+. Click *Create data view*.
+. Give the data view a name: *tri_met_tracks**.
 . Click *Next step*.
 . Set the *Time field* to *time*.
-. Click *Create index pattern*.
+. Click *Create data view*.
 
-{kib} shows the fields in your index pattern.
+{kib} shows the fields in your data view.
 
 [role="screenshot"]
 image::maps/images/asset-tracking-tutorial/index_pattern.png[]
@@ -174,7 +174,7 @@ image::maps/images/asset-tracking-tutorial/index_pattern.png[]
 ==== Step 4: Explore the Portland bus data
 
 . Open the main menu, and click *Discover*.
-. Set the index pattern to *tri_met_tracks**.
+. Set the data view to *tri_met_tracks**.
 . Open the <<set-time-filter, time filter>>, and set the time range to the last 15 minutes.
 . Expand a document and explore some of the fields that you will use later in this tutorial: `bearing`, `in_congestion`, `location`, and `vehicle_id`.
 
@@ -202,7 +202,7 @@ Add a layer to show the bus routes for the last 15 minutes.
 
 . Click *Add layer*.
 . Click *Tracks*.
-. Select the *tri_met_tracks** index pattern.
+. Select the *tri_met_tracks** data view.
 . Define the tracks:
 .. Set *Entity* to *vehicle_id*.
 .. Set *Sort* to *time*.
@@ -225,7 +225,7 @@ image::maps/images/asset-tracking-tutorial/tracks_layer.png[]
 Add a layer that uses attributes in the data to set the style and orientation of the buses. You’ll see the direction buses are headed and what traffic is like.
 
 . Click *Add layer*, and then select *Top Hits per entity*.
-. Select the *tri_met_tracks** index pattern.
+. Select the *tri_met_tracks** data view.
 . To display the most recent location per bus:
 .. Set *Entity* to *vehicle_id*.
 .. Set *Documents per entity* to 1.
diff --git a/docs/maps/geojson-upload.asciidoc b/docs/maps/geojson-upload.asciidoc
index 3c9bea11176cc..15ef3471e58d7 100644
--- a/docs/maps/geojson-upload.asciidoc
+++ b/docs/maps/geojson-upload.asciidoc
@@ -30,11 +30,11 @@ a preview of the data on the map.
 . Use the default *Index type* of {ref}/geo-point.html[geo_point] for point data,
 or override it and select {ref}/geo-shape.html[geo_shape].
 All other shapes will default to a type of `geo_shape`.
-. Leave the default *Index name* and *Index pattern* names (the name of the uploaded
+. Leave the default *Index name* and *Data view* names (the name of the uploaded
 file minus its extension). You might need to change the index name if it is invalid.
 . Click *Import file*.
 +
-Upon completing the indexing process and creating the associated index pattern,
+Upon completing the indexing process and creating the associated data view,
 the Elasticsearch responses are shown on the *Layer add panel* and the indexed data
 appears on the map. The geospatial data on the map
 should be identical to the locally-previewed data, but now it's indexed data from Elasticsearch.
diff --git a/docs/maps/indexing-geojson-data-tutorial.asciidoc b/docs/maps/indexing-geojson-data-tutorial.asciidoc
index 434c9ab369a5b..50f2e9aed9248 100644
--- a/docs/maps/indexing-geojson-data-tutorial.asciidoc
+++ b/docs/maps/indexing-geojson-data-tutorial.asciidoc
@@ -58,8 +58,8 @@ auto-populate *Index type* with either {ref}/geo-point.html[geo_point] or
 . Click *Import file*.
 +
 You'll see activity as the GeoJSON Upload utility creates a new index
-and index pattern for the data set. When the process is complete, you should
-receive messages that the creation of the new index and index pattern
+and data view for the data set. When the process is complete, you should
+receive messages that the creation of the new index and data view
 were successful.
 
 . Click *Add layer*.
diff --git a/docs/maps/maps-aggregations.asciidoc b/docs/maps/maps-aggregations.asciidoc
index 7f4af952653e7..fced15771c386 100644
--- a/docs/maps/maps-aggregations.asciidoc
+++ b/docs/maps/maps-aggregations.asciidoc
@@ -62,7 +62,7 @@ To enable a grid aggregation layer:
 To enable a blended layer that dynamically shows clusters or documents:
 
 . Click *Add layer*, then select the *Documents* layer.
-. Configure *Index pattern* and the *Geospatial field*.
+. Configure *Data view* and the *Geospatial field*.
 . In *Scaling*, select *Show clusters when results exceed 10000*.
 
 
@@ -77,7 +77,7 @@ then accumulates the most relevant documents based on sort order for each entry
 To enable top hits:
 
 . Click *Add layer*, then select the *Top hits per entity* layer.
-. Configure *Index pattern* and *Geospatial field*.
+. Configure *Data view* and *Geospatial field*.
 . Set *Entity* to the field that identifies entities in your documents.
 This field will be used in the terms aggregation to group your documents into entity buckets.
 . Set *Documents per entity* to configure the maximum number of documents accumulated per entity.
diff --git a/docs/maps/maps-getting-started.asciidoc b/docs/maps/maps-getting-started.asciidoc
index 014be570253bb..89d06fce60183 100644
--- a/docs/maps/maps-getting-started.asciidoc
+++ b/docs/maps/maps-getting-started.asciidoc
@@ -49,7 +49,7 @@ and lighter shades will symbolize countries with less traffic.
 . From the **Layer** dropdown menu, select **World Countries**.
 
 . In **Statistics source**, set:
-** **Index pattern** to **kibana_sample_data_logs**
+** **Data view** to **kibana_sample_data_logs**
 ** **Join field** to **geo.dest**
 
 . Click **Add layer**.
@@ -95,7 +95,7 @@ The layer is only visible when users zoom in.
 
 . Click **Add layer**, and then click **Documents**.
 
-. Set **Index pattern** to **kibana_sample_data_logs**.
+. Set **Data view** to **kibana_sample_data_logs**.
 
 . Set **Scaling** to *Limits results to 10000.*
 
@@ -129,7 +129,7 @@ more total bytes transferred, and smaller circles will symbolize
 grids with less bytes transferred.
 
 . Click **Add layer**, and select **Clusters and grids**.
-. Set **Index pattern** to **kibana_sample_data_logs**.
+. Set **Data view** to **kibana_sample_data_logs**.
 . Click **Add layer**.
 . In **Layer settings**, set:
 ** **Name** to `Total Requests and Bytes`
diff --git a/docs/maps/reverse-geocoding-tutorial.asciidoc b/docs/maps/reverse-geocoding-tutorial.asciidoc
index 0c942f120a4da..8760d3ab4df8b 100644
--- a/docs/maps/reverse-geocoding-tutorial.asciidoc
+++ b/docs/maps/reverse-geocoding-tutorial.asciidoc
@@ -141,7 +141,7 @@ PUT kibana_sample_data_logs/_settings
 ----------------------------------
 
 . Open the main menu, and click *Discover*.
-. Set the index pattern to *kibana_sample_data_logs*.
+. Set the data view to *kibana_sample_data_logs*.
 . Open the <<set-time-filter, time filter>>, and set the time range to the last 30 days.
 . Scan through the list of *Available fields* until you find the `csa.GEOID` field. You can also search for the field by name.
 . Click image:images/reverse-geocoding-tutorial/add-icon.png[Add icon] to toggle the field into the document table.
@@ -162,10 +162,10 @@ Now that our web traffic contains CSA region identifiers, you'll visualize CSA r
 . Click *Choropleth*.
 . For *Boundaries source*: 
 .. Select *Points, lines, and polygons from Elasticsearch*.
-.. Set *Index pattern* to *csa*.
+.. Set *Data view* to *csa*.
 .. Set *Join field* to *GEOID*.
 . For *Statistics source*:
-.. Set *Index pattern* to *kibana_sample_data_logs*.
+.. Set *Data view* to *kibana_sample_data_logs*.
 .. Set *Join field* to *csa.GEOID.keyword*.
 . Click *Add layer*.
 . Scroll to *Layer Style* and Set *Label* to *Fixed*.
diff --git a/docs/maps/trouble-shooting.asciidoc b/docs/maps/trouble-shooting.asciidoc
index 60bcabad3a6b4..13c8b97c30b3d 100644
--- a/docs/maps/trouble-shooting.asciidoc
+++ b/docs/maps/trouble-shooting.asciidoc
@@ -21,18 +21,18 @@ image::maps/images/inspector.png[]
 === Solutions to common problems
 
 [float]
-==== Index not listed when adding layer
+==== Data view not listed when adding layer
 
 * Verify your geospatial data is correctly mapped as {ref}/geo-point.html[geo_point] or {ref}/geo-shape.html[geo_shape].
-  ** Run `GET myIndexPatternTitle/_field_caps?fields=myGeoFieldName` in <<console-kibana, Console>>, replacing `myIndexPatternTitle` and `myGeoFieldName` with your index pattern title and geospatial field name.
+  ** Run `GET myIndexName/_field_caps?fields=myGeoFieldName` in <<console-kibana, Console>>, replacing `myIndexName` and `myGeoFieldName` with your index and geospatial field name.
   ** Ensure response specifies `type` as `geo_point` or `geo_shape`.
-* Verify your geospatial data is correctly mapped in your <<managing-fields,index pattern>>.
-  ** Open your index pattern in <<management, Stack Management>>.
+* Verify your geospatial data is correctly mapped in your <<managing-fields, data view>>.
+  ** Open your data view in <<management, Stack Management>>.
   ** Ensure your geospatial field type is `geo_point` or `geo_shape`.
   ** Ensure your geospatial field is searchable and aggregatable.
   ** If your geospatial field type does not match your Elasticsearch mapping, click the *Refresh* button to refresh the field list from Elasticsearch.
-* Index patterns with thousands of fields can exceed the default maximum payload size.
-Increase <<settings, `server.maxPayload`>> for large index patterns.
+* Data views with thousands of fields can exceed the default maximum payload size.
+Increase <<settings, `server.maxPayload`>> for large data views.
 
 [float]
 ==== Features are not displayed
diff --git a/docs/maps/vector-tooltips.asciidoc b/docs/maps/vector-tooltips.asciidoc
index 2dda35aa28f76..2e4ee99d5b84f 100644
--- a/docs/maps/vector-tooltips.asciidoc
+++ b/docs/maps/vector-tooltips.asciidoc
@@ -18,7 +18,7 @@ image::maps/images/multifeature_tooltip.png[]
 ==== Format tooltips
 
 You can format the attributes in a tooltip by adding <<managing-fields, field formatters>> to your
-index pattern. You can use field formatters to round numbers, provide units,
+data view. You can use field formatters to round numbers, provide units,
 and even display images in your tooltip.
 
 [float]
diff --git a/docs/user/security/audit-logging.asciidoc b/docs/user/security/audit-logging.asciidoc
index 5391e88350943..926331008e990 100644
--- a/docs/user/security/audit-logging.asciidoc
+++ b/docs/user/security/audit-logging.asciidoc
@@ -144,6 +144,10 @@ Refer to the corresponding {es} logs for potential write errors.
 | `unknown` | User is updating a space.
 | `failure` | User is not authorized to update a space.
 
+.2+| `alert_update`
+| `unknown` | User is updating an alert.
+| `failure` | User is not authorized to update an alert.
+
 3+a|
 ====== Type: deletion
 
@@ -214,6 +218,14 @@ Refer to the corresponding {es} logs for potential write errors.
 | `success` | User has accessed a space as part of a search operation.
 | `failure` | User is not authorized to search for spaces.
 
+.2+| `alert_get`
+| `success` | User has accessed an alert.
+| `failure` | User is not authorized to access an alert.
+
+.2+| `alert_find`
+| `success` | User has accessed an alert as part of a search operation.
+| `failure` | User is not authorized to access alerts.
+
 3+a|
 ===== Category: web
 
diff --git a/examples/developer_examples/public/index.ts b/examples/developer_examples/public/index.ts
index a6e5748765ab6..8fcbda387abf0 100644
--- a/examples/developer_examples/public/index.ts
+++ b/examples/developer_examples/public/index.ts
@@ -10,4 +10,4 @@ import { DeveloperExamplesPlugin } from './plugin';
 
 export const plugin = () => new DeveloperExamplesPlugin();
 
-export { DeveloperExamplesSetup } from './plugin';
+export type { DeveloperExamplesSetup } from './plugin';
diff --git a/examples/embeddable_examples/common/index.ts b/examples/embeddable_examples/common/index.ts
index bea814e5a3ed0..4ff60ffb3afcf 100644
--- a/examples/embeddable_examples/common/index.ts
+++ b/examples/embeddable_examples/common/index.ts
@@ -6,5 +6,6 @@
  * Side Public License, v 1.
  */
 
-export { TodoSavedObjectAttributes } from './todo_saved_object_attributes';
-export { BookSavedObjectAttributes, BOOK_SAVED_OBJECT } from './book_saved_object_attributes';
+export type { TodoSavedObjectAttributes } from './todo_saved_object_attributes';
+export type { BookSavedObjectAttributes } from './book_saved_object_attributes';
+export { BOOK_SAVED_OBJECT } from './book_saved_object_attributes';
diff --git a/examples/embeddable_examples/public/index.ts b/examples/embeddable_examples/public/index.ts
index 365c001559843..43d8db39692c7 100644
--- a/examples/embeddable_examples/public/index.ts
+++ b/examples/embeddable_examples/public/index.ts
@@ -6,14 +6,16 @@
  * Side Public License, v 1.
  */
 
+export type { HelloWorldEmbeddableFactory } from './hello_world';
 export {
   HELLO_WORLD_EMBEDDABLE,
   HelloWorldEmbeddable,
   HelloWorldEmbeddableFactoryDefinition,
-  HelloWorldEmbeddableFactory,
 } from './hello_world';
-export { ListContainer, LIST_CONTAINER, ListContainerFactory } from './list_container';
-export { TODO_EMBEDDABLE, TodoEmbeddableFactory } from './todo';
+export type { ListContainerFactory } from './list_container';
+export { ListContainer, LIST_CONTAINER } from './list_container';
+export type { TodoEmbeddableFactory } from './todo';
+export { TODO_EMBEDDABLE } from './todo';
 
 export { BOOK_EMBEDDABLE } from './book';
 
@@ -21,10 +23,8 @@ export { SIMPLE_EMBEDDABLE } from './migrations';
 
 import { EmbeddableExamplesPlugin } from './plugin';
 
-export {
-  SearchableListContainer,
-  SEARCHABLE_LIST_CONTAINER,
-  SearchableListContainerFactory,
-} from './searchable_list_container';
-export { MULTI_TASK_TODO_EMBEDDABLE, MultiTaskTodoEmbeddableFactory } from './multi_task_todo';
+export type { SearchableListContainerFactory } from './searchable_list_container';
+export { SearchableListContainer, SEARCHABLE_LIST_CONTAINER } from './searchable_list_container';
+export type { MultiTaskTodoEmbeddableFactory } from './multi_task_todo';
+export { MULTI_TASK_TODO_EMBEDDABLE } from './multi_task_todo';
 export const plugin = () => new EmbeddableExamplesPlugin();
diff --git a/examples/embeddable_examples/public/list_container/index.ts b/examples/embeddable_examples/public/list_container/index.ts
index cda0e55e59eef..299c3eeae42cd 100644
--- a/examples/embeddable_examples/public/list_container/index.ts
+++ b/examples/embeddable_examples/public/list_container/index.ts
@@ -7,4 +7,5 @@
  */
 
 export { ListContainer, LIST_CONTAINER } from './list_container';
-export { ListContainerFactoryDefinition, ListContainerFactory } from './list_container_factory';
+export type { ListContainerFactory } from './list_container_factory';
+export { ListContainerFactoryDefinition } from './list_container_factory';
diff --git a/examples/embeddable_examples/public/searchable_list_container/index.ts b/examples/embeddable_examples/public/searchable_list_container/index.ts
index 5448731abf2c1..cea0154be812d 100644
--- a/examples/embeddable_examples/public/searchable_list_container/index.ts
+++ b/examples/embeddable_examples/public/searchable_list_container/index.ts
@@ -7,7 +7,5 @@
  */
 
 export { SearchableListContainer, SEARCHABLE_LIST_CONTAINER } from './searchable_list_container';
-export {
-  SearchableListContainerFactoryDefinition,
-  SearchableListContainerFactory,
-} from './searchable_list_container_factory';
+export type { SearchableListContainerFactory } from './searchable_list_container_factory';
+export { SearchableListContainerFactoryDefinition } from './searchable_list_container_factory';
diff --git a/examples/locator_examples/public/index.ts b/examples/locator_examples/public/index.ts
index 50da3501805fa..e71d6bf1e5b01 100644
--- a/examples/locator_examples/public/index.ts
+++ b/examples/locator_examples/public/index.ts
@@ -8,12 +8,12 @@
 
 import { LocatorExamplesPlugin } from './plugin';
 
-export {
+export type {
   HelloLocator,
   HelloLocatorV1Params,
   HelloLocatorV2Params,
   HelloLocatorParams,
-  HELLO_LOCATOR,
 } from './locator';
+export { HELLO_LOCATOR } from './locator';
 
 export const plugin = () => new LocatorExamplesPlugin();
diff --git a/examples/search_examples/public/index.ts b/examples/search_examples/public/index.ts
index fd557f752a38e..c1361facc2941 100644
--- a/examples/search_examples/public/index.ts
+++ b/examples/search_examples/public/index.ts
@@ -15,4 +15,4 @@ import { SearchExamplesPlugin } from './plugin';
 export function plugin() {
   return new SearchExamplesPlugin();
 }
-export { SearchExamplesPluginSetup, SearchExamplesPluginStart } from './types';
+export type { SearchExamplesPluginSetup, SearchExamplesPluginStart } from './types';
diff --git a/examples/search_examples/server/index.ts b/examples/search_examples/server/index.ts
index f351681a1041a..75c23e8e89257 100644
--- a/examples/search_examples/server/index.ts
+++ b/examples/search_examples/server/index.ts
@@ -13,4 +13,4 @@ export function plugin(initializerContext: PluginInitializerContext) {
   return new SearchExamplesPlugin(initializerContext);
 }
 
-export { SearchExamplesPluginSetup, SearchExamplesPluginStart } from './types';
+export type { SearchExamplesPluginSetup, SearchExamplesPluginStart } from './types';
diff --git a/package.json b/package.json
index ae8c9621b1893..440a30d36534e 100644
--- a/package.json
+++ b/package.json
@@ -95,9 +95,9 @@
     "@dnd-kit/core": "^3.1.1",
     "@dnd-kit/sortable": "^4.0.0",
     "@dnd-kit/utilities": "^2.0.0",
-    "@elastic/apm-synthtrace": "link:bazel-bin/packages/elastic-apm-synthtrace",
     "@elastic/apm-rum": "^5.9.1",
     "@elastic/apm-rum-react": "^1.3.1",
+    "@elastic/apm-synthtrace": "link:bazel-bin/packages/elastic-apm-synthtrace",
     "@elastic/charts": "38.1.3",
     "@elastic/datemath": "link:bazel-bin/packages/elastic-datemath",
     "@elastic/elasticsearch": "npm:@elastic/elasticsearch-canary@^8.0.0-canary.35",
@@ -111,7 +111,10 @@
     "@elastic/request-crypto": "1.1.4",
     "@elastic/safer-lodash-set": "link:bazel-bin/packages/elastic-safer-lodash-set",
     "@elastic/search-ui-app-search-connector": "^1.6.0",
+    "@emotion/cache": "^11.4.0",
+    "@emotion/css": "^11.4.0",
     "@emotion/react": "^11.4.0",
+    "@emotion/serialize": "^1.0.2",
     "@hapi/accept": "^5.0.2",
     "@hapi/boom": "^9.1.4",
     "@hapi/cookie": "^11.0.2",
@@ -542,6 +545,7 @@
     "@types/jest-when": "^2.7.2",
     "@types/joi": "^17.2.3",
     "@types/jquery": "^3.3.31",
+    "@types/js-levenshtein": "^1.1.0",
     "@types/js-search": "^1.4.0",
     "@types/js-yaml": "^3.11.1",
     "@types/jsdom": "^16.2.3",
@@ -595,6 +599,7 @@
     "@types/react-router-dom": "^5.1.5",
     "@types/react-test-renderer": "^16.9.1",
     "@types/react-virtualized": "^9.18.7",
+    "@types/react-vis": "^1.11.9",
     "@types/read-pkg": "^4.0.0",
     "@types/recompose": "^0.30.6",
     "@types/reduce-reducers": "^1.0.0",
@@ -633,9 +638,9 @@
     "@types/xml2js": "^0.4.5",
     "@types/yauzl": "^2.9.1",
     "@types/zen-observable": "^0.8.0",
-    "@typescript-eslint/eslint-plugin": "^4.31.2",
-    "@typescript-eslint/parser": "^4.31.2",
-    "@typescript-eslint/typescript-estree": "^4.31.2",
+    "@typescript-eslint/eslint-plugin": "^5.2.0",
+    "@typescript-eslint/parser": "^5.2.0",
+    "@typescript-eslint/typescript-estree": "^5.2.0",
     "@yarnpkg/lockfile": "^1.1.0",
     "abab": "^2.0.4",
     "aggregate-error": "^3.1.0",
diff --git a/packages/kbn-cli-dev-mode/src/get_server_watch_paths.test.ts b/packages/kbn-cli-dev-mode/src/get_server_watch_paths.test.ts
index 9cb902882ffd7..9fa13b013f195 100644
--- a/packages/kbn-cli-dev-mode/src/get_server_watch_paths.test.ts
+++ b/packages/kbn-cli-dev-mode/src/get_server_watch_paths.test.ts
@@ -68,6 +68,7 @@ it('produces the right watch and ignore list', () => {
       <absolute path>/x-pack/plugins/reporting/chromium,
       <absolute path>/x-pack/plugins/security_solution/cypress,
       <absolute path>/x-pack/plugins/apm/scripts,
+      <absolute path>/x-pack/plugins/apm/ftr_e2e,
       <absolute path>/x-pack/plugins/canvas/canvas_plugin_src,
       <absolute path>/x-pack/plugins/cases/server/scripts,
       <absolute path>/x-pack/plugins/lists/scripts,
diff --git a/packages/kbn-cli-dev-mode/src/get_server_watch_paths.ts b/packages/kbn-cli-dev-mode/src/get_server_watch_paths.ts
index 53f52279c8be8..e1bd431d280a4 100644
--- a/packages/kbn-cli-dev-mode/src/get_server_watch_paths.ts
+++ b/packages/kbn-cli-dev-mode/src/get_server_watch_paths.ts
@@ -59,6 +59,7 @@ export function getServerWatchPaths({ pluginPaths, pluginScanDirs }: Options) {
     fromRoot('x-pack/plugins/reporting/chromium'),
     fromRoot('x-pack/plugins/security_solution/cypress'),
     fromRoot('x-pack/plugins/apm/scripts'),
+    fromRoot('x-pack/plugins/apm/ftr_e2e'), // prevents restarts for APM cypress tests
     fromRoot('x-pack/plugins/canvas/canvas_plugin_src'), // prevents server from restarting twice for Canvas plugin changes,
     fromRoot('x-pack/plugins/cases/server/scripts'),
     fromRoot('x-pack/plugins/lists/scripts'),
diff --git a/packages/kbn-config-schema/src/duration/index.ts b/packages/kbn-config-schema/src/duration/index.ts
index 6a05a00c9e871..1b1d47a24abd3 100644
--- a/packages/kbn-config-schema/src/duration/index.ts
+++ b/packages/kbn-config-schema/src/duration/index.ts
@@ -7,7 +7,8 @@
  */
 
 import { Duration, duration as momentDuration, DurationInputArg2, isDuration } from 'moment';
-export { Duration, isDuration };
+export type { Duration };
+export { isDuration };
 
 const timeFormatRegex = /^(0|[1-9][0-9]*)(ms|s|m|h|d|w|M|Y)$/;
 
diff --git a/packages/kbn-config-schema/src/index.ts b/packages/kbn-config-schema/src/index.ts
index 68500a18530bc..8635421beb0a1 100644
--- a/packages/kbn-config-schema/src/index.ts
+++ b/packages/kbn-config-schema/src/index.ts
@@ -49,7 +49,8 @@ import {
   StreamType,
 } from './types';
 
-export { ObjectType, TypeOf, Type, Props, NullableProps };
+export type { TypeOf, Props, NullableProps };
+export { ObjectType, Type };
 export { ByteSizeValue } from './byte_size_value';
 export { SchemaTypeError, ValidationError } from './errors';
 export { isConfigSchema } from './typeguards';
diff --git a/packages/kbn-config-schema/src/types/index.ts b/packages/kbn-config-schema/src/types/index.ts
index d4098a2abf352..5152137985ff3 100644
--- a/packages/kbn-config-schema/src/types/index.ts
+++ b/packages/kbn-config-schema/src/types/index.ts
@@ -6,23 +6,35 @@
  * Side Public License, v 1.
  */
 
-export { Type, TypeOptions } from './type';
+export type { TypeOptions } from './type';
+export { Type } from './type';
 export { AnyType } from './any_type';
-export { ArrayOptions, ArrayType } from './array_type';
+export type { ArrayOptions } from './array_type';
+export { ArrayType } from './array_type';
 export { BooleanType } from './boolean_type';
 export { BufferType } from './buffer_type';
-export { ByteSizeOptions, ByteSizeType } from './byte_size_type';
-export { ConditionalType, ConditionalTypeValue } from './conditional_type';
-export { DurationOptions, DurationType } from './duration_type';
+export type { ByteSizeOptions } from './byte_size_type';
+export { ByteSizeType } from './byte_size_type';
+export type { ConditionalTypeValue } from './conditional_type';
+export { ConditionalType } from './conditional_type';
+export type { DurationOptions } from './duration_type';
+export { DurationType } from './duration_type';
 export { LiteralType } from './literal_type';
 export { MaybeType } from './maybe_type';
-export { MapOfOptions, MapOfType } from './map_type';
-export { NumberOptions, NumberType } from './number_type';
-export { ObjectType, ObjectTypeOptions, Props, NullableProps, TypeOf } from './object_type';
-export { RecordOfOptions, RecordOfType } from './record_type';
+export type { MapOfOptions } from './map_type';
+export { MapOfType } from './map_type';
+export type { NumberOptions } from './number_type';
+export { NumberType } from './number_type';
+export type { ObjectTypeOptions, Props, NullableProps, TypeOf } from './object_type';
+export { ObjectType } from './object_type';
+export type { RecordOfOptions } from './record_type';
+export { RecordOfType } from './record_type';
 export { StreamType } from './stream_type';
-export { StringOptions, StringType } from './string_type';
+export type { StringOptions } from './string_type';
+export { StringType } from './string_type';
 export { UnionType } from './union_type';
-export { URIOptions, URIType } from './uri_type';
+export type { URIOptions } from './uri_type';
+export { URIType } from './uri_type';
 export { NeverType } from './never_type';
-export { IpType, IpOptions } from './ip_type';
+export type { IpOptions } from './ip_type';
+export { IpType } from './ip_type';
diff --git a/packages/kbn-config/src/index.ts b/packages/kbn-config/src/index.ts
index 0068fc87855b0..272ee7598570c 100644
--- a/packages/kbn-config/src/index.ts
+++ b/packages/kbn-config/src/index.ts
@@ -19,16 +19,15 @@ export type {
 
 export { applyDeprecations, configDeprecationFactory } from './deprecation';
 
-export {
-  RawConfigurationProvider,
-  RawConfigService,
-  RawConfigAdapter,
-  getConfigFromFiles,
-} from './raw';
+export type { RawConfigurationProvider, RawConfigAdapter } from './raw';
+export { RawConfigService, getConfigFromFiles } from './raw';
 
-export { ConfigService, IConfigService, ConfigValidateParameters } from './config_service';
-export { Config, ConfigPath, isConfigPath, hasConfigPathIntersection } from './config';
+export type { IConfigService, ConfigValidateParameters } from './config_service';
+export { ConfigService } from './config_service';
+export type { Config, ConfigPath } from './config';
+export { isConfigPath, hasConfigPathIntersection } from './config';
 export { ObjectToConfigAdapter } from './object_to_config_adapter';
-export { CliArgs, Env, RawPackageInfo } from './env';
-export { EnvironmentMode, PackageInfo } from './types';
+export type { CliArgs, RawPackageInfo } from './env';
+export { Env } from './env';
+export type { EnvironmentMode, PackageInfo } from './types';
 export { getPluginSearchPaths } from './plugins';
diff --git a/packages/kbn-config/src/raw/index.ts b/packages/kbn-config/src/raw/index.ts
index 01ad83728aa08..be0a206e16b66 100644
--- a/packages/kbn-config/src/raw/index.ts
+++ b/packages/kbn-config/src/raw/index.ts
@@ -6,5 +6,6 @@
  * Side Public License, v 1.
  */
 
-export { RawConfigService, RawConfigurationProvider, RawConfigAdapter } from './raw_config_service';
+export type { RawConfigurationProvider, RawConfigAdapter } from './raw_config_service';
+export { RawConfigService } from './raw_config_service';
 export { getConfigFromFiles } from './read_config';
diff --git a/packages/kbn-dev-utils/src/proc_runner/errors.ts b/packages/kbn-dev-utils/src/proc_runner/errors.ts
deleted file mode 100644
index d4d252476b76e..0000000000000
--- a/packages/kbn-dev-utils/src/proc_runner/errors.ts
+++ /dev/null
@@ -1,23 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-const $isCliError = Symbol('isCliError');
-
-interface CliError extends Error {
-  [$isCliError]: boolean;
-}
-
-export function createCliError(message: string) {
-  const error: Partial<CliError> = new Error(message);
-  error[$isCliError] = true;
-  return error as CliError;
-}
-
-export function isCliError(error: any): error is CliError {
-  return error && !!error[$isCliError];
-}
diff --git a/packages/kbn-dev-utils/src/proc_runner/proc.ts b/packages/kbn-dev-utils/src/proc_runner/proc.ts
index c9a520de6eb4d..8238e29413309 100644
--- a/packages/kbn-dev-utils/src/proc_runner/proc.ts
+++ b/packages/kbn-dev-utils/src/proc_runner/proc.ts
@@ -19,7 +19,7 @@ const treeKillAsync = promisify((...args: [number, string, any]) => treeKill(...
 
 import { ToolingLog } from '../tooling_log';
 import { observeLines } from '../stdio';
-import { createCliError } from './errors';
+import { createFailError } from '../run';
 
 const SECOND = 1000;
 const STOP_TIMEOUT = 30 * SECOND;
@@ -57,7 +57,7 @@ export type Proc = ReturnType<typeof startProc>;
 export function startProc(name: string, options: ProcOptions, log: ToolingLog) {
   const { cmd, args, cwd, env, stdin } = options;
 
-  log.info('[%s] > %s', name, cmd, args.join(' '));
+  log.info('[%s] > %s', name, cmd === process.execPath ? 'node' : cmd, args.join(' '));
 
   // spawn fails with ENOENT when either the
   // cmd or cwd don't exist, so we check for the cwd
@@ -97,7 +97,9 @@ export function startProc(name: string, options: ProcOptions, log: ToolingLog) {
         }
         // JVM exits with 143 on SIGTERM and 130 on SIGINT, dont' treat then as errors
         if (code > 0 && !(code === 143 || code === 130)) {
-          throw createCliError(`[${name}] exited with code ${code}`);
+          throw createFailError(`[${name}] exited with code ${code}`, {
+            exitCode: code,
+          });
         }
 
         return code;
diff --git a/packages/kbn-dev-utils/src/proc_runner/proc_runner.ts b/packages/kbn-dev-utils/src/proc_runner/proc_runner.ts
index 8ef32411621f8..cb2ac2604e035 100644
--- a/packages/kbn-dev-utils/src/proc_runner/proc_runner.ts
+++ b/packages/kbn-dev-utils/src/proc_runner/proc_runner.ts
@@ -11,7 +11,7 @@ import { filter, first, catchError, map } from 'rxjs/operators';
 import exitHook from 'exit-hook';
 
 import { ToolingLog } from '../tooling_log';
-import { createCliError } from './errors';
+import { createFailError } from '../run';
 import { Proc, ProcOptions, startProc } from './proc';
 
 const SECOND = 1000;
@@ -61,7 +61,6 @@ export class ProcRunner {
    */
   async run(name: string, options: RunOptions) {
     const {
-      cmd,
       args = [],
       cwd = process.cwd(),
       stdin = undefined,
@@ -69,6 +68,7 @@ export class ProcRunner {
       waitTimeout = 15 * MINUTE,
       env = process.env,
     } = options;
+    const cmd = options.cmd === 'node' ? process.execPath : options.cmd;
 
     if (this.closing) {
       throw new Error('ProcRunner is closing');
@@ -99,7 +99,7 @@ export class ProcRunner {
             first(),
             catchError((err) => {
               if (err.name !== 'EmptyError') {
-                throw createCliError(`[${name}] exited without matching pattern: ${wait}`);
+                throw createFailError(`[${name}] exited without matching pattern: ${wait}`);
               } else {
                 throw err;
               }
@@ -110,7 +110,7 @@ export class ProcRunner {
             : Rx.timer(waitTimeout).pipe(
                 map(() => {
                   const sec = waitTimeout / SECOND;
-                  throw createCliError(
+                  throw createFailError(
                     `[${name}] failed to match pattern within ${sec} seconds [pattern=${wait}]`
                   );
                 })
diff --git a/packages/kbn-dev-utils/src/tooling_log/index.ts b/packages/kbn-dev-utils/src/tooling_log/index.ts
index 4da54ee9bfeae..2c7216c87c419 100644
--- a/packages/kbn-dev-utils/src/tooling_log/index.ts
+++ b/packages/kbn-dev-utils/src/tooling_log/index.ts
@@ -8,8 +8,10 @@
 
 export { ToolingLog } from './tooling_log';
 export type { ToolingLogOptions } from './tooling_log';
-export { ToolingLogTextWriter, ToolingLogTextWriterConfig } from './tooling_log_text_writer';
-export { pickLevelFromFlags, parseLogLevel, LogLevel, ParsedLogLevel } from './log_levels';
+export type { ToolingLogTextWriterConfig } from './tooling_log_text_writer';
+export { ToolingLogTextWriter } from './tooling_log_text_writer';
+export type { LogLevel, ParsedLogLevel } from './log_levels';
+export { pickLevelFromFlags, parseLogLevel } from './log_levels';
 export { ToolingLogCollectingWriter } from './tooling_log_collecting_writer';
 export type { Writer } from './writer';
 export type { Message } from './message';
diff --git a/packages/kbn-dev-utils/src/vscode_config/managed_config_keys.ts b/packages/kbn-dev-utils/src/vscode_config/managed_config_keys.ts
index 32cc91ad74c50..63a05910653af 100644
--- a/packages/kbn-dev-utils/src/vscode_config/managed_config_keys.ts
+++ b/packages/kbn-dev-utils/src/vscode_config/managed_config_keys.ts
@@ -37,6 +37,8 @@ export const MANAGED_CONFIG_KEYS: ManagedConfigKey[] = [
     value: {
       ['**/packages/kbn-pm/dist/index.js']: true,
       ['**/api_docs']: true,
+      ['**/tsconfig.tsbuildinfo']: true,
+      ['**/*.map']: true,
     },
   },
   {
diff --git a/packages/kbn-es-archiver/src/lib/index.ts b/packages/kbn-es-archiver/src/lib/index.ts
index 0e47294909add..ee37591e1f2c3 100644
--- a/packages/kbn-es-archiver/src/lib/index.ts
+++ b/packages/kbn-es-archiver/src/lib/index.ts
@@ -20,7 +20,8 @@ export {
 
 export { createFilterRecordsStream } from './records';
 
-export { createStats, Stats } from './stats';
+export type { Stats } from './stats';
+export { createStats } from './stats';
 
 export {
   isGzip,
diff --git a/packages/kbn-es-query/src/es_query/index.ts b/packages/kbn-es-query/src/es_query/index.ts
index 8045b625cd921..192834c9fd485 100644
--- a/packages/kbn-es-query/src/es_query/index.ts
+++ b/packages/kbn-es-query/src/es_query/index.ts
@@ -7,11 +7,12 @@
  */
 
 export { migrateFilter } from './migrate_filter';
-export { buildEsQuery, EsQueryConfig } from './build_es_query';
+export type { EsQueryConfig } from './build_es_query';
+export { buildEsQuery } from './build_es_query';
 export { buildQueryFromFilters } from './from_filters';
 export { luceneStringToDsl } from './lucene_string_to_dsl';
 export { decorateQuery } from './decorate_query';
-export {
+export type {
   IndexPatternBase,
   IndexPatternFieldBase,
   IFieldSubType,
diff --git a/packages/kbn-es-query/src/filters/index.ts b/packages/kbn-es-query/src/filters/index.ts
index 21011db9462ca..c202892cd9c3f 100644
--- a/packages/kbn-es-query/src/filters/index.ts
+++ b/packages/kbn-es-query/src/filters/index.ts
@@ -6,12 +6,12 @@
  * Side Public License, v 1.
  */
 
+export type { FilterCompareOptions } from './helpers';
 export {
   dedupFilters,
   uniqFilters,
   compareFilters,
   COMPARE_ALL_OPTIONS,
-  FilterCompareOptions,
   cleanFilter,
   isFilter,
   isFilters,
@@ -53,7 +53,7 @@ export {
   getFilterParams,
 } from './build_filters';
 
-export {
+export type {
   Query,
   Filter,
   LatLon,
diff --git a/packages/kbn-es-query/src/kuery/index.ts b/packages/kbn-es-query/src/kuery/index.ts
index 6e03b3cb18f4c..868904125dc44 100644
--- a/packages/kbn-es-query/src/kuery/index.ts
+++ b/packages/kbn-es-query/src/kuery/index.ts
@@ -23,4 +23,4 @@ export const toElasticsearchQuery = (...params: Parameters<typeof astToElasticse
 export { KQLSyntaxError } from './kuery_syntax_error';
 export { nodeTypes, nodeBuilder } from './node_types';
 export { fromKueryExpression } from './ast';
-export { DslQuery, KueryNode, KueryQueryOptions } from './types';
+export type { DslQuery, KueryNode, KueryQueryOptions } from './types';
diff --git a/packages/kbn-es-query/src/kuery/node_types/index.ts b/packages/kbn-es-query/src/kuery/node_types/index.ts
index a9298f27d28be..e116b44205853 100644
--- a/packages/kbn-es-query/src/kuery/node_types/index.ts
+++ b/packages/kbn-es-query/src/kuery/node_types/index.ts
@@ -12,7 +12,7 @@ import * as namedArg from './named_arg';
 import * as wildcard from './wildcard';
 import { NodeTypes } from './types';
 
-export { NodeTypes };
+export type { NodeTypes };
 export { nodeBuilder } from './node_builder';
 
 /**
diff --git a/packages/kbn-field-types/src/index.ts b/packages/kbn-field-types/src/index.ts
index 77a2e96367d6f..7bc259c579aad 100644
--- a/packages/kbn-field-types/src/index.ts
+++ b/packages/kbn-field-types/src/index.ts
@@ -15,4 +15,5 @@ export {
   getFilterableKbnTypeNames,
 } from './kbn_field_types';
 
-export { KBN_FIELD_TYPES, ES_FIELD_TYPES, KbnFieldTypeOptions } from './types';
+export type { KbnFieldTypeOptions } from './types';
+export { KBN_FIELD_TYPES, ES_FIELD_TYPES } from './types';
diff --git a/packages/kbn-interpreter/src/common/index.ts b/packages/kbn-interpreter/src/common/index.ts
index 524c854b40429..982de97cf881b 100644
--- a/packages/kbn-interpreter/src/common/index.ts
+++ b/packages/kbn-interpreter/src/common/index.ts
@@ -6,13 +6,8 @@
  * Side Public License, v 1.
  */
 
-export {
-  fromExpression,
-  toExpression,
-  safeElementFromExpression,
-  Ast,
-  ExpressionFunctionAST,
-} from './lib/ast';
+export type { Ast, ExpressionFunctionAST } from './lib/ast';
+export { fromExpression, toExpression, safeElementFromExpression } from './lib/ast';
 export { Fn } from './lib/fn';
 export { getType } from './lib/get_type';
 export { castProvider } from './lib/cast';
diff --git a/packages/kbn-logging/src/ecs/index.ts b/packages/kbn-logging/src/ecs/index.ts
index 08a363ab70275..4de36e25018a8 100644
--- a/packages/kbn-logging/src/ecs/index.ts
+++ b/packages/kbn-logging/src/ecs/index.ts
@@ -44,7 +44,7 @@ import { EcsUser } from './user';
 import { EcsUserAgent } from './user_agent';
 import { EcsVulnerability } from './vulnerability';
 
-export { EcsEventCategory, EcsEventKind, EcsEventOutcome, EcsEventType } from './event';
+export type { EcsEventCategory, EcsEventKind, EcsEventOutcome, EcsEventType } from './event';
 
 interface EcsField {
   /**
diff --git a/packages/kbn-logging/src/index.ts b/packages/kbn-logging/src/index.ts
index 075e18f99afe3..8b713f3ec5172 100644
--- a/packages/kbn-logging/src/index.ts
+++ b/packages/kbn-logging/src/index.ts
@@ -6,11 +6,12 @@
  * Side Public License, v 1.
  */
 
-export { LogLevel, LogLevelId } from './log_level';
-export { LogRecord } from './log_record';
-export { Logger } from './logger';
-export { LogMeta } from './log_meta';
-export { LoggerFactory } from './logger_factory';
-export { Layout } from './layout';
-export { Appender, DisposableAppender } from './appenders';
-export { Ecs, EcsEventCategory, EcsEventKind, EcsEventOutcome, EcsEventType } from './ecs';
+export type { LogLevelId } from './log_level';
+export { LogLevel } from './log_level';
+export type { LogRecord } from './log_record';
+export type { Logger } from './logger';
+export type { LogMeta } from './log_meta';
+export type { LoggerFactory } from './logger_factory';
+export type { Layout } from './layout';
+export type { Appender, DisposableAppender } from './appenders';
+export type { Ecs, EcsEventCategory, EcsEventKind, EcsEventOutcome, EcsEventType } from './ecs';
diff --git a/packages/kbn-logging/src/mocks/index.ts b/packages/kbn-logging/src/mocks/index.ts
index 81918f2c9a15d..d0f084cc99392 100644
--- a/packages/kbn-logging/src/mocks/index.ts
+++ b/packages/kbn-logging/src/mocks/index.ts
@@ -6,4 +6,5 @@
  * Side Public License, v 1.
  */
 
-export { MockedLogger, loggerMock } from './logger.mock';
+export type { MockedLogger } from './logger.mock';
+export { loggerMock } from './logger.mock';
diff --git a/packages/kbn-monaco/src/painless/worker/index.ts b/packages/kbn-monaco/src/painless/worker/index.ts
index acd84020145cd..fdbaa23f74bb1 100644
--- a/packages/kbn-monaco/src/painless/worker/index.ts
+++ b/packages/kbn-monaco/src/painless/worker/index.ts
@@ -8,4 +8,4 @@
 
 export { PainlessWorker } from './painless_worker';
 
-export { PainlessError } from './lib';
+export type { PainlessError } from './lib';
diff --git a/packages/kbn-monaco/src/painless/worker/lib/index.ts b/packages/kbn-monaco/src/painless/worker/lib/index.ts
index ab11a42e0c2b1..46f9be825800a 100644
--- a/packages/kbn-monaco/src/painless/worker/lib/index.ts
+++ b/packages/kbn-monaco/src/painless/worker/lib/index.ts
@@ -8,6 +8,6 @@
 
 export { getAutocompleteSuggestions } from './autocomplete';
 
-export { PainlessError } from './error_listener';
+export type { PainlessError } from './error_listener';
 
 export { parseAndGetSyntaxErrors } from './parser';
diff --git a/packages/kbn-optimizer/src/optimizer/index.ts b/packages/kbn-optimizer/src/optimizer/index.ts
index 28d206488b0a4..a2fefb395e720 100644
--- a/packages/kbn-optimizer/src/optimizer/index.ts
+++ b/packages/kbn-optimizer/src/optimizer/index.ts
@@ -7,7 +7,7 @@
  */
 
 export * from './optimizer_config';
-export { WorkerStdio } from './observe_worker';
+export type { WorkerStdio } from './observe_worker';
 export * from './optimizer_state';
 export * from './cache_keys';
 export * from './watch_bundles_for_changes';
diff --git a/packages/kbn-pm/dist/index.js b/packages/kbn-pm/dist/index.js
index f70c5145516f8..d2c067759e25f 100644
--- a/packages/kbn-pm/dist/index.js
+++ b/packages/kbn-pm/dist/index.js
@@ -548,12 +548,6 @@ Object.defineProperty(exports, "ToolingLogTextWriter", {
     return _tooling_log_text_writer.ToolingLogTextWriter;
   }
 });
-Object.defineProperty(exports, "ToolingLogTextWriterConfig", {
-  enumerable: true,
-  get: function () {
-    return _tooling_log_text_writer.ToolingLogTextWriterConfig;
-  }
-});
 Object.defineProperty(exports, "pickLevelFromFlags", {
   enumerable: true,
   get: function () {
@@ -566,18 +560,6 @@ Object.defineProperty(exports, "parseLogLevel", {
     return _log_levels.parseLogLevel;
   }
 });
-Object.defineProperty(exports, "LogLevel", {
-  enumerable: true,
-  get: function () {
-    return _log_levels.LogLevel;
-  }
-});
-Object.defineProperty(exports, "ParsedLogLevel", {
-  enumerable: true,
-  get: function () {
-    return _log_levels.ParsedLogLevel;
-  }
-});
 Object.defineProperty(exports, "ToolingLogCollectingWriter", {
   enumerable: true,
   get: function () {
@@ -15580,8 +15562,6 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony export (binding) */ __webpack_require__.d(__webpack_exports__, "Log", function() { return Log; });
 /* harmony import */ var _kbn_dev_utils_tooling_log__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(5);
 /* harmony import */ var _kbn_dev_utils_tooling_log__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(_kbn_dev_utils_tooling_log__WEBPACK_IMPORTED_MODULE_0__);
-/* harmony reexport (safe) */ __webpack_require__.d(__webpack_exports__, "LogLevel", function() { return _kbn_dev_utils_tooling_log__WEBPACK_IMPORTED_MODULE_0__["LogLevel"]; });
-
 function _defineProperty(obj, key, value) { if (key in obj) { Object.defineProperty(obj, key, { value: value, enumerable: true, configurable: true, writable: true }); } else { obj[key] = value; } return obj; }
 
 /*
@@ -22197,8 +22177,128 @@ module.exports = function globParent(str, opts) {
 
 var isExtglob = __webpack_require__(267);
 var chars = { '{': '}', '(': ')', '[': ']'};
-var strictRegex = /\\(.)|(^!|\*|[\].+)]\?|\[[^\\\]]+\]|\{[^\\}]+\}|\(\?[:!=][^\\)]+\)|\([^|]+\|[^\\)]+\))/;
-var relaxedRegex = /\\(.)|(^!|[*?{}()[\]]|\(\?)/;
+var strictCheck = function(str) {
+  if (str[0] === '!') {
+    return true;
+  }
+  var index = 0;
+  var pipeIndex = -2;
+  var closeSquareIndex = -2;
+  var closeCurlyIndex = -2;
+  var closeParenIndex = -2;
+  var backSlashIndex = -2;
+  while (index < str.length) {
+    if (str[index] === '*') {
+      return true;
+    }
+
+    if (str[index + 1] === '?' && /[\].+)]/.test(str[index])) {
+      return true;
+    }
+
+    if (closeSquareIndex !== -1 && str[index] === '[' && str[index + 1] !== ']') {
+      if (closeSquareIndex < index) {
+        closeSquareIndex = str.indexOf(']', index);
+      }
+      if (closeSquareIndex > index) {
+        if (backSlashIndex === -1 || backSlashIndex > closeSquareIndex) {
+          return true;
+        }
+        backSlashIndex = str.indexOf('\\', index);
+        if (backSlashIndex === -1 || backSlashIndex > closeSquareIndex) {
+          return true;
+        }
+      }
+    }
+
+    if (closeCurlyIndex !== -1 && str[index] === '{' && str[index + 1] !== '}') {
+      closeCurlyIndex = str.indexOf('}', index);
+      if (closeCurlyIndex > index) {
+        backSlashIndex = str.indexOf('\\', index);
+        if (backSlashIndex === -1 || backSlashIndex > closeCurlyIndex) {
+          return true;
+        }
+      }
+    }
+
+    if (closeParenIndex !== -1 && str[index] === '(' && str[index + 1] === '?' && /[:!=]/.test(str[index + 2]) && str[index + 3] !== ')') {
+      closeParenIndex = str.indexOf(')', index);
+      if (closeParenIndex > index) {
+        backSlashIndex = str.indexOf('\\', index);
+        if (backSlashIndex === -1 || backSlashIndex > closeParenIndex) {
+          return true;
+        }
+      }
+    }
+
+    if (pipeIndex !== -1 && str[index] === '(' && str[index + 1] !== '|') {
+      if (pipeIndex < index) {
+        pipeIndex = str.indexOf('|', index);
+      }
+      if (pipeIndex !== -1 && str[pipeIndex + 1] !== ')') {
+        closeParenIndex = str.indexOf(')', pipeIndex);
+        if (closeParenIndex > pipeIndex) {
+          backSlashIndex = str.indexOf('\\', pipeIndex);
+          if (backSlashIndex === -1 || backSlashIndex > closeParenIndex) {
+            return true;
+          }
+        }
+      }
+    }
+
+    if (str[index] === '\\') {
+      var open = str[index + 1];
+      index += 2;
+      var close = chars[open];
+
+      if (close) {
+        var n = str.indexOf(close, index);
+        if (n !== -1) {
+          index = n + 1;
+        }
+      }
+
+      if (str[index] === '!') {
+        return true;
+      }
+    } else {
+      index++;
+    }
+  }
+  return false;
+};
+
+var relaxedCheck = function(str) {
+  if (str[0] === '!') {
+    return true;
+  }
+  var index = 0;
+  while (index < str.length) {
+    if (/[*?{}()[\]]/.test(str[index])) {
+      return true;
+    }
+
+    if (str[index] === '\\') {
+      var open = str[index + 1];
+      index += 2;
+      var close = chars[open];
+
+      if (close) {
+        var n = str.indexOf(close, index);
+        if (n !== -1) {
+          index = n + 1;
+        }
+      }
+
+      if (str[index] === '!') {
+        return true;
+      }
+    } else {
+      index++;
+    }
+  }
+  return false;
+};
 
 module.exports = function isGlob(str, options) {
   if (typeof str !== 'string' || str === '') {
@@ -22209,32 +22309,14 @@ module.exports = function isGlob(str, options) {
     return true;
   }
 
-  var regex = strictRegex;
-  var match;
+  var check = strictCheck;
 
-  // optionally relax regex
+  // optionally relax check
   if (options && options.strict === false) {
-    regex = relaxedRegex;
+    check = relaxedCheck;
   }
 
-  while ((match = regex.exec(str))) {
-    if (match[2]) return true;
-    var idx = match.index + match[0].length;
-
-    // if an open bracket/brace/paren is escaped,
-    // set the index to the next closing character
-    var open = match[1];
-    var close = open ? chars[open] : null;
-    if (open && close) {
-      var n = str.indexOf(close, idx);
-      if (n !== -1) {
-        idx = n + 1;
-      }
-    }
-
-    str = str.slice(idx);
-  }
-  return false;
+  return check(str);
 };
 
 
diff --git a/packages/kbn-pm/src/utils/log.ts b/packages/kbn-pm/src/utils/log.ts
index 9dbfad2895793..ba4ee6941f540 100644
--- a/packages/kbn-pm/src/utils/log.ts
+++ b/packages/kbn-pm/src/utils/log.ts
@@ -38,4 +38,5 @@ class Log extends ToolingLog {
 }
 
 export const log = new Log();
-export { LogLevel, Log };
+export type { LogLevel };
+export { Log };
diff --git a/packages/kbn-securitysolution-autocomplete/src/field/index.tsx b/packages/kbn-securitysolution-autocomplete/src/field/index.tsx
index 69408e919bb1e..a89e0a096b673 100644
--- a/packages/kbn-securitysolution-autocomplete/src/field/index.tsx
+++ b/packages/kbn-securitysolution-autocomplete/src/field/index.tsx
@@ -8,7 +8,7 @@
 
 import React, { useCallback, useMemo, useState } from 'react';
 import { EuiComboBox, EuiComboBoxOptionOption } from '@elastic/eui';
-import { IndexPatternBase, IndexPatternFieldBase } from '@kbn/es-query';
+import { DataViewBase, DataViewFieldBase } from '@kbn/es-query';
 
 import {
   getGenericComboBoxProps,
@@ -20,14 +20,14 @@ const AS_PLAIN_TEXT = { asPlainText: true };
 interface OperatorProps {
   fieldInputWidth?: number;
   fieldTypeFilter?: string[];
-  indexPattern: IndexPatternBase | undefined;
+  indexPattern: DataViewBase | undefined;
   isClearable: boolean;
   isDisabled: boolean;
   isLoading: boolean;
   isRequired?: boolean;
-  onChange: (a: IndexPatternFieldBase[]) => void;
+  onChange: (a: DataViewFieldBase[]) => void;
   placeholder: string;
-  selectedField: IndexPatternFieldBase | undefined;
+  selectedField: DataViewFieldBase | undefined;
 }
 
 export const FieldComponent: React.FC<OperatorProps> = ({
@@ -56,7 +56,7 @@ export const FieldComponent: React.FC<OperatorProps> = ({
 
   const handleValuesChange = useCallback(
     (newOptions: EuiComboBoxOptionOption[]): void => {
-      const newValues: IndexPatternFieldBase[] = newOptions.map(
+      const newValues: DataViewFieldBase[] = newOptions.map(
         ({ label }) => availableFields[labels.indexOf(label)]
       );
       onChange(newValues);
@@ -94,13 +94,13 @@ export const FieldComponent: React.FC<OperatorProps> = ({
 FieldComponent.displayName = 'Field';
 
 interface ComboBoxFields {
-  availableFields: IndexPatternFieldBase[];
-  selectedFields: IndexPatternFieldBase[];
+  availableFields: DataViewFieldBase[];
+  selectedFields: DataViewFieldBase[];
 }
 
 const getComboBoxFields = (
-  indexPattern: IndexPatternBase | undefined,
-  selectedField: IndexPatternFieldBase | undefined,
+  indexPattern: DataViewBase | undefined,
+  selectedField: DataViewFieldBase | undefined,
   fieldTypeFilter: string[]
 ): ComboBoxFields => {
   const existingFields = getExistingFields(indexPattern);
@@ -113,29 +113,27 @@ const getComboBoxFields = (
 const getComboBoxProps = (fields: ComboBoxFields): GetGenericComboBoxPropsReturn => {
   const { availableFields, selectedFields } = fields;
 
-  return getGenericComboBoxProps<IndexPatternFieldBase>({
+  return getGenericComboBoxProps<DataViewFieldBase>({
     getLabel: (field) => field.name,
     options: availableFields,
     selectedOptions: selectedFields,
   });
 };
 
-const getExistingFields = (indexPattern: IndexPatternBase | undefined): IndexPatternFieldBase[] => {
+const getExistingFields = (indexPattern: DataViewBase | undefined): DataViewFieldBase[] => {
   return indexPattern != null ? indexPattern.fields : [];
 };
 
-const getSelectedFields = (
-  selectedField: IndexPatternFieldBase | undefined
-): IndexPatternFieldBase[] => {
+const getSelectedFields = (selectedField: DataViewFieldBase | undefined): DataViewFieldBase[] => {
   return selectedField ? [selectedField] : [];
 };
 
 const getAvailableFields = (
-  existingFields: IndexPatternFieldBase[],
-  selectedFields: IndexPatternFieldBase[],
+  existingFields: DataViewFieldBase[],
+  selectedFields: DataViewFieldBase[],
   fieldTypeFilter: string[]
-): IndexPatternFieldBase[] => {
-  const fieldsByName = new Map<string, IndexPatternFieldBase>();
+): DataViewFieldBase[] => {
+  const fieldsByName = new Map<string, DataViewFieldBase>();
 
   existingFields.forEach((f) => fieldsByName.set(f.name, f));
   selectedFields.forEach((f) => fieldsByName.set(f.name, f));
diff --git a/packages/kbn-securitysolution-hook-utils/src/use_async/index.test.ts b/packages/kbn-securitysolution-hook-utils/src/use_async/index.test.ts
index 886a3dd27befc..7503f2c5c2be8 100644
--- a/packages/kbn-securitysolution-hook-utils/src/use_async/index.test.ts
+++ b/packages/kbn-securitysolution-hook-utils/src/use_async/index.test.ts
@@ -18,6 +18,13 @@ interface TestArgs {
 type TestReturn = Promise<unknown>;
 
 describe('useAsync', () => {
+  /**
+   * Timeout for both jest tests and for the waitForNextUpdate.
+   * jest tests default to 5 seconds and waitForNextUpdate defaults to 1 second.
+   * 20_0000 = 20,000 milliseconds = 20 seconds
+   */
+  const timeout = 20_000;
+
   let fn: jest.Mock<TestReturn, TestArgs[]>;
   let args: TestArgs;
 
@@ -31,16 +38,20 @@ describe('useAsync', () => {
     expect(fn).not.toHaveBeenCalled();
   });
 
-  it('invokes the function when start is called', async () => {
-    const { result, waitForNextUpdate } = renderHook(() => useAsync(fn));
+  it(
+    'invokes the function when start is called',
+    async () => {
+      const { result, waitForNextUpdate } = renderHook(() => useAsync(fn));
 
-    act(() => {
-      result.current.start(args);
-    });
-    await waitForNextUpdate();
+      act(() => {
+        result.current.start(args);
+      });
+      await waitForNextUpdate({ timeout });
 
-    expect(fn).toHaveBeenCalled();
-  });
+      expect(fn).toHaveBeenCalled();
+    },
+    timeout
+  );
 
   it('invokes the function with start args', async () => {
     const { result, waitForNextUpdate } = renderHook(() => useAsync(fn));
@@ -49,84 +60,99 @@ describe('useAsync', () => {
     act(() => {
       result.current.start(args);
     });
-    await waitForNextUpdate();
+    await waitForNextUpdate({ timeout });
 
     expect(fn).toHaveBeenCalledWith(expectedArgs);
   });
 
-  it('populates result with the resolved value of the fn', async () => {
-    const { result, waitForNextUpdate } = renderHook(() => useAsync(fn));
-    fn.mockResolvedValue({ resolved: 'value' });
-
-    act(() => {
-      result.current.start(args);
-    });
-    await waitForNextUpdate();
-
-    expect(result.current.result).toEqual({ resolved: 'value' });
-    expect(result.current.error).toBeUndefined();
-  });
-
-  it('populates error if function rejects', async () => {
-    fn.mockRejectedValue(new Error('whoops'));
-    const { result, waitForNextUpdate } = renderHook(() => useAsync(fn));
-
-    act(() => {
-      result.current.start(args);
-    });
-    await waitForNextUpdate();
-
-    expect(result.current.result).toBeUndefined();
-    expect(result.current.error).toEqual(new Error('whoops'));
-  });
-
-  it('populates the loading state while the function is pending', async () => {
-    let resolve: () => void;
-    fn.mockImplementation(() => new Promise<void>((_resolve) => (resolve = _resolve)));
-
-    const { result, waitForNextUpdate } = renderHook(() => useAsync(fn));
-
-    act(() => {
-      result.current.start(args);
-    });
-
-    expect(result.current.loading).toBe(true);
-
-    act(() => resolve());
-    await waitForNextUpdate();
-
-    expect(result.current.loading).toBe(false);
-  });
-
-  it('multiple start calls reset state', async () => {
-    let resolve: (result: string) => void;
-    fn.mockImplementation(() => new Promise((_resolve) => (resolve = _resolve)));
-
-    const { result, waitForNextUpdate } = renderHook(() => useAsync(fn));
-
-    act(() => {
-      result.current.start(args);
-    });
-
-    expect(result.current.loading).toBe(true);
-
-    act(() => resolve('result'));
-    await waitForNextUpdate();
-
-    expect(result.current.loading).toBe(false);
-    expect(result.current.result).toBe('result');
-
-    act(() => {
-      result.current.start(args);
-    });
-
-    expect(result.current.loading).toBe(true);
-    expect(result.current.result).toBe(undefined);
-
-    act(() => resolve('result'));
-    await waitForNextUpdate();
-
-    expect(result.current.loading).toBe(false);
-    expect(result.current.result).toBe('result');
-  });
+  it(
+    'populates result with the resolved value of the fn',
+    async () => {
+      const { result, waitForNextUpdate } = renderHook(() => useAsync(fn));
+      fn.mockResolvedValue({ resolved: 'value' });
+
+      act(() => {
+        result.current.start(args);
+      });
+      await waitForNextUpdate({ timeout });
+
+      expect(result.current.result).toEqual({ resolved: 'value' });
+      expect(result.current.error).toBeUndefined();
+    },
+    timeout
+  );
+
+  it(
+    'populates error if function rejects',
+    async () => {
+      fn.mockRejectedValue(new Error('whoops'));
+      const { result, waitForNextUpdate } = renderHook(() => useAsync(fn));
+
+      act(() => {
+        result.current.start(args);
+      });
+      await waitForNextUpdate({ timeout });
+
+      expect(result.current.result).toBeUndefined();
+      expect(result.current.error).toEqual(new Error('whoops'));
+    },
+    timeout
+  );
+
+  it(
+    'populates the loading state while the function is pending',
+    async () => {
+      let resolve: () => void;
+      fn.mockImplementation(() => new Promise<void>((_resolve) => (resolve = _resolve)));
+
+      const { result, waitForNextUpdate } = renderHook(() => useAsync(fn));
+
+      act(() => {
+        result.current.start(args);
+      });
+
+      expect(result.current.loading).toBe(true);
+
+      act(() => resolve());
+      await waitForNextUpdate({ timeout });
+
+      expect(result.current.loading).toBe(false);
+    },
+    timeout
+  );
+
+  it(
+    'multiple start calls reset state',
+    async () => {
+      let resolve: (result: string) => void;
+      fn.mockImplementation(() => new Promise((_resolve) => (resolve = _resolve)));
+
+      const { result, waitForNextUpdate } = renderHook(() => useAsync(fn));
+
+      act(() => {
+        result.current.start(args);
+      });
+
+      expect(result.current.loading).toBe(true);
+
+      act(() => resolve('result'));
+      await waitForNextUpdate({ timeout });
+
+      expect(result.current.loading).toBe(false);
+      expect(result.current.result).toBe('result');
+
+      act(() => {
+        result.current.start(args);
+      });
+
+      expect(result.current.loading).toBe(true);
+      expect(result.current.result).toBe(undefined);
+      act(() => resolve('result'));
+      await waitForNextUpdate({ timeout });
+
+      expect(result.current.loading).toBe(false);
+      expect(result.current.result).toBe('result');
+    },
+    timeout
+  );
 });
diff --git a/packages/kbn-securitysolution-io-ts-list-types/src/common/exception_export_details/index.mock.ts b/packages/kbn-securitysolution-io-ts-list-types/src/common/exception_export_details/index.mock.ts
new file mode 100644
index 0000000000000..703c26ffc3ff1
--- /dev/null
+++ b/packages/kbn-securitysolution-io-ts-list-types/src/common/exception_export_details/index.mock.ts
@@ -0,0 +1,29 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { ExportExceptionDetails } from '.';
+
+export interface ExportExceptionDetailsMock {
+  listCount?: number;
+  missingListsCount?: number;
+  missingLists?: Array<Record<'list_id', string>>;
+  itemCount?: number;
+  missingItemCount?: number;
+  missingItems?: Array<Record<'item_id', string>>;
+}
+
+export const getExceptionExportDetailsMock = (
+  details?: ExportExceptionDetailsMock
+): ExportExceptionDetails => ({
+  exported_exception_list_count: details?.listCount ?? 0,
+  exported_exception_list_item_count: details?.itemCount ?? 0,
+  missing_exception_list_item_count: details?.missingItemCount ?? 0,
+  missing_exception_list_items: details?.missingItems ?? [],
+  missing_exception_lists: details?.missingLists ?? [],
+  missing_exception_lists_count: details?.missingListsCount ?? 0,
+});
diff --git a/packages/kbn-securitysolution-io-ts-list-types/src/common/exception_export_details/index.test.ts b/packages/kbn-securitysolution-io-ts-list-types/src/common/exception_export_details/index.test.ts
new file mode 100644
index 0000000000000..96e25a024c71b
--- /dev/null
+++ b/packages/kbn-securitysolution-io-ts-list-types/src/common/exception_export_details/index.test.ts
@@ -0,0 +1,36 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { pipe } from 'fp-ts/lib/pipeable';
+import { left } from 'fp-ts/lib/Either';
+import { getExceptionExportDetailsMock } from './index.mock';
+import { exportExceptionDetailsSchema, ExportExceptionDetails } from '.';
+import { foldLeftRight, getPaths } from '@kbn/securitysolution-io-ts-utils';
+
+describe('exportExceptionDetails', () => {
+  test('it should validate export meta', () => {
+    const payload = getExceptionExportDetailsMock();
+    const decoded = exportExceptionDetailsSchema.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should strip out extra keys', () => {
+    const payload: ExportExceptionDetails & {
+      extraKey?: string;
+    } = getExceptionExportDetailsMock();
+    payload.extraKey = 'some extra key';
+    const decoded = exportExceptionDetailsSchema.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(getExceptionExportDetailsMock());
+  });
+});
diff --git a/packages/kbn-securitysolution-io-ts-list-types/src/common/exception_export_details/index.ts b/packages/kbn-securitysolution-io-ts-list-types/src/common/exception_export_details/index.ts
new file mode 100644
index 0000000000000..3617ae8c9b8b4
--- /dev/null
+++ b/packages/kbn-securitysolution-io-ts-list-types/src/common/exception_export_details/index.ts
@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import * as t from 'io-ts';
+import { NonEmptyString } from '@kbn/securitysolution-io-ts-types';
+
+export const exportExceptionDetails = {
+  exported_exception_list_count: t.number,
+  exported_exception_list_item_count: t.number,
+  missing_exception_list_item_count: t.number,
+  missing_exception_list_items: t.array(
+    t.exact(
+      t.type({
+        item_id: NonEmptyString,
+      })
+    )
+  ),
+  missing_exception_lists: t.array(
+    t.exact(
+      t.type({
+        list_id: NonEmptyString,
+      })
+    )
+  ),
+  missing_exception_lists_count: t.number,
+};
+
+export const exportExceptionDetailsSchema = t.exact(t.type(exportExceptionDetails));
+
+export type ExportExceptionDetails = t.TypeOf<typeof exportExceptionDetailsSchema>;
diff --git a/packages/kbn-securitysolution-io-ts-list-types/src/common/index.ts b/packages/kbn-securitysolution-io-ts-list-types/src/common/index.ts
index 51b32f3fafa77..81ecd58cb397c 100644
--- a/packages/kbn-securitysolution-io-ts-list-types/src/common/index.ts
+++ b/packages/kbn-securitysolution-io-ts-list-types/src/common/index.ts
@@ -23,6 +23,7 @@ export * from './entry_match';
 export * from './entry_match_any';
 export * from './entry_match_wildcard';
 export * from './entry_nested';
+export * from './exception_export_details';
 export * from './exception_list';
 export * from './exception_list_item_type';
 export * from './filter';
diff --git a/packages/kbn-server-route-repository/src/index.ts b/packages/kbn-server-route-repository/src/index.ts
index 23621c5b213bc..1cc7bd0fdeebe 100644
--- a/packages/kbn-server-route-repository/src/index.ts
+++ b/packages/kbn-server-route-repository/src/index.ts
@@ -12,7 +12,7 @@ export { formatRequest } from './format_request';
 export { parseEndpoint } from './parse_endpoint';
 export { decodeRequestParams } from './decode_request_params';
 export { routeValidationObject } from './route_validation_object';
-export {
+export type {
   RouteRepositoryClient,
   ReturnOf,
   EndpointOf,
diff --git a/packages/kbn-std/src/index.ts b/packages/kbn-std/src/index.ts
index 33b40c20039f2..66fb98888444f 100644
--- a/packages/kbn-std/src/index.ts
+++ b/packages/kbn-std/src/index.ts
@@ -7,13 +7,15 @@
  */
 
 export { assertNever } from './assert_never';
-export { deepFreeze, Freezable } from './deep_freeze';
+export type { Freezable } from './deep_freeze';
+export { deepFreeze } from './deep_freeze';
 export { get } from './get';
 export { mapToObject } from './map_to_object';
 export { merge } from './merge';
 export { pick } from './pick';
 export { withTimeout, isPromise } from './promise';
-export { isRelativeUrl, modifyUrl, getUrlOrigin, URLMeaningfulParts } from './url';
+export type { URLMeaningfulParts } from './url';
+export { isRelativeUrl, modifyUrl, getUrlOrigin } from './url';
 export { unset } from './unset';
 export { getFlattenedObject } from './get_flattened_object';
 export { ensureNoUnsafeProperties } from './ensure_no_unsafe_properties';
diff --git a/packages/kbn-test/src/functional_test_runner/public_types.ts b/packages/kbn-test/src/functional_test_runner/public_types.ts
index d94f61e23b8b8..d1a0f7998b0a9 100644
--- a/packages/kbn-test/src/functional_test_runner/public_types.ts
+++ b/packages/kbn-test/src/functional_test_runner/public_types.ts
@@ -103,4 +103,4 @@ export interface FtrConfigProviderContext {
   readConfigFile(path: string): Promise<Config>;
 }
 
-export { Test, Suite };
+export type { Test, Suite };
diff --git a/packages/kbn-test/src/functional_tests/lib/index.ts b/packages/kbn-test/src/functional_tests/lib/index.ts
index 93700a692dc81..bf2cc43159526 100644
--- a/packages/kbn-test/src/functional_tests/lib/index.ts
+++ b/packages/kbn-test/src/functional_tests/lib/index.ts
@@ -8,6 +8,7 @@
 
 export { runKibanaServer } from './run_kibana_server';
 export { runElasticsearch } from './run_elasticsearch';
-export { runFtr, hasTests, assertNoneExcluded, CreateFtrOptions, CreateFtrParams } from './run_ftr';
+export type { CreateFtrOptions, CreateFtrParams } from './run_ftr';
+export { runFtr, hasTests, assertNoneExcluded } from './run_ftr';
 export { KIBANA_ROOT, KIBANA_FTR_SCRIPT, FUNCTIONAL_CONFIG_PATH, API_CONFIG_PATH } from './paths';
 export { runCli } from './run_cli';
diff --git a/packages/kbn-test/src/index.ts b/packages/kbn-test/src/index.ts
index 0ef9fbfed07a0..29e7e775ec171 100644
--- a/packages/kbn-test/src/index.ts
+++ b/packages/kbn-test/src/index.ts
@@ -25,14 +25,8 @@ export { runTests, startServers } from './functional_tests/tasks';
 // @internal
 export { KIBANA_ROOT } from './functional_tests/lib/paths';
 
-export {
-  esTestConfig,
-  createTestEsCluster,
-  CreateTestEsClusterOptions,
-  EsTestCluster,
-  ICluster,
-  convertToKibanaClient,
-} from './es';
+export type { CreateTestEsClusterOptions, EsTestCluster, ICluster } from './es';
+export { esTestConfig, createTestEsCluster, convertToKibanaClient } from './es';
 
 export { kbnTestConfig, kibanaServerTestUser, kibanaTestUser, adminTestUser } from './kbn';
 
diff --git a/packages/kbn-test/src/jest/utils/testbed/index.ts b/packages/kbn-test/src/jest/utils/testbed/index.ts
index 7abd4f000ab58..dfa5f011853c0 100644
--- a/packages/kbn-test/src/jest/utils/testbed/index.ts
+++ b/packages/kbn-test/src/jest/utils/testbed/index.ts
@@ -7,4 +7,4 @@
  */
 
 export { registerTestBed } from './testbed';
-export { TestBed, TestBedConfig, SetupFunc, UnwrapPromise } from './types';
+export type { TestBed, TestBedConfig, SetupFunc, UnwrapPromise } from './types';
diff --git a/packages/kbn-utility-types/src/index.ts b/packages/kbn-utility-types/src/index.ts
index 921f056c6b755..92aa8d7ecc989 100644
--- a/packages/kbn-utility-types/src/index.ts
+++ b/packages/kbn-utility-types/src/index.ts
@@ -7,7 +7,7 @@
  */
 
 import { PromiseType } from 'utility-types';
-export { $Values, Assign, Class, Optional, Required } from 'utility-types';
+export type { $Values, Assign, Class, Optional, Required } from 'utility-types';
 
 export type {
   JsonArray,
diff --git a/typings/react_vis.d.ts b/scripts/eslint_with_types.js
similarity index 80%
rename from typings/react_vis.d.ts
rename to scripts/eslint_with_types.js
index 209dd398e86f4..e0371bc532170 100644
--- a/typings/react_vis.d.ts
+++ b/scripts/eslint_with_types.js
@@ -6,4 +6,5 @@
  * Side Public License, v 1.
  */
 
-declare module 'react-vis';
+require('../src/setup_node_env');
+require('../src/dev/eslint').runEslintWithTypes();
diff --git a/src/core/public/doc_links/doc_links_service.ts b/src/core/public/doc_links/doc_links_service.ts
index 7284a1a3f06f0..5dc214407e206 100644
--- a/src/core/public/doc_links/doc_links_service.ts
+++ b/src/core/public/doc_links/doc_links_service.ts
@@ -305,9 +305,9 @@ export class DocLinksService {
         },
         observability: {
           guide: `${ELASTIC_WEBSITE_URL}guide/en/observability/${DOC_LINK_VERSION}/index.html`,
-          infrastructureThreshold: `{ELASTIC_WEBSITE_URL}guide/en/observability/${DOC_LINK_VERSION}/infrastructure-threshold-alert.html`,
-          logsThreshold: `{ELASTIC_WEBSITE_URL}guide/en/observability/${DOC_LINK_VERSION}/logs-threshold-alert.html`,
-          metricsThreshold: `{ELASTIC_WEBSITE_URL}guide/en/observability/${DOC_LINK_VERSION}/metrics-threshold-alert.html`,
+          infrastructureThreshold: `${ELASTIC_WEBSITE_URL}guide/en/observability/${DOC_LINK_VERSION}/infrastructure-threshold-alert.html`,
+          logsThreshold: `${ELASTIC_WEBSITE_URL}guide/en/observability/${DOC_LINK_VERSION}/logs-threshold-alert.html`,
+          metricsThreshold: `${ELASTIC_WEBSITE_URL}guide/en/observability/${DOC_LINK_VERSION}/metrics-threshold-alert.html`,
           monitorStatus: `${ELASTIC_WEBSITE_URL}guide/en/observability/${DOC_LINK_VERSION}/monitor-status-alert.html`,
           monitorUptime: `${ELASTIC_WEBSITE_URL}guide/en/observability/${DOC_LINK_VERSION}/monitor-uptime.html`,
           tlsCertificate: `${ELASTIC_WEBSITE_URL}guide/en/observability/${DOC_LINK_VERSION}/tls-certificate-alert.html`,
diff --git a/src/core/server/saved_objects/object_types/registration.ts b/src/core/server/saved_objects/object_types/registration.ts
index ce10896747178..a199ce947f96b 100644
--- a/src/core/server/saved_objects/object_types/registration.ts
+++ b/src/core/server/saved_objects/object_types/registration.ts
@@ -16,8 +16,9 @@ const legacyUrlAliasType: SavedObjectsType = {
     dynamic: false,
     properties: {
       sourceId: { type: 'keyword' },
-      targetType: { type: 'keyword' },
       targetNamespace: { type: 'keyword' },
+      targetType: { type: 'keyword' },
+      targetId: { type: 'keyword' },
       resolveCounter: { type: 'long' },
       disabled: { type: 'boolean' },
       // other properties exist, but we aren't querying or aggregating on those, so we don't need to specify them (because we use `dynamic: false` above)
diff --git a/src/core/server/saved_objects/service/lib/collect_multi_namespace_references.test.mock.ts b/src/core/server/saved_objects/service/lib/collect_multi_namespace_references.test.mock.ts
index 382212cfbbd11..728f3b847b631 100644
--- a/src/core/server/saved_objects/service/lib/collect_multi_namespace_references.test.mock.ts
+++ b/src/core/server/saved_objects/service/lib/collect_multi_namespace_references.test.mock.ts
@@ -6,14 +6,14 @@
  * Side Public License, v 1.
  */
 
-import type { findLegacyUrlAliases } from './find_legacy_url_aliases';
+import type { findLegacyUrlAliases } from './legacy_url_aliases';
 import type * as InternalUtils from './internal_utils';
 
 export const mockFindLegacyUrlAliases = jest.fn() as jest.MockedFunction<
   typeof findLegacyUrlAliases
 >;
 
-jest.mock('./find_legacy_url_aliases', () => {
+jest.mock('./legacy_url_aliases', () => {
   return { findLegacyUrlAliases: mockFindLegacyUrlAliases };
 });
 
diff --git a/src/core/server/saved_objects/service/lib/collect_multi_namespace_references.ts b/src/core/server/saved_objects/service/lib/collect_multi_namespace_references.ts
index 87bb5017aab95..fd2afea999a07 100644
--- a/src/core/server/saved_objects/service/lib/collect_multi_namespace_references.ts
+++ b/src/core/server/saved_objects/service/lib/collect_multi_namespace_references.ts
@@ -9,7 +9,7 @@
 import type { ISavedObjectTypeRegistry } from '../../saved_objects_type_registry';
 import type { SavedObjectsSerializer } from '../../serialization';
 import type { SavedObject, SavedObjectsBaseOptions } from '../../types';
-import { findLegacyUrlAliases } from './find_legacy_url_aliases';
+import { findLegacyUrlAliases } from './legacy_url_aliases';
 import { getRootFields } from './included_fields';
 import {
   getObjectKey,
diff --git a/src/core/server/saved_objects/service/lib/legacy_url_aliases/delete_legacy_url_aliases.test.mock.ts b/src/core/server/saved_objects/service/lib/legacy_url_aliases/delete_legacy_url_aliases.test.mock.ts
new file mode 100644
index 0000000000000..9585c40e6a161
--- /dev/null
+++ b/src/core/server/saved_objects/service/lib/legacy_url_aliases/delete_legacy_url_aliases.test.mock.ts
@@ -0,0 +1,23 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { getErrorMessage } from '../../../../elasticsearch';
+
+export const mockGetEsErrorMessage = jest.fn() as jest.MockedFunction<typeof getErrorMessage>;
+
+jest.mock('../../../../elasticsearch', () => {
+  return { getErrorMessage: mockGetEsErrorMessage };
+});
+
+// Mock these functions to return empty results, as this simplifies test cases and we don't need to exercise alternate code paths for these
+jest.mock('@kbn/es-query', () => {
+  return { nodeTypes: { function: { buildNode: jest.fn() } } };
+});
+jest.mock('../search_dsl', () => {
+  return { getSearchDsl: jest.fn() };
+});
diff --git a/src/core/server/saved_objects/service/lib/legacy_url_aliases/delete_legacy_url_aliases.test.ts b/src/core/server/saved_objects/service/lib/legacy_url_aliases/delete_legacy_url_aliases.test.ts
new file mode 100644
index 0000000000000..22c57fe3f280f
--- /dev/null
+++ b/src/core/server/saved_objects/service/lib/legacy_url_aliases/delete_legacy_url_aliases.test.ts
@@ -0,0 +1,152 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { mockGetEsErrorMessage } from './delete_legacy_url_aliases.test.mock'; // Note: importing this file applies default mocks for other functions too
+
+import { errors as EsErrors } from '@elastic/elasticsearch';
+
+import { elasticsearchClientMock } from '../../../../elasticsearch/client/mocks';
+import { typeRegistryMock } from '../../../saved_objects_type_registry.mock';
+import { ALL_NAMESPACES_STRING } from '../utils';
+import { deleteLegacyUrlAliases } from './delete_legacy_url_aliases';
+import type { DeleteLegacyUrlAliasesParams } from './delete_legacy_url_aliases';
+
+type SetupParams = Pick<
+  DeleteLegacyUrlAliasesParams,
+  'type' | 'id' | 'namespaces' | 'deleteBehavior'
+>;
+
+describe('deleteLegacyUrlAliases', () => {
+  function setup(setupParams: SetupParams) {
+    return {
+      mappings: { properties: {} }, // doesn't matter, only used as an argument to getSearchDsl which is mocked
+      registry: typeRegistryMock.create(), // doesn't matter, only used as an argument to getSearchDsl which is mocked
+      client: elasticsearchClientMock.createElasticsearchClient(),
+      getIndexForType: jest.fn(), // doesn't matter
+      ...setupParams,
+    };
+  }
+
+  const type = 'obj-type';
+  const id = 'obj-id';
+
+  it('throws an error if namespaces includes the "all namespaces" string', async () => {
+    const namespaces = [ALL_NAMESPACES_STRING];
+    const params = setup({ type, id, namespaces, deleteBehavior: 'inclusive' });
+
+    await expect(() => deleteLegacyUrlAliases(params)).rejects.toThrowError(
+      `Failed to delete legacy URL aliases for ${type}/${id}: "namespaces" cannot include the * string`
+    );
+    expect(params.client.updateByQuery).not.toHaveBeenCalled();
+  });
+
+  it('throws an error if updateByQuery fails', async () => {
+    const namespaces = ['space-a', 'space-b'];
+    const params = setup({ type, id, namespaces, deleteBehavior: 'inclusive' });
+    const esError = new EsErrors.ResponseError(
+      elasticsearchClientMock.createApiResponse({
+        statusCode: 500,
+        body: { error: { type: 'es_type', reason: 'es_reason' } },
+      })
+    );
+    params.client.updateByQuery.mockResolvedValueOnce(
+      elasticsearchClientMock.createErrorTransportRequestPromise(esError)
+    );
+    mockGetEsErrorMessage.mockClear();
+    mockGetEsErrorMessage.mockReturnValue('Oh no!');
+
+    await expect(() => deleteLegacyUrlAliases(params)).rejects.toThrowError(
+      `Failed to delete legacy URL aliases for ${type}/${id}: Oh no!`
+    );
+    expect(params.client.updateByQuery).toHaveBeenCalledTimes(1);
+    expect(mockGetEsErrorMessage).toHaveBeenCalledTimes(1);
+    expect(mockGetEsErrorMessage).toHaveBeenCalledWith(esError);
+  });
+
+  describe('deleteBehavior "inclusive"', () => {
+    const deleteBehavior = 'inclusive' as const;
+
+    it('when filtered namespaces is not empty, returns early', async () => {
+      const namespaces = ['default'];
+      const params = setup({ type, id, namespaces, deleteBehavior });
+
+      await deleteLegacyUrlAliases(params);
+      expect(params.client.updateByQuery).not.toHaveBeenCalled();
+    });
+
+    it('when filtered namespaces is not empty, calls updateByQuery with expected script params', async () => {
+      const namespaces = ['space-a', 'default', 'space-b'];
+      const params = setup({ type, id, namespaces, deleteBehavior });
+
+      await deleteLegacyUrlAliases(params);
+      expect(params.client.updateByQuery).toHaveBeenCalledTimes(1);
+      expect(params.client.updateByQuery).toHaveBeenCalledWith(
+        expect.objectContaining({
+          body: expect.objectContaining({
+            script: expect.objectContaining({
+              params: {
+                namespaces: ['space-a', 'space-b'], // 'default' is filtered out
+                matchTargetNamespaceOp: 'delete',
+                notMatchTargetNamespaceOp: 'noop',
+              },
+            }),
+          }),
+        }),
+        expect.anything()
+      );
+    });
+  });
+
+  describe('deleteBehavior "exclusive"', () => {
+    const deleteBehavior = 'exclusive' as const;
+
+    it('when filtered namespaces is empty, calls updateByQuery with expected script params', async () => {
+      const namespaces = ['default'];
+      const params = setup({ type, id, namespaces, deleteBehavior });
+
+      await deleteLegacyUrlAliases(params);
+      expect(params.client.updateByQuery).toHaveBeenCalledTimes(1);
+      expect(params.client.updateByQuery).toHaveBeenCalledWith(
+        expect.objectContaining({
+          body: expect.objectContaining({
+            script: expect.objectContaining({
+              params: {
+                namespaces: [], // 'default' is filtered out
+                matchTargetNamespaceOp: 'noop',
+                notMatchTargetNamespaceOp: 'delete',
+              },
+            }),
+          }),
+        }),
+        expect.anything()
+      );
+    });
+
+    it('when filtered namespaces is not empty, calls updateByQuery with expected script params', async () => {
+      const namespaces = ['space-a', 'default', 'space-b'];
+      const params = setup({ type, id, namespaces, deleteBehavior });
+
+      await deleteLegacyUrlAliases(params);
+      expect(params.client.updateByQuery).toHaveBeenCalledTimes(1);
+      expect(params.client.updateByQuery).toHaveBeenCalledWith(
+        expect.objectContaining({
+          body: expect.objectContaining({
+            script: expect.objectContaining({
+              params: {
+                namespaces: ['space-a', 'space-b'], // 'default' is filtered out
+                matchTargetNamespaceOp: 'noop',
+                notMatchTargetNamespaceOp: 'delete',
+              },
+            }),
+          }),
+        }),
+        expect.anything()
+      );
+    });
+  });
+});
diff --git a/src/core/server/saved_objects/service/lib/legacy_url_aliases/delete_legacy_url_aliases.ts b/src/core/server/saved_objects/service/lib/legacy_url_aliases/delete_legacy_url_aliases.ts
new file mode 100644
index 0000000000000..59c73d1f781a2
--- /dev/null
+++ b/src/core/server/saved_objects/service/lib/legacy_url_aliases/delete_legacy_url_aliases.ts
@@ -0,0 +1,113 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import * as esKuery from '@kbn/es-query';
+
+import { getErrorMessage as getEsErrorMessage } from '../../../../elasticsearch';
+import type { ISavedObjectTypeRegistry } from '../../../saved_objects_type_registry';
+import type { IndexMapping } from '../../../mappings';
+import { LEGACY_URL_ALIAS_TYPE } from '../../../object_types';
+import type { RepositoryEsClient } from '../repository_es_client';
+import { getSearchDsl } from '../search_dsl';
+import { ALL_NAMESPACES_STRING, DEFAULT_NAMESPACE_STRING } from '../utils';
+
+/** @internal */
+export interface DeleteLegacyUrlAliasesParams {
+  mappings: IndexMapping;
+  registry: ISavedObjectTypeRegistry;
+  client: RepositoryEsClient;
+  getIndexForType: (type: string) => string;
+  /** The object type. */
+  type: string;
+  /** The object ID. */
+  id: string;
+  /**
+   * The namespaces to include or exclude when searching for legacy URL alias targets (depends on the `deleteBehavior` parameter).
+   * Note that using `namespaces: [], deleteBehavior: 'exclusive'` will delete all aliases for this object in all spaces.
+   */
+  namespaces: string[];
+  /**
+   * If this is equal to 'inclusive', all aliases with a `targetNamespace` in the `namespaces` array will be deleted.
+   * If this is equal to 'exclusive', all aliases with a `targetNamespace` _not_ in the `namespaces` array will be deleted.
+   */
+  deleteBehavior: 'inclusive' | 'exclusive';
+}
+
+/**
+ * Deletes legacy URL aliases that point to a given object.
+ *
+ * Note that aliases are only created when an object is converted to become share-capable, and each targetId is deterministically generated
+ * with uuidv5 -- this means that the chances of there actually being _multiple_ legacy URL aliases that target a given type/ID are slim to
+ * none. However, we don't always know exactly what space an alias could be in (if an object exists in multiple spaces, or in all spaces),
+ * so the most straightforward way for us to ensure that aliases are reliably deleted is to use updateByQuery, which is what this function
+ * does.
+ *
+ * @internal
+ */
+export async function deleteLegacyUrlAliases(params: DeleteLegacyUrlAliasesParams) {
+  const { mappings, registry, client, getIndexForType, type, id, namespaces, deleteBehavior } =
+    params;
+
+  if (namespaces.includes(ALL_NAMESPACES_STRING)) {
+    throwError(type, id, '"namespaces" cannot include the * string');
+  }
+
+  // Legacy URL aliases cannot exist in the default space; filter that out
+  const filteredNamespaces = namespaces.filter(
+    (namespace) => namespace !== DEFAULT_NAMESPACE_STRING
+  );
+  if (!filteredNamespaces.length && deleteBehavior === 'inclusive') {
+    // nothing to do, return early
+    return;
+  }
+
+  const { buildNode } = esKuery.nodeTypes.function;
+  const match1 = buildNode('is', `${LEGACY_URL_ALIAS_TYPE}.targetType`, type);
+  const match2 = buildNode('is', `${LEGACY_URL_ALIAS_TYPE}.targetId`, id);
+  const kueryNode = buildNode('and', [match1, match2]);
+
+  try {
+    await client.updateByQuery(
+      {
+        index: getIndexForType(LEGACY_URL_ALIAS_TYPE),
+        refresh: false, // This could be called many times in succession, intentionally do not wait for a refresh
+        body: {
+          ...getSearchDsl(mappings, registry, {
+            type: LEGACY_URL_ALIAS_TYPE,
+            kueryNode,
+          }),
+          script: {
+            // Intentionally use one script source with variable params to take advantage of ES script caching
+            source: `
+              if (params['namespaces'].indexOf(ctx._source['${LEGACY_URL_ALIAS_TYPE}']['targetNamespace']) > -1) {
+                ctx.op = params['matchTargetNamespaceOp'];
+              } else {
+                ctx.op = params['notMatchTargetNamespaceOp'];
+              }
+            `,
+            params: {
+              namespaces: filteredNamespaces,
+              matchTargetNamespaceOp: deleteBehavior === 'inclusive' ? 'delete' : 'noop',
+              notMatchTargetNamespaceOp: deleteBehavior === 'inclusive' ? 'noop' : 'delete',
+            },
+            lang: 'painless',
+          },
+          conflicts: 'proceed',
+        },
+      },
+      { ignore: [404] }
+    );
+  } catch (err) {
+    const errorMessage = getEsErrorMessage(err);
+    throwError(type, id, `${errorMessage}`);
+  }
+}
+
+function throwError(type: string, id: string, message: string) {
+  throw new Error(`Failed to delete legacy URL aliases for ${type}/${id}: ${message}`);
+}
diff --git a/src/core/server/saved_objects/service/lib/find_legacy_url_aliases.test.ts b/src/core/server/saved_objects/service/lib/legacy_url_aliases/find_legacy_url_aliases.test.ts
similarity index 94%
rename from src/core/server/saved_objects/service/lib/find_legacy_url_aliases.test.ts
rename to src/core/server/saved_objects/service/lib/legacy_url_aliases/find_legacy_url_aliases.test.ts
index 134ea26d53b7d..755fa5794b575 100644
--- a/src/core/server/saved_objects/service/lib/find_legacy_url_aliases.test.ts
+++ b/src/core/server/saved_objects/service/lib/legacy_url_aliases/find_legacy_url_aliases.test.ts
@@ -8,12 +8,12 @@
 
 import type { DeeplyMockedKeys } from '@kbn/utility-types/jest';
 
-import { LegacyUrlAlias, LEGACY_URL_ALIAS_TYPE } from '../../object_types';
+import { LegacyUrlAlias, LEGACY_URL_ALIAS_TYPE } from '../../../object_types';
+import type { CreatePointInTimeFinderFn, PointInTimeFinder } from '../point_in_time_finder';
+import { savedObjectsPointInTimeFinderMock } from '../point_in_time_finder.mock';
+import type { ISavedObjectsRepository } from '../repository';
+import { savedObjectsRepositoryMock } from '../repository.mock';
 import { findLegacyUrlAliases } from './find_legacy_url_aliases';
-import type { CreatePointInTimeFinderFn, PointInTimeFinder } from './point_in_time_finder';
-import { savedObjectsPointInTimeFinderMock } from './point_in_time_finder.mock';
-import type { ISavedObjectsRepository } from './repository';
-import { savedObjectsRepositoryMock } from './repository.mock';
 
 describe('findLegacyUrlAliases', () => {
   let savedObjectsMock: jest.Mocked<ISavedObjectsRepository>;
diff --git a/src/core/server/saved_objects/service/lib/find_legacy_url_aliases.ts b/src/core/server/saved_objects/service/lib/legacy_url_aliases/find_legacy_url_aliases.ts
similarity index 87%
rename from src/core/server/saved_objects/service/lib/find_legacy_url_aliases.ts
rename to src/core/server/saved_objects/service/lib/legacy_url_aliases/find_legacy_url_aliases.ts
index aac022fc32098..7c1ce82129710 100644
--- a/src/core/server/saved_objects/service/lib/find_legacy_url_aliases.ts
+++ b/src/core/server/saved_objects/service/lib/legacy_url_aliases/find_legacy_url_aliases.ts
@@ -7,9 +7,9 @@
  */
 
 import * as esKuery from '@kbn/es-query';
-import { LegacyUrlAlias, LEGACY_URL_ALIAS_TYPE } from '../../object_types';
-import { getObjectKey } from './internal_utils';
-import type { CreatePointInTimeFinderFn } from './point_in_time_finder';
+import { LegacyUrlAlias, LEGACY_URL_ALIAS_TYPE } from '../../../object_types';
+import { getObjectKey } from '../internal_utils';
+import type { CreatePointInTimeFinderFn } from '../point_in_time_finder';
 
 interface FindLegacyUrlAliasesObject {
   type: string;
@@ -68,6 +68,7 @@ export async function findLegacyUrlAliases(
 
 function createAliasKueryFilter(objects: Array<{ type: string; id: string }>) {
   const { buildNode } = esKuery.nodeTypes.function;
+  // Note: these nodes include '.attributes' for type-level fields because these are eventually passed to `validateConvertFilterToKueryNode`, which requires it
   const kueryNodes = objects.reduce<unknown[]>((acc, { type, id }) => {
     const match1 = buildNode('is', `${LEGACY_URL_ALIAS_TYPE}.attributes.targetType`, type);
     const match2 = buildNode('is', `${LEGACY_URL_ALIAS_TYPE}.attributes.sourceId`, id);
diff --git a/typings/global_fetch.d.ts b/src/core/server/saved_objects/service/lib/legacy_url_aliases/index.ts
similarity index 61%
rename from typings/global_fetch.d.ts
rename to src/core/server/saved_objects/service/lib/legacy_url_aliases/index.ts
index 597bc7e89497c..ec10668940d72 100644
--- a/typings/global_fetch.d.ts
+++ b/src/core/server/saved_objects/service/lib/legacy_url_aliases/index.ts
@@ -6,6 +6,7 @@
  * Side Public License, v 1.
  */
 
-// This type needs to still exist due to apollo-link-http-common hasn't yet updated
-// it's usage (https://github.com/apollographql/apollo-link/issues/1131)
-declare type GlobalFetch = WindowOrWorkerGlobalScope;
+export { findLegacyUrlAliases } from './find_legacy_url_aliases';
+
+export { deleteLegacyUrlAliases } from './delete_legacy_url_aliases';
+export type { DeleteLegacyUrlAliasesParams } from './delete_legacy_url_aliases';
diff --git a/src/core/server/saved_objects/service/lib/preflight_check_for_create.test.mock.ts b/src/core/server/saved_objects/service/lib/preflight_check_for_create.test.mock.ts
index e774a178abd49..fe8076b51e5dd 100644
--- a/src/core/server/saved_objects/service/lib/preflight_check_for_create.test.mock.ts
+++ b/src/core/server/saved_objects/service/lib/preflight_check_for_create.test.mock.ts
@@ -6,14 +6,14 @@
  * Side Public License, v 1.
  */
 
-import type { findLegacyUrlAliases } from './find_legacy_url_aliases';
+import type { findLegacyUrlAliases } from './legacy_url_aliases';
 import type * as InternalUtils from './internal_utils';
 
 export const mockFindLegacyUrlAliases = jest.fn() as jest.MockedFunction<
   typeof findLegacyUrlAliases
 >;
 
-jest.mock('./find_legacy_url_aliases', () => {
+jest.mock('./legacy_url_aliases', () => {
   return { findLegacyUrlAliases: mockFindLegacyUrlAliases };
 });
 
diff --git a/src/core/server/saved_objects/service/lib/preflight_check_for_create.ts b/src/core/server/saved_objects/service/lib/preflight_check_for_create.ts
index 6788cd8aa3abf..e5b96a22631c1 100644
--- a/src/core/server/saved_objects/service/lib/preflight_check_for_create.ts
+++ b/src/core/server/saved_objects/service/lib/preflight_check_for_create.ts
@@ -13,7 +13,7 @@ import type {
   SavedObjectsRawDocSource,
   SavedObjectsSerializer,
 } from '../../serialization';
-import { findLegacyUrlAliases } from './find_legacy_url_aliases';
+import { findLegacyUrlAliases } from './legacy_url_aliases';
 import { Either, rawDocExistsInNamespaces } from './internal_utils';
 import { getObjectKey, isLeft, isRight } from './internal_utils';
 import type { CreatePointInTimeFinderFn } from './point_in_time_finder';
diff --git a/src/core/server/saved_objects/service/lib/repository.test.js b/src/core/server/saved_objects/service/lib/repository.test.js
index 51ec81503956a..f61a79ca9de66 100644
--- a/src/core/server/saved_objects/service/lib/repository.test.js
+++ b/src/core/server/saved_objects/service/lib/repository.test.js
@@ -14,6 +14,7 @@ import {
   mockUpdateObjectsSpaces,
   mockGetCurrentTime,
   mockPreflightCheckForCreate,
+  mockDeleteLegacyUrlAliases,
 } from './repository.test.mock';
 
 import { SavedObjectsRepository } from './repository';
@@ -2394,9 +2395,11 @@ describe('SavedObjectsRepository', () => {
     const id = 'logstash-*';
     const namespace = 'foo-namespace';
 
-    const deleteSuccess = async (type, id, options) => {
+    const deleteSuccess = async (type, id, options, internalOptions = {}) => {
+      const { mockGetResponseValue } = internalOptions;
       if (registry.isMultiNamespace(type)) {
-        const mockGetResponse = getMockGetResponse({ type, id }, options?.namespace);
+        const mockGetResponse =
+          mockGetResponseValue ?? getMockGetResponse({ type, id }, options?.namespace);
         client.get.mockResolvedValueOnce(
           elasticsearchClientMock.createSuccessTransportRequestPromise(mockGetResponse)
         );
@@ -2409,6 +2412,11 @@ describe('SavedObjectsRepository', () => {
       return result;
     };
 
+    beforeEach(() => {
+      mockDeleteLegacyUrlAliases.mockClear();
+      mockDeleteLegacyUrlAliases.mockResolvedValue();
+    });
+
     describe('client calls', () => {
       it(`should use the ES delete action when not using a multi-namespace type`, async () => {
         await deleteSuccess(type, id);
@@ -2482,6 +2490,64 @@ describe('SavedObjectsRepository', () => {
       });
     });
 
+    describe('legacy URL aliases', () => {
+      it(`doesn't delete legacy URL aliases for single-namespace object types`, async () => {
+        await deleteSuccess(type, id, { namespace });
+        expect(mockDeleteLegacyUrlAliases).not.toHaveBeenCalled();
+      });
+
+      // We intentionally do not include a test case for a multi-namespace object with a "not found" preflight result, because that throws
+      // an error (without deleting aliases) and we already have a test case for that
+
+      it(`deletes legacy URL aliases for multi-namespace object types (all spaces)`, async () => {
+        const internalOptions = {
+          mockGetResponseValue: getMockGetResponse(
+            { type: MULTI_NAMESPACE_TYPE, id },
+            ALL_NAMESPACES_STRING
+          ),
+        };
+        await deleteSuccess(MULTI_NAMESPACE_TYPE, id, { namespace, force: true }, internalOptions);
+        expect(mockDeleteLegacyUrlAliases).toHaveBeenCalledWith(
+          expect.objectContaining({
+            type: MULTI_NAMESPACE_TYPE,
+            id,
+            namespaces: [],
+            deleteBehavior: 'exclusive',
+          })
+        );
+      });
+
+      it(`deletes legacy URL aliases for multi-namespace object types (specific spaces)`, async () => {
+        await deleteSuccess(MULTI_NAMESPACE_TYPE, id, { namespace }); // this function mocks a preflight response with the given namespace by default
+        expect(mockDeleteLegacyUrlAliases).toHaveBeenCalledWith(
+          expect.objectContaining({
+            type: MULTI_NAMESPACE_TYPE,
+            id,
+            namespaces: [namespace],
+            deleteBehavior: 'inclusive',
+          })
+        );
+      });
+
+      it(`logs a message when deleteLegacyUrlAliases returns an error`, async () => {
+        client.get.mockResolvedValueOnce(
+          elasticsearchClientMock.createSuccessTransportRequestPromise(
+            getMockGetResponse({ type: MULTI_NAMESPACE_ISOLATED_TYPE, id, namespace })
+          )
+        );
+        client.delete.mockResolvedValueOnce(
+          elasticsearchClientMock.createSuccessTransportRequestPromise({ result: 'deleted' })
+        );
+        mockDeleteLegacyUrlAliases.mockRejectedValueOnce(new Error('Oh no!'));
+        await savedObjectsRepository.delete(MULTI_NAMESPACE_ISOLATED_TYPE, id, { namespace });
+        expect(client.get).toHaveBeenCalledTimes(1);
+        expect(logger.error).toHaveBeenCalledTimes(1);
+        expect(logger.error).toHaveBeenCalledWith(
+          'Unable to delete aliases when deleting an object: Oh no!'
+        );
+      });
+    });
+
     describe('errors', () => {
       const expectNotFoundError = async (type, id, options) => {
         await expect(savedObjectsRepository.delete(type, id, options)).rejects.toThrowError(
diff --git a/src/core/server/saved_objects/service/lib/repository.test.mock.ts b/src/core/server/saved_objects/service/lib/repository.test.mock.ts
index 88eb13e3ca46b..3ec2cb0a5d8b9 100644
--- a/src/core/server/saved_objects/service/lib/repository.test.mock.ts
+++ b/src/core/server/saved_objects/service/lib/repository.test.mock.ts
@@ -11,6 +11,7 @@ import type { internalBulkResolve } from './internal_bulk_resolve';
 import type * as InternalUtils from './internal_utils';
 import type { preflightCheckForCreate } from './preflight_check_for_create';
 import type { updateObjectsSpaces } from './update_objects_spaces';
+import type { deleteLegacyUrlAliases } from './legacy_url_aliases';
 
 export const mockCollectMultiNamespaceReferences = jest.fn() as jest.MockedFunction<
   typeof collectMultiNamespaceReferences
@@ -60,3 +61,10 @@ export const pointInTimeFinderMock = jest.fn();
 jest.doMock('./point_in_time_finder', () => ({
   PointInTimeFinder: pointInTimeFinderMock,
 }));
+
+export const mockDeleteLegacyUrlAliases = jest.fn() as jest.MockedFunction<
+  typeof deleteLegacyUrlAliases
+>;
+jest.mock('./legacy_url_aliases', () => ({
+  deleteLegacyUrlAliases: mockDeleteLegacyUrlAliases,
+}));
diff --git a/src/core/server/saved_objects/service/lib/repository.ts b/src/core/server/saved_objects/service/lib/repository.ts
index ab802d2f36677..d538690fb1920 100644
--- a/src/core/server/saved_objects/service/lib/repository.ts
+++ b/src/core/server/saved_objects/service/lib/repository.ts
@@ -100,6 +100,7 @@ import {
   preflightCheckForCreate,
   PreflightCheckForCreateObject,
 } from './preflight_check_for_create';
+import { deleteLegacyUrlAliases } from './legacy_url_aliases';
 
 // BEWARE: The SavedObjectClient depends on the implementation details of the SavedObjectsRepository
 // so any breaking changes to this repository are considered breaking changes to the SavedObjectsClient.
@@ -717,6 +718,25 @@ export class SavedObjectsRepository {
 
     const deleted = body.result === 'deleted';
     if (deleted) {
+      const namespaces = preflightResult?.savedObjectNamespaces;
+      if (namespaces) {
+        // This is a multi-namespace object type, and it might have legacy URL aliases that need to be deleted.
+        await deleteLegacyUrlAliases({
+          mappings: this._mappings,
+          registry: this._registry,
+          client: this.client,
+          getIndexForType: this.getIndexForType.bind(this),
+          type,
+          id,
+          ...(namespaces.includes(ALL_NAMESPACES_STRING)
+            ? { namespaces: [], deleteBehavior: 'exclusive' } // delete legacy URL aliases for this type/ID for all spaces
+            : { namespaces, deleteBehavior: 'inclusive' }), // delete legacy URL aliases for this type/ID for these specific spaces
+        }).catch((err) => {
+          // The object has already been deleted, but we caught an error when attempting to delete aliases.
+          // A consumer cannot attempt to delete the object again, so just log the error and swallow it.
+          this._logger.error(`Unable to delete aliases when deleting an object: ${err.message}`);
+        });
+      }
       return {};
     }
 
@@ -1344,10 +1364,12 @@ export class SavedObjectsRepository {
     options?: SavedObjectsUpdateObjectsSpacesOptions
   ) {
     return updateObjectsSpaces({
+      mappings: this._mappings,
       registry: this._registry,
       allowedTypes: this._allowedTypes,
       client: this.client,
       serializer: this._serializer,
+      logger: this._logger,
       getIndexForType: this.getIndexForType.bind(this),
       objects,
       spacesToAdd,
diff --git a/src/core/server/saved_objects/service/lib/update_objects_spaces.test.mock.ts b/src/core/server/saved_objects/service/lib/update_objects_spaces.test.mock.ts
index d7aa762e01aab..043975d5bb52b 100644
--- a/src/core/server/saved_objects/service/lib/update_objects_spaces.test.mock.ts
+++ b/src/core/server/saved_objects/service/lib/update_objects_spaces.test.mock.ts
@@ -7,6 +7,7 @@
  */
 
 import type * as InternalUtils from './internal_utils';
+import type { deleteLegacyUrlAliases } from './legacy_url_aliases';
 
 export const mockGetBulkOperationError = jest.fn() as jest.MockedFunction<
   typeof InternalUtils['getBulkOperationError']
@@ -27,3 +28,10 @@ jest.mock('./internal_utils', () => {
     rawDocExistsInNamespace: mockRawDocExistsInNamespace,
   };
 });
+
+export const mockDeleteLegacyUrlAliases = jest.fn() as jest.MockedFunction<
+  typeof deleteLegacyUrlAliases
+>;
+jest.mock('./legacy_url_aliases', () => ({
+  deleteLegacyUrlAliases: mockDeleteLegacyUrlAliases,
+}));
diff --git a/src/core/server/saved_objects/service/lib/update_objects_spaces.test.ts b/src/core/server/saved_objects/service/lib/update_objects_spaces.test.ts
index 11dbe6149878c..d5b79b70a55a1 100644
--- a/src/core/server/saved_objects/service/lib/update_objects_spaces.test.ts
+++ b/src/core/server/saved_objects/service/lib/update_objects_spaces.test.ts
@@ -10,12 +10,14 @@ import {
   mockGetBulkOperationError,
   mockGetExpectedVersionProperties,
   mockRawDocExistsInNamespace,
+  mockDeleteLegacyUrlAliases,
 } from './update_objects_spaces.test.mock';
 
 import type { DeeplyMockedKeys } from '@kbn/utility-types/jest';
 import type { ElasticsearchClient } from 'src/core/server/elasticsearch';
 import { elasticsearchClientMock } from 'src/core/server/elasticsearch/client/mocks';
 
+import { loggerMock } from '../../../logging/logger.mock';
 import { typeRegistryMock } from '../../saved_objects_type_registry.mock';
 import { SavedObjectsSerializer } from '../../serialization';
 import type {
@@ -23,6 +25,7 @@ import type {
   UpdateObjectsSpacesParams,
 } from './update_objects_spaces';
 import { updateObjectsSpaces } from './update_objects_spaces';
+import { ALL_NAMESPACES_STRING } from './utils';
 
 type SetupParams = Partial<
   Pick<UpdateObjectsSpacesParams, 'objects' | 'spacesToAdd' | 'spacesToRemove' | 'options'>
@@ -53,6 +56,8 @@ beforeEach(() => {
   mockGetExpectedVersionProperties.mockReturnValue(EXPECTED_VERSION_PROPS);
   mockRawDocExistsInNamespace.mockReset();
   mockRawDocExistsInNamespace.mockReturnValue(true); // return true by default
+  mockDeleteLegacyUrlAliases.mockReset();
+  mockDeleteLegacyUrlAliases.mockResolvedValue(); // resolve an empty promise by default
 });
 
 afterAll(() => {
@@ -71,10 +76,12 @@ describe('#updateObjectsSpaces', () => {
     client = elasticsearchClientMock.createElasticsearchClient();
     const serializer = new SavedObjectsSerializer(registry);
     return {
+      mappings: { properties: {} }, // doesn't matter, only used as an argument to deleteLegacyUrlAliases which is mocked
       registry,
       allowedTypes: [SHAREABLE_OBJ_TYPE, NON_SHAREABLE_OBJ_TYPE], // SHAREABLE_HIDDEN_OBJ_TYPE is excluded
       client,
       serializer,
+      logger: loggerMock.create(),
       getIndexForType: (type: string) => `index-for-${type}`,
       objects,
       spacesToAdd,
@@ -382,6 +389,149 @@ describe('#updateObjectsSpaces', () => {
         expect(client.bulk).not.toHaveBeenCalled();
       });
     });
+
+    describe('legacy URL aliases', () => {
+      it('does not delete aliases for objects that were not removed from any spaces', async () => {
+        const space1 = 'space-to-add';
+        const space2 = 'space-to-remove';
+        const space3 = 'other-space';
+        const obj1 = { type: SHAREABLE_OBJ_TYPE, id: 'id-1', spaces: [space1] }; // will not be changed
+        const obj2 = { type: SHAREABLE_OBJ_TYPE, id: 'id-2', spaces: [space3] }; // will be updated
+
+        const objects = [obj1, obj2];
+        const spacesToAdd = [space1];
+        const spacesToRemove = [space2];
+        const params = setup({ objects, spacesToAdd, spacesToRemove });
+        // this test case does not call mget
+        mockBulkResults({ error: false }); // result for obj2
+
+        await updateObjectsSpaces(params);
+        expect(client.bulk).toHaveBeenCalledTimes(1);
+        expectBulkArgs({ action: 'update', object: { ...obj2, namespaces: [space3, space1] } });
+        expect(mockDeleteLegacyUrlAliases).not.toHaveBeenCalled();
+        expect(params.logger.error).not.toHaveBeenCalled();
+      });
+
+      it('does not delete aliases for objects that were removed from spaces but were also added to All Spaces (*)', async () => {
+        const space2 = 'space-to-remove';
+        const obj1 = { type: SHAREABLE_OBJ_TYPE, id: 'id-1', spaces: [space2] };
+
+        const objects = [obj1];
+        const spacesToAdd = [ALL_NAMESPACES_STRING];
+        const spacesToRemove = [space2];
+        const params = setup({ objects, spacesToAdd, spacesToRemove });
+        // this test case does not call mget
+        mockBulkResults({ error: false }); // result for obj1
+
+        await updateObjectsSpaces(params);
+        expect(client.bulk).toHaveBeenCalledTimes(1);
+        expectBulkArgs({
+          action: 'update',
+          object: { ...obj1, namespaces: [ALL_NAMESPACES_STRING] },
+        });
+        expect(mockDeleteLegacyUrlAliases).not.toHaveBeenCalled();
+        expect(params.logger.error).not.toHaveBeenCalled();
+      });
+
+      it('deletes aliases for objects that were removed from specific spaces using "deleteBehavior: exclusive"', async () => {
+        const space1 = 'space-to-remove';
+        const space2 = 'another-space-to-remove';
+        const space3 = 'other-space';
+        const obj1 = { type: SHAREABLE_OBJ_TYPE, id: 'id-1', spaces: [space3] }; // will not be changed
+        const obj2 = { type: SHAREABLE_OBJ_TYPE, id: 'id-1', spaces: [space1, space2, space3] }; // will be updated
+        const obj3 = { type: SHAREABLE_OBJ_TYPE, id: 'id-1', spaces: [space1] }; // will be deleted
+
+        const objects = [obj1, obj2, obj3];
+        const spacesToRemove = [space1, space2];
+        const params = setup({ objects, spacesToRemove });
+        // this test case does not call mget
+        mockBulkResults({ error: false }, { error: false }); // result2 for obj2 and obj3
+
+        await updateObjectsSpaces(params);
+        expect(client.bulk).toHaveBeenCalledTimes(1);
+        expectBulkArgs(
+          { action: 'update', object: { ...obj2, namespaces: [space3] } },
+          { action: 'delete', object: obj3 }
+        );
+        expect(mockDeleteLegacyUrlAliases).toHaveBeenCalledTimes(2);
+        expect(mockDeleteLegacyUrlAliases).toHaveBeenNthCalledWith(
+          1, // the first call resulted in an error which generated a log message (see assertion below)
+          expect.objectContaining({
+            type: obj2.type,
+            id: obj2.id,
+            namespaces: [space1, space2],
+            deleteBehavior: 'inclusive',
+          })
+        );
+        expect(mockDeleteLegacyUrlAliases).toHaveBeenNthCalledWith(
+          2,
+          expect.objectContaining({
+            type: obj3.type,
+            id: obj3.id,
+            namespaces: [space1],
+            deleteBehavior: 'inclusive',
+          })
+        );
+        expect(params.logger.error).not.toHaveBeenCalled();
+      });
+
+      it('deletes aliases for objects that were removed from all spaces using "deleteBehavior: inclusive"', async () => {
+        const space1 = 'space-to-add';
+        const space2 = 'other-space';
+        const obj1 = { type: SHAREABLE_OBJ_TYPE, id: 'id-1', spaces: [space2] }; // will be updated to add space1
+        const obj2 = {
+          type: SHAREABLE_OBJ_TYPE,
+          id: 'id-2',
+          spaces: [space2, ALL_NAMESPACES_STRING], // will be updated to add space1 and remove *
+        };
+
+        const objects = [obj1, obj2];
+        const spacesToAdd = [space1];
+        const spacesToRemove = [ALL_NAMESPACES_STRING];
+        const params = setup({ objects, spacesToAdd, spacesToRemove });
+        // this test case does not call mget
+        mockBulkResults({ error: false }); // result for obj1
+
+        await updateObjectsSpaces(params);
+        expect(client.bulk).toHaveBeenCalledTimes(1);
+        expectBulkArgs(
+          { action: 'update', object: { ...obj1, namespaces: [space2, space1] } },
+          { action: 'update', object: { ...obj2, namespaces: [space2, space1] } }
+        );
+        expect(mockDeleteLegacyUrlAliases).toHaveBeenCalledTimes(1);
+        expect(mockDeleteLegacyUrlAliases).toHaveBeenCalledWith(
+          expect.objectContaining({
+            type: obj2.type,
+            id: obj2.id,
+            namespaces: [space2, space1],
+            deleteBehavior: 'exclusive',
+          })
+        );
+        expect(params.logger.error).not.toHaveBeenCalled();
+      });
+
+      it('logs a message when deleteLegacyUrlAliases returns an error', async () => {
+        const space1 = 'space-to-remove';
+        const space2 = 'other-space';
+        const obj1 = { type: SHAREABLE_OBJ_TYPE, id: 'id-1', spaces: [space1, space2] }; // will be updated
+
+        const objects = [obj1];
+        const spacesToRemove = [space1];
+        const params = setup({ objects, spacesToRemove });
+        // this test case does not call mget
+        mockBulkResults({ error: false }); // result for obj1
+        mockDeleteLegacyUrlAliases.mockRejectedValueOnce(new Error('Oh no!')); // result for deleting aliases for obj1
+
+        await updateObjectsSpaces(params);
+        expect(client.bulk).toHaveBeenCalledTimes(1);
+        expectBulkArgs({ action: 'update', object: { ...obj1, namespaces: [space2] } });
+        expect(mockDeleteLegacyUrlAliases).toHaveBeenCalledTimes(1); // don't assert deleteLegacyUrlAliases args, we have tests for that above
+        expect(params.logger.error).toHaveBeenCalledTimes(1);
+        expect(params.logger.error).toHaveBeenCalledWith(
+          'Unable to delete aliases when unsharing an object: Oh no!'
+        );
+      });
+    });
   });
 
   describe('returns expected results', () => {
diff --git a/src/core/server/saved_objects/service/lib/update_objects_spaces.ts b/src/core/server/saved_objects/service/lib/update_objects_spaces.ts
index d88bf700a900e..90e914b9796c3 100644
--- a/src/core/server/saved_objects/service/lib/update_objects_spaces.ts
+++ b/src/core/server/saved_objects/service/lib/update_objects_spaces.ts
@@ -6,9 +6,12 @@
  * Side Public License, v 1.
  */
 
+import pMap from 'p-map';
 import * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import intersection from 'lodash/intersection';
 
+import type { Logger } from '../../../logging';
+import type { IndexMapping } from '../../mappings';
 import type { ISavedObjectTypeRegistry } from '../../saved_objects_type_registry';
 import type { SavedObjectsRawDocSource, SavedObjectsSerializer } from '../../serialization';
 import type {
@@ -28,6 +31,9 @@ import {
 } from './internal_utils';
 import { DEFAULT_REFRESH_SETTING } from './repository';
 import type { RepositoryEsClient } from './repository_es_client';
+import { ALL_NAMESPACES_STRING } from './utils';
+import type { DeleteLegacyUrlAliasesParams } from './legacy_url_aliases';
+import { deleteLegacyUrlAliases } from './legacy_url_aliases';
 
 /**
  * An object that should have its spaces updated.
@@ -94,10 +100,12 @@ export interface SavedObjectsUpdateObjectsSpacesResponseObject {
  * @internal
  */
 export interface UpdateObjectsSpacesParams {
+  mappings: IndexMapping;
   registry: ISavedObjectTypeRegistry;
   allowedTypes: string[];
   client: RepositoryEsClient;
   serializer: SavedObjectsSerializer;
+  logger: Logger;
   getIndexForType: (type: string) => string;
   objects: SavedObjectsUpdateObjectsSpacesObject[];
   spacesToAdd: string[];
@@ -105,15 +113,24 @@ export interface UpdateObjectsSpacesParams {
   options?: SavedObjectsUpdateObjectsSpacesOptions;
 }
 
+type ObjectToDeleteAliasesFor = Pick<
+  DeleteLegacyUrlAliasesParams,
+  'type' | 'id' | 'namespaces' | 'deleteBehavior'
+>;
+
+const MAX_CONCURRENT_ALIAS_DELETIONS = 10;
+
 /**
  * Gets all references and transitive references of the given objects. Ignores any object and/or reference that is not a multi-namespace
  * type.
  */
 export async function updateObjectsSpaces({
+  mappings,
   registry,
   allowedTypes,
   client,
   serializer,
+  logger,
   getIndexForType,
   objects,
   spacesToAdd,
@@ -190,8 +207,12 @@ export async function updateObjectsSpaces({
   const time = new Date().toISOString();
   let bulkOperationRequestIndexCounter = 0;
   const bulkOperationParams: estypes.BulkOperationContainer[] = [];
+  const objectsToDeleteAliasesFor: ObjectToDeleteAliasesFor[] = [];
   const expectedBulkOperationResults: Array<
-    Either<SavedObjectsUpdateObjectsSpacesResponseObject, Record<string, any>>
+    Either<
+      SavedObjectsUpdateObjectsSpacesResponseObject,
+      { type: string; id: string; updatedSpaces: string[]; esRequestIndex?: number }
+    >
   > = expectedBulkGetResults.map((expectedBulkGetResult) => {
     if (isLeft(expectedBulkGetResult)) {
       return expectedBulkGetResult;
@@ -225,7 +246,7 @@ export async function updateObjectsSpaces({
       versionProperties = getExpectedVersionProperties(version);
     }
 
-    const { newSpaces, isUpdateRequired } = getNewSpacesArray(
+    const { updatedSpaces, removedSpaces, isUpdateRequired } = analyzeSpaceChanges(
       currentSpaces,
       spacesToAdd,
       spacesToRemove
@@ -233,7 +254,7 @@ export async function updateObjectsSpaces({
     const expectedResult = {
       type,
       id,
-      newSpaces,
+      updatedSpaces,
       ...(isUpdateRequired && { esRequestIndex: bulkOperationRequestIndexCounter++ }),
     };
 
@@ -243,13 +264,24 @@ export async function updateObjectsSpaces({
         _index: getIndexForType(type),
         ...versionProperties,
       };
-      if (newSpaces.length) {
-        const documentToSave = { updated_at: time, namespaces: newSpaces };
+      if (updatedSpaces.length) {
+        const documentToSave = { updated_at: time, namespaces: updatedSpaces };
         // @ts-expect-error BulkOperation.retry_on_conflict, BulkOperation.routing. BulkOperation.version, and BulkOperation.version_type are optional
         bulkOperationParams.push({ update: documentMetadata }, { doc: documentToSave });
       } else {
         bulkOperationParams.push({ delete: documentMetadata });
       }
+
+      if (removedSpaces.length && !updatedSpaces.includes(ALL_NAMESPACES_STRING)) {
+        // The object is being removed from at least one space; make sure to delete aliases appropriately
+        objectsToDeleteAliasesFor.push({
+          type,
+          id,
+          ...(removedSpaces.includes(ALL_NAMESPACES_STRING)
+            ? { namespaces: updatedSpaces, deleteBehavior: 'exclusive' }
+            : { namespaces: removedSpaces, deleteBehavior: 'inclusive' }),
+        });
+      }
     }
 
     return { tag: 'Right', value: expectedResult };
@@ -260,6 +292,24 @@ export async function updateObjectsSpaces({
     ? await client.bulk({ refresh, body: bulkOperationParams, require_alias: true })
     : undefined;
 
+  // Delete aliases if necessary, ensuring we don't have too many concurrent operations running.
+  const mapper = async ({ type, id, namespaces, deleteBehavior }: ObjectToDeleteAliasesFor) =>
+    deleteLegacyUrlAliases({
+      mappings,
+      registry,
+      client,
+      getIndexForType,
+      type,
+      id,
+      namespaces,
+      deleteBehavior,
+    }).catch((err) => {
+      // The object has already been unshared, but we caught an error when attempting to delete aliases.
+      // A consumer cannot attempt to unshare the object again, so just log the error and swallow it.
+      logger.error(`Unable to delete aliases when unsharing an object: ${err.message}`);
+    });
+  await pMap(objectsToDeleteAliasesFor, mapper, { concurrency: MAX_CONCURRENT_ALIAS_DELETIONS });
+
   return {
     objects: expectedBulkOperationResults.map<SavedObjectsUpdateObjectsSpacesResponseObject>(
       (expectedResult) => {
@@ -267,7 +317,7 @@ export async function updateObjectsSpaces({
           return expectedResult.value;
         }
 
-        const { type, id, newSpaces, esRequestIndex } = expectedResult.value;
+        const { type, id, updatedSpaces, esRequestIndex } = expectedResult.value;
         if (esRequestIndex !== undefined) {
           const response = bulkOperationResponse?.body.items[esRequestIndex] ?? {};
           const rawResponse = Object.values(response)[0] as any;
@@ -277,7 +327,7 @@ export async function updateObjectsSpaces({
           }
         }
 
-        return { id, type, spaces: newSpaces };
+        return { id, type, spaces: updatedSpaces };
       }
     ),
   };
@@ -289,17 +339,22 @@ function errorContent(error: DecoratedError) {
 }
 
 /** Gets the remaining spaces for an object after adding new ones and removing old ones. */
-function getNewSpacesArray(
+function analyzeSpaceChanges(
   existingSpaces: string[],
   spacesToAdd: string[],
   spacesToRemove: string[]
 ) {
   const addSet = new Set(spacesToAdd);
   const removeSet = new Set(spacesToRemove);
-  const newSpaces = existingSpaces
+  const removedSpaces: string[] = [];
+  const updatedSpaces = existingSpaces
     .filter((x) => {
       addSet.delete(x);
-      return !removeSet.delete(x);
+      const removed = removeSet.delete(x);
+      if (removed) {
+        removedSpaces.push(x);
+      }
+      return !removed;
     })
     .concat(Array.from(addSet));
 
@@ -307,5 +362,5 @@ function getNewSpacesArray(
   const isAnySpaceRemoved = removeSet.size < spacesToRemove.length;
   const isUpdateRequired = isAnySpaceAdded || isAnySpaceRemoved;
 
-  return { newSpaces, isUpdateRequired };
+  return { updatedSpaces, removedSpaces, isUpdateRequired };
 }
diff --git a/src/core/server/ui_settings/integration_tests/index.test.ts b/src/core/server/ui_settings/integration_tests/index.test.ts
index 44d98afdf54f5..ef635e90dac70 100644
--- a/src/core/server/ui_settings/integration_tests/index.test.ts
+++ b/src/core/server/ui_settings/integration_tests/index.test.ts
@@ -20,9 +20,9 @@ describe('uiSettings/routes', function () {
   jest.setTimeout(120_000);
 
   beforeAll(startServers);
-  /* eslint-disable jest/valid-describe */
+  // eslint-disable-next-line jest/valid-describe
   describe('doc missing', docMissingSuite(savedObjectIndex));
+  // eslint-disable-next-line jest/valid-describe
   describe('doc exists', docExistsSuite(savedObjectIndex));
-  /* eslint-enable jest/valid-describe */
   afterAll(stopServers);
 });
diff --git a/src/core/server/ui_settings/settings/misc.test.ts b/src/core/server/ui_settings/settings/misc.test.ts
deleted file mode 100644
index 7b6788664c997..0000000000000
--- a/src/core/server/ui_settings/settings/misc.test.ts
+++ /dev/null
@@ -1,31 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import { UiSettingsParams } from '../../../types';
-import { getMiscUiSettings } from './misc';
-
-describe('misc settings', () => {
-  const miscSettings = getMiscUiSettings();
-
-  const getValidationFn = (setting: UiSettingsParams) => (value: any) =>
-    setting.schema.validate(value);
-
-  describe('truncate:maxHeight', () => {
-    const validate = getValidationFn(miscSettings['truncate:maxHeight']);
-
-    it('should only accept positive numeric values', () => {
-      expect(() => validate(127)).not.toThrow();
-      expect(() => validate(-12)).toThrowErrorMatchingInlineSnapshot(
-        `"Value must be equal to or greater than [0]."`
-      );
-      expect(() => validate('foo')).toThrowErrorMatchingInlineSnapshot(
-        `"expected value of type [number] but got [string]"`
-      );
-    });
-  });
-});
diff --git a/src/core/server/ui_settings/settings/misc.ts b/src/core/server/ui_settings/settings/misc.ts
index cd9e43400d3c9..ad7411dfd12af 100644
--- a/src/core/server/ui_settings/settings/misc.ts
+++ b/src/core/server/ui_settings/settings/misc.ts
@@ -6,23 +6,11 @@
  * Side Public License, v 1.
  */
 
-import { i18n } from '@kbn/i18n';
 import { schema } from '@kbn/config-schema';
 import { UiSettingsParams } from '../types';
 
 export const getMiscUiSettings = (): Record<string, UiSettingsParams> => {
   return {
-    'truncate:maxHeight': {
-      name: i18n.translate('core.ui_settings.params.maxCellHeightTitle', {
-        defaultMessage: 'Maximum table cell height',
-      }),
-      value: 115,
-      description: i18n.translate('core.ui_settings.params.maxCellHeightText', {
-        defaultMessage:
-          'The maximum height that a cell in a table should occupy. Set to 0 to disable truncation',
-      }),
-      schema: schema.number({ min: 0 }),
-    },
     buildNum: {
       readonly: true,
       schema: schema.maybe(schema.number()),
diff --git a/src/dev/bazel/index.bzl b/src/dev/bazel/index.bzl
index e38d3d78c0071..313cc9f06236c 100644
--- a/src/dev/bazel/index.bzl
+++ b/src/dev/bazel/index.bzl
@@ -11,5 +11,7 @@ Please do not import from any other files when looking to use a custom rule
 """
 
 load("//src/dev/bazel:jsts_transpiler.bzl", _jsts_transpiler = "jsts_transpiler")
+load("//src/dev/bazel:ts_project.bzl", _ts_project = "ts_project")
 
 jsts_transpiler = _jsts_transpiler
+ts_project = _ts_project
diff --git a/src/dev/bazel/ts_project.bzl b/src/dev/bazel/ts_project.bzl
new file mode 100644
index 0000000000000..afd28fa513164
--- /dev/null
+++ b/src/dev/bazel/ts_project.bzl
@@ -0,0 +1,16 @@
+"Simple wrapper over the general ts_project rule from rules_nodejs so we can override some configs"
+
+load("@npm//@bazel/typescript:index.bzl", _ts_project = "ts_project")
+
+def ts_project(validate = False, **kwargs):
+  """A macro around the upstream ts_project rule.
+
+  Args:
+    validate: boolean; whether to check that the tsconfig JSON settings match the attributes on this target. Defaults to false
+    **kwargs: the rest
+  """
+
+  _ts_project(
+    validate = validate,
+    **kwargs
+  )
diff --git a/src/dev/build/tasks/os_packages/docker_generator/templates/kibana_yml.template.ts b/src/dev/build/tasks/os_packages/docker_generator/templates/kibana_yml.template.ts
index 340a035adea4c..96d66b111b062 100644
--- a/src/dev/build/tasks/os_packages/docker_generator/templates/kibana_yml.template.ts
+++ b/src/dev/build/tasks/os_packages/docker_generator/templates/kibana_yml.template.ts
@@ -22,7 +22,7 @@ function generator({ imageFlavor }: TemplateContext) {
   server.host: "0.0.0.0"
   server.shutdownTimeout: "5s"
   elasticsearch.hosts: [ "http://elasticsearch:9200" ]
-  ${!imageFlavor ? 'monitoring.ui.container.elasticsearch.enabled: true' : ''}
+  monitoring.ui.container.elasticsearch.enabled: true
   `);
 }
 
diff --git a/src/dev/eslint/index.ts b/src/dev/eslint/index.ts
index 765c7dfce9ed0..5aeb83c45ad05 100644
--- a/src/dev/eslint/index.ts
+++ b/src/dev/eslint/index.ts
@@ -8,3 +8,4 @@
 
 export { pickFilesToLint } from './pick_files_to_lint';
 export { lintFiles } from './lint_files';
+export { runEslintWithTypes } from './run_eslint_with_types';
diff --git a/src/dev/eslint/run_eslint_with_types.ts b/src/dev/eslint/run_eslint_with_types.ts
new file mode 100644
index 0000000000000..750011dea1031
--- /dev/null
+++ b/src/dev/eslint/run_eslint_with_types.ts
@@ -0,0 +1,171 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import Path from 'path';
+import Fs from 'fs';
+import Os from 'os';
+
+import execa from 'execa';
+import * as Rx from 'rxjs';
+import { mergeMap, reduce } from 'rxjs/operators';
+import { supportsColor } from 'chalk';
+import { REPO_ROOT, run, createFailError } from '@kbn/dev-utils';
+import { lastValueFrom } from '@kbn/std';
+
+import { PROJECTS } from '../typescript/projects';
+import { Project } from '../typescript/project';
+
+export function runEslintWithTypes() {
+  run(
+    async ({ log, flags }) => {
+      const eslintPath = require.resolve('eslint/bin/eslint');
+      const ignoreFilePath = Path.resolve(REPO_ROOT, '.eslintignore');
+      const configTemplate = Fs.readFileSync(
+        Path.resolve(__dirname, 'types.eslint.config.template.js'),
+        'utf8'
+      );
+
+      const projectFilter =
+        flags.project && typeof flags.project === 'string'
+          ? Path.resolve(flags.project)
+          : undefined;
+
+      const projects = PROJECTS.filter((project) => {
+        if (project.disableTypeCheck) {
+          log.verbose(`[${project.name}] skipping project with type checking disabled`);
+          return false;
+        }
+
+        if (projectFilter && project.tsConfigPath !== projectFilter) {
+          log.verbose(`[${project.name}] skipping because it doesn't match --project`);
+          return false;
+        }
+
+        return true;
+      });
+
+      if (!projects.length) {
+        if (projectFilter) {
+          throw createFailError(`[${projectFilter}] is not a valid tsconfig project`);
+        }
+
+        throw createFailError('unable to find projects to lint');
+      }
+
+      const concurrency = Math.max(1, Math.round((Os.cpus() || []).length / 2) || 1) || 1;
+      log.info(`Linting ${projects.length} projects, ${concurrency} at a time`);
+
+      const failures = await lastValueFrom(
+        Rx.from(projects).pipe(
+          mergeMap(async (project) => {
+            const configFilePath = Path.resolve(project.directory, 'types.eslint.config.js');
+
+            Fs.writeFileSync(
+              configFilePath,
+              configTemplate.replace(
+                `'{PACKAGE_CONFIG}'`,
+                JSON.stringify(JSON.stringify({ rootDir: project.directory }))
+              ),
+              'utf8'
+            );
+
+            const proc = await execa(
+              process.execPath,
+              [
+                Path.relative(project.directory, eslintPath),
+                ...project.getIncludePatterns().map((p) => (p.endsWith('*') ? `${p}.{ts,tsx}` : p)),
+                ...project.getExcludePatterns().flatMap((p) => ['--ignore-pattern', p]),
+                ...['--ignore-pattern', '**/*.json'],
+                ...['--ext', '.ts,.tsx'],
+                '--no-error-on-unmatched-pattern',
+                '--no-inline-config',
+                '--no-eslintrc',
+                ...['--config', Path.relative(project.directory, configFilePath)],
+                ...['--ignore-path', Path.relative(project.directory, ignoreFilePath)],
+                ...(flags.verbose ? ['--debug'] : []),
+                ...(flags.fix ? ['--fix'] : []),
+              ],
+              {
+                cwd: project.directory,
+                env: {
+                  ...(supportsColor ? { FORCE_COLOR: 'true' } : {}),
+                  ...process.env,
+                },
+                buffer: true,
+                all: true,
+                reject: false,
+              }
+            );
+
+            if (proc.exitCode === 0) {
+              Fs.unlinkSync(configFilePath);
+              log.success(project.name);
+              return undefined;
+            } else {
+              log.error(`${project.name} failed`);
+              log.indent(4);
+              log.write(proc.all);
+              log.indent(-4);
+              return project;
+            }
+          }, concurrency),
+          reduce((acc: Project[], project) => {
+            if (project) {
+              return [...acc, project];
+            } else {
+              return acc;
+            }
+          }, [])
+        )
+      );
+
+      if (!failures.length) {
+        log.success(`All projects validated successfully!`);
+        if (flags.fix) {
+          log.info(`
+❗️ After staging your changes, don't forget to run eslint/prettier on them with:
+
+    node scripts/precommit_hook --fix
+`);
+        }
+
+        return;
+      }
+
+      throw createFailError(
+        `
+          ${
+            failures.length
+          } projects failed, run the following commands locally to try auto-fixing them:
+
+            ${failures
+              .map(
+                (p) =>
+                  `node scripts/eslint_with_types --fix --project ${Path.relative(
+                    REPO_ROOT,
+                    p.tsConfigPath
+                  )}`
+              )
+              .join('\n            ')}
+        `
+      );
+    },
+    {
+      description:
+        'Run ESLint in each TS project, feeding it the TS config so it can validate our code using the type information',
+      flags: {
+        string: ['project'],
+        boolean: ['fix'],
+        help: `
+          --project          Only run eslint on a specific ts project
+          --fix              Run eslint in --fix mode
+        `,
+      },
+    }
+  );
+}
diff --git a/src/dev/eslint/types.eslint.config.template.js b/src/dev/eslint/types.eslint.config.template.js
new file mode 100644
index 0000000000000..08cbaf3b02325
--- /dev/null
+++ b/src/dev/eslint/types.eslint.config.template.js
@@ -0,0 +1,27 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+/**
+ * THIS FILE IS WRITTEN AUTOMATICALLY by `node scripts/eslint_with_types` and
+ * should be deleted automatically unless something goes wrong
+ */
+
+const config = JSON.parse('{PACKAGE_CONFIG}');
+
+module.exports = {
+  root: true,
+  parser: '@typescript-eslint/parser',
+  parserOptions: {
+    tsconfigRootDir: config.rootDir,
+    project: ['./tsconfig.json'],
+  },
+  plugins: ['@typescript-eslint'],
+  rules: {
+    '@typescript-eslint/consistent-type-exports': 'error',
+  },
+};
diff --git a/src/dev/i18n/index.ts b/src/dev/i18n/index.ts
index 111dc6b688e9f..54ea36a9f82c4 100644
--- a/src/dev/i18n/index.ts
+++ b/src/dev/i18n/index.ts
@@ -12,10 +12,6 @@ export { extractMessagesFromPathToMap } from './extract_default_translations';
 export { matchEntriesWithExctractors } from './extract_default_translations';
 export { arrayify, writeFileAsync, readFileAsync, normalizePath, ErrorReporter } from './utils';
 export { serializeToJson, serializeToJson5 } from './serializers';
-export {
-  I18nConfig,
-  filterConfigPaths,
-  assignConfigFromPath,
-  checkConfigNamespacePrefix,
-} from './config';
+export type { I18nConfig } from './config';
+export { filterConfigPaths, assignConfigFromPath, checkConfigNamespacePrefix } from './config';
 export { integrateLocaleFiles } from './integrate_locale_files';
diff --git a/src/dev/typescript/project.ts b/src/dev/typescript/project.ts
index a0c196dd8e919..baeaf39ec288d 100644
--- a/src/dev/typescript/project.ts
+++ b/src/dev/typescript/project.ts
@@ -66,8 +66,10 @@ export class Project {
     const disableTypeCheck = projectOptions?.disableTypeCheck || false;
     const name =
       projectOptions?.name || Path.relative(REPO_ROOT, directory) || Path.basename(directory);
-    const include = config.include ? makeMatchers(directory, config.include) : undefined;
-    const exclude = config.exclude ? makeMatchers(directory, config.exclude) : undefined;
+    const includePatterns = config.include;
+    const include = includePatterns ? makeMatchers(directory, includePatterns) : undefined;
+    const excludePatterns = config.exclude;
+    const exclude = excludePatterns ? makeMatchers(directory, excludePatterns) : undefined;
 
     let baseProject;
     if (config.extends) {
@@ -99,7 +101,9 @@ export class Project {
       disableTypeCheck,
       baseProject,
       include,
-      exclude
+      includePatterns,
+      exclude,
+      excludePatterns
     );
     cache.set(tsConfigPath, project);
     return project;
@@ -114,9 +118,22 @@ export class Project {
 
     public readonly baseProject?: Project,
     private readonly include?: IMinimatch[],
-    private readonly exclude?: IMinimatch[]
+    private readonly includePatterns?: string[],
+    private readonly exclude?: IMinimatch[],
+    private readonly excludePatterns?: string[]
   ) {}
 
+  public getIncludePatterns(): string[] {
+    return this.includePatterns
+      ? this.includePatterns
+      : this.baseProject?.getIncludePatterns() ?? [];
+  }
+  public getExcludePatterns(): string[] {
+    return this.excludePatterns
+      ? this.excludePatterns
+      : this.baseProject?.getExcludePatterns() ?? [];
+  }
+
   private getInclude(): IMinimatch[] {
     return this.include ? this.include : this.baseProject?.getInclude() ?? [];
   }
diff --git a/src/plugins/advanced_settings/public/index.ts b/src/plugins/advanced_settings/public/index.ts
index be57576d176c6..83676b4f7c38d 100644
--- a/src/plugins/advanced_settings/public/index.ts
+++ b/src/plugins/advanced_settings/public/index.ts
@@ -9,7 +9,7 @@
 import React from 'react';
 import { PluginInitializerContext } from 'kibana/public';
 import { AdvancedSettingsPlugin } from './plugin';
-export { AdvancedSettingsSetup, AdvancedSettingsStart } from './types';
+export type { AdvancedSettingsSetup, AdvancedSettingsStart } from './types';
 export { ComponentRegistry } from './component_registry';
 
 /**
diff --git a/src/plugins/bfetch/public/batching/index.ts b/src/plugins/bfetch/public/batching/index.ts
index 115fd84cbe979..e3a8d0169af27 100644
--- a/src/plugins/bfetch/public/batching/index.ts
+++ b/src/plugins/bfetch/public/batching/index.ts
@@ -6,7 +6,5 @@
  * Side Public License, v 1.
  */
 
-export {
-  createStreamingBatchedFunction,
-  StreamingBatchedFunctionParams,
-} from './create_streaming_batched_function';
+export type { StreamingBatchedFunctionParams } from './create_streaming_batched_function';
+export { createStreamingBatchedFunction } from './create_streaming_batched_function';
diff --git a/src/plugins/bfetch/public/index.ts b/src/plugins/bfetch/public/index.ts
index 59ee2d63ac57e..6ab5480327538 100644
--- a/src/plugins/bfetch/public/index.ts
+++ b/src/plugins/bfetch/public/index.ts
@@ -9,10 +9,10 @@
 import { PluginInitializerContext } from '../../../core/public';
 import { BfetchPublicPlugin } from './plugin';
 
-export { BfetchPublicSetup, BfetchPublicStart, BfetchPublicContract } from './plugin';
+export type { BfetchPublicSetup, BfetchPublicStart, BfetchPublicContract } from './plugin';
 export { split } from './streaming';
 
-export { BatchedFunc } from './batching/types';
+export type { BatchedFunc } from './batching/types';
 
 export function plugin(initializerContext: PluginInitializerContext) {
   return new BfetchPublicPlugin(initializerContext);
diff --git a/src/plugins/bfetch/server/index.ts b/src/plugins/bfetch/server/index.ts
index f4c41d10e42cb..76f86e6975070 100644
--- a/src/plugins/bfetch/server/index.ts
+++ b/src/plugins/bfetch/server/index.ts
@@ -9,7 +9,7 @@
 import { PluginInitializerContext } from '../../../core/server';
 import { BfetchServerPlugin } from './plugin';
 
-export { BfetchServerSetup, BfetchServerStart, BatchProcessingRouteParams } from './plugin';
+export type { BfetchServerSetup, BfetchServerStart, BatchProcessingRouteParams } from './plugin';
 
 export function plugin(initializerContext: PluginInitializerContext) {
   return new BfetchServerPlugin(initializerContext);
diff --git a/src/plugins/charts/common/index.ts b/src/plugins/charts/common/index.ts
index 936ad2d10ac64..825fd74e24041 100644
--- a/src/plugins/charts/common/index.ts
+++ b/src/plugins/charts/common/index.ts
@@ -9,23 +9,19 @@
 export const COLOR_MAPPING_SETTING = 'visualization:colorMapping';
 export const LEGACY_TIME_AXIS = 'visualization:useLegacyTimeAxis';
 
-export {
+export type {
   CustomPaletteArguments,
   CustomPaletteState,
   SystemPaletteArguments,
   PaletteOutput,
-  defaultCustomColors,
-  palette,
-  systemPalette,
 } from './palette';
+export { defaultCustomColors, palette, systemPalette } from './palette';
 
 export { paletteIds } from './constants';
 
+export type { ColorSchema, RawColorSchema, ColorMap } from './static';
 export {
   ColorSchemas,
-  ColorSchema,
-  RawColorSchema,
-  ColorMap,
   vislibColorMaps,
   colorSchemas,
   getHeatmapColors,
@@ -37,4 +33,4 @@ export {
   MULTILAYER_TIME_AXIS_STYLE,
 } from './static';
 
-export { ColorSchemaParams, Labels, Style } from './types';
+export type { ColorSchemaParams, Labels, Style } from './types';
diff --git a/src/plugins/charts/common/static/color_maps/index.ts b/src/plugins/charts/common/static/color_maps/index.ts
index c624c5ceb6685..115758988f04b 100644
--- a/src/plugins/charts/common/static/color_maps/index.ts
+++ b/src/plugins/charts/common/static/color_maps/index.ts
@@ -6,13 +6,7 @@
  * Side Public License, v 1.
  */
 
-export {
-  ColorSchemas,
-  ColorSchema,
-  RawColorSchema,
-  ColorMap,
-  vislibColorMaps,
-  colorSchemas,
-} from './color_maps';
+export type { ColorSchema, RawColorSchema, ColorMap } from './color_maps';
+export { ColorSchemas, vislibColorMaps, colorSchemas } from './color_maps';
 export { getHeatmapColors } from './heatmap_color';
 export { truncatedColorMaps, truncatedColorSchemas } from './truncated_color_maps';
diff --git a/src/plugins/charts/common/static/index.ts b/src/plugins/charts/common/static/index.ts
index ac706ac7869c5..4a6b3ec2b52bb 100644
--- a/src/plugins/charts/common/static/index.ts
+++ b/src/plugins/charts/common/static/index.ts
@@ -6,11 +6,9 @@
  * Side Public License, v 1.
  */
 
+export type { ColorSchema, RawColorSchema, ColorMap } from './color_maps';
 export {
   ColorSchemas,
-  ColorSchema,
-  RawColorSchema,
-  ColorMap,
   vislibColorMaps,
   colorSchemas,
   getHeatmapColors,
diff --git a/src/plugins/charts/public/index.ts b/src/plugins/charts/public/index.ts
index e3d38b797c576..51d2722e3a24f 100644
--- a/src/plugins/charts/public/index.ts
+++ b/src/plugins/charts/public/index.ts
@@ -13,23 +13,28 @@ import { ChartsPlugin } from './plugin';
 
 export const plugin = () => new ChartsPlugin();
 
-export { ChartsPluginSetup, ChartsPluginStart } from './plugin';
+export type { ChartsPluginSetup, ChartsPluginStart } from './plugin';
 
 export * from './static';
 export * from './services/palettes/types';
 export { lightenColor } from './services/palettes/lighten_color';
 export { useActiveCursor } from './services/active_cursor';
 
-export {
+export type {
   PaletteOutput,
   CustomPaletteArguments,
   CustomPaletteState,
   SystemPaletteArguments,
-  paletteIds,
-  ColorSchemas,
   ColorSchema,
   RawColorSchema,
   ColorMap,
+  ColorSchemaParams,
+  Labels,
+  Style,
+} from '../common';
+export {
+  paletteIds,
+  ColorSchemas,
   vislibColorMaps,
   colorSchemas,
   getHeatmapColors,
@@ -38,7 +43,4 @@ export {
   ColorMode,
   LabelRotation,
   defaultCountLabel,
-  ColorSchemaParams,
-  Labels,
-  Style,
 } from '../common';
diff --git a/src/plugins/charts/public/services/theme/theme.ts b/src/plugins/charts/public/services/theme/theme.ts
index dfea367327e7a..1aad4f0ab6328 100644
--- a/src/plugins/charts/public/services/theme/theme.ts
+++ b/src/plugins/charts/public/services/theme/theme.ts
@@ -39,10 +39,8 @@ export class ThemeService {
 
   /** A React hook for consuming the dark mode value */
   public useDarkMode = (): boolean => {
-    // eslint-disable-next-line react-hooks/rules-of-hooks
     const [value, update] = useState(false);
 
-    // eslint-disable-next-line react-hooks/rules-of-hooks
     useEffect(() => {
       const s = this.darkModeEnabled$.subscribe(update);
       return () => s.unsubscribe();
@@ -53,12 +51,9 @@ export class ThemeService {
 
   /** A React hook for consuming the charts theme */
   public useChartsTheme = (): PartialTheme => {
-    // eslint-disable-next-line react-hooks/rules-of-hooks
     const [value, update] = useState(this._chartsTheme$.getValue());
-    // eslint-disable-next-line react-hooks/rules-of-hooks
     const ref = useRef(value);
 
-    // eslint-disable-next-line react-hooks/rules-of-hooks
     useEffect(() => {
       const s = this.chartsTheme$.subscribe((val) => {
         if (val !== ref.current) {
@@ -74,12 +69,9 @@ export class ThemeService {
 
   /** A React hook for consuming the charts theme */
   public useChartsBaseTheme = (): Theme => {
-    // eslint-disable-next-line react-hooks/rules-of-hooks
     const [value, update] = useState(this._chartsBaseTheme$.getValue());
-    // eslint-disable-next-line react-hooks/rules-of-hooks
     const ref = useRef(value);
 
-    // eslint-disable-next-line react-hooks/rules-of-hooks
     useEffect(() => {
       const s = this.chartsBaseTheme$.subscribe((val) => {
         if (val !== ref.current) {
diff --git a/src/plugins/charts/server/index.ts b/src/plugins/charts/server/index.ts
index e65318747224d..73524964efb9b 100644
--- a/src/plugins/charts/server/index.ts
+++ b/src/plugins/charts/server/index.ts
@@ -7,12 +7,12 @@
  */
 
 import { ChartsServerPlugin } from './plugin';
-export {
+export type {
   PaletteOutput,
   CustomPaletteArguments,
   CustomPaletteState,
   SystemPaletteArguments,
-  paletteIds,
 } from '../common';
+export { paletteIds } from '../common';
 
 export const plugin = () => new ChartsServerPlugin();
diff --git a/src/plugins/console/public/application/components/index.ts b/src/plugins/console/public/application/components/index.ts
index 7bf3bc8a9c33b..8f8292477cb94 100644
--- a/src/plugins/console/public/application/components/index.ts
+++ b/src/plugins/console/public/application/components/index.ts
@@ -8,9 +8,11 @@
 
 export { NetworkRequestStatusBar } from './network_request_status_bar';
 export { SomethingWentWrongCallout } from './something_went_wrong_callout';
-export { TopNavMenuItem, TopNavMenu } from './top_nav_menu';
+export type { TopNavMenuItem } from './top_nav_menu';
+export { TopNavMenu } from './top_nav_menu';
 export { ConsoleMenu } from './console_menu';
 export { WelcomePanel } from './welcome_panel';
-export { AutocompleteOptions, DevToolsSettingsModal } from './settings_modal';
+export type { AutocompleteOptions } from './settings_modal';
+export { DevToolsSettingsModal } from './settings_modal';
 export { HelpPanel } from './help_panel';
 export { EditorContentSpinner } from './editor_content_spinner';
diff --git a/src/plugins/console/public/application/contexts/index.ts b/src/plugins/console/public/application/contexts/index.ts
index 693056ec23af6..2239c4f3354c2 100644
--- a/src/plugins/console/public/application/contexts/index.ts
+++ b/src/plugins/console/public/application/contexts/index.ts
@@ -6,7 +6,8 @@
  * Side Public License, v 1.
  */
 
-export { useServicesContext, ServicesContextProvider, ContextValue } from './services_context';
+export type { ContextValue } from './services_context';
+export { useServicesContext, ServicesContextProvider } from './services_context';
 
 export {
   useRequestActionContext,
diff --git a/src/plugins/console/public/application/lib/index.ts b/src/plugins/console/public/application/lib/index.ts
index 3c67718d170ee..8eba015910362 100644
--- a/src/plugins/console/public/application/lib/index.ts
+++ b/src/plugins/console/public/application/lib/index.ts
@@ -6,5 +6,6 @@
  * Side Public License, v 1.
  */
 
-export { createApi, Api } from './api';
+export type { Api } from './api';
+export { createApi } from './api';
 export { createEsHostService, EsHostService } from './es_host_service';
diff --git a/src/plugins/console/public/services/index.ts b/src/plugins/console/public/services/index.ts
index 2b1e64525d0f9..c37c9d9359a16 100644
--- a/src/plugins/console/public/services/index.ts
+++ b/src/plugins/console/public/services/index.ts
@@ -8,4 +8,5 @@
 
 export { createHistory, History } from './history';
 export { createStorage, Storage, StorageKeys } from './storage';
-export { createSettings, Settings, DevToolsSettings, DEFAULT_SETTINGS } from './settings';
+export type { DevToolsSettings } from './settings';
+export { createSettings, Settings, DEFAULT_SETTINGS } from './settings';
diff --git a/src/plugins/console/public/types/index.ts b/src/plugins/console/public/types/index.ts
index d8b6aaf7b12c4..2a86e53e55b80 100644
--- a/src/plugins/console/public/types/index.ts
+++ b/src/plugins/console/public/types/index.ts
@@ -11,5 +11,5 @@ export * from './core_editor';
 export * from './token';
 export * from './tokens_provider';
 export * from './common';
-export { ClientConfigType } from './config';
-export { ConsoleUILocatorParams } from './locator';
+export type { ClientConfigType } from './config';
+export type { ConsoleUILocatorParams } from './locator';
diff --git a/src/plugins/console/server/index.ts b/src/plugins/console/server/index.ts
index b270b89a3d45a..598dfa23958c9 100644
--- a/src/plugins/console/server/index.ts
+++ b/src/plugins/console/server/index.ts
@@ -10,7 +10,7 @@ import { PluginInitializerContext } from 'kibana/server';
 
 import { ConsoleServerPlugin } from './plugin';
 
-export { ConsoleSetup, ConsoleStart } from './types';
+export type { ConsoleSetup, ConsoleStart } from './types';
 
 export { config } from './config';
 
diff --git a/src/plugins/custom_integrations/public/components/replacement_card/index.ts b/src/plugins/custom_integrations/public/components/replacement_card/index.ts
index 631dc1fcb2ba2..3c378d7603f95 100644
--- a/src/plugins/custom_integrations/public/components/replacement_card/index.ts
+++ b/src/plugins/custom_integrations/public/components/replacement_card/index.ts
@@ -8,7 +8,8 @@
 
 import { ReplacementCard } from './replacement_card';
 
-export { ReplacementCard, Props } from './replacement_card';
+export type { Props } from './replacement_card';
+export { ReplacementCard } from './replacement_card';
 
 // required for dynamic import using React.lazy()
 // eslint-disable-next-line import/no-default-export
diff --git a/src/plugins/custom_integrations/public/index.ts b/src/plugins/custom_integrations/public/index.ts
index 91da75c634a44..27176c4c5acbe 100755
--- a/src/plugins/custom_integrations/public/index.ts
+++ b/src/plugins/custom_integrations/public/index.ts
@@ -14,7 +14,7 @@ export function plugin() {
   return new CustomIntegrationsPlugin();
 }
 
-export { CustomIntegrationsSetup, CustomIntegrationsStart } from './types';
+export type { CustomIntegrationsSetup, CustomIntegrationsStart } from './types';
 
 export { withSuspense, LazyReplacementCard } from './components';
 export { filterCustomIntegrations } from './services/find';
diff --git a/src/plugins/custom_integrations/server/index.ts b/src/plugins/custom_integrations/server/index.ts
index 00372df501435..e2da055e745c2 100755
--- a/src/plugins/custom_integrations/server/index.ts
+++ b/src/plugins/custom_integrations/server/index.ts
@@ -17,7 +17,7 @@ export function plugin(initializerContext: PluginInitializerContext) {
   return new CustomIntegrationsPlugin(initializerContext);
 }
 
-export { CustomIntegrationsPluginSetup, CustomIntegrationsPluginStart } from './types';
+export type { CustomIntegrationsPluginSetup, CustomIntegrationsPluginStart } from './types';
 
 export type { IntegrationCategory, CustomIntegration } from '../common';
 
diff --git a/src/plugins/dashboard/common/index.ts b/src/plugins/dashboard/common/index.ts
index 1ed5bfba3abb9..73e01693977d9 100644
--- a/src/plugins/dashboard/common/index.ts
+++ b/src/plugins/dashboard/common/index.ts
@@ -6,14 +6,14 @@
  * Side Public License, v 1.
  */
 
-export { GridData } from './embeddable/types';
-export {
+export type { GridData } from './embeddable/types';
+export type {
   RawSavedDashboardPanel730ToLatest,
   DashboardDoc730ToLatest,
   DashboardDoc700To720,
   DashboardDocPre700,
 } from './bwc/types';
-export {
+export type {
   DashboardContainerStateWithType,
   SavedDashboardPanelTo60,
   SavedDashboardPanel610,
diff --git a/src/plugins/dashboard/public/application/actions/index.ts b/src/plugins/dashboard/public/application/actions/index.ts
index 827ae5bcb4419..2c6263314cb25 100644
--- a/src/plugins/dashboard/public/application/actions/index.ts
+++ b/src/plugins/dashboard/public/application/actions/index.ts
@@ -6,39 +6,22 @@
  * Side Public License, v 1.
  */
 
+export type { ExpandPanelActionContext } from './expand_panel_action';
+export { ExpandPanelAction, ACTION_EXPAND_PANEL } from './expand_panel_action';
+export type { ReplacePanelActionContext } from './replace_panel_action';
+export { ReplacePanelAction, ACTION_REPLACE_PANEL } from './replace_panel_action';
+export type { ClonePanelActionContext } from './clone_panel_action';
+export { ClonePanelAction, ACTION_CLONE_PANEL } from './clone_panel_action';
+export type { AddToLibraryActionContext } from './add_to_library_action';
+export { AddToLibraryAction, ACTION_ADD_TO_LIBRARY } from './add_to_library_action';
+export type { UnlinkFromLibraryActionContext } from './unlink_from_library_action';
+export { UnlinkFromLibraryAction, ACTION_UNLINK_FROM_LIBRARY } from './unlink_from_library_action';
+export type { CopyToDashboardActionContext } from './copy_to_dashboard_action';
+export { CopyToDashboardAction, ACTION_COPY_TO_DASHBOARD } from './copy_to_dashboard_action';
+export type { LibraryNotificationActionContext } from './library_notification_action';
 export {
-  ExpandPanelAction,
-  ExpandPanelActionContext,
-  ACTION_EXPAND_PANEL,
-} from './expand_panel_action';
-export {
-  ReplacePanelAction,
-  ReplacePanelActionContext,
-  ACTION_REPLACE_PANEL,
-} from './replace_panel_action';
-export {
-  ClonePanelAction,
-  ClonePanelActionContext,
-  ACTION_CLONE_PANEL,
-} from './clone_panel_action';
-export {
-  AddToLibraryAction,
-  AddToLibraryActionContext,
-  ACTION_ADD_TO_LIBRARY,
-} from './add_to_library_action';
-export {
-  UnlinkFromLibraryAction,
-  UnlinkFromLibraryActionContext,
-  ACTION_UNLINK_FROM_LIBRARY,
-} from './unlink_from_library_action';
-export {
-  CopyToDashboardAction,
-  CopyToDashboardActionContext,
-  ACTION_COPY_TO_DASHBOARD,
-} from './copy_to_dashboard_action';
-export {
-  LibraryNotificationActionContext,
   LibraryNotificationAction,
   ACTION_LIBRARY_NOTIFICATION,
 } from './library_notification_action';
-export { ExportContext, ExportCSVAction, ACTION_EXPORT_CSV } from './export_csv_action';
+export type { ExportContext } from './export_csv_action';
+export { ExportCSVAction, ACTION_EXPORT_CSV } from './export_csv_action';
diff --git a/src/plugins/dashboard/public/application/embeddable/index.ts b/src/plugins/dashboard/public/application/embeddable/index.ts
index b3ee0f83ee852..ce8bb5b7169ac 100644
--- a/src/plugins/dashboard/public/application/embeddable/index.ts
+++ b/src/plugins/dashboard/public/application/embeddable/index.ts
@@ -6,10 +6,8 @@
  * Side Public License, v 1.
  */
 
-export {
-  DashboardContainerFactoryDefinition,
-  DashboardContainerFactory,
-} from './dashboard_container_factory';
+export type { DashboardContainerFactory } from './dashboard_container_factory';
+export { DashboardContainerFactoryDefinition } from './dashboard_container_factory';
 export type { DashboardContainer } from './dashboard_container';
 export { createPanelState } from './panel';
 
diff --git a/src/plugins/dashboard/public/index.ts b/src/plugins/dashboard/public/index.ts
index ff7708689c221..f25a92275d723 100644
--- a/src/plugins/dashboard/public/index.ts
+++ b/src/plugins/dashboard/public/index.ts
@@ -16,22 +16,19 @@ export {
 } from './application';
 export { DashboardConstants, createDashboardEditUrl } from './dashboard_constants';
 
-export {
+export type {
   DashboardSetup,
   DashboardStart,
   DashboardUrlGenerator,
   DashboardFeatureFlagConfig,
 } from './plugin';
 
-export {
-  DASHBOARD_APP_URL_GENERATOR,
-  createDashboardUrlGenerator,
-  DashboardUrlGeneratorState,
-} from './url_generator';
-export { DashboardAppLocator, DashboardAppLocatorParams } from './locator';
+export type { DashboardUrlGeneratorState } from './url_generator';
+export { DASHBOARD_APP_URL_GENERATOR, createDashboardUrlGenerator } from './url_generator';
+export type { DashboardAppLocator, DashboardAppLocatorParams } from './locator';
 
-export { DashboardSavedObject } from './saved_dashboards';
-export { SavedDashboardPanel, DashboardContainerInput } from './types';
+export type { DashboardSavedObject } from './saved_dashboards';
+export type { SavedDashboardPanel, DashboardContainerInput } from './types';
 
 export function plugin(initializerContext: PluginInitializerContext) {
   return new DashboardPlugin(initializerContext);
diff --git a/src/plugins/dashboard/public/services/core.ts b/src/plugins/dashboard/public/services/core.ts
index e805c6cd706a9..38c91842de4f2 100644
--- a/src/plugins/dashboard/public/services/core.ts
+++ b/src/plugins/dashboard/public/services/core.ts
@@ -6,12 +6,12 @@
  * Side Public License, v 1.
  */
 
-export {
+export type {
   AppMountParameters,
   CoreSetup,
   Capabilities,
   PluginInitializerContext,
-  ScopedHistory,
   NotificationsStart,
   ApplicationStart,
 } from '../../../../core/public';
+export { ScopedHistory } from '../../../../core/public';
diff --git a/src/plugins/dashboard/public/services/home.ts b/src/plugins/dashboard/public/services/home.ts
index 692a1218b9535..ebbb715e53ca6 100644
--- a/src/plugins/dashboard/public/services/home.ts
+++ b/src/plugins/dashboard/public/services/home.ts
@@ -6,4 +6,5 @@
  * Side Public License, v 1.
  */
 
-export { FeatureCatalogueCategory, HomePublicPluginSetup } from '../../../home/public';
+export type { HomePublicPluginSetup } from '../../../home/public';
+export { FeatureCatalogueCategory } from '../../../home/public';
diff --git a/src/plugins/dashboard/public/services/kibana_react.ts b/src/plugins/dashboard/public/services/kibana_react.ts
index 203b6aa9cd2cb..4d5a3a5b57657 100644
--- a/src/plugins/dashboard/public/services/kibana_react.ts
+++ b/src/plugins/dashboard/public/services/kibana_react.ts
@@ -6,6 +6,11 @@
  * Side Public License, v 1.
  */
 
+export type {
+  KibanaReactContext,
+  KibanaReactContextValue,
+  ExitFullScreenButtonProps,
+} from '../../../kibana_react/public';
 export {
   context,
   useKibana,
@@ -13,9 +18,6 @@ export {
   toMountPoint,
   TableListView,
   reactToUiComponent,
-  KibanaReactContext,
   ExitFullScreenButton,
   KibanaContextProvider,
-  KibanaReactContextValue,
-  ExitFullScreenButtonProps,
 } from '../../../kibana_react/public';
diff --git a/src/plugins/dashboard/public/services/kibana_utils.ts b/src/plugins/dashboard/public/services/kibana_utils.ts
index 94128f902df02..599e9b73f504f 100644
--- a/src/plugins/dashboard/public/services/kibana_utils.ts
+++ b/src/plugins/dashboard/public/services/kibana_utils.ts
@@ -6,19 +6,21 @@
  * Side Public License, v 1.
  */
 
+export type {
+  ISyncStateRef,
+  IKbnUrlStateStorage,
+  ReduxLikeStateContainer,
+} from '../../../kibana_utils/public';
 export {
   Storage,
   unhashUrl,
   syncState,
-  ISyncStateRef,
   getQueryParams,
   setStateToKbnUrl,
   removeQueryParam,
   withNotifyOnErrors,
-  IKbnUrlStateStorage,
   createKbnUrlTracker,
   SavedObjectNotFound,
   createStateContainer,
-  ReduxLikeStateContainer,
   createKbnUrlStateStorage,
 } from '../../../kibana_utils/public';
diff --git a/src/plugins/dashboard/public/services/navigation.ts b/src/plugins/dashboard/public/services/navigation.ts
index 60373b0eb44ec..eb1622eba35e0 100644
--- a/src/plugins/dashboard/public/services/navigation.ts
+++ b/src/plugins/dashboard/public/services/navigation.ts
@@ -6,4 +6,4 @@
  * Side Public License, v 1.
  */
 
-export { NavigationPublicPluginStart } from '../../../navigation/public';
+export type { NavigationPublicPluginStart } from '../../../navigation/public';
diff --git a/src/plugins/dashboard/public/services/presentation_util.ts b/src/plugins/dashboard/public/services/presentation_util.ts
index 17bc97db9ac63..d640b6326729d 100644
--- a/src/plugins/dashboard/public/services/presentation_util.ts
+++ b/src/plugins/dashboard/public/services/presentation_util.ts
@@ -6,9 +6,5 @@
  * Side Public License, v 1.
  */
 
-export {
-  PresentationUtilPluginStart,
-  LazyDashboardPicker,
-  withSuspense,
-  useLabs,
-} from '../../../presentation_util/public';
+export type { PresentationUtilPluginStart } from '../../../presentation_util/public';
+export { LazyDashboardPicker, withSuspense, useLabs } from '../../../presentation_util/public';
diff --git a/src/plugins/dashboard/public/services/saved_objects.ts b/src/plugins/dashboard/public/services/saved_objects.ts
index bd4a73f8ed817..305ff3c2014f8 100644
--- a/src/plugins/dashboard/public/services/saved_objects.ts
+++ b/src/plugins/dashboard/public/services/saved_objects.ts
@@ -6,14 +6,16 @@
  * Side Public License, v 1.
  */
 
-export {
+export type {
   SaveResult,
   SavedObject,
-  showSaveModal,
-  SavedObjectLoader,
   SavedObjectsStart,
   SavedObjectSaveOpts,
+  SavedObjectLoaderFindOptions,
+} from '../../../saved_objects/public';
+export {
+  showSaveModal,
+  SavedObjectLoader,
   SavedObjectSaveModal,
   getSavedObjectFinder,
-  SavedObjectLoaderFindOptions,
 } from '../../../saved_objects/public';
diff --git a/src/plugins/dashboard/public/services/share.ts b/src/plugins/dashboard/public/services/share.ts
index 38a516ff80ecb..7ed9b86571596 100644
--- a/src/plugins/dashboard/public/services/share.ts
+++ b/src/plugins/dashboard/public/services/share.ts
@@ -6,9 +6,9 @@
  * Side Public License, v 1.
  */
 
-export {
+export type {
   SharePluginStart,
   SharePluginSetup,
-  downloadMultipleAs,
   UrlGeneratorContract,
 } from '../../../share/public';
+export { downloadMultipleAs } from '../../../share/public';
diff --git a/src/plugins/dashboard/public/services/spaces.ts b/src/plugins/dashboard/public/services/spaces.ts
index 89a0acaf611bd..4ebe6644e2393 100644
--- a/src/plugins/dashboard/public/services/spaces.ts
+++ b/src/plugins/dashboard/public/services/spaces.ts
@@ -6,4 +6,4 @@
  * Side Public License, v 1.
  */
 
-export { SpacesPluginStart } from '../../../../../x-pack/plugins/spaces/public';
+export type { SpacesPluginStart } from '../../../../../x-pack/plugins/spaces/public';
diff --git a/src/plugins/dashboard/public/services/ui_actions.ts b/src/plugins/dashboard/public/services/ui_actions.ts
index 017f5b232d11e..5dc2e016a121c 100644
--- a/src/plugins/dashboard/public/services/ui_actions.ts
+++ b/src/plugins/dashboard/public/services/ui_actions.ts
@@ -6,9 +6,5 @@
  * Side Public License, v 1.
  */
 
-export {
-  Action,
-  IncompatibleActionError,
-  UiActionsSetup,
-  UiActionsStart,
-} from '../../../ui_actions/public';
+export type { Action, UiActionsSetup, UiActionsStart } from '../../../ui_actions/public';
+export { IncompatibleActionError } from '../../../ui_actions/public';
diff --git a/src/plugins/dashboard/public/services/usage_collection.ts b/src/plugins/dashboard/public/services/usage_collection.ts
index 4bf43106f4e8f..dee7499c61138 100644
--- a/src/plugins/dashboard/public/services/usage_collection.ts
+++ b/src/plugins/dashboard/public/services/usage_collection.ts
@@ -6,4 +6,4 @@
  * Side Public License, v 1.
  */
 
-export { UsageCollectionSetup } from '../../../usage_collection/public';
+export type { UsageCollectionSetup } from '../../../usage_collection/public';
diff --git a/src/plugins/dashboard/public/types.ts b/src/plugins/dashboard/public/types.ts
index c4cc00838a343..d4a6cb20bc551 100644
--- a/src/plugins/dashboard/public/types.ts
+++ b/src/plugins/dashboard/public/types.ts
@@ -39,7 +39,7 @@ import { DashboardAppLocatorParams } from './locator';
 import { SpacesPluginStart } from './services/spaces';
 import type { DashboardControlGroupInput } from './application/lib/dashboard_control_group';
 
-export { SavedDashboardPanel };
+export type { SavedDashboardPanel };
 
 export type NavAction = (anchorElement?: any) => void;
 export interface SavedDashboardPanelMap {
diff --git a/src/plugins/dashboard/server/index.ts b/src/plugins/dashboard/server/index.ts
index 3af8833d5e4a4..c99ca43ad835e 100644
--- a/src/plugins/dashboard/server/index.ts
+++ b/src/plugins/dashboard/server/index.ts
@@ -24,5 +24,5 @@ export function plugin(initializerContext: PluginInitializerContext) {
   return new DashboardPlugin(initializerContext);
 }
 
-export { DashboardPluginSetup, DashboardPluginStart } from './types';
+export type { DashboardPluginSetup, DashboardPluginStart } from './types';
 export { findByValueEmbeddables } from './usage/find_by_value_embeddables';
diff --git a/src/plugins/data/common/es_query/index.ts b/src/plugins/data/common/es_query/index.ts
index 7029e9d064b21..28361114be6e1 100644
--- a/src/plugins/data/common/es_query/index.ts
+++ b/src/plugins/data/common/es_query/index.ts
@@ -373,6 +373,21 @@ type EsQueryConfig = oldEsQueryConfig;
  * @removeBy 8.1
  */
 
+export type {
+  Filter,
+  RangeFilterMeta,
+  RangeFilterParams,
+  ExistsFilter,
+  PhrasesFilter,
+  PhraseFilter,
+  MatchAllFilter,
+  CustomFilter,
+  RangeFilter,
+  KueryNode,
+  FilterMeta,
+  IFieldSubType,
+  EsQueryConfig,
+};
 export {
   COMPARE_ALL_OPTIONS,
   compareFilters,
@@ -414,17 +429,4 @@ export {
   onlyDisabledFiltersChanged,
   uniqFilters,
   FilterStateStore,
-  Filter,
-  RangeFilterMeta,
-  RangeFilterParams,
-  ExistsFilter,
-  PhrasesFilter,
-  PhraseFilter,
-  MatchAllFilter,
-  CustomFilter,
-  RangeFilter,
-  KueryNode,
-  FilterMeta,
-  IFieldSubType,
-  EsQueryConfig,
 };
diff --git a/src/plugins/data/common/index.ts b/src/plugins/data/common/index.ts
index 34a75f8f24dc6..9a58b73d2c49c 100644
--- a/src/plugins/data/common/index.ts
+++ b/src/plugins/data/common/index.ts
@@ -51,6 +51,12 @@ export type {
   IndexPatternLoadStartDependencies,
   IndexPatternLoadExpressionFunctionDefinition,
 } from '../../data_views/common';
+export type {
+  IndexPatternsContract,
+  DataViewsContract,
+  IndexPatternListItem,
+  DataViewListItem,
+} from '../../data_views/common';
 export {
   RUNTIME_FIELD_TYPES,
   FLEET_ASSETS_TO_IGNORE,
@@ -64,13 +70,9 @@ export {
   DataViewType,
   IndexPatternType,
   IndexPatternsService,
-  IndexPatternsContract,
   DataViewsService,
-  DataViewsContract,
   IndexPattern,
-  IndexPatternListItem,
   DataView,
-  DataViewListItem,
   DuplicateDataViewError,
   DataViewSavedObjectConflictError,
   getIndexPatternLoadMeta,
diff --git a/src/plugins/data/common/kbn_field_types/types.ts b/src/plugins/data/common/kbn_field_types/types.ts
index cea35a53e9da1..29471e95a36b8 100644
--- a/src/plugins/data/common/kbn_field_types/types.ts
+++ b/src/plugins/data/common/kbn_field_types/types.ts
@@ -8,4 +8,5 @@
 
 import { KbnFieldTypeOptions, ES_FIELD_TYPES, KBN_FIELD_TYPES } from '@kbn/field-types';
 
-export { KbnFieldTypeOptions, ES_FIELD_TYPES, KBN_FIELD_TYPES };
+export type { KbnFieldTypeOptions };
+export { ES_FIELD_TYPES, KBN_FIELD_TYPES };
diff --git a/src/plugins/data/common/search/aggs/types.ts b/src/plugins/data/common/search/aggs/types.ts
index fec02a5ae23fd..34c4f0fbf98c5 100644
--- a/src/plugins/data/common/search/aggs/types.ts
+++ b/src/plugins/data/common/search/aggs/types.ts
@@ -89,14 +89,14 @@ import {
   aggSinglePercentile,
 } from './';
 
-export { IAggConfig, AggConfigSerialized } from './agg_config';
-export { CreateAggConfigParams, IAggConfigs } from './agg_configs';
-export { IAggType } from './agg_type';
-export { AggParam, AggParamOption } from './agg_params';
-export { IFieldParamType } from './param_types';
-export { IMetricAggType } from './metrics/metric_agg_type';
-export { IpRangeKey } from './buckets/lib/ip_range';
-export { OptionedValueProp } from './param_types/optioned';
+export type { IAggConfig, AggConfigSerialized } from './agg_config';
+export type { CreateAggConfigParams, IAggConfigs } from './agg_configs';
+export type { IAggType } from './agg_type';
+export type { AggParam, AggParamOption } from './agg_params';
+export type { IFieldParamType } from './param_types';
+export type { IMetricAggType } from './metrics/metric_agg_type';
+export type { IpRangeKey } from './buckets/lib/ip_range';
+export type { OptionedValueProp } from './param_types/optioned';
 
 /** @internal */
 export interface AggsCommonSetup {
diff --git a/src/plugins/data/public/actions/index.ts b/src/plugins/data/public/actions/index.ts
index cb4eff5c274bb..0ec33f7e46523 100644
--- a/src/plugins/data/public/actions/index.ts
+++ b/src/plugins/data/public/actions/index.ts
@@ -6,11 +6,8 @@
  * Side Public License, v 1.
  */
 
-export {
-  ACTION_GLOBAL_APPLY_FILTER,
-  createFilterAction,
-  ApplyGlobalFilterActionContext,
-} from './apply_filter_action';
+export type { ApplyGlobalFilterActionContext } from './apply_filter_action';
+export { ACTION_GLOBAL_APPLY_FILTER, createFilterAction } from './apply_filter_action';
 export { createFiltersFromValueClickAction } from './filters/create_filters_from_value_click';
 export { createFiltersFromRangeSelectAction } from './filters/create_filters_from_range_select';
 export * from './select_range_action';
diff --git a/src/plugins/data/public/autocomplete/collectors/index.ts b/src/plugins/data/public/autocomplete/collectors/index.ts
index 5cfaab19787da..e9b5736008ab1 100644
--- a/src/plugins/data/public/autocomplete/collectors/index.ts
+++ b/src/plugins/data/public/autocomplete/collectors/index.ts
@@ -7,4 +7,5 @@
  */
 
 export { createUsageCollector } from './create_usage_collector';
-export { AUTOCOMPLETE_EVENT_TYPE, AutocompleteUsageCollector } from './types';
+export type { AutocompleteUsageCollector } from './types';
+export { AUTOCOMPLETE_EVENT_TYPE } from './types';
diff --git a/src/plugins/data/public/autocomplete/index.ts b/src/plugins/data/public/autocomplete/index.ts
index 00aa14b86409a..b36af8f12eb52 100644
--- a/src/plugins/data/public/autocomplete/index.ts
+++ b/src/plugins/data/public/autocomplete/index.ts
@@ -6,13 +6,14 @@
  * Side Public License, v 1.
  */
 
-export {
+export type {
   QuerySuggestion,
-  QuerySuggestionTypes,
   QuerySuggestionGetFn,
   QuerySuggestionGetFnArgs,
   QuerySuggestionBasic,
   QuerySuggestionField,
 } from './providers/query_suggestion_provider';
+export { QuerySuggestionTypes } from './providers/query_suggestion_provider';
 
-export { AutocompleteService, AutocompleteSetup, AutocompleteStart } from './autocomplete_service';
+export type { AutocompleteSetup, AutocompleteStart } from './autocomplete_service';
+export { AutocompleteService } from './autocomplete_service';
diff --git a/src/plugins/data/public/deprecated.ts b/src/plugins/data/public/deprecated.ts
index 163d329858293..8b90f92b932e0 100644
--- a/src/plugins/data/public/deprecated.ts
+++ b/src/plugins/data/public/deprecated.ts
@@ -137,7 +137,7 @@ export const esFilters = {
 /**
  * Deprecated type exports
  */
-export {
+export type {
   KueryNode,
   RangeFilter,
   RangeFilterMeta,
@@ -149,9 +149,8 @@ export {
   MatchAllFilter,
   IFieldSubType,
   EsQueryConfig,
-  isFilter,
-  isFilters,
 };
+export { isFilter, isFilters };
 
 /**
  * @deprecated Import helpers from the "@kbn/es-query" package directly instead.
diff --git a/src/plugins/data/public/index.ts b/src/plugins/data/public/index.ts
index 4d51a7ae0ad77..0b749d90f7152 100644
--- a/src/plugins/data/public/index.ts
+++ b/src/plugins/data/public/index.ts
@@ -70,29 +70,26 @@ export const indexPatterns = {
   validate: validateDataView,
 };
 
-export {
-  IndexPatternsContract,
-  DataViewsContract,
-  IndexPattern,
-  IndexPatternField,
-  TypeMeta,
-} from './data_views';
+export type { IndexPatternsContract, DataViewsContract, TypeMeta } from './data_views';
+export { IndexPattern, IndexPatternField } from './data_views';
 
-export {
+export type {
   IIndexPattern,
   IFieldType,
-  ES_FIELD_TYPES,
-  KBN_FIELD_TYPES,
   IndexPatternAttributes,
-  UI_SETTINGS,
   AggregationRestrictions as IndexPatternAggRestrictions,
   IndexPatternSpec,
   IndexPatternLoadExpressionFunctionDefinition,
-  fieldList,
   GetFieldsOptions,
   AggregationRestrictions,
-  IndexPatternType,
   IndexPatternListItem,
+} from '../common';
+export {
+  ES_FIELD_TYPES,
+  KBN_FIELD_TYPES,
+  UI_SETTINGS,
+  fieldList,
+  IndexPatternType,
   DuplicateDataViewError,
 } from '../common';
 
@@ -217,7 +214,8 @@ export type {
   SearchUsageCollector,
 } from './search';
 
-export { ISearchOptions, isErrorResponse, isCompleteResponse, isPartialResponse } from '../common';
+export type { ISearchOptions } from '../common';
+export { isErrorResponse, isCompleteResponse, isPartialResponse } from '../common';
 
 // Search namespace
 export const search = {
@@ -301,7 +299,8 @@ export {
 
 export { isTimeRange, isQuery } from '../common';
 
-export { ACTION_GLOBAL_APPLY_FILTER, ApplyGlobalFilterActionContext } from './actions';
+export type { ApplyGlobalFilterActionContext } from './actions';
+export { ACTION_GLOBAL_APPLY_FILTER } from './actions';
 export { APPLY_FILTER_TRIGGER } from './triggers';
 
 /*
diff --git a/src/plugins/data/public/now_provider/index.ts b/src/plugins/data/public/now_provider/index.ts
index 4d22d674b60b4..b3bfd31fca2c4 100644
--- a/src/plugins/data/public/now_provider/index.ts
+++ b/src/plugins/data/public/now_provider/index.ts
@@ -6,8 +6,5 @@
  * Side Public License, v 1.
  */
 
-export {
-  NowProvider,
-  NowProviderInternalContract,
-  NowProviderPublicContract,
-} from './now_provider';
+export type { NowProviderInternalContract, NowProviderPublicContract } from './now_provider';
+export { NowProvider } from './now_provider';
diff --git a/src/plugins/data/public/query/query_string/index.ts b/src/plugins/data/public/query/query_string/index.ts
index feef1965f8b24..63cc777f6688d 100644
--- a/src/plugins/data/public/query/query_string/index.ts
+++ b/src/plugins/data/public/query/query_string/index.ts
@@ -6,4 +6,5 @@
  * Side Public License, v 1.
  */
 
-export { QueryStringContract, QueryStringManager } from './query_string_manager';
+export type { QueryStringContract } from './query_string_manager';
+export { QueryStringManager } from './query_string_manager';
diff --git a/src/plugins/data/public/query/saved_query/index.ts b/src/plugins/data/public/query/saved_query/index.ts
index 6cde77c7a7722..03d8f0b35b9b1 100644
--- a/src/plugins/data/public/query/saved_query/index.ts
+++ b/src/plugins/data/public/query/saved_query/index.ts
@@ -6,5 +6,10 @@
  * Side Public License, v 1.
  */
 
-export { SavedQuery, SavedQueryAttributes, SavedQueryService, SavedQueryTimeFilter } from './types';
+export type {
+  SavedQuery,
+  SavedQueryAttributes,
+  SavedQueryService,
+  SavedQueryTimeFilter,
+} from './types';
 export { createSavedQueryService } from './saved_query_service';
diff --git a/src/plugins/data/public/query/state_sync/index.ts b/src/plugins/data/public/query/state_sync/index.ts
index dac51411dfd40..58740cfab06d0 100644
--- a/src/plugins/data/public/query/state_sync/index.ts
+++ b/src/plugins/data/public/query/state_sync/index.ts
@@ -8,4 +8,4 @@
 
 export { connectToQueryState } from './connect_to_query_state';
 export { syncQueryStateWithUrl } from './sync_state_with_url';
-export { QueryState, QueryStateChange } from './types';
+export type { QueryState, QueryStateChange } from './types';
diff --git a/src/plugins/data/public/query/timefilter/index.ts b/src/plugins/data/public/query/timefilter/index.ts
index 3dfd4e0fe514f..604213054fd02 100644
--- a/src/plugins/data/public/query/timefilter/index.ts
+++ b/src/plugins/data/public/query/timefilter/index.ts
@@ -6,11 +6,14 @@
  * Side Public License, v 1.
  */
 
-export { TimefilterService, TimefilterSetup } from './timefilter_service';
+export type { TimefilterSetup } from './timefilter_service';
+export { TimefilterService } from './timefilter_service';
 
 export * from './types';
-export { Timefilter, TimefilterContract, AutoRefreshDoneFn } from './timefilter';
-export { TimeHistory, TimeHistoryContract } from './time_history';
+export type { TimefilterContract, AutoRefreshDoneFn } from './timefilter';
+export { Timefilter } from './timefilter';
+export type { TimeHistoryContract } from './time_history';
+export { TimeHistory } from './time_history';
 export { changeTimeFilter, convertRangeFilterToTimeRangeString } from './lib/change_time_filter';
 export { extractTimeFilter, extractTimeRange } from './lib/extract_time_filter';
 export { validateTimeRange } from './lib/validate_timerange';
diff --git a/src/plugins/data/public/query/timefilter/timefilter.ts b/src/plugins/data/public/query/timefilter/timefilter.ts
index 3b537562586a7..f3520abb2f46e 100644
--- a/src/plugins/data/public/query/timefilter/timefilter.ts
+++ b/src/plugins/data/public/query/timefilter/timefilter.ts
@@ -25,7 +25,7 @@ import {
 import { TimeHistoryContract } from './time_history';
 import { createAutoRefreshLoop, AutoRefreshDoneFn } from './lib/auto_refresh_loop';
 
-export { AutoRefreshDoneFn };
+export type { AutoRefreshDoneFn };
 
 // TODO: remove!
 export class Timefilter {
diff --git a/src/plugins/data/public/query/timefilter/types.ts b/src/plugins/data/public/query/timefilter/types.ts
index 66584358ccb34..3c35ae2d79ae5 100644
--- a/src/plugins/data/public/query/timefilter/types.ts
+++ b/src/plugins/data/public/query/timefilter/types.ts
@@ -23,4 +23,4 @@ export type InputTimeRange =
       to: Moment;
     };
 
-export { TimeRangeBounds } from '../../../common';
+export type { TimeRangeBounds } from '../../../common';
diff --git a/src/plugins/data/public/search/aggs/types.ts b/src/plugins/data/public/search/aggs/types.ts
index 34ec3415427d3..5a8110034bbc1 100644
--- a/src/plugins/data/public/search/aggs/types.ts
+++ b/src/plugins/data/public/search/aggs/types.ts
@@ -9,4 +9,4 @@
 import { AggsCommonSetup } from '../../../common';
 
 export type AggsSetup = AggsCommonSetup;
-export { AggsStart } from '../../../common';
+export type { AggsStart } from '../../../common';
diff --git a/src/plugins/data/public/search/collectors/index.ts b/src/plugins/data/public/search/collectors/index.ts
index b6640a8e61f6c..9eb96be5a0455 100644
--- a/src/plugins/data/public/search/collectors/index.ts
+++ b/src/plugins/data/public/search/collectors/index.ts
@@ -7,4 +7,5 @@
  */
 
 export { createUsageCollector } from './create_usage_collector';
-export { SEARCH_EVENT_TYPE, SearchUsageCollector } from './types';
+export type { SearchUsageCollector } from './types';
+export { SEARCH_EVENT_TYPE } from './types';
diff --git a/src/plugins/data/public/search/index.ts b/src/plugins/data/public/search/index.ts
index 21d607eedb152..821f16e0cf68a 100644
--- a/src/plugins/data/public/search/index.ts
+++ b/src/plugins/data/public/search/index.ts
@@ -8,46 +8,51 @@
 
 export * from './expressions';
 
-export {
+export type {
   ISearchSetup,
   ISearchStart,
   ISearchStartSearchSource,
   SearchUsageCollector,
 } from './types';
 
-export {
-  ES_SEARCH_STRATEGY,
+export type {
   EsQuerySortValue,
-  extractReferences as extractSearchSourceReferences,
-  getSearchParamsFromRequest,
   IEsSearchRequest,
   IEsSearchResponse,
   IKibanaSearchRequest,
   IKibanaSearchResponse,
-  injectReferences as injectSearchSourceReferences,
   ISearchGeneric,
   ISearchSource,
-  parseSearchSourceJSON,
   SearchError,
   SearchRequest,
-  SearchSource,
   SearchSourceDependencies,
   SearchSourceFields,
-  SortDirection,
 } from '../../common/search';
 export {
-  SessionService,
+  ES_SEARCH_STRATEGY,
+  extractReferences as extractSearchSourceReferences,
+  getSearchParamsFromRequest,
+  injectReferences as injectSearchSourceReferences,
+  parseSearchSourceJSON,
+  SearchSource,
+  SortDirection,
+} from '../../common/search';
+export type {
   ISessionService,
   SearchSessionInfoProvider,
+  ISessionsClient,
+  WaitUntilNextSessionCompletesOptions,
+} from './session';
+export {
+  SessionService,
   SearchSessionState,
   SessionsClient,
-  ISessionsClient,
   noSearchSessionStorageCapabilityMessage,
   SEARCH_SESSIONS_MANAGEMENT_ID,
   waitUntilNextSessionCompletes$,
-  WaitUntilNextSessionCompletesOptions,
 } from './session';
 export { getEsPreference } from './es_search';
 
-export { SearchInterceptor, SearchInterceptorDeps } from './search_interceptor';
+export type { SearchInterceptorDeps } from './search_interceptor';
+export { SearchInterceptor } from './search_interceptor';
 export * from './errors';
diff --git a/src/plugins/data/public/search/search_interceptor/index.ts b/src/plugins/data/public/search/search_interceptor/index.ts
index 411c4beefe96c..bf6930276020e 100644
--- a/src/plugins/data/public/search/search_interceptor/index.ts
+++ b/src/plugins/data/public/search/search_interceptor/index.ts
@@ -6,4 +6,5 @@
  * Side Public License, v 1.
  */
 
-export { SearchInterceptor, ISearchInterceptor, SearchInterceptorDeps } from './search_interceptor';
+export type { ISearchInterceptor, SearchInterceptorDeps } from './search_interceptor';
+export { SearchInterceptor } from './search_interceptor';
diff --git a/src/plugins/data/public/search/session/index.ts b/src/plugins/data/public/search/session/index.ts
index ce578378a2fe8..c48362538a5fd 100644
--- a/src/plugins/data/public/search/session/index.ts
+++ b/src/plugins/data/public/search/session/index.ts
@@ -6,12 +6,12 @@
  * Side Public License, v 1.
  */
 
-export { SessionService, ISessionService, SearchSessionInfoProvider } from './session_service';
+export type { ISessionService, SearchSessionInfoProvider } from './session_service';
+export { SessionService } from './session_service';
 export { SearchSessionState } from './search_session_state';
-export { SessionsClient, ISessionsClient } from './sessions_client';
+export type { ISessionsClient } from './sessions_client';
+export { SessionsClient } from './sessions_client';
 export { noSearchSessionStorageCapabilityMessage } from './i18n';
 export { SEARCH_SESSIONS_MANAGEMENT_ID } from './constants';
-export {
-  waitUntilNextSessionCompletes$,
-  WaitUntilNextSessionCompletesOptions,
-} from './session_helpers';
+export type { WaitUntilNextSessionCompletesOptions } from './session_helpers';
+export { waitUntilNextSessionCompletes$ } from './session_helpers';
diff --git a/src/plugins/data/public/search/types.ts b/src/plugins/data/public/search/types.ts
index 764933d15e065..3dacad42273ae 100644
--- a/src/plugins/data/public/search/types.ts
+++ b/src/plugins/data/public/search/types.ts
@@ -14,7 +14,7 @@ import { IndexPatternsContract } from '../../common';
 import { UsageCollectionSetup } from '../../../usage_collection/public';
 import { ISessionsClient, ISessionService } from './session';
 
-export { ISearchStartSearchSource, SearchUsageCollector };
+export type { ISearchStartSearchSource, SearchUsageCollector };
 
 /**
  * The setup contract exposed by the Search plugin exposes the search strategy extension
diff --git a/src/plugins/data/public/ui/index.ts b/src/plugins/data/public/ui/index.ts
index 1c8df359602b9..026db1b7c09ee 100644
--- a/src/plugins/data/public/ui/index.ts
+++ b/src/plugins/data/public/ui/index.ts
@@ -6,8 +6,10 @@
  * Side Public License, v 1.
  */
 
-export { IndexPatternSelectProps } from './index_pattern_select';
+export type { IndexPatternSelectProps } from './index_pattern_select';
 export { FilterLabel, FilterItem } from './filter_bar';
-export { QueryStringInput, QueryStringInputProps } from './query_string_input';
-export { SearchBar, SearchBarProps, StatefulSearchBarProps } from './search_bar';
+export type { QueryStringInputProps } from './query_string_input';
+export { QueryStringInput } from './query_string_input';
+export type { SearchBarProps, StatefulSearchBarProps } from './search_bar';
+export { SearchBar } from './search_bar';
 export { SuggestionsComponent } from './typeahead';
diff --git a/src/plugins/data/public/ui/saved_query_form/index.ts b/src/plugins/data/public/ui/saved_query_form/index.ts
index f440294dc6eb7..1590b8fc98927 100644
--- a/src/plugins/data/public/ui/saved_query_form/index.ts
+++ b/src/plugins/data/public/ui/saved_query_form/index.ts
@@ -7,4 +7,5 @@
  */
 
 // @internal
-export { SavedQueryMeta, SaveQueryForm } from '../saved_query_form/save_query_form';
+export type { SavedQueryMeta } from '../saved_query_form/save_query_form';
+export { SaveQueryForm } from '../saved_query_form/save_query_form';
diff --git a/src/plugins/data/public/ui/search_bar/index.tsx b/src/plugins/data/public/ui/search_bar/index.tsx
index 64dacee4ad363..fac421dd743d7 100644
--- a/src/plugins/data/public/ui/search_bar/index.tsx
+++ b/src/plugins/data/public/ui/search_bar/index.tsx
@@ -21,5 +21,5 @@ const WrappedSearchBar = (props: SearchBarProps) => (
 );
 
 export const SearchBar = injectI18n(withKibana(WrappedSearchBar));
-export { StatefulSearchBarProps } from './create_search_bar';
+export type { StatefulSearchBarProps } from './create_search_bar';
 export type { SearchBarProps, SearchBarOwnProps } from './search_bar';
diff --git a/src/plugins/data/server/index.ts b/src/plugins/data/server/index.ts
index fce73e65dc699..939d4a9fa3237 100644
--- a/src/plugins/data/server/index.ts
+++ b/src/plugins/data/server/index.ts
@@ -36,20 +36,18 @@ export { DATA_VIEW_SAVED_OBJECT_TYPE } from '../common';
  * Index patterns:
  */
 
+export type { FieldDescriptor, IndexPatternsServiceStart } from './data_views';
 export {
   IndexPatternsFetcher,
-  shouldReadFieldFromDocValues, // used only in logstash_fields fixture
-  FieldDescriptor,
+  shouldReadFieldFromDocValues,
   getCapabilitiesForRollupIndices,
-  IndexPatternsServiceStart,
 } from './data_views';
 
+export type { IFieldType, IndexPatternAttributes } from '../common';
 export {
   IndexPatternField,
-  IFieldType,
   ES_FIELD_TYPES,
   KBN_FIELD_TYPES,
-  IndexPatternAttributes,
   UI_SETTINGS,
   IndexPattern,
   IndexPatternsService,
@@ -72,29 +70,24 @@ import {
 } from '../common';
 import { autocompleteConfigDeprecationProvider } from './config_deprecations';
 
-export {
-  // aggs
-  METRIC_TYPES,
+export type {
   ParsedInterval,
-  // search
   ISearchOptions,
   IEsSearchRequest,
   IEsSearchResponse,
-  ES_SEARCH_STRATEGY,
 } from '../common';
+export { METRIC_TYPES, ES_SEARCH_STRATEGY } from '../common';
 
-export {
+export type {
   IScopedSearchClient,
   ISearchStrategy,
   SearchStrategyDependencies,
-  shimHitsTotal,
-  SearchSessionService,
   ISearchSessionService,
   SearchRequestHandlerContext,
   DataRequestHandlerContext,
   AsyncSearchStatusResponse,
-  NoSearchIdInSessionError,
 } from './search';
+export { shimHitsTotal, SearchSessionService, NoSearchIdInSessionError } from './search';
 
 // Search namespace
 export const search = {
@@ -112,14 +105,8 @@ export const search = {
  * @public
  */
 
-export {
-  castEsToKbnFieldTypeName,
-  getTime,
-  // timefilter
-  TimeRange,
-  // utils
-  parseInterval,
-} from '../common';
+export type { TimeRange } from '../common';
+export { castEsToKbnFieldTypeName, getTime, parseInterval } from '../common';
 
 /**
  * Static code to be shared externally
@@ -130,11 +117,8 @@ export function plugin(initializerContext: PluginInitializerContext<ConfigSchema
   return new DataServerPlugin(initializerContext);
 }
 
-export {
-  DataServerPlugin as Plugin,
-  DataPluginSetup as PluginSetup,
-  DataPluginStart as PluginStart,
-};
+export type { DataPluginSetup as PluginSetup, DataPluginStart as PluginStart };
+export { DataServerPlugin as Plugin };
 
 export const config: PluginConfigDescriptor<ConfigSchema> = {
   deprecations: autocompleteConfigDeprecationProvider,
diff --git a/src/plugins/data/server/search/index.ts b/src/plugins/data/server/search/index.ts
index b9affe96ea2dd..b7087e95c0a2c 100644
--- a/src/plugins/data/server/search/index.ts
+++ b/src/plugins/data/server/search/index.ts
@@ -10,7 +10,8 @@ export * from './types';
 export * from './strategies/es_search';
 export * from './strategies/ese_search';
 export * from './strategies/eql_search';
-export { usageProvider, SearchUsage, searchUsageObserver } from './collectors';
+export type { SearchUsage } from './collectors';
+export { usageProvider, searchUsageObserver } from './collectors';
 export * from './aggs';
 export * from './session';
 export * from './errors/no_search_id_in_session';
diff --git a/src/plugins/data/server/search/strategies/es_search/index.ts b/src/plugins/data/server/search/strategies/es_search/index.ts
index d43fab0a86e69..53a791455e64e 100644
--- a/src/plugins/data/server/search/strategies/es_search/index.ts
+++ b/src/plugins/data/server/search/strategies/es_search/index.ts
@@ -9,4 +9,5 @@
 export { esSearchStrategyProvider } from './es_search_strategy';
 export * from './request_utils';
 export * from './response_utils';
-export { ES_SEARCH_STRATEGY, IEsSearchRequest, IEsSearchResponse } from '../../../../common';
+export type { IEsSearchRequest, IEsSearchResponse } from '../../../../common';
+export { ES_SEARCH_STRATEGY } from '../../../../common';
diff --git a/src/plugins/data_views/common/index.ts b/src/plugins/data_views/common/index.ts
index b057a1ba84174..b3123df2597cc 100644
--- a/src/plugins/data_views/common/index.ts
+++ b/src/plugins/data_views/common/index.ts
@@ -55,13 +55,10 @@ export type {
   SourceFilter,
 } from './types';
 export { DataViewType, IndexPatternType } from './types';
-export {
-  IndexPatternsService,
-  IndexPatternsContract,
-  DataViewsService,
-  DataViewsContract,
-} from './data_views';
-export { IndexPattern, IndexPatternListItem, DataView, DataViewListItem } from './data_views';
+export type { IndexPatternsContract, DataViewsContract } from './data_views';
+export { IndexPatternsService, DataViewsService } from './data_views';
+export type { IndexPatternListItem, DataViewListItem } from './data_views';
+export { IndexPattern, DataView } from './data_views';
 export { DuplicateDataViewError, DataViewSavedObjectConflictError } from './errors';
 export type {
   IndexPatternExpressionType,
diff --git a/src/plugins/data_views/public/index.ts b/src/plugins/data_views/public/index.ts
index 3a6b5ccb237f2..650d2132212f8 100644
--- a/src/plugins/data_views/public/index.ts
+++ b/src/plugins/data_views/public/index.ts
@@ -15,15 +15,15 @@ export {
 } from '../common/lib';
 export { onRedirectNoIndexPattern } from './data_views';
 
-export { IndexPatternField, IIndexPatternFieldList, TypeMeta } from '../common';
+export type { IIndexPatternFieldList, TypeMeta } from '../common';
+export { IndexPatternField } from '../common';
 
+export type { IndexPatternsContract, DataViewsContract } from './data_views';
 export {
   IndexPatternsService,
-  IndexPatternsContract,
   IndexPattern,
   DataViewsApiClient,
   DataViewsService,
-  DataViewsContract,
   DataView,
 } from './data_views';
 export { UiSettingsPublicToCommon } from './ui_settings_wrapper';
diff --git a/src/plugins/data_views/server/fetcher/index_patterns_fetcher.test.ts b/src/plugins/data_views/server/fetcher/index_patterns_fetcher.test.ts
index a65d4d551cf7c..1a8b705480258 100644
--- a/src/plugins/data_views/server/fetcher/index_patterns_fetcher.test.ts
+++ b/src/plugins/data_views/server/fetcher/index_patterns_fetcher.test.ts
@@ -5,7 +5,6 @@
  * in compliance with, at your election, the Elastic License 2.0 or the Server
  * Side Public License, v 1.
  */
-
 import { IndexPatternsFetcher } from '.';
 import { ElasticsearchClient } from 'kibana/server';
 import * as indexNotFoundException from './index_not_found_exception.json';
@@ -15,36 +14,36 @@ describe('Index Pattern Fetcher - server', () => {
   let esClient: ElasticsearchClient;
   const emptyResponse = {
     body: {
-      count: 0,
+      indices: [],
     },
   };
   const response = {
     body: {
-      count: 1115,
+      indices: ['b'],
+      fields: [{ name: 'foo' }, { name: 'bar' }, { name: 'baz' }],
     },
   };
   const patternList = ['a', 'b', 'c'];
   beforeEach(() => {
+    jest.clearAllMocks();
     esClient = {
-      count: jest.fn().mockResolvedValueOnce(emptyResponse).mockResolvedValue(response),
+      fieldCaps: jest.fn().mockResolvedValueOnce(emptyResponse).mockResolvedValue(response),
     } as unknown as ElasticsearchClient;
     indexPatterns = new IndexPatternsFetcher(esClient);
   });
-
   it('Removes pattern without matching indices', async () => {
     const result = await indexPatterns.validatePatternListActive(patternList);
     expect(result).toEqual(['b', 'c']);
   });
-
   it('Returns all patterns when all match indices', async () => {
     esClient = {
-      count: jest.fn().mockResolvedValue(response),
+      fieldCaps: jest.fn().mockResolvedValue(response),
     } as unknown as ElasticsearchClient;
     indexPatterns = new IndexPatternsFetcher(esClient);
     const result = await indexPatterns.validatePatternListActive(patternList);
     expect(result).toEqual(patternList);
   });
-  it('Removes pattern when "index_not_found_exception" error is thrown', async () => {
+  it('Removes pattern when error is thrown', async () => {
     class ServerError extends Error {
       public body?: Record<string, any>;
       constructor(
@@ -56,9 +55,8 @@ describe('Index Pattern Fetcher - server', () => {
         this.body = errBody;
       }
     }
-
     esClient = {
-      count: jest
+      fieldCaps: jest
         .fn()
         .mockResolvedValueOnce(response)
         .mockRejectedValue(
@@ -69,4 +67,22 @@ describe('Index Pattern Fetcher - server', () => {
     const result = await indexPatterns.validatePatternListActive(patternList);
     expect(result).toEqual([patternList[0]]);
   });
+  it('When allowNoIndices is false, run validatePatternListActive', async () => {
+    const fieldCapsMock = jest.fn();
+    esClient = {
+      fieldCaps: fieldCapsMock.mockResolvedValue(response),
+    } as unknown as ElasticsearchClient;
+    indexPatterns = new IndexPatternsFetcher(esClient);
+    await indexPatterns.getFieldsForWildcard({ pattern: patternList });
+    expect(fieldCapsMock.mock.calls).toHaveLength(4);
+  });
+  it('When allowNoIndices is true, do not run validatePatternListActive', async () => {
+    const fieldCapsMock = jest.fn();
+    esClient = {
+      fieldCaps: fieldCapsMock.mockResolvedValue(response),
+    } as unknown as ElasticsearchClient;
+    indexPatterns = new IndexPatternsFetcher(esClient, true);
+    await indexPatterns.getFieldsForWildcard({ pattern: patternList });
+    expect(fieldCapsMock.mock.calls).toHaveLength(1);
+  });
 });
diff --git a/src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts b/src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts
index 7dae85c920ebf..c054d547e956f 100644
--- a/src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts
+++ b/src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts
@@ -36,12 +36,10 @@ interface FieldSubType {
 export class IndexPatternsFetcher {
   private elasticsearchClient: ElasticsearchClient;
   private allowNoIndices: boolean;
-
   constructor(elasticsearchClient: ElasticsearchClient, allowNoIndices: boolean = false) {
     this.elasticsearchClient = elasticsearchClient;
     this.allowNoIndices = allowNoIndices;
   }
-
   /**
    *  Get a list of field objects for an index pattern that may contain wildcards
    *
@@ -60,23 +58,22 @@ export class IndexPatternsFetcher {
   }): Promise<FieldDescriptor[]> {
     const { pattern, metaFields, fieldCapsOptions, type, rollupIndex } = options;
     const patternList = Array.isArray(pattern) ? pattern : pattern.split(',');
+    const allowNoIndices = fieldCapsOptions
+      ? fieldCapsOptions.allow_no_indices
+      : this.allowNoIndices;
     let patternListActive: string[] = patternList;
     // if only one pattern, don't bother with validation. We let getFieldCapabilities fail if the single pattern is bad regardless
-    if (patternList.length > 1) {
+    if (patternList.length > 1 && !allowNoIndices) {
       patternListActive = await this.validatePatternListActive(patternList);
     }
     const fieldCapsResponse = await getFieldCapabilities(
       this.elasticsearchClient,
-      // if none of the patterns are active, pass the original list to get an error
-      patternListActive.length > 0 ? patternListActive : patternList,
+      patternListActive,
       metaFields,
       {
-        allow_no_indices: fieldCapsOptions
-          ? fieldCapsOptions.allow_no_indices
-          : this.allowNoIndices,
+        allow_no_indices: allowNoIndices,
       }
     );
-
     if (type === 'rollup' && rollupIndex) {
       const rollupFields: FieldDescriptor[] = [];
       const rollupIndexCapabilities = getCapabilitiesForRollupIndices(
@@ -87,13 +84,11 @@ export class IndexPatternsFetcher {
         ).body
       )[rollupIndex].aggs;
       const fieldCapsResponseObj = keyBy(fieldCapsResponse, 'name');
-
       // Keep meta fields
       metaFields!.forEach(
         (field: string) =>
           fieldCapsResponseObj[field] && rollupFields.push(fieldCapsResponseObj[field])
       );
-
       return mergeCapabilitiesWithFields(
         rollupIndexCapabilities,
         fieldCapsResponseObj,
@@ -137,23 +132,20 @@ export class IndexPatternsFetcher {
   async validatePatternListActive(patternList: string[]) {
     const result = await Promise.all(
       patternList
-        .map((pattern) =>
-          this.elasticsearchClient.count({
-            index: pattern,
-          })
-        )
-        .map((p) =>
-          p.catch((e) => {
-            if (e.body.error.type === 'index_not_found_exception') {
-              return { body: { count: 0 } };
-            }
-            throw e;
-          })
-        )
+        .map(async (index) => {
+          const searchResponse = await this.elasticsearchClient.fieldCaps({
+            index,
+            fields: '_id',
+            ignore_unavailable: true,
+            allow_no_indices: false,
+          });
+          return searchResponse.body.indices.length > 0;
+        })
+        .map((p) => p.catch(() => false))
     );
     return result.reduce(
-      (acc: string[], { body: { count } }, patternListIndex) =>
-        count > 0 ? [...acc, patternList[patternListIndex]] : acc,
+      (acc: string[], isValid, patternListIndex) =>
+        isValid ? [...acc, patternList[patternListIndex]] : acc,
       []
     );
   }
diff --git a/src/plugins/data_views/server/index.ts b/src/plugins/data_views/server/index.ts
index 1c7eeb073bbe2..7a4df9518b435 100644
--- a/src/plugins/data_views/server/index.ts
+++ b/src/plugins/data_views/server/index.ts
@@ -7,14 +7,14 @@
  */
 
 export { getFieldByName, findIndexPatternById } from './utils';
+export type { FieldDescriptor } from './fetcher';
 export {
   IndexPatternsFetcher,
-  FieldDescriptor,
   shouldReadFieldFromDocValues,
   mergeCapabilitiesWithFields,
   getCapabilitiesForRollupIndices,
 } from './fetcher';
-export { IndexPatternsServiceStart } from './types';
+export type { IndexPatternsServiceStart } from './types';
 
 import { PluginInitializerContext } from 'src/core/server';
 import { DataViewsServerPlugin } from './plugin';
@@ -30,8 +30,8 @@ export function plugin(initializerContext: PluginInitializerContext) {
   return new DataViewsServerPlugin(initializerContext);
 }
 
-export {
-  DataViewsServerPlugin as Plugin,
+export type {
   DataViewsServerPluginSetup as PluginSetup,
   DataViewsServerPluginStart as PluginStart,
 };
+export { DataViewsServerPlugin as Plugin };
diff --git a/src/plugins/discover/common/index.ts b/src/plugins/discover/common/index.ts
index 32704d95423f7..6262855409b29 100644
--- a/src/plugins/discover/common/index.ts
+++ b/src/plugins/discover/common/index.ts
@@ -21,4 +21,5 @@ export const SEARCH_FIELDS_FROM_SOURCE = 'discover:searchFieldsFromSource';
 export const MAX_DOC_FIELDS_DISPLAYED = 'discover:maxDocFieldsDisplayed';
 export const SHOW_FIELD_STATISTICS = 'discover:showFieldStatistics';
 export const SHOW_MULTIFIELDS = 'discover:showMultiFields';
+export const TRUNCATE_MAX_HEIGHT = 'truncate:maxHeight';
 export const SEARCH_EMBEDDABLE_TYPE = 'search';
diff --git a/src/plugins/discover/public/application/apps/context/context_app_content.tsx b/src/plugins/discover/public/application/apps/context/context_app_content.tsx
index 153639edc29a1..c8f3cfe0a568f 100644
--- a/src/plugins/discover/public/application/apps/context/context_app_content.tsx
+++ b/src/plugins/discover/public/application/apps/context/context_app_content.tsx
@@ -141,7 +141,7 @@ export function ContextAppContent({
           dataTestSubj="contextDocTable"
         />
       )}
-      {!isLegacy && rows && rows.length && (
+      {!isLegacy && (
         <div className="dscDocsGrid">
           <DiscoverGridMemoized
             ariaLabelledBy="surDocumentsAriaLabel"
diff --git a/src/plugins/discover/public/application/apps/main/components/chart/histogram.tsx b/src/plugins/discover/public/application/apps/main/components/chart/histogram.tsx
index e35201651d5a7..315ab7bad40f1 100644
--- a/src/plugins/discover/public/application/apps/main/components/chart/histogram.tsx
+++ b/src/plugins/discover/public/application/apps/main/components/chart/histogram.tsx
@@ -8,7 +8,14 @@
 import './histogram.scss';
 import moment, { unitOfTime } from 'moment-timezone';
 import React, { useCallback, useMemo } from 'react';
-import { EuiLoadingChart, EuiSpacer, EuiText } from '@elastic/eui';
+import {
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiIconTip,
+  EuiLoadingChart,
+  EuiSpacer,
+  EuiText,
+} from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import dateMath from '@elastic/datemath';
 import {
@@ -25,6 +32,7 @@ import {
   XYChartElementEvent,
 } from '@elastic/charts';
 import { IUiSettingsClient } from 'kibana/public';
+import { i18n } from '@kbn/i18n';
 import {
   CurrentTime,
   Endzones,
@@ -65,7 +73,7 @@ export function DiscoverHistogram({
 
   const uiSettings = services.uiSettings;
   const timeZone = getTimezone(uiSettings);
-  const { chartData, fetchStatus } = dataState;
+  const { chartData, fetchStatus, bucketInterval } = dataState;
 
   const onBrushEnd = useCallback(
     ({ x }: XYBrushEvent) => {
@@ -182,6 +190,47 @@ export function DiscoverHistogram({
 
   const useLegacyTimeAxis = uiSettings.get(LEGACY_TIME_AXIS, false);
 
+  const toolTipTitle = i18n.translate('discover.timeIntervalWithValueWarning', {
+    defaultMessage: 'Warning',
+  });
+
+  const toolTipContent = i18n.translate('discover.bucketIntervalTooltip', {
+    defaultMessage:
+      'This interval creates {bucketsDescription} to show in the selected time range, so it has been scaled to {bucketIntervalDescription}.',
+    values: {
+      bucketsDescription:
+        bucketInterval!.scale && bucketInterval!.scale > 1
+          ? i18n.translate('discover.bucketIntervalTooltip.tooLargeBucketsText', {
+              defaultMessage: 'buckets that are too large',
+            })
+          : i18n.translate('discover.bucketIntervalTooltip.tooManyBucketsText', {
+              defaultMessage: 'too many buckets',
+            }),
+      bucketIntervalDescription: bucketInterval?.description,
+    },
+  });
+
+  let timeRange = (
+    <EuiText size="xs" className="dscHistogramTimeRange" textAlign="center">
+      {timeRangeText}
+    </EuiText>
+  );
+  if (bucketInterval?.scaled) {
+    timeRange = (
+      <EuiFlexGroup
+        alignItems="baseline"
+        justifyContent="center"
+        gutterSize="none"
+        responsive={false}
+      >
+        <EuiFlexItem grow={false}>{timeRange}</EuiFlexItem>
+        <EuiFlexItem grow={false}>
+          <EuiIconTip type="alert" color="warning" title={toolTipTitle} content={toolTipContent} />
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    );
+  }
+
   return (
     <React.Fragment>
       <div className="dscHistogram" data-test-subj="discoverChart" data-time-range={timeRangeText}>
@@ -232,9 +281,7 @@ export function DiscoverHistogram({
           />
         </Chart>
       </div>
-      <EuiText size="xs" className="dscHistogramTimeRange" textAlign="center">
-        {timeRangeText}
-      </EuiText>
+      {timeRange}
     </React.Fragment>
   );
 }
diff --git a/src/plugins/discover/public/application/apps/main/components/chart/use_chart_panels.ts b/src/plugins/discover/public/application/apps/main/components/chart/use_chart_panels.ts
index 72f921bca5f53..3660173ef761d 100644
--- a/src/plugins/discover/public/application/apps/main/components/chart/use_chart_panels.ts
+++ b/src/plugins/discover/public/application/apps/main/components/chart/use_chart_panels.ts
@@ -12,8 +12,7 @@ import type {
 } from '@elastic/eui';
 import { search } from '../../../../../../../data/public';
 import { AppState } from '../../services/discover_state';
-import { DataCharts$, DataChartsMessage } from '../../services/use_saved_search';
-import { useDataState } from '../../utils/use_data_state';
+import { DataCharts$ } from '../../services/use_saved_search';
 
 export function useChartPanels(
   state: AppState,
@@ -22,8 +21,6 @@ export function useChartPanels(
   onChangeInterval: (value: string) => void,
   closePopover: () => void
 ) {
-  const dataState: DataChartsMessage = useDataState(savedSearchDataChart$);
-  const { bucketInterval } = dataState;
   const { interval, hideChart } = state;
   const selectedOptionIdx = search.aggs.intervalOptions.findIndex((opt) => opt.val === interval);
   const intervalDisplay =
@@ -56,29 +53,6 @@ export function useChartPanels(
           timeInterval: intervalDisplay,
         },
       }),
-      icon: bucketInterval?.scaled ? 'alert' : '',
-      toolTipTitle: bucketInterval?.scaled
-        ? i18n.translate('discover.timeIntervalWithValueWarning', {
-            defaultMessage: 'Warning',
-          })
-        : '',
-      toolTipContent: bucketInterval?.scaled
-        ? i18n.translate('discover.bucketIntervalTooltip', {
-            defaultMessage:
-              'This interval creates {bucketsDescription} to show in the selected time range, so it has been scaled to {bucketIntervalDescription}.',
-            values: {
-              bucketsDescription:
-                bucketInterval!.scale && bucketInterval!.scale > 1
-                  ? i18n.translate('discover.bucketIntervalTooltip.tooLargeBucketsText', {
-                      defaultMessage: 'buckets that are too large',
-                    })
-                  : i18n.translate('discover.bucketIntervalTooltip.tooManyBucketsText', {
-                      defaultMessage: 'too many buckets',
-                    }),
-              bucketIntervalDescription: bucketInterval?.description,
-            },
-          })
-        : '',
       panel: 1,
       'data-test-subj': 'discoverTimeIntervalPanel',
     });
diff --git a/src/plugins/discover/public/application/apps/main/components/doc_table/_doc_table.scss b/src/plugins/discover/public/application/apps/main/components/doc_table/_doc_table.scss
index d19a1fd042069..164b61d42df19 100644
--- a/src/plugins/discover/public/application/apps/main/components/doc_table/_doc_table.scss
+++ b/src/plugins/discover/public/application/apps/main/components/doc_table/_doc_table.scss
@@ -103,10 +103,6 @@
   text-align: center;
 }
 
-.truncate-by-height {
-  overflow: hidden;
-}
-
 .table {
   // Nesting
   .table {
diff --git a/src/plugins/discover/public/application/apps/main/components/doc_table/components/table_row.tsx b/src/plugins/discover/public/application/apps/main/components/doc_table/components/table_row.tsx
index 0bf4a36555d16..515782ce23f45 100644
--- a/src/plugins/discover/public/application/apps/main/components/doc_table/components/table_row.tsx
+++ b/src/plugins/discover/public/application/apps/main/components/doc_table/components/table_row.tsx
@@ -88,7 +88,7 @@ export const TableRow = ({
     return (
       // formatFieldValue always returns sanitized HTML
       // eslint-disable-next-line react/no-danger
-      <div className="truncate-by-height" dangerouslySetInnerHTML={{ __html: formattedField }} />
+      <div className="dscTruncateByHeight" dangerouslySetInnerHTML={{ __html: formattedField }} />
     );
   };
   const inlineFilter = useCallback(
diff --git a/src/plugins/discover/public/application/apps/main/components/doc_table/lib/row_formatter.tsx b/src/plugins/discover/public/application/apps/main/components/doc_table/lib/row_formatter.tsx
index a73bc3f175be1..d5660a091f0aa 100644
--- a/src/plugins/discover/public/application/apps/main/components/doc_table/lib/row_formatter.tsx
+++ b/src/plugins/discover/public/application/apps/main/components/doc_table/lib/row_formatter.tsx
@@ -20,7 +20,7 @@ interface Props {
 }
 const TemplateComponent = ({ defPairs }: Props) => {
   return (
-    <dl className={'source truncate-by-height'}>
+    <dl className={'source dscTruncateByHeight'}>
       {defPairs.map((pair, idx) => (
         <Fragment key={idx}>
           <dt>{pair[0]}:</dt>
diff --git a/src/plugins/discover/public/application/components/table/table.test.tsx b/src/plugins/discover/public/application/components/table/table.test.tsx
index e61333cce1166..176a1961378aa 100644
--- a/src/plugins/discover/public/application/components/table/table.test.tsx
+++ b/src/plugins/discover/public/application/components/table/table.test.tsx
@@ -236,7 +236,7 @@ describe('DocViewTable at Discover Context', () => {
     const btn = findTestSubject(component, `collapseBtn`);
     const html = component.html();
 
-    expect(component.html()).toContain('truncate-by-height');
+    expect(component.html()).toContain('dscTruncateByHeight');
 
     expect(btn.length).toBe(1);
     btn.simulate('click');
diff --git a/src/plugins/discover/public/application/components/table/table_cell_value.tsx b/src/plugins/discover/public/application/components/table/table_cell_value.tsx
index e006de1cd7aeb..ebb4ea243fb25 100644
--- a/src/plugins/discover/public/application/components/table/table_cell_value.tsx
+++ b/src/plugins/discover/public/application/components/table/table_cell_value.tsx
@@ -104,7 +104,7 @@ export const TableFieldValue = ({
   const valueClassName = classNames({
     // eslint-disable-next-line @typescript-eslint/naming-convention
     kbnDocViewer__value: true,
-    'truncate-by-height': isCollapsible && isCollapsed,
+    dscTruncateByHeight: isCollapsible && isCollapsed,
   });
 
   const onToggleCollapse = () => setFieldOpen((fieldOpenPrev) => !fieldOpenPrev);
diff --git a/src/plugins/discover/public/application/discover_router.tsx b/src/plugins/discover/public/application/discover_router.tsx
index 320ce3e5f644a..b3fe36358bbd4 100644
--- a/src/plugins/discover/public/application/discover_router.tsx
+++ b/src/plugins/discover/public/application/discover_router.tsx
@@ -22,6 +22,7 @@ export const discoverRouter = (services: DiscoverServices, history: History) =>
     services,
     history,
   };
+
   return (
     <KibanaContextProvider services={services}>
       <Router history={history} data-test-subj="discover-react-router">
diff --git a/src/plugins/discover/public/application/helpers/truncate_styles.ts b/src/plugins/discover/public/application/helpers/truncate_styles.ts
new file mode 100644
index 0000000000000..dbe8b770e1793
--- /dev/null
+++ b/src/plugins/discover/public/application/helpers/truncate_styles.ts
@@ -0,0 +1,51 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import createCache from '@emotion/cache';
+import { cache } from '@emotion/css';
+import { serializeStyles } from '@emotion/serialize';
+
+/**
+ * The following emotion cache management was introduced here
+ * https://ntsim.uk/posts/how-to-update-or-remove-global-styles-in-emotion/
+ */
+const TRUNCATE_GRADIENT_HEIGHT = 15;
+const globalThemeCache = createCache({ key: 'truncation' });
+
+const buildStylesheet = (maxHeight: number) => {
+  return [
+    `
+    .dscTruncateByHeight {
+      overflow: hidden;
+      max-height: ${maxHeight}px !important;
+      display: inline-block;
+    }
+    .dscTruncateByHeight:before {
+      top: ${maxHeight - TRUNCATE_GRADIENT_HEIGHT}px;
+    }
+  `,
+  ];
+};
+
+const flushThemedGlobals = () => {
+  globalThemeCache.sheet.flush();
+  globalThemeCache.inserted = {};
+  globalThemeCache.registered = {};
+};
+
+export const injectTruncateStyles = (maxHeight: number) => {
+  if (maxHeight <= 0) {
+    flushThemedGlobals();
+    return;
+  }
+
+  const serialized = serializeStyles(buildStylesheet(maxHeight), cache.registered);
+  if (!globalThemeCache.inserted[serialized.name]) {
+    globalThemeCache.insert('', serialized, globalThemeCache.sheet, true);
+  }
+};
diff --git a/src/plugins/discover/public/index.ts b/src/plugins/discover/public/index.ts
index 21f1c31e774ee..cb7b29afe3f9a 100644
--- a/src/plugins/discover/public/index.ts
+++ b/src/plugins/discover/public/index.ts
@@ -9,22 +9,24 @@
 import { PluginInitializerContext } from 'kibana/public';
 import { DiscoverPlugin } from './plugin';
 
+export type { SavedSearch } from './saved_searches';
 export {
   getSavedSearch,
   getSavedSearchFullPathUrl,
   getSavedSearchUrl,
   getSavedSearchUrlConflictMessage,
   throwErrorOnSavedSearchUrlConflict,
-  SavedSearch,
 } from './saved_searches';
 
-export { DiscoverSetup, DiscoverStart } from './plugin';
+export type { DiscoverSetup, DiscoverStart } from './plugin';
 export function plugin(initializerContext: PluginInitializerContext) {
   return new DiscoverPlugin(initializerContext);
 }
 
-export { ISearchEmbeddable, SEARCH_EMBEDDABLE_TYPE, SearchInput } from './application/embeddable';
+export type { ISearchEmbeddable, SearchInput } from './application/embeddable';
+export { SEARCH_EMBEDDABLE_TYPE } from './application/embeddable';
 export { loadSharingDataHelpers } from './shared';
 
-export { DISCOVER_APP_URL_GENERATOR, DiscoverUrlGeneratorState } from './url_generator';
-export { DiscoverAppLocator, DiscoverAppLocatorParams } from './locator';
+export type { DiscoverUrlGeneratorState } from './url_generator';
+export { DISCOVER_APP_URL_GENERATOR } from './url_generator';
+export type { DiscoverAppLocator, DiscoverAppLocatorParams } from './locator';
diff --git a/src/plugins/discover/public/plugin.tsx b/src/plugins/discover/public/plugin.tsx
index c91bcf3897e14..62a5a7972a278 100644
--- a/src/plugins/discover/public/plugin.tsx
+++ b/src/plugins/discover/public/plugin.tsx
@@ -62,6 +62,8 @@ import { DeferredSpinner } from './shared';
 import { ViewSavedSearchAction } from './application/embeddable/view_saved_search_action';
 import type { SpacesPluginStart } from '../../../../x-pack/plugins/spaces/public';
 import { FieldFormatsStart } from '../../field_formats/public';
+import { injectTruncateStyles } from './application/helpers/truncate_styles';
+import { TRUNCATE_MAX_HEIGHT } from '../common';
 
 declare module '../../share/public' {
   export interface UrlGeneratorStateMapping {
@@ -413,6 +415,8 @@ export class DiscoverPlugin
     const services = buildServices(core, plugins, this.initializerContext);
     setServices(services);
 
+    injectTruncateStyles(services.uiSettings.get(TRUNCATE_MAX_HEIGHT));
+
     return {
       urlGenerator: this.urlGenerator,
       locator: this.locator,
diff --git a/src/plugins/discover/public/saved_searches/index.ts b/src/plugins/discover/public/saved_searches/index.ts
index da9dd047fb5ac..c41c92df30084 100644
--- a/src/plugins/discover/public/saved_searches/index.ts
+++ b/src/plugins/discover/public/saved_searches/index.ts
@@ -15,6 +15,7 @@ export {
 } from './saved_searches_utils';
 export { useSavedSearchAliasMatchRedirect } from './saved_search_alias_match_redirect';
 export { SavedSearchURLConflictCallout } from './saved_search_url_conflict_callout';
-export { saveSavedSearch, SaveSavedSearchOptions } from './save_saved_searches';
+export type { SaveSavedSearchOptions } from './save_saved_searches';
+export { saveSavedSearch } from './save_saved_searches';
 export { SAVED_SEARCH_TYPE } from './constants';
 export type { SavedSearch, SortOrder } from './types';
diff --git a/src/plugins/discover/server/ui_settings.ts b/src/plugins/discover/server/ui_settings.ts
index 529ba0d1beef1..df06260d45d21 100644
--- a/src/plugins/discover/server/ui_settings.ts
+++ b/src/plugins/discover/server/ui_settings.ts
@@ -26,6 +26,7 @@ import {
   SEARCH_FIELDS_FROM_SOURCE,
   MAX_DOC_FIELDS_DISPLAYED,
   SHOW_MULTIFIELDS,
+  TRUNCATE_MAX_HEIGHT,
   SHOW_FIELD_STATISTICS,
 } from '../common';
 
@@ -241,4 +242,16 @@ export const getUiSettings: () => Record<string, UiSettingsParams> = () => ({
     category: ['discover'],
     schema: schema.boolean(),
   },
+  [TRUNCATE_MAX_HEIGHT]: {
+    name: i18n.translate('discover.advancedSettings.params.maxCellHeightTitle', {
+      defaultMessage: 'Maximum table cell height',
+    }),
+    value: 115,
+    category: ['discover'],
+    description: i18n.translate('discover.advancedSettings.params.maxCellHeightText', {
+      defaultMessage:
+        'The maximum height that a cell in a table should occupy. Set to 0 to disable truncation',
+    }),
+    schema: schema.number({ min: 0 }),
+  },
 });
diff --git a/src/plugins/embeddable/public/index.ts b/src/plugins/embeddable/public/index.ts
index 80171e1ad2fab..6a6b5b2df2ddd 100644
--- a/src/plugins/embeddable/public/index.ts
+++ b/src/plugins/embeddable/public/index.ts
@@ -11,76 +11,78 @@ import './index.scss';
 import { PluginInitializerContext } from 'src/core/public';
 import { EmbeddablePublicPlugin } from './plugin';
 
-export {
-  ACTION_ADD_PANEL,
-  ACTION_EDIT_PANEL,
+export type {
   Adapters,
-  AddPanelAction,
   ReferenceOrValueEmbeddable,
-  isReferenceOrValueEmbeddable,
   ChartActionContext,
-  Container,
   ContainerInput,
   ContainerOutput,
-  CONTEXT_MENU_TRIGGER,
-  contextMenuTrigger,
-  defaultEmbeddableFactoryProvider,
-  EditPanelAction,
-  Embeddable,
-  EmbeddableChildPanel,
   EmbeddableChildPanelProps,
   EmbeddableContext,
   EmbeddableFactory,
   EmbeddableFactoryDefinition,
-  EmbeddableFactoryNotFoundError,
   EmbeddableInput,
   EmbeddableInstanceConfiguration,
   EmbeddableOutput,
-  EmbeddablePanel,
-  EmbeddableRoot,
   ValueClickContext,
   RangeSelectContext,
-  ErrorEmbeddable,
   IContainer,
   IEmbeddable,
+  OutputSpec,
+  PanelState,
+  PropertySpec,
+  SavedObjectEmbeddableInput,
+  EmbeddableEditorState,
+  EmbeddablePackageState,
+  EmbeddableRendererProps,
+} from './lib';
+export {
+  ACTION_ADD_PANEL,
+  ACTION_EDIT_PANEL,
+  AddPanelAction,
+  isReferenceOrValueEmbeddable,
+  Container,
+  CONTEXT_MENU_TRIGGER,
+  contextMenuTrigger,
+  defaultEmbeddableFactoryProvider,
+  EditPanelAction,
+  Embeddable,
+  EmbeddableChildPanel,
+  EmbeddableFactoryNotFoundError,
+  EmbeddablePanel,
+  EmbeddableRoot,
+  ErrorEmbeddable,
   isEmbeddable,
   isErrorEmbeddable,
   openAddPanelFlyout,
-  OutputSpec,
   PANEL_BADGE_TRIGGER,
   panelBadgeTrigger,
   PANEL_NOTIFICATION_TRIGGER,
   panelNotificationTrigger,
   PanelNotFoundError,
-  PanelState,
-  PropertySpec,
   SELECT_RANGE_TRIGGER,
   VALUE_CLICK_TRIGGER,
   ViewMode,
   withEmbeddableSubscription,
-  SavedObjectEmbeddableInput,
   isSavedObjectEmbeddableInput,
   isRangeSelectTriggerContext,
   isValueClickTriggerContext,
   isRowClickTriggerContext,
   isContextMenuTriggerContext,
   EmbeddableStateTransfer,
-  EmbeddableEditorState,
-  EmbeddablePackageState,
   EmbeddableRenderer,
-  EmbeddableRendererProps,
   useEmbeddableFactory,
 } from './lib';
 
 export { AttributeService, ATTRIBUTE_SERVICE_KEY } from './lib/attribute_service';
 
-export { EnhancementRegistryDefinition } from './types';
+export type { EnhancementRegistryDefinition } from './types';
 
 export function plugin(initializerContext: PluginInitializerContext) {
   return new EmbeddablePublicPlugin(initializerContext);
 }
 
-export {
+export type {
   EmbeddableSetup,
   EmbeddableStart,
   EmbeddableSetupDependencies,
diff --git a/src/plugins/embeddable/public/lib/containers/i_container.ts b/src/plugins/embeddable/public/lib/containers/i_container.ts
index f68a3ada33c07..c4593cac4969a 100644
--- a/src/plugins/embeddable/public/lib/containers/i_container.ts
+++ b/src/plugins/embeddable/public/lib/containers/i_container.ts
@@ -15,7 +15,7 @@ import {
 } from '../embeddables';
 import { PanelState } from '../../../common/types';
 
-export { PanelState };
+export type { PanelState };
 
 export interface ContainerOutput extends EmbeddableOutput {
   embeddableLoaded: { [key: string]: boolean };
diff --git a/src/plugins/embeddable/public/lib/containers/index.ts b/src/plugins/embeddable/public/lib/containers/index.ts
index cc2c0bfa58223..041923188e175 100644
--- a/src/plugins/embeddable/public/lib/containers/index.ts
+++ b/src/plugins/embeddable/public/lib/containers/index.ts
@@ -6,6 +6,6 @@
  * Side Public License, v 1.
  */
 
-export { IContainer, PanelState, ContainerInput, ContainerOutput } from './i_container';
+export type { IContainer, PanelState, ContainerInput, ContainerOutput } from './i_container';
 export { Container } from './container';
 export * from './embeddable_child_panel';
diff --git a/src/plugins/embeddable/public/lib/embeddables/i_embeddable.ts b/src/plugins/embeddable/public/lib/embeddables/i_embeddable.ts
index bbac617d41590..b53f036024259 100644
--- a/src/plugins/embeddable/public/lib/embeddables/i_embeddable.ts
+++ b/src/plugins/embeddable/public/lib/embeddables/i_embeddable.ts
@@ -16,7 +16,7 @@ export interface EmbeddableError {
   message: string;
 }
 
-export { EmbeddableInput };
+export type { EmbeddableInput };
 
 export interface EmbeddableOutput {
   // Whether the embeddable is actively loading.
diff --git a/src/plugins/embeddable/public/lib/embeddables/index.ts b/src/plugins/embeddable/public/lib/embeddables/index.ts
index eede745f31794..1745c64c73bf5 100644
--- a/src/plugins/embeddable/public/lib/embeddables/index.ts
+++ b/src/plugins/embeddable/public/lib/embeddables/index.ts
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-export { EmbeddableOutput, EmbeddableInput, IEmbeddable } from './i_embeddable';
+export type { EmbeddableOutput, EmbeddableInput, IEmbeddable } from './i_embeddable';
 export { isEmbeddable } from './is_embeddable';
 export { Embeddable } from './embeddable';
 export * from './embeddable_factory';
@@ -16,8 +16,5 @@ export { ErrorEmbeddable, isErrorEmbeddable } from './error_embeddable';
 export { withEmbeddableSubscription } from './with_subscription';
 export { EmbeddableRoot } from './embeddable_root';
 export * from '../../../common/lib/saved_object_embeddable';
-export {
-  EmbeddableRenderer,
-  EmbeddableRendererProps,
-  useEmbeddableFactory,
-} from './embeddable_renderer';
+export type { EmbeddableRendererProps } from './embeddable_renderer';
+export { EmbeddableRenderer, useEmbeddableFactory } from './embeddable_renderer';
diff --git a/src/plugins/embeddable/public/lib/reference_or_value_embeddable/index.ts b/src/plugins/embeddable/public/lib/reference_or_value_embeddable/index.ts
index a448eb1319ab4..41554e8efce1d 100644
--- a/src/plugins/embeddable/public/lib/reference_or_value_embeddable/index.ts
+++ b/src/plugins/embeddable/public/lib/reference_or_value_embeddable/index.ts
@@ -6,4 +6,5 @@
  * Side Public License, v 1.
  */
 
-export { ReferenceOrValueEmbeddable, isReferenceOrValueEmbeddable } from './types';
+export type { ReferenceOrValueEmbeddable } from './types';
+export { isReferenceOrValueEmbeddable } from './types';
diff --git a/src/plugins/embeddable/public/lib/state_transfer/index.ts b/src/plugins/embeddable/public/lib/state_transfer/index.ts
index 6643f048d6425..009b2994f9caa 100644
--- a/src/plugins/embeddable/public/lib/state_transfer/index.ts
+++ b/src/plugins/embeddable/public/lib/state_transfer/index.ts
@@ -7,4 +7,4 @@
  */
 
 export { EmbeddableStateTransfer } from './embeddable_state_transfer';
-export { EmbeddableEditorState, EmbeddablePackageState } from './types';
+export type { EmbeddableEditorState, EmbeddablePackageState } from './types';
diff --git a/src/plugins/embeddable/public/lib/types.ts b/src/plugins/embeddable/public/lib/types.ts
index 2def03c742e7b..d22bcbd12bef9 100644
--- a/src/plugins/embeddable/public/lib/types.ts
+++ b/src/plugins/embeddable/public/lib/types.ts
@@ -22,4 +22,4 @@ export interface PropertySpec {
   value?: string;
 }
 export { ViewMode } from '../../common/types';
-export { Adapters };
+export type { Adapters };
diff --git a/src/plugins/embeddable/server/index.ts b/src/plugins/embeddable/server/index.ts
index aac081f9467b6..8d88f35a4be22 100644
--- a/src/plugins/embeddable/server/index.ts
+++ b/src/plugins/embeddable/server/index.ts
@@ -8,8 +8,8 @@
 
 import { EmbeddableServerPlugin, EmbeddableSetup, EmbeddableStart } from './plugin';
 
-export { EmbeddableSetup, EmbeddableStart };
+export type { EmbeddableSetup, EmbeddableStart };
 
-export { EnhancementRegistryDefinition, EmbeddableRegistryDefinition } from './types';
+export type { EnhancementRegistryDefinition, EmbeddableRegistryDefinition } from './types';
 
 export const plugin = () => new EmbeddableServerPlugin();
diff --git a/src/plugins/es_ui_shared/__packages_do_not_import__/authorization/components/index.ts b/src/plugins/es_ui_shared/__packages_do_not_import__/authorization/components/index.ts
index 75d79a204f141..a43e7c1b31e45 100644
--- a/src/plugins/es_ui_shared/__packages_do_not_import__/authorization/components/index.ts
+++ b/src/plugins/es_ui_shared/__packages_do_not_import__/authorization/components/index.ts
@@ -6,11 +6,11 @@
  * Side Public License, v 1.
  */
 
+export type { Authorization } from './authorization_provider';
 export {
   AuthorizationProvider,
   AuthorizationContext,
   useAuthorizationContext,
-  Authorization,
 } from './authorization_provider';
 
 export { WithPrivileges } from './with_privileges';
diff --git a/src/plugins/es_ui_shared/__packages_do_not_import__/authorization/index.ts b/src/plugins/es_ui_shared/__packages_do_not_import__/authorization/index.ts
index 9ccbc5a5cd3df..57d5cd88d3e4a 100644
--- a/src/plugins/es_ui_shared/__packages_do_not_import__/authorization/index.ts
+++ b/src/plugins/es_ui_shared/__packages_do_not_import__/authorization/index.ts
@@ -6,6 +6,7 @@
  * Side Public License, v 1.
  */
 
+export type { Authorization } from './components';
 export {
   WithPrivileges,
   NotAuthorizedSection,
@@ -14,7 +15,6 @@ export {
   SectionError,
   PageError,
   useAuthorizationContext,
-  Authorization,
 } from './components';
 
-export { Privileges, MissingPrivileges, Error } from './types';
+export type { Privileges, MissingPrivileges, Error } from './types';
diff --git a/src/plugins/es_ui_shared/common/index.ts b/src/plugins/es_ui_shared/common/index.ts
index 1c2955b8e5e28..4f0185ba110d9 100644
--- a/src/plugins/es_ui_shared/common/index.ts
+++ b/src/plugins/es_ui_shared/common/index.ts
@@ -6,4 +6,7 @@
  * Side Public License, v 1.
  */
 
-export { Privileges, MissingPrivileges } from '../__packages_do_not_import__/authorization/types';
+export type {
+  Privileges,
+  MissingPrivileges,
+} from '../__packages_do_not_import__/authorization/types';
diff --git a/src/plugins/es_ui_shared/public/authorization/index.ts b/src/plugins/es_ui_shared/public/authorization/index.ts
index b8fb2f45794ee..8175d6b80d298 100644
--- a/src/plugins/es_ui_shared/public/authorization/index.ts
+++ b/src/plugins/es_ui_shared/public/authorization/index.ts
@@ -6,16 +6,18 @@
  * Side Public License, v 1.
  */
 
+export type {
+  Error,
+  MissingPrivileges,
+  Privileges,
+  Authorization,
+} from '../../__packages_do_not_import__/authorization';
 export {
   AuthorizationContext,
   AuthorizationProvider,
-  Error,
-  MissingPrivileges,
   NotAuthorizedSection,
-  Privileges,
   SectionError,
   PageError,
   useAuthorizationContext,
   WithPrivileges,
-  Authorization,
 } from '../../__packages_do_not_import__/authorization';
diff --git a/src/plugins/es_ui_shared/public/components/cron_editor/index.ts b/src/plugins/es_ui_shared/public/components/cron_editor/index.ts
index 88176c429fcf3..bee0bc412fb55 100644
--- a/src/plugins/es_ui_shared/public/components/cron_editor/index.ts
+++ b/src/plugins/es_ui_shared/public/components/cron_editor/index.ts
@@ -6,5 +6,5 @@
  * Side Public License, v 1.
  */
 
-export { Frequency } from './types';
+export type { Frequency } from './types';
 export { CronEditor } from './cron_editor';
diff --git a/src/plugins/es_ui_shared/public/components/cron_editor/services/index.ts b/src/plugins/es_ui_shared/public/components/cron_editor/services/index.ts
index 85d650994b33c..8988c640cd09e 100644
--- a/src/plugins/es_ui_shared/public/components/cron_editor/services/index.ts
+++ b/src/plugins/es_ui_shared/public/components/cron_editor/services/index.ts
@@ -7,10 +7,5 @@
  */
 
 export { cronExpressionToParts, cronPartsToExpression } from './cron';
-export {
-  getOrdinalValue,
-  getDayName,
-  getMonthName,
-  DayOrdinal,
-  MonthOrdinal,
-} from './humanized_numbers';
+export type { DayOrdinal, MonthOrdinal } from './humanized_numbers';
+export { getOrdinalValue, getDayName, getMonthName } from './humanized_numbers';
diff --git a/src/plugins/es_ui_shared/public/components/json_editor/index.ts b/src/plugins/es_ui_shared/public/components/json_editor/index.ts
index bf7697523d3fe..f31f586f1033e 100644
--- a/src/plugins/es_ui_shared/public/components/json_editor/index.ts
+++ b/src/plugins/es_ui_shared/public/components/json_editor/index.ts
@@ -8,4 +8,4 @@
 
 export * from './json_editor';
 
-export { OnJsonEditorUpdateHandler, JsonEditorState } from './use_json';
+export type { OnJsonEditorUpdateHandler, JsonEditorState } from './use_json';
diff --git a/src/plugins/es_ui_shared/public/forms/form_wizard/index.ts b/src/plugins/es_ui_shared/public/forms/form_wizard/index.ts
index 6c4912f7e4b33..0f868712553c7 100644
--- a/src/plugins/es_ui_shared/public/forms/form_wizard/index.ts
+++ b/src/plugins/es_ui_shared/public/forms/form_wizard/index.ts
@@ -10,12 +10,12 @@ export { FormWizard } from './form_wizard';
 
 export { FormWizardStep } from './form_wizard_step';
 
+export type { Step, Steps } from './form_wizard_context';
 export {
   FormWizardProvider,
   FormWizardConsumer,
   useFormWizardContext,
-  Step,
-  Steps,
 } from './form_wizard_context';
 
-export { FormWizardNav, NavTexts } from './form_wizard_nav';
+export type { NavTexts } from './form_wizard_nav';
+export { FormWizardNav } from './form_wizard_nav';
diff --git a/src/plugins/es_ui_shared/public/forms/multi_content/index.ts b/src/plugins/es_ui_shared/public/forms/multi_content/index.ts
index 76ff8a9ff3066..bae46ad0abfd8 100644
--- a/src/plugins/es_ui_shared/public/forms/multi_content/index.ts
+++ b/src/plugins/es_ui_shared/public/forms/multi_content/index.ts
@@ -13,6 +13,7 @@ export {
   useContent,
 } from './multi_content_context';
 
-export { useMultiContent, HookProps, Content, MultiContent } from './use_multi_content';
+export type { HookProps, Content, MultiContent } from './use_multi_content';
+export { useMultiContent } from './use_multi_content';
 
 export { WithMultiContent } from './with_multi_content';
diff --git a/src/plugins/es_ui_shared/public/index.ts b/src/plugins/es_ui_shared/public/index.ts
index 2dc50536ca631..c21587c9a6040 100644
--- a/src/plugins/es_ui_shared/public/index.ts
+++ b/src/plugins/es_ui_shared/public/index.ts
@@ -15,37 +15,36 @@ import * as ace from './ace';
 import * as GlobalFlyout from './global_flyout';
 import * as XJson from './xjson';
 
-export { JsonEditor, OnJsonEditorUpdateHandler, JsonEditorState } from './components/json_editor';
+export type { OnJsonEditorUpdateHandler, JsonEditorState } from './components/json_editor';
+export { JsonEditor } from './components/json_editor';
 
 export { PageLoading } from './components/page_loading';
 export { SectionLoading } from './components/section_loading';
 
-export { EuiCodeEditor, EuiCodeEditorProps } from './components/code_editor';
-export { Frequency, CronEditor } from './components/cron_editor';
+export type { EuiCodeEditorProps } from './components/code_editor';
+export { EuiCodeEditor } from './components/code_editor';
+export type { Frequency } from './components/cron_editor';
+export { CronEditor } from './components/cron_editor';
 
-export {
+export type {
   SendRequestConfig,
   SendRequestResponse,
   UseRequestConfig,
   UseRequestResponse,
-  sendRequest,
-  useRequest,
 } from './request';
+export { sendRequest, useRequest } from './request';
 
 export { indices } from './indices';
 
+export type { Privileges, MissingPrivileges, Error, Authorization } from './authorization';
 export {
   AuthorizationContext,
   AuthorizationProvider,
   NotAuthorizedSection,
   WithPrivileges,
-  Privileges,
-  MissingPrivileges,
   SectionError,
   PageError,
-  Error,
   useAuthorizationContext,
-  Authorization,
 } from './authorization';
 
 export { Forms, ace, GlobalFlyout, XJson };
diff --git a/src/plugins/es_ui_shared/public/request/index.ts b/src/plugins/es_ui_shared/public/request/index.ts
index da407d0013037..5cfcc77f8e117 100644
--- a/src/plugins/es_ui_shared/public/request/index.ts
+++ b/src/plugins/es_ui_shared/public/request/index.ts
@@ -6,5 +6,7 @@
  * Side Public License, v 1.
  */
 
-export { SendRequestConfig, SendRequestResponse, sendRequest } from './send_request';
-export { UseRequestConfig, UseRequestResponse, useRequest } from './use_request';
+export type { SendRequestConfig, SendRequestResponse } from './send_request';
+export { sendRequest } from './send_request';
+export type { UseRequestConfig, UseRequestResponse } from './use_request';
+export { useRequest } from './use_request';
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/index.ts b/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/index.ts
index 8438e5de871bd..6f2dc768508ec 100644
--- a/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/index.ts
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/index.ts
@@ -6,7 +6,8 @@
  * Side Public License, v 1.
  */
 
-export { useField, InternalFieldConfig } from './use_field';
+export type { InternalFieldConfig } from './use_field';
+export { useField } from './use_field';
 export { useForm } from './use_form';
 export { useFormData } from './use_form_data';
 export { useFormIsModified } from './use_form_is_modified';
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/lib/index.ts b/src/plugins/es_ui_shared/static/forms/hook_form_lib/lib/index.ts
index 79d1067cd36b2..0bbaedcf2e90e 100644
--- a/src/plugins/es_ui_shared/static/forms/hook_form_lib/lib/index.ts
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/lib/index.ts
@@ -6,5 +6,6 @@
  * Side Public License, v 1.
  */
 
-export { Subject, Subscription } from './subject';
+export type { Subscription } from './subject';
+export { Subject } from './subject';
 export * from './utils';
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/shared_imports.ts b/src/plugins/es_ui_shared/static/forms/hook_form_lib/shared_imports.ts
index c57333d788ef5..cd9bb97cab8d9 100644
--- a/src/plugins/es_ui_shared/static/forms/hook_form_lib/shared_imports.ts
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/shared_imports.ts
@@ -7,7 +7,9 @@
  */
 
 // eslint-disable-next-line import/no-extraneous-dependencies
-export { registerTestBed, TestBed } from '@kbn/test/jest';
+export type { TestBed } from '@kbn/test/jest';
+// eslint-disable-next-line import/no-extraneous-dependencies
+export { registerTestBed } from '@kbn/test/jest';
 
 // eslint-disable-next-line import/no-extraneous-dependencies
 export { getRandomString } from '@kbn/test/jest';
diff --git a/src/plugins/expressions/common/expression_functions/specs/index.ts b/src/plugins/expressions/common/expression_functions/specs/index.ts
index de9a1dedd8248..0e473e4a79e5a 100644
--- a/src/plugins/expressions/common/expression_functions/specs/index.ts
+++ b/src/plugins/expressions/common/expression_functions/specs/index.ts
@@ -17,6 +17,9 @@ export * from './overall_metric';
 export * from './derivative';
 export * from './moving_average';
 export * from './ui_setting';
-export { mapColumn, MapColumnArguments } from './map_column';
-export { math, MathArguments, MathInput } from './math';
-export { mathColumn, MathColumnArguments } from './math_column';
+export type { MapColumnArguments } from './map_column';
+export { mapColumn } from './map_column';
+export type { MathArguments, MathInput } from './math';
+export { math } from './math';
+export type { MathColumnArguments } from './math_column';
+export { mathColumn } from './math_column';
diff --git a/src/plugins/expressions/common/types/index.ts b/src/plugins/expressions/common/types/index.ts
index 00a79289c0b5f..a7fc51d88c236 100644
--- a/src/plugins/expressions/common/types/index.ts
+++ b/src/plugins/expressions/common/types/index.ts
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-export { TypeToString, KnownTypeToString, TypeString, UnmappedTypeStrings } from './common';
+export type { TypeToString, KnownTypeToString, TypeString, UnmappedTypeStrings } from './common';
 
 export * from './style';
 export * from './registry';
diff --git a/src/plugins/expressions/server/index.ts b/src/plugins/expressions/server/index.ts
index 7c0662ad54e4b..db94ed6dbd440 100644
--- a/src/plugins/expressions/server/index.ts
+++ b/src/plugins/expressions/server/index.ts
@@ -12,7 +12,7 @@
 import { PluginInitializerContext } from 'src/core/server';
 import { ExpressionsServerPlugin } from './plugin';
 
-export { ExpressionsServerSetup, ExpressionsServerStart } from './plugin';
+export type { ExpressionsServerSetup, ExpressionsServerStart } from './plugin';
 
 // Kibana Platform.
 export { ExpressionsServerPlugin as Plugin };
@@ -22,22 +22,18 @@ export function plugin(initializerContext: PluginInitializerContext) {
 }
 
 // Static exports.
-export {
+export type {
   AnyExpressionFunctionDefinition,
   AnyExpressionTypeDefinition,
   ArgumentType,
-  buildExpression,
-  buildExpressionFunction,
   Datatable,
   DatatableColumn,
   DatatableColumnType,
   DatatableRow,
-  Execution,
   ExecutionContainer,
   ExecutionContext,
   ExecutionParams,
   ExecutionState,
-  Executor,
   ExecutorContainer,
   ExecutorState,
   ExpressionAstArgument,
@@ -46,15 +42,10 @@ export {
   ExpressionAstFunction,
   ExpressionAstFunctionBuilder,
   ExpressionAstNode,
-  ExpressionFunction,
   ExpressionFunctionDefinition,
   ExpressionFunctionDefinitions,
-  ExpressionFunctionParameter,
   ExpressionImage,
   ExpressionRenderDefinition,
-  ExpressionRenderer,
-  ExpressionRendererRegistry,
-  ExpressionType,
   ExpressionTypeDefinition,
   ExpressionTypeStyle,
   ExpressionValue,
@@ -67,20 +58,11 @@ export {
   ExpressionValueFilter,
   Font,
   FontLabel,
-  FontStyle,
   FontValue,
-  FontWeight,
-  format,
-  formatExpression,
-  FunctionsRegistry,
   IInterpreterRenderHandlers,
   InterpreterErrorType,
   IRegistry,
-  isExpressionAstBuilder,
   KnownTypeToString,
-  Overflow,
-  parse,
-  parseExpression,
   PointSeries,
   PointSeriesColumn,
   PointSeriesColumnName,
@@ -89,11 +71,31 @@ export {
   Range,
   SerializedDatatable,
   Style,
-  TextAlignment,
-  TextDecoration,
-  TypesRegistry,
   TypeString,
   TypeToString,
   UnmappedTypeStrings,
   ExpressionValueRender as Render,
 } from '../common';
+export {
+  buildExpression,
+  buildExpressionFunction,
+  Execution,
+  Executor,
+  ExpressionFunction,
+  ExpressionFunctionParameter,
+  ExpressionRenderer,
+  ExpressionRendererRegistry,
+  ExpressionType,
+  FontStyle,
+  FontWeight,
+  format,
+  formatExpression,
+  FunctionsRegistry,
+  isExpressionAstBuilder,
+  Overflow,
+  parse,
+  parseExpression,
+  TextAlignment,
+  TextDecoration,
+  TypesRegistry,
+} from '../common';
diff --git a/src/plugins/field_formats/common/index.ts b/src/plugins/field_formats/common/index.ts
index aeb5e0af220db..092fc49af3d28 100644
--- a/src/plugins/field_formats/common/index.ts
+++ b/src/plugins/field_formats/common/index.ts
@@ -12,7 +12,8 @@ import { FieldFormatsRegistry } from './field_formats_registry';
 /** @public */
 type IFieldFormatsRegistry = PublicMethodsOf<FieldFormatsRegistry>;
 
-export { FieldFormatsRegistry, IFieldFormatsRegistry };
+export type { IFieldFormatsRegistry };
+export { FieldFormatsRegistry };
 export { FieldFormat } from './field_format';
 export { baseFormatters } from './constants/base_formatters';
 export {
@@ -24,7 +25,6 @@ export {
   NumberFormat,
   PercentFormat,
   RelativeDateFormat,
-  SourceFormat,
   StaticLookupFormat,
   UrlFormat,
   StringFormat,
@@ -39,7 +39,7 @@ export { FORMATS_UI_SETTINGS } from './constants/ui_settings';
 export { FIELD_FORMAT_IDS } from './types';
 export { HTML_CONTEXT_TYPE, TEXT_CONTEXT_TYPE } from './content_types';
 
-export {
+export type {
   FieldFormatsGetConfigFn,
   FieldFormatsContentType,
   FieldFormatConfig,
diff --git a/src/plugins/field_formats/public/index.ts b/src/plugins/field_formats/public/index.ts
index f765513fb4c4c..f4f7019fe772d 100755
--- a/src/plugins/field_formats/public/index.ts
+++ b/src/plugins/field_formats/public/index.ts
@@ -12,4 +12,4 @@ export { DateFormat, DateNanosFormat } from './lib/converters';
 export function plugin() {
   return new FieldFormatsPlugin();
 }
-export { FieldFormatsSetup, FieldFormatsStart } from './plugin';
+export type { FieldFormatsSetup, FieldFormatsStart } from './plugin';
diff --git a/src/plugins/field_formats/server/index.ts b/src/plugins/field_formats/server/index.ts
index 44de8fde558ec..d3cac3bfb00c2 100755
--- a/src/plugins/field_formats/server/index.ts
+++ b/src/plugins/field_formats/server/index.ts
@@ -14,4 +14,4 @@ export function plugin(initializerContext: PluginInitializerContext) {
   return new FieldFormatsPlugin(initializerContext);
 }
 
-export { FieldFormatsSetup, FieldFormatsStart } from './types';
+export type { FieldFormatsSetup, FieldFormatsStart } from './types';
diff --git a/src/plugins/index_pattern_editor/public/components/index.ts b/src/plugins/index_pattern_editor/public/components/index.ts
index c32c4081e973f..b78ac6946ad94 100644
--- a/src/plugins/index_pattern_editor/public/components/index.ts
+++ b/src/plugins/index_pattern_editor/public/components/index.ts
@@ -6,10 +6,8 @@
  * Side Public License, v 1.
  */
 
-export {
-  IndexPatternEditorFlyoutContent,
-  Props as IndexPatternEditorFlyoutContentProps,
-} from './index_pattern_editor_flyout_content';
+export type { Props as IndexPatternEditorFlyoutContentProps } from './index_pattern_editor_flyout_content';
+export { IndexPatternEditorFlyoutContent } from './index_pattern_editor_flyout_content';
 
 export { IndexPatternEditor } from './index_pattern_editor';
 
diff --git a/src/plugins/index_pattern_editor/public/shared_imports.ts b/src/plugins/index_pattern_editor/public/shared_imports.ts
index c99d32e0c8a28..7edb7dfd0f599 100644
--- a/src/plugins/index_pattern_editor/public/shared_imports.ts
+++ b/src/plugins/index_pattern_editor/public/shared_imports.ts
@@ -6,14 +6,13 @@
  * Side Public License, v 1.
  */
 
-export {
-  IndexPattern,
-  IndexPatternField,
+export type {
   DataPublicPluginStart,
   IndexPatternSpec,
   GetFieldsOptions,
   IndexPatternAggRestrictions,
 } from '../../data/public';
+export { IndexPattern, IndexPatternField } from '../../data/public';
 
 export {
   createKibanaReactContext,
@@ -22,18 +21,20 @@ export {
   useKibana,
 } from '../../kibana_react/public';
 
+export type {
+  FormSchema,
+  FormHook,
+  ValidationFunc,
+  FieldConfig,
+  ValidationConfig,
+} from '../../es_ui_shared/static/forms/hook_form_lib';
 export {
   useForm,
   useFormData,
   useFormContext,
   Form,
-  FormSchema,
   UseField,
-  FormHook,
-  ValidationFunc,
-  FieldConfig,
   getFieldValidityAndErrorMessage,
-  ValidationConfig,
 } from '../../es_ui_shared/static/forms/hook_form_lib';
 
 export { fieldValidators } from '../../es_ui_shared/static/forms/helpers';
@@ -47,4 +48,4 @@ export {
   SuperSelectField,
 } from '../../es_ui_shared/static/forms/components';
 
-export { HttpStart } from '../../../core/public';
+export type { HttpStart } from '../../../core/public';
diff --git a/src/plugins/index_pattern_editor/public/test_utils/test_utils.ts b/src/plugins/index_pattern_editor/public/test_utils/test_utils.ts
index c8e4aedc26471..311d93d31b593 100644
--- a/src/plugins/index_pattern_editor/public/test_utils/test_utils.ts
+++ b/src/plugins/index_pattern_editor/public/test_utils/test_utils.ts
@@ -8,4 +8,5 @@
 
 export { getRandomString } from '@kbn/test/jest';
 
-export { registerTestBed, TestBed } from '@kbn/test/jest';
+export type { TestBed } from '@kbn/test/jest';
+export { registerTestBed } from '@kbn/test/jest';
diff --git a/src/plugins/index_pattern_field_editor/__jest__/client_integration/helpers/index.ts b/src/plugins/index_pattern_field_editor/__jest__/client_integration/helpers/index.ts
index 6a1f1aa74036a..e8ff7eb7538f2 100644
--- a/src/plugins/index_pattern_field_editor/__jest__/client_integration/helpers/index.ts
+++ b/src/plugins/index_pattern_field_editor/__jest__/client_integration/helpers/index.ts
@@ -6,7 +6,8 @@
  * Side Public License, v 1.
  */
 
-export { findTestSubject, TestBed } from '@kbn/test/jest';
+export type { TestBed } from '@kbn/test/jest';
+export { findTestSubject } from '@kbn/test/jest';
 
 export {
   setupEnvironment,
diff --git a/src/plugins/index_pattern_field_editor/kibana.json b/src/plugins/index_pattern_field_editor/kibana.json
index 898e7c564e57f..df09fd56136c3 100644
--- a/src/plugins/index_pattern_field_editor/kibana.json
+++ b/src/plugins/index_pattern_field_editor/kibana.json
@@ -5,7 +5,7 @@
   "ui": true,
   "requiredPlugins": ["data"],
   "optionalPlugins": ["usageCollection"],
-  "requiredBundles": ["kibanaReact", "esUiShared", "usageCollection", "fieldFormats"],
+  "requiredBundles": ["kibanaReact", "esUiShared", "fieldFormats"],
   "owner": {
     "name": "App Services",
     "githubTeam": "kibana-app-services"
diff --git a/src/plugins/index_pattern_field_editor/public/components/field_editor/form_fields/index.ts b/src/plugins/index_pattern_field_editor/public/components/field_editor/form_fields/index.ts
index e958e1362bb05..693709729ed92 100644
--- a/src/plugins/index_pattern_field_editor/public/components/field_editor/form_fields/index.ts
+++ b/src/plugins/index_pattern_field_editor/public/components/field_editor/form_fields/index.ts
@@ -12,6 +12,7 @@ export { CustomLabelField } from './custom_label_field';
 
 export { PopularityField } from './popularity_field';
 
-export { ScriptField, ScriptSyntaxError } from './script_field';
+export type { ScriptSyntaxError } from './script_field';
+export { ScriptField } from './script_field';
 
 export { FormatField } from './format_field';
diff --git a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/default/index.ts b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/default/index.ts
index 31d7e95897090..4cadb6e837620 100644
--- a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/default/index.ts
+++ b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/editors/default/index.ts
@@ -9,7 +9,8 @@
 import { FieldFormatEditorFactory } from '../types';
 import { formatId } from './constants';
 
-export { defaultState, FormatEditorState } from './default';
+export type { FormatEditorState } from './default';
+export { defaultState } from './default';
 export type { FormatEditorProps } from '../types';
 export type { DefaultFormatEditor } from './default';
 
diff --git a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/index.ts b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/index.ts
index 34619f53e9eed..0c23c8de616cf 100644
--- a/src/plugins/index_pattern_field_editor/public/components/field_format_editor/index.ts
+++ b/src/plugins/index_pattern_field_editor/public/components/field_format_editor/index.ts
@@ -6,5 +6,6 @@
  * Side Public License, v 1.
  */
 
-export { FormatSelectEditor, FormatSelectEditorProps } from './field_format_editor';
+export type { FormatSelectEditorProps } from './field_format_editor';
+export { FormatSelectEditor } from './field_format_editor';
 export * from './editors';
diff --git a/src/plugins/index_pattern_field_editor/public/components/index.ts b/src/plugins/index_pattern_field_editor/public/components/index.ts
index 927e28a8e3adf..e6fa42a591f5e 100644
--- a/src/plugins/index_pattern_field_editor/public/components/index.ts
+++ b/src/plugins/index_pattern_field_editor/public/components/index.ts
@@ -6,6 +6,7 @@
  * Side Public License, v 1.
  */
 
-export { getDeleteFieldProvider, Props as DeleteFieldProviderProps } from './delete_field_provider';
+export type { Props as DeleteFieldProviderProps } from './delete_field_provider';
+export { getDeleteFieldProvider } from './delete_field_provider';
 
 export * from './field_format_editor';
diff --git a/src/plugins/index_pattern_field_editor/public/index.ts b/src/plugins/index_pattern_field_editor/public/index.ts
index 6546dabcb2c44..55af27fdb29eb 100644
--- a/src/plugins/index_pattern_field_editor/public/index.ts
+++ b/src/plugins/index_pattern_field_editor/public/index.ts
@@ -25,7 +25,7 @@ export type {
   PluginStart as IndexPatternFieldEditorStart,
 } from './types';
 export { DefaultFormatEditor } from './components/field_format_editor/editors/default/default';
-export { FieldFormatEditorFactory, FieldFormatEditor, FormatEditorProps } from './components';
+export type { FieldFormatEditorFactory, FieldFormatEditor, FormatEditorProps } from './components';
 
 export function plugin() {
   return new IndexPatternFieldEditorPlugin();
diff --git a/src/plugins/index_pattern_field_editor/public/lib/index.ts b/src/plugins/index_pattern_field_editor/public/lib/index.ts
index 336de9574c460..d9aaab77ff66a 100644
--- a/src/plugins/index_pattern_field_editor/public/lib/index.ts
+++ b/src/plugins/index_pattern_field_editor/public/lib/index.ts
@@ -10,10 +10,8 @@ export { deserializeField } from './serialization';
 
 export { getLinks } from './documentation';
 
-export {
-  getRuntimeFieldValidator,
-  RuntimeFieldPainlessError,
-  parseEsError,
-} from './runtime_field_validation';
+export type { RuntimeFieldPainlessError } from './runtime_field_validation';
+export { getRuntimeFieldValidator, parseEsError } from './runtime_field_validation';
 
-export { initApi, ApiService } from './api';
+export type { ApiService } from './api';
+export { initApi } from './api';
diff --git a/src/plugins/index_pattern_field_editor/public/shared_imports.ts b/src/plugins/index_pattern_field_editor/public/shared_imports.ts
index 2827928d1c060..e2154800908cb 100644
--- a/src/plugins/index_pattern_field_editor/public/shared_imports.ts
+++ b/src/plugins/index_pattern_field_editor/public/shared_imports.ts
@@ -6,27 +6,31 @@
  * Side Public License, v 1.
  */
 
-export { IndexPattern, IndexPatternField, DataPublicPluginStart } from '../../data/public';
+export type { DataPublicPluginStart } from '../../data/public';
+export { IndexPattern, IndexPatternField } from '../../data/public';
 
-export { UsageCollectionStart } from '../../usage_collection/public';
+export type { UsageCollectionStart } from '../../usage_collection/public';
 
-export { RuntimeType, RuntimeField, KBN_FIELD_TYPES, ES_FIELD_TYPES } from '../../data/common';
+export type { RuntimeType, RuntimeField } from '../../data/common';
+export { KBN_FIELD_TYPES, ES_FIELD_TYPES } from '../../data/common';
 
 export { createKibanaReactContext, toMountPoint, CodeEditor } from '../../kibana_react/public';
 
 export { FieldFormat } from '../../field_formats/common';
 
+export type {
+  FormSchema,
+  FormHook,
+  ValidationFunc,
+  FieldConfig,
+} from '../../es_ui_shared/static/forms/hook_form_lib';
 export {
   useForm,
   useFormData,
   useFormContext,
   useFormIsModified,
   Form,
-  FormSchema,
   UseField,
-  FormHook,
-  ValidationFunc,
-  FieldConfig,
 } from '../../es_ui_shared/static/forms/hook_form_lib';
 
 export { fieldValidators } from '../../es_ui_shared/static/forms/helpers';
diff --git a/src/plugins/index_pattern_management/public/index.ts b/src/plugins/index_pattern_management/public/index.ts
index 45a2f0b5a468b..65b71ee6053e3 100644
--- a/src/plugins/index_pattern_management/public/index.ts
+++ b/src/plugins/index_pattern_management/public/index.ts
@@ -19,7 +19,7 @@
  */
 import { PluginInitializerContext } from 'src/core/public';
 import { IndexPatternManagementPlugin } from './plugin';
-export { IndexPatternManagementSetup, IndexPatternManagementStart } from './plugin';
+export type { IndexPatternManagementSetup, IndexPatternManagementStart } from './plugin';
 
 export function plugin(initializerContext: PluginInitializerContext) {
   return new IndexPatternManagementPlugin(initializerContext);
diff --git a/src/plugins/inspector/common/adapters/request/index.ts b/src/plugins/inspector/common/adapters/request/index.ts
index 807f11569ba2c..d1654ea66b93d 100644
--- a/src/plugins/inspector/common/adapters/request/index.ts
+++ b/src/plugins/inspector/common/adapters/request/index.ts
@@ -6,6 +6,7 @@
  * Side Public License, v 1.
  */
 
-export { Request, RequestStatistic, RequestStatistics, RequestStatus } from './types';
+export type { Request, RequestStatistic, RequestStatistics } from './types';
+export { RequestStatus } from './types';
 export { RequestAdapter } from './request_adapter';
 export { RequestResponder } from './request_responder';
diff --git a/src/plugins/inspector/common/index.ts b/src/plugins/inspector/common/index.ts
index e92c9b670475a..995846fadd921 100644
--- a/src/plugins/inspector/common/index.ts
+++ b/src/plugins/inspector/common/index.ts
@@ -6,12 +6,5 @@
  * Side Public License, v 1.
  */
 
-export {
-  Adapters,
-  Request,
-  RequestAdapter,
-  RequestStatistic,
-  RequestStatistics,
-  RequestStatus,
-  RequestResponder,
-} from './adapters';
+export type { Adapters, Request, RequestStatistic, RequestStatistics } from './adapters';
+export { RequestAdapter, RequestStatus, RequestResponder } from './adapters';
diff --git a/src/plugins/inspector/public/index.ts b/src/plugins/inspector/public/index.ts
index c611d13c06ca2..5ad7898550974 100644
--- a/src/plugins/inspector/public/index.ts
+++ b/src/plugins/inspector/public/index.ts
@@ -18,6 +18,7 @@ export function plugin(initializerContext: PluginInitializerContext) {
   return new InspectorPublicPlugin(initializerContext);
 }
 
-export { InspectorPublicPlugin as Plugin, Setup, Start } from './plugin';
+export type { Setup, Start } from './plugin';
+export { InspectorPublicPlugin as Plugin } from './plugin';
 export * from './types';
 export * from '../common/adapters';
diff --git a/src/plugins/kibana_legacy/public/plugin.ts b/src/plugins/kibana_legacy/public/plugin.ts
index ac78e8cac4f07..a154770bbfffd 100644
--- a/src/plugins/kibana_legacy/public/plugin.ts
+++ b/src/plugins/kibana_legacy/public/plugin.ts
@@ -6,16 +6,14 @@
  * Side Public License, v 1.
  */
 
-import { CoreStart, CoreSetup } from 'kibana/public';
-import { injectHeaderStyle } from './utils/inject_header_style';
+import type { CoreSetup } from 'kibana/public';
 
 export class KibanaLegacyPlugin {
   public setup(core: CoreSetup<{}, KibanaLegacyStart>) {
     return {};
   }
 
-  public start({ uiSettings }: CoreStart) {
-    injectHeaderStyle(uiSettings);
+  public start() {
     return {
       /**
        * Loads the font-awesome icon font. Should be removed once the last consumer has migrated to EUI
diff --git a/src/plugins/kibana_legacy/public/utils/inject_header_style.ts b/src/plugins/kibana_legacy/public/utils/inject_header_style.ts
deleted file mode 100644
index 967aa2232838e..0000000000000
--- a/src/plugins/kibana_legacy/public/utils/inject_header_style.ts
+++ /dev/null
@@ -1,32 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-import { IUiSettingsClient } from 'kibana/public';
-
-export function buildCSS(maxHeight = 0, truncateGradientHeight = 15) {
-  return `
-.truncate-by-height {
-  max-height: ${maxHeight > 0 ? `${maxHeight}px !important` : 'none'};
-  display: inline-block;
-}
-.truncate-by-height:before {
-  top:  ${maxHeight > 0 ? maxHeight - truncateGradientHeight : truncateGradientHeight * -1}px;
-}
-`;
-}
-
-export function injectHeaderStyle(uiSettings: IUiSettingsClient) {
-  const style = document.createElement('style');
-  style.setAttribute('id', 'style-compile');
-  document.getElementsByTagName('head')[0].appendChild(style);
-
-  uiSettings.get$('truncate:maxHeight').subscribe((value: number) => {
-    // eslint-disable-next-line no-unsanitized/property
-    style.innerHTML = buildCSS(value);
-  });
-}
diff --git a/src/plugins/kibana_overview/public/index.ts b/src/plugins/kibana_overview/public/index.ts
index eae86edf1d426..aef16587e3de5 100644
--- a/src/plugins/kibana_overview/public/index.ts
+++ b/src/plugins/kibana_overview/public/index.ts
@@ -15,4 +15,4 @@ import { KibanaOverviewPlugin } from './plugin';
 export function plugin() {
   return new KibanaOverviewPlugin();
 }
-export { KibanaOverviewPluginSetup, KibanaOverviewPluginStart } from './types';
+export type { KibanaOverviewPluginSetup, KibanaOverviewPluginStart } from './types';
diff --git a/src/plugins/kibana_react/public/context/index.ts b/src/plugins/kibana_react/public/context/index.ts
index b34951b298836..8647a1414b9dd 100644
--- a/src/plugins/kibana_react/public/context/index.ts
+++ b/src/plugins/kibana_react/public/context/index.ts
@@ -13,4 +13,4 @@ export {
   useKibana,
   withKibana,
 } from './context';
-export { KibanaReactContext, KibanaReactContextValue, KibanaServices } from './types';
+export type { KibanaReactContext, KibanaReactContextValue, KibanaServices } from './types';
diff --git a/src/plugins/kibana_react/public/exit_full_screen_button/index.tsx b/src/plugins/kibana_react/public/exit_full_screen_button/index.tsx
index d2d7cbc2f570c..16466f5c0f6a2 100644
--- a/src/plugins/kibana_react/public/exit_full_screen_button/index.tsx
+++ b/src/plugins/kibana_react/public/exit_full_screen_button/index.tsx
@@ -6,4 +6,5 @@
  * Side Public License, v 1.
  */
 
-export { ExitFullScreenButton, ExitFullScreenButtonProps } from './exit_full_screen_button';
+export type { ExitFullScreenButtonProps } from './exit_full_screen_button';
+export { ExitFullScreenButton } from './exit_full_screen_button';
diff --git a/src/plugins/kibana_react/public/index.ts b/src/plugins/kibana_react/public/index.ts
index 6fccb804c357f..03e2bb5f9c272 100644
--- a/src/plugins/kibana_react/public/index.ts
+++ b/src/plugins/kibana_react/public/index.ts
@@ -23,7 +23,8 @@ export * from './toolbar_button';
 export * from './split_panel';
 export * from './react_router_navigate';
 export * from './page_template';
-export { ValidatedDualRange, Value } from './validated_range';
+export type { Value } from './validated_range';
+export { ValidatedDualRange } from './validated_range';
 export * from './notifications';
 export { Markdown, MarkdownSimple } from './markdown';
 export { reactToUiComponent, uiToReactComponent } from './adapters';
diff --git a/src/plugins/kibana_react/public/page_template/index.ts b/src/plugins/kibana_react/public/page_template/index.ts
index 193dc8cd07eee..41eeaab01ef39 100644
--- a/src/plugins/kibana_react/public/page_template/index.ts
+++ b/src/plugins/kibana_react/public/page_template/index.ts
@@ -6,6 +6,7 @@
  * Side Public License, v 1.
  */
 
-export { KibanaPageTemplate, KibanaPageTemplateProps } from './page_template';
+export type { KibanaPageTemplateProps } from './page_template';
+export { KibanaPageTemplate } from './page_template';
 export { KibanaPageTemplateSolutionNavAvatar } from './solution_nav';
 export * from './no_data_page';
diff --git a/src/plugins/kibana_react/public/page_template/solution_nav/index.ts b/src/plugins/kibana_react/public/page_template/solution_nav/index.ts
index 3dace6524fef5..81c2033a7ce7c 100644
--- a/src/plugins/kibana_react/public/page_template/solution_nav/index.ts
+++ b/src/plugins/kibana_react/public/page_template/solution_nav/index.ts
@@ -6,12 +6,9 @@
  * Side Public License, v 1.
  */
 
-export { KibanaPageTemplateSolutionNav, KibanaPageTemplateSolutionNavProps } from './solution_nav';
-export {
-  KibanaPageTemplateSolutionNavAvatar,
-  KibanaPageTemplateSolutionNavAvatarProps,
-} from './solution_nav_avatar';
-export {
-  KibanaPageTemplateSolutionNavCollapseButton,
-  KibanaPageTemplateSolutionNavCollapseButtonProps,
-} from './solution_nav_collapse_button';
+export type { KibanaPageTemplateSolutionNavProps } from './solution_nav';
+export { KibanaPageTemplateSolutionNav } from './solution_nav';
+export type { KibanaPageTemplateSolutionNavAvatarProps } from './solution_nav_avatar';
+export { KibanaPageTemplateSolutionNavAvatar } from './solution_nav_avatar';
+export type { KibanaPageTemplateSolutionNavCollapseButtonProps } from './solution_nav_collapse_button';
+export { KibanaPageTemplateSolutionNavCollapseButton } from './solution_nav_collapse_button';
diff --git a/src/plugins/kibana_react/public/validated_range/index.ts b/src/plugins/kibana_react/public/validated_range/index.ts
index d5ecfd23382b8..14f4333cde240 100644
--- a/src/plugins/kibana_react/public/validated_range/index.ts
+++ b/src/plugins/kibana_react/public/validated_range/index.ts
@@ -6,4 +6,5 @@
  * Side Public License, v 1.
  */
 
-export { ValidatedDualRange, Value } from './validated_dual_range';
+export type { Value } from './validated_dual_range';
+export { ValidatedDualRange } from './validated_dual_range';
diff --git a/src/plugins/kibana_utils/common/index.ts b/src/plugins/kibana_utils/common/index.ts
index be00a13715fc7..365ff52ac9d4b 100644
--- a/src/plugins/kibana_utils/common/index.ts
+++ b/src/plugins/kibana_utils/common/index.ts
@@ -16,7 +16,8 @@ export * from './ui';
 export * from './state_containers';
 export * from './errors';
 export { AbortError, abortSignalToPromise } from './abort_utils';
-export { createGetterSetter, Get, Set } from './create_getter_setter';
+export type { Get, Set } from './create_getter_setter';
+export { createGetterSetter } from './create_getter_setter';
 export { distinctUntilChangedWithInitialValue } from './distinct_until_changed_with_initial_value';
 export { url } from './url';
 export { now } from './now';
diff --git a/src/plugins/kibana_utils/common/state_containers/index.ts b/src/plugins/kibana_utils/common/state_containers/index.ts
index c96b48cc045b7..8c4d3f87a0681 100644
--- a/src/plugins/kibana_utils/common/state_containers/index.ts
+++ b/src/plugins/kibana_utils/common/state_containers/index.ts
@@ -13,7 +13,7 @@
  * @packageDocumentation
  */
 
-export {
+export type {
   BaseState,
   BaseStateContainer,
   TransitionDescription,
@@ -37,7 +37,8 @@ export {
   PureTransition,
   Transition,
 } from './types';
-export { createStateContainer, CreateStateContainerOptions } from './create_state_container';
+export type { CreateStateContainerOptions } from './create_state_container';
+export { createStateContainer } from './create_state_container';
 export {
   createStateContainerReactHelpers,
   useContainerSelector,
diff --git a/src/plugins/kibana_utils/index.ts b/src/plugins/kibana_utils/index.ts
index ecffc0544c7db..9b7e91b747db8 100644
--- a/src/plugins/kibana_utils/index.ts
+++ b/src/plugins/kibana_utils/index.ts
@@ -6,4 +6,5 @@
  * Side Public License, v 1.
  */
 
-export { createStateContainer, StateContainer, of } from './common';
+export type { StateContainer } from './common';
+export { createStateContainer, of } from './common';
diff --git a/src/plugins/kibana_utils/public/index.ts b/src/plugins/kibana_utils/public/index.ts
index 0ac4c61f4a711..090c33e121370 100644
--- a/src/plugins/kibana_utils/public/index.ts
+++ b/src/plugins/kibana_utils/public/index.ts
@@ -12,6 +12,7 @@ import { KibanaUtilsPublicPlugin } from './plugin';
 // TODO: https://github.com/elastic/kibana/issues/109893
 /* eslint-disable @kbn/eslint/no_export_all */
 
+export type { Get, Set, UiComponent, UiComponentInstance } from '../common';
 export {
   AbortError,
   abortSignalToPromise,
@@ -20,11 +21,7 @@ export {
   Defer,
   fieldWildcardFilter,
   fieldWildcardMatcher,
-  Get,
   of,
-  Set,
-  UiComponent,
-  UiComponentInstance,
   url,
   createGetterSetter,
 } from '../common';
@@ -56,11 +53,7 @@ export {
   replaceUrlQuery,
   replaceUrlHashQuery,
 } from './state_management/url';
-export {
-  syncState,
-  syncStates,
-  createKbnUrlStateStorage,
-  createSessionStorageStateStorage,
+export type {
   IStateSyncConfig,
   ISyncStateRef,
   IKbnUrlStateStorage,
@@ -69,7 +62,13 @@ export {
   StartSyncStateFnType,
   StopSyncStateFnType,
 } from './state_sync';
-export { Configurable, CollectConfigProps } from './ui';
+export {
+  syncState,
+  syncStates,
+  createKbnUrlStateStorage,
+  createSessionStorageStateStorage,
+} from './state_sync';
+export type { Configurable, CollectConfigProps } from './ui';
 export {
   removeQueryParam,
   redirectWhenMissing,
@@ -79,9 +78,10 @@ export {
   createQueryParamObservable,
 } from './history';
 export { applyDiff } from './state_management/utils/diff_object';
-export { createStartServicesGetter, StartServicesGetter } from './core/create_start_service_getter';
+export type { StartServicesGetter } from './core/create_start_service_getter';
+export { createStartServicesGetter } from './core/create_start_service_getter';
 
-export { KibanaUtilsSetup } from './plugin';
+export type { KibanaUtilsSetup } from './plugin';
 
 export function plugin(initializerContext: PluginInitializerContext) {
   return new KibanaUtilsPublicPlugin(initializerContext);
diff --git a/src/plugins/kibana_utils/public/state_management/url/index.ts b/src/plugins/kibana_utils/public/state_management/url/index.ts
index b180232b21526..7f39e9ac1b698 100644
--- a/src/plugins/kibana_utils/public/state_management/url/index.ts
+++ b/src/plugins/kibana_utils/public/state_management/url/index.ts
@@ -7,12 +7,12 @@
  */
 
 export { hashUrl, hashQuery, unhashUrl, unhashQuery } from './hash_unhash_url';
+export type { IKbnUrlControls } from './kbn_url_storage';
 export {
   createKbnUrlControls,
   setStateToKbnUrl,
   getStateFromKbnUrl,
   getStatesFromKbnUrl,
-  IKbnUrlControls,
 } from './kbn_url_storage';
 export { createKbnUrlTracker } from './kbn_url_tracker';
 export { createUrlTracker } from './url_tracker';
diff --git a/src/plugins/kibana_utils/public/state_sync/index.ts b/src/plugins/kibana_utils/public/state_sync/index.ts
index 2e14096c23950..603e7582c7b16 100644
--- a/src/plugins/kibana_utils/public/state_sync/index.ts
+++ b/src/plugins/kibana_utils/public/state_sync/index.ts
@@ -26,18 +26,15 @@
  * @packageDocumentation
  */
 
-export {
-  createSessionStorageStateStorage,
-  createKbnUrlStateStorage,
+export type {
   IKbnUrlStateStorage,
   ISessionStorageStateStorage,
   IStateStorage,
 } from './state_sync_state_storage';
-export { IStateSyncConfig, INullableBaseStateContainer } from './types';
 export {
-  syncState,
-  syncStates,
-  StopSyncStateFnType,
-  StartSyncStateFnType,
-  ISyncStateRef,
-} from './state_sync';
+  createSessionStorageStateStorage,
+  createKbnUrlStateStorage,
+} from './state_sync_state_storage';
+export type { IStateSyncConfig, INullableBaseStateContainer } from './types';
+export type { StopSyncStateFnType, StartSyncStateFnType, ISyncStateRef } from './state_sync';
+export { syncState, syncStates } from './state_sync';
diff --git a/src/plugins/kibana_utils/public/state_sync/state_sync_state_storage/index.ts b/src/plugins/kibana_utils/public/state_sync/state_sync_state_storage/index.ts
index 8ac6c4eaaf3d0..55f62b5183379 100644
--- a/src/plugins/kibana_utils/public/state_sync/state_sync_state_storage/index.ts
+++ b/src/plugins/kibana_utils/public/state_sync/state_sync_state_storage/index.ts
@@ -6,9 +6,8 @@
  * Side Public License, v 1.
  */
 
-export { IStateStorage } from './types';
-export { createKbnUrlStateStorage, IKbnUrlStateStorage } from './create_kbn_url_state_storage';
-export {
-  createSessionStorageStateStorage,
-  ISessionStorageStateStorage,
-} from './create_session_storage_state_storage';
+export type { IStateStorage } from './types';
+export type { IKbnUrlStateStorage } from './create_kbn_url_state_storage';
+export { createKbnUrlStateStorage } from './create_kbn_url_state_storage';
+export type { ISessionStorageStateStorage } from './create_session_storage_state_storage';
+export { createSessionStorageStateStorage } from './create_session_storage_state_storage';
diff --git a/src/plugins/kibana_utils/public/storage/index.ts b/src/plugins/kibana_utils/public/storage/index.ts
index 9423741145319..26859bb86107e 100644
--- a/src/plugins/kibana_utils/public/storage/index.ts
+++ b/src/plugins/kibana_utils/public/storage/index.ts
@@ -7,4 +7,4 @@
  */
 
 export { Storage } from './storage';
-export { IStorage, IStorageWrapper } from './types';
+export type { IStorage, IStorageWrapper } from './types';
diff --git a/src/plugins/kibana_utils/server/index.ts b/src/plugins/kibana_utils/server/index.ts
index 42847042be151..2e4f7c7cc52f1 100644
--- a/src/plugins/kibana_utils/server/index.ts
+++ b/src/plugins/kibana_utils/server/index.ts
@@ -6,14 +6,13 @@
  * Side Public License, v 1.
  */
 
+export type { Get, Set } from '../common';
 export {
   AbortError,
   abortSignalToPromise,
   createGetterSetter,
   fieldWildcardFilter,
   fieldWildcardMatcher,
-  Get,
-  Set,
   url,
   mergeMigrationFunctionMaps,
 } from '../common';
diff --git a/src/plugins/management/common/index.ts b/src/plugins/management/common/index.ts
index c701ba846bcac..77ae14c3c1d2d 100644
--- a/src/plugins/management/common/index.ts
+++ b/src/plugins/management/common/index.ts
@@ -6,4 +6,4 @@
  * Side Public License, v 1.
  */
 
-export { ManagementAppLocator } from './locator';
+export type { ManagementAppLocator } from './locator';
diff --git a/src/plugins/management/public/components/management_app/index.ts b/src/plugins/management/public/components/management_app/index.ts
index 1a5cc3945344f..aa768e3837922 100644
--- a/src/plugins/management/public/components/management_app/index.ts
+++ b/src/plugins/management/public/components/management_app/index.ts
@@ -6,4 +6,5 @@
  * Side Public License, v 1.
  */
 
-export { ManagementApp, ManagementAppDependencies } from './management_app';
+export type { ManagementAppDependencies } from './management_app';
+export { ManagementApp } from './management_app';
diff --git a/src/plugins/management/public/index.ts b/src/plugins/management/public/index.ts
index 2f5550acbaf6b..41d244ad44d5a 100644
--- a/src/plugins/management/public/index.ts
+++ b/src/plugins/management/public/index.ts
@@ -13,9 +13,10 @@ export function plugin(initializerContext: PluginInitializerContext) {
   return new ManagementPlugin(initializerContext);
 }
 
-export { RegisterManagementAppArgs, ManagementSection, ManagementApp } from './utils';
+export type { RegisterManagementAppArgs } from './utils';
+export { ManagementSection, ManagementApp } from './utils';
 
-export {
+export type {
   ManagementAppMountParams,
   ManagementSetup,
   ManagementStart,
diff --git a/src/plugins/management/public/utils/index.ts b/src/plugins/management/public/utils/index.ts
index c51c6b050753a..4bdf6979c28f2 100644
--- a/src/plugins/management/public/utils/index.ts
+++ b/src/plugins/management/public/utils/index.ts
@@ -7,5 +7,7 @@
  */
 
 export { MANAGEMENT_BREADCRUMB } from './breadcrumbs';
-export { ManagementApp, RegisterManagementAppArgs } from './management_app';
-export { ManagementSection, RegisterManagementSectionArgs } from './management_section';
+export type { RegisterManagementAppArgs } from './management_app';
+export { ManagementApp } from './management_app';
+export type { RegisterManagementSectionArgs } from './management_section';
+export { ManagementSection } from './management_section';
diff --git a/src/plugins/maps_ems/public/index.ts b/src/plugins/maps_ems/public/index.ts
index a4a0fc45d9164..74b831e058801 100644
--- a/src/plugins/maps_ems/public/index.ts
+++ b/src/plugins/maps_ems/public/index.ts
@@ -12,7 +12,7 @@ import { IServiceSettings } from './service_settings';
 import type { MapsEmsConfig } from '../config';
 
 /** @public */
-export {
+export type {
   VectorLayer,
   FileLayerField,
   FileLayer,
diff --git a/src/plugins/navigation/public/index.ts b/src/plugins/navigation/public/index.ts
index 21d63c72cdd62..91b68ecab644b 100644
--- a/src/plugins/navigation/public/index.ts
+++ b/src/plugins/navigation/public/index.ts
@@ -13,9 +13,10 @@ export function plugin(initializerContext: PluginInitializerContext) {
   return new NavigationPublicPlugin(initializerContext);
 }
 
-export { TopNavMenuData, TopNavMenu, TopNavMenuProps } from './top_nav_menu';
+export type { TopNavMenuData, TopNavMenuProps } from './top_nav_menu';
+export { TopNavMenu } from './top_nav_menu';
 
-export { NavigationPublicPluginSetup, NavigationPublicPluginStart } from './types';
+export type { NavigationPublicPluginSetup, NavigationPublicPluginStart } from './types';
 
 // Export plugin after all other imports
 import { NavigationPublicPlugin } from './plugin';
diff --git a/src/plugins/navigation/public/top_nav_menu/index.ts b/src/plugins/navigation/public/top_nav_menu/index.ts
index 19f359e60ba7a..16c92aaaaf712 100644
--- a/src/plugins/navigation/public/top_nav_menu/index.ts
+++ b/src/plugins/navigation/public/top_nav_menu/index.ts
@@ -7,9 +7,8 @@
  */
 
 export { createTopNav } from './create_top_nav_menu';
-export { TopNavMenu, TopNavMenuProps } from './top_nav_menu';
-export { TopNavMenuData } from './top_nav_menu_data';
-export {
-  TopNavMenuExtensionsRegistrySetup,
-  TopNavMenuExtensionsRegistry,
-} from './top_nav_menu_extensions_registry';
+export type { TopNavMenuProps } from './top_nav_menu';
+export { TopNavMenu } from './top_nav_menu';
+export type { TopNavMenuData } from './top_nav_menu_data';
+export type { TopNavMenuExtensionsRegistrySetup } from './top_nav_menu_extensions_registry';
+export { TopNavMenuExtensionsRegistry } from './top_nav_menu_extensions_registry';
diff --git a/src/plugins/newsfeed/public/index.ts b/src/plugins/newsfeed/public/index.ts
index 324306f889d15..f9d59ca6d99dd 100644
--- a/src/plugins/newsfeed/public/index.ts
+++ b/src/plugins/newsfeed/public/index.ts
@@ -15,13 +15,8 @@ import {
 import { FetchResult, NewsfeedItem } from './types';
 import { NewsfeedApiEndpoint } from './lib/api';
 
-export {
-  NewsfeedPublicPluginSetup,
-  NewsfeedPublicPluginStart,
-  FetchResult,
-  NewsfeedItem,
-  NewsfeedApiEndpoint,
-};
+export type { NewsfeedPublicPluginSetup, NewsfeedPublicPluginStart, FetchResult, NewsfeedItem };
+export { NewsfeedApiEndpoint };
 
 export function plugin(initializerContext: PluginInitializerContext) {
   return new NewsfeedPublicPlugin(initializerContext);
diff --git a/src/plugins/presentation_util/public/components/controls/control_group/index.ts b/src/plugins/presentation_util/public/components/controls/control_group/index.ts
index 45a91a87a7962..95988d2e8143c 100644
--- a/src/plugins/presentation_util/public/components/controls/control_group/index.ts
+++ b/src/plugins/presentation_util/public/components/controls/control_group/index.ts
@@ -6,6 +6,6 @@
  * Side Public License, v 1.
  */
 
-export { ControlGroupInput, ControlGroupOutput } from './types';
+export type { ControlGroupInput, ControlGroupOutput } from './types';
 export type { ControlGroupContainer } from './embeddable/control_group_container';
 export { ControlGroupContainerFactory } from './embeddable/control_group_container_factory';
diff --git a/src/plugins/presentation_util/public/components/solution_toolbar/items/index.ts b/src/plugins/presentation_util/public/components/solution_toolbar/items/index.ts
index 654831e86d3f6..6076dbf8cf123 100644
--- a/src/plugins/presentation_util/public/components/solution_toolbar/items/index.ts
+++ b/src/plugins/presentation_util/public/components/solution_toolbar/items/index.ts
@@ -9,6 +9,7 @@
 export { SolutionToolbarButton } from './button';
 export { SolutionToolbarPopover } from './popover';
 export { AddFromLibraryButton } from './add_from_library';
-export { QuickButtonProps, QuickButtonGroup } from './quick_group';
+export type { QuickButtonProps } from './quick_group';
+export { QuickButtonGroup } from './quick_group';
 export { PrimaryActionButton } from './primary_button';
 export { PrimaryActionPopover } from './primary_popover';
diff --git a/src/plugins/presentation_util/public/index.ts b/src/plugins/presentation_util/public/index.ts
index 478e8a7cda032..91f1e3a937f62 100644
--- a/src/plugins/presentation_util/public/index.ts
+++ b/src/plugins/presentation_util/public/index.ts
@@ -11,26 +11,25 @@
 
 import { PresentationUtilPlugin } from './plugin';
 
-export {
+export type {
   PresentationCapabilitiesService,
   PresentationDashboardsService,
   PresentationLabsService,
-  getStubPluginServices,
 } from './services';
+export { getStubPluginServices } from './services';
 
-export {
+export type {
   KibanaPluginServiceFactory,
   PluginServiceFactory,
-  PluginServices,
   PluginServiceProviders,
-  PluginServiceProvider,
-  PluginServiceRegistry,
   KibanaPluginServiceParams,
 } from './services/create';
+export { PluginServices, PluginServiceProvider, PluginServiceRegistry } from './services/create';
 
-export { PresentationUtilPluginSetup, PresentationUtilPluginStart } from './types';
-export { SaveModalDashboardProps } from './components/types';
-export { projectIDs, ProjectID, Project } from '../common/labs';
+export type { PresentationUtilPluginSetup, PresentationUtilPluginStart } from './types';
+export type { SaveModalDashboardProps } from './components/types';
+export type { ProjectID, Project } from '../common/labs';
+export { projectIDs } from '../common/labs';
 export * from '../common/lib';
 
 export {
@@ -43,12 +42,12 @@ export {
 
 export * from './components/types';
 
+export type { QuickButtonProps } from './components/solution_toolbar';
 export {
   AddFromLibraryButton,
   PrimaryActionButton,
   PrimaryActionPopover,
   QuickButtonGroup,
-  QuickButtonProps,
   SolutionToolbar,
   SolutionToolbarButton,
   SolutionToolbarPopover,
diff --git a/src/plugins/presentation_util/public/services/create/index.ts b/src/plugins/presentation_util/public/services/create/index.ts
index 163e25e26babf..d616d7bee20c8 100644
--- a/src/plugins/presentation_util/public/services/create/index.ts
+++ b/src/plugins/presentation_util/public/services/create/index.ts
@@ -9,8 +9,9 @@
 import { PluginServiceRegistry } from './registry';
 
 export { PluginServiceRegistry } from './registry';
-export { PluginServiceProvider, PluginServiceProviders } from './provider';
-export {
+export type { PluginServiceProviders } from './provider';
+export { PluginServiceProvider } from './provider';
+export type {
   PluginServiceFactory,
   KibanaPluginServiceFactory,
   KibanaPluginServiceParams,
diff --git a/src/plugins/presentation_util/public/services/index.ts b/src/plugins/presentation_util/public/services/index.ts
index c7d8d2617888a..cafb01594bd3c 100644
--- a/src/plugins/presentation_util/public/services/index.ts
+++ b/src/plugins/presentation_util/public/services/index.ts
@@ -17,9 +17,9 @@ import { PresentationControlsService } from './controls';
 import { PresentationDataViewsService } from './data_views';
 import { PresentationDataService } from './data';
 
-export { PresentationCapabilitiesService } from './capabilities';
-export { PresentationDashboardsService } from './dashboards';
-export { PresentationLabsService } from './labs';
+export type { PresentationCapabilitiesService } from './capabilities';
+export type { PresentationDashboardsService } from './dashboards';
+export type { PresentationLabsService } from './labs';
 export interface PresentationUtilServices {
   dashboards: PresentationDashboardsService;
   dataViews: PresentationDataViewsService;
diff --git a/src/plugins/presentation_util/public/services/storybook/index.ts b/src/plugins/presentation_util/public/services/storybook/index.ts
index 1639316a1fe19..a2d729f6d730a 100644
--- a/src/plugins/presentation_util/public/services/storybook/index.ts
+++ b/src/plugins/presentation_util/public/services/storybook/index.ts
@@ -21,8 +21,9 @@ import { controlsServiceFactory } from './controls';
 import { dataViewsServiceFactory } from './data_views';
 import { dataServiceFactory } from './data';
 
-export { PluginServiceProviders, PluginServiceProvider, PluginServiceRegistry } from '../create';
-export { PresentationUtilServices } from '..';
+export type { PluginServiceProviders } from '../create';
+export { PluginServiceProvider, PluginServiceRegistry } from '../create';
+export type { PresentationUtilServices } from '..';
 
 export interface StorybookParams {
   canAccessDashboards?: boolean;
diff --git a/src/plugins/saved_objects/public/finder/index.ts b/src/plugins/saved_objects/public/finder/index.ts
index de6a54795fce5..aaf6259daca1d 100644
--- a/src/plugins/saved_objects/public/finder/index.ts
+++ b/src/plugins/saved_objects/public/finder/index.ts
@@ -6,9 +6,5 @@
  * Side Public License, v 1.
  */
 
-export {
-  SavedObjectMetaData,
-  SavedObjectFinderUi,
-  SavedObjectFinderUiProps,
-  getSavedObjectFinder,
-} from './saved_object_finder';
+export type { SavedObjectMetaData, SavedObjectFinderUiProps } from './saved_object_finder';
+export { SavedObjectFinderUi, getSavedObjectFinder } from './saved_object_finder';
diff --git a/src/plugins/saved_objects/public/index.ts b/src/plugins/saved_objects/public/index.ts
index bc84298a63717..d63e20f5f5673 100644
--- a/src/plugins/saved_objects/public/index.ts
+++ b/src/plugins/saved_objects/public/index.ts
@@ -8,33 +8,24 @@
 
 import { SavedObjectsPublicPlugin } from './plugin';
 
-export {
-  OnSaveProps,
-  SavedObjectSaveModal,
-  SavedObjectSaveModalOrigin,
-  OriginSaveModalProps,
-  SaveModalState,
-  SaveResult,
-  showSaveModal,
-} from './save_modal';
-export {
-  getSavedObjectFinder,
-  SavedObjectFinderUi,
-  SavedObjectFinderUiProps,
-  SavedObjectMetaData,
-} from './finder';
+export type { OnSaveProps, OriginSaveModalProps, SaveModalState, SaveResult } from './save_modal';
+export { SavedObjectSaveModal, SavedObjectSaveModalOrigin, showSaveModal } from './save_modal';
+export type { SavedObjectFinderUiProps, SavedObjectMetaData } from './finder';
+export { getSavedObjectFinder, SavedObjectFinderUi } from './finder';
+export type {
+  SavedObjectLoaderFindOptions,
+  SavedObjectDecorator,
+  SavedObjectDecoratorFactory,
+  SavedObjectDecoratorConfig,
+} from './saved_object';
 export {
   SavedObjectLoader,
-  SavedObjectLoaderFindOptions,
   checkForDuplicateTitle,
   saveWithConfirmation,
   isErrorNonFatal,
-  SavedObjectDecorator,
-  SavedObjectDecoratorFactory,
-  SavedObjectDecoratorConfig,
 } from './saved_object';
-export { SavedObjectSaveOpts, SavedObject, SavedObjectConfig } from './types';
+export type { SavedObjectSaveOpts, SavedObject, SavedObjectConfig } from './types';
 export { PER_PAGE_SETTING, LISTING_LIMIT_SETTING } from '../common';
-export { SavedObjectsStart, SavedObjectSetup } from './plugin';
+export type { SavedObjectsStart, SavedObjectSetup } from './plugin';
 
 export const plugin = () => new SavedObjectsPublicPlugin();
diff --git a/src/plugins/saved_objects/public/save_modal/index.ts b/src/plugins/saved_objects/public/save_modal/index.ts
index cd10374e57343..8c23b797a05db 100644
--- a/src/plugins/saved_objects/public/save_modal/index.ts
+++ b/src/plugins/saved_objects/public/save_modal/index.ts
@@ -6,6 +6,9 @@
  * Side Public License, v 1.
  */
 
-export { SavedObjectSaveModal, OnSaveProps, SaveModalState } from './saved_object_save_modal';
-export { SavedObjectSaveModalOrigin, OriginSaveModalProps } from './saved_object_save_modal_origin';
-export { showSaveModal, SaveResult } from './show_saved_object_save_modal';
+export type { OnSaveProps, SaveModalState } from './saved_object_save_modal';
+export { SavedObjectSaveModal } from './saved_object_save_modal';
+export type { OriginSaveModalProps } from './saved_object_save_modal_origin';
+export { SavedObjectSaveModalOrigin } from './saved_object_save_modal_origin';
+export type { SaveResult } from './show_saved_object_save_modal';
+export { showSaveModal } from './show_saved_object_save_modal';
diff --git a/src/plugins/saved_objects/public/saved_object/decorators/index.ts b/src/plugins/saved_objects/public/saved_object/decorators/index.ts
index d7aed32b5e2e7..1b43ae9808bf7 100644
--- a/src/plugins/saved_objects/public/saved_object/decorators/index.ts
+++ b/src/plugins/saved_objects/public/saved_object/decorators/index.ts
@@ -6,9 +6,6 @@
  * Side Public License, v 1.
  */
 
-export {
-  ISavedObjectDecoratorRegistry,
-  SavedObjectDecoratorRegistry,
-  SavedObjectDecoratorConfig,
-} from './registry';
-export { SavedObjectDecorator, SavedObjectDecoratorFactory } from './types';
+export type { ISavedObjectDecoratorRegistry, SavedObjectDecoratorConfig } from './registry';
+export { SavedObjectDecoratorRegistry } from './registry';
+export type { SavedObjectDecorator, SavedObjectDecoratorFactory } from './types';
diff --git a/src/plugins/saved_objects/public/saved_object/helpers/field_mapping/index.ts b/src/plugins/saved_objects/public/saved_object/helpers/field_mapping/index.ts
index b8a7b7ecc31a1..9a52f9b0e8458 100644
--- a/src/plugins/saved_objects/public/saved_object/helpers/field_mapping/index.ts
+++ b/src/plugins/saved_objects/public/saved_object/helpers/field_mapping/index.ts
@@ -6,5 +6,5 @@
  * Side Public License, v 1.
  */
 
-export { FieldMappingSpec, MappingObject } from './types';
+export type { FieldMappingSpec, MappingObject } from './types';
 export { expandShorthand } from './mapping_setup';
diff --git a/src/plugins/saved_objects/public/saved_object/index.ts b/src/plugins/saved_objects/public/saved_object/index.ts
index 116999afb71ae..f30730a1c39ac 100644
--- a/src/plugins/saved_objects/public/saved_object/index.ts
+++ b/src/plugins/saved_objects/public/saved_object/index.ts
@@ -7,13 +7,14 @@
  */
 
 export { createSavedObjectClass } from './saved_object';
-export { SavedObjectLoader, SavedObjectLoaderFindOptions } from './saved_object_loader';
+export type { SavedObjectLoaderFindOptions } from './saved_object_loader';
+export { SavedObjectLoader } from './saved_object_loader';
 export { checkForDuplicateTitle } from './helpers/check_for_duplicate_title';
 export { saveWithConfirmation } from './helpers/save_with_confirmation';
 export { isErrorNonFatal } from './helpers/save_saved_object';
-export {
-  SavedObjectDecoratorRegistry,
+export type {
   SavedObjectDecoratorFactory,
   SavedObjectDecorator,
   SavedObjectDecoratorConfig,
 } from './decorators';
+export { SavedObjectDecoratorRegistry } from './decorators';
diff --git a/src/plugins/saved_objects_management/public/index.ts b/src/plugins/saved_objects_management/public/index.ts
index 92e01ab903699..99ffae349bb48 100644
--- a/src/plugins/saved_objects_management/public/index.ts
+++ b/src/plugins/saved_objects_management/public/index.ts
@@ -9,18 +9,22 @@
 import { PluginInitializerContext } from 'kibana/public';
 import { SavedObjectsManagementPlugin } from './plugin';
 
-export { SavedObjectsManagementPluginSetup, SavedObjectsManagementPluginStart } from './plugin';
-export {
+export type {
+  SavedObjectsManagementPluginSetup,
+  SavedObjectsManagementPluginStart,
+} from './plugin';
+export type {
   SavedObjectsManagementActionServiceSetup,
   SavedObjectsManagementActionServiceStart,
-  SavedObjectsManagementAction,
   SavedObjectsManagementColumnServiceSetup,
   SavedObjectsManagementColumnServiceStart,
   SavedObjectsManagementColumn,
   SavedObjectsManagementRecord,
 } from './services';
-export { ProcessedImportResponse, processImportResponse, FailedImport } from './lib';
-export { SavedObjectRelation, SavedObjectWithMetadata, SavedObjectMetadata } from './types';
+export { SavedObjectsManagementAction } from './services';
+export type { ProcessedImportResponse, FailedImport } from './lib';
+export { processImportResponse } from './lib';
+export type { SavedObjectRelation, SavedObjectWithMetadata, SavedObjectMetadata } from './types';
 
 export function plugin(initializerContext: PluginInitializerContext) {
   return new SavedObjectsManagementPlugin();
diff --git a/src/plugins/saved_objects_management/public/lib/index.ts b/src/plugins/saved_objects_management/public/lib/index.ts
index e317bb5e39f73..258387c39ecd9 100644
--- a/src/plugins/saved_objects_management/public/lib/index.ts
+++ b/src/plugins/saved_objects_management/public/lib/index.ts
@@ -14,14 +14,12 @@ export { getSavedObjectLabel } from './get_saved_object_label';
 export { importFile } from './import_file';
 export { parseQuery } from './parse_query';
 export { resolveImportErrors } from './resolve_import_errors';
-export {
-  processImportResponse,
-  ProcessedImportResponse,
-  FailedImport,
-} from './process_import_response';
+export type { ProcessedImportResponse, FailedImport } from './process_import_response';
+export { processImportResponse } from './process_import_response';
 export { getDefaultTitle } from './get_default_title';
 export { findObjects } from './find_objects';
 export { bulkGetObjects } from './bulk_get_objects';
-export { extractExportDetails, SavedObjectsExportResultDetails } from './extract_export_details';
+export type { SavedObjectsExportResultDetails } from './extract_export_details';
+export { extractExportDetails } from './extract_export_details';
 export { getAllowedTypes } from './get_allowed_types';
 export { getTagFindReferences } from './get_tag_references';
diff --git a/src/plugins/saved_objects_management/public/services/index.ts b/src/plugins/saved_objects_management/public/services/index.ts
index f3c0100d61599..c45c81d3122ad 100644
--- a/src/plugins/saved_objects_management/public/services/index.ts
+++ b/src/plugins/saved_objects_management/public/services/index.ts
@@ -6,18 +6,15 @@
  * Side Public License, v 1.
  */
 
-export {
-  SavedObjectsManagementActionService,
+export type {
   SavedObjectsManagementActionServiceStart,
   SavedObjectsManagementActionServiceSetup,
 } from './action_service';
-export {
-  SavedObjectsManagementColumnService,
+export { SavedObjectsManagementActionService } from './action_service';
+export type {
   SavedObjectsManagementColumnServiceStart,
   SavedObjectsManagementColumnServiceSetup,
 } from './column_service';
-export {
-  SavedObjectsManagementAction,
-  SavedObjectsManagementColumn,
-  SavedObjectsManagementRecord,
-} from './types';
+export { SavedObjectsManagementColumnService } from './column_service';
+export type { SavedObjectsManagementColumn, SavedObjectsManagementRecord } from './types';
+export { SavedObjectsManagementAction } from './types';
diff --git a/src/plugins/saved_objects_management/public/services/types/index.ts b/src/plugins/saved_objects_management/public/services/types/index.ts
index 457ade0a295e7..82b45f9df33f0 100644
--- a/src/plugins/saved_objects_management/public/services/types/index.ts
+++ b/src/plugins/saved_objects_management/public/services/types/index.ts
@@ -7,5 +7,5 @@
  */
 
 export { SavedObjectsManagementAction } from './action';
-export { SavedObjectsManagementColumn } from './column';
-export { SavedObjectsManagementRecord } from './record';
+export type { SavedObjectsManagementColumn } from './column';
+export type { SavedObjectsManagementRecord } from './record';
diff --git a/src/plugins/saved_objects_management/public/types.ts b/src/plugins/saved_objects_management/public/types.ts
index cd6e3e9eaa32c..61766e1cb8c10 100644
--- a/src/plugins/saved_objects_management/public/types.ts
+++ b/src/plugins/saved_objects_management/public/types.ts
@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-export {
+export type {
   SavedObjectMetadata,
   SavedObjectWithMetadata,
   SavedObjectRelationKind,
diff --git a/src/plugins/saved_objects_management/server/index.ts b/src/plugins/saved_objects_management/server/index.ts
index b56382113e1ea..942d7b0734aee 100644
--- a/src/plugins/saved_objects_management/server/index.ts
+++ b/src/plugins/saved_objects_management/server/index.ts
@@ -12,7 +12,7 @@ import { SavedObjectsManagementPlugin } from './plugin';
 export const plugin = (context: PluginInitializerContext) =>
   new SavedObjectsManagementPlugin(context);
 
-export {
+export type {
   SavedObjectsManagementPluginSetup,
   SavedObjectsManagementPluginStart,
   SavedObjectMetadata,
diff --git a/src/plugins/saved_objects_management/server/services/index.ts b/src/plugins/saved_objects_management/server/services/index.ts
index 7bee337f59a98..f0f6d9e7fa978 100644
--- a/src/plugins/saved_objects_management/server/services/index.ts
+++ b/src/plugins/saved_objects_management/server/services/index.ts
@@ -6,4 +6,5 @@
  * Side Public License, v 1.
  */
 
-export { SavedObjectsManagement, ISavedObjectsManagement } from './management';
+export type { ISavedObjectsManagement } from './management';
+export { SavedObjectsManagement } from './management';
diff --git a/src/plugins/saved_objects_management/server/types.ts b/src/plugins/saved_objects_management/server/types.ts
index 5779c6d98e35d..93f6f3d09547a 100644
--- a/src/plugins/saved_objects_management/server/types.ts
+++ b/src/plugins/saved_objects_management/server/types.ts
@@ -12,7 +12,7 @@ export interface SavedObjectsManagementPluginSetup {}
 // eslint-disable-next-line @typescript-eslint/no-empty-interface
 export interface SavedObjectsManagementPluginStart {}
 
-export {
+export type {
   SavedObjectMetadata,
   SavedObjectWithMetadata,
   SavedObjectRelationKind,
diff --git a/src/plugins/saved_objects_tagging_oss/common/index.ts b/src/plugins/saved_objects_tagging_oss/common/index.ts
index a892f41c69314..0a8bd890614b7 100644
--- a/src/plugins/saved_objects_tagging_oss/common/index.ts
+++ b/src/plugins/saved_objects_tagging_oss/common/index.ts
@@ -6,4 +6,4 @@
  * Side Public License, v 1.
  */
 
-export { Tag, TagAttributes, GetAllTagsOptions, ITagsClient } from './types';
+export type { Tag, TagAttributes, GetAllTagsOptions, ITagsClient } from './types';
diff --git a/src/plugins/saved_objects_tagging_oss/public/decorator/index.ts b/src/plugins/saved_objects_tagging_oss/public/decorator/index.ts
index 6ea905b1db245..7ca7c50505f27 100644
--- a/src/plugins/saved_objects_tagging_oss/public/decorator/index.ts
+++ b/src/plugins/saved_objects_tagging_oss/public/decorator/index.ts
@@ -10,7 +10,7 @@ import { SavedObjectDecoratorConfig } from '../../../saved_objects/public';
 import { tagDecoratorFactory, decoratorId } from './factory';
 import { InternalTagDecoratedSavedObject } from './types';
 
-export { TagDecoratedSavedObject } from './types';
+export type { TagDecoratedSavedObject } from './types';
 
 export const tagDecoratorConfig: SavedObjectDecoratorConfig<InternalTagDecoratedSavedObject> = {
   id: decoratorId,
diff --git a/src/plugins/saved_objects_tagging_oss/public/index.ts b/src/plugins/saved_objects_tagging_oss/public/index.ts
index eb38614f90539..6e9a0bf3d832e 100644
--- a/src/plugins/saved_objects_tagging_oss/public/index.ts
+++ b/src/plugins/saved_objects_tagging_oss/public/index.ts
@@ -9,9 +9,9 @@
 import { PluginInitializerContext } from '../../../../src/core/public';
 import { SavedObjectTaggingOssPlugin } from './plugin';
 
-export { SavedObjectTaggingOssPluginSetup, SavedObjectTaggingOssPluginStart } from './types';
+export type { SavedObjectTaggingOssPluginSetup, SavedObjectTaggingOssPluginStart } from './types';
 
-export {
+export type {
   SavedObjectsTaggingApi,
   SavedObjectsTaggingApiUi,
   SavedObjectsTaggingApiUiComponent,
@@ -25,7 +25,7 @@ export {
   SavedObjectTagDecoratorTypeGuard,
 } from './api';
 
-export { TagDecoratedSavedObject } from './decorator';
+export type { TagDecoratedSavedObject } from './decorator';
 
 export const plugin = (initializerContext: PluginInitializerContext) =>
   new SavedObjectTaggingOssPlugin(initializerContext);
diff --git a/src/plugins/screenshot_mode/public/index.ts b/src/plugins/screenshot_mode/public/index.ts
index 012f57e837f41..591ddbfdf49c5 100644
--- a/src/plugins/screenshot_mode/public/index.ts
+++ b/src/plugins/screenshot_mode/public/index.ts
@@ -18,4 +18,4 @@ export {
   KBN_SCREENSHOT_MODE_ENABLED_KEY,
 } from '../common';
 
-export { ScreenshotModePluginSetup, ScreenshotModePluginStart } from './types';
+export type { ScreenshotModePluginSetup, ScreenshotModePluginStart } from './types';
diff --git a/src/plugins/screenshot_mode/server/index.ts b/src/plugins/screenshot_mode/server/index.ts
index b9f19a474ccbe..cc5d45b7be732 100644
--- a/src/plugins/screenshot_mode/server/index.ts
+++ b/src/plugins/screenshot_mode/server/index.ts
@@ -14,7 +14,7 @@ export {
   KBN_SCREENSHOT_MODE_ENABLED_KEY,
 } from '../common';
 
-export {
+export type {
   ScreenshotModeRequestHandlerContext,
   ScreenshotModePluginSetup,
   ScreenshotModePluginStart,
diff --git a/src/plugins/share/common/index.ts b/src/plugins/share/common/index.ts
index 992ec2447855f..0269dda43b9c5 100644
--- a/src/plugins/share/common/index.ts
+++ b/src/plugins/share/common/index.ts
@@ -6,5 +6,6 @@
  * Side Public License, v 1.
  */
 
-export { LocatorDefinition, LocatorPublic, useLocatorUrl, formatSearchParams } from './url_service';
+export type { LocatorDefinition, LocatorPublic } from './url_service';
+export { useLocatorUrl } from './url_service';
 export type { AnonymousAccessServiceContract, AnonymousAccessState } from './anonymous_access';
diff --git a/src/plugins/share/common/url_service/locators/locator.ts b/src/plugins/share/common/url_service/locators/locator.ts
index 2d33f701df595..2bacdd67875bd 100644
--- a/src/plugins/share/common/url_service/locators/locator.ts
+++ b/src/plugins/share/common/url_service/locators/locator.ts
@@ -118,11 +118,9 @@ export class Locator<P extends SerializableRecord> implements LocatorPublic<P> {
     });
   }
 
-  /* eslint-disable react-hooks/rules-of-hooks */
   public readonly useUrl = (
     params: P,
     getUrlParams?: LocatorGetUrlParams,
     deps: DependencyList = []
   ): string => useLocatorUrl<P>(this, params, getUrlParams, deps);
-  /* eslint-enable react-hooks/rules-of-hooks */
 }
diff --git a/src/plugins/share/public/index.ts b/src/plugins/share/public/index.ts
index 75f541dd5ae3d..2e57a9347b057 100644
--- a/src/plugins/share/public/index.ts
+++ b/src/plugins/share/public/index.ts
@@ -10,13 +10,13 @@ import type { PluginInitializerContext } from 'src/core/public';
 
 export { CSV_QUOTE_VALUES_SETTING, CSV_SEPARATOR_SETTING } from '../common/constants';
 
-export { LocatorDefinition, LocatorPublic, KibanaLocation } from '../common/url_service';
+export type { LocatorDefinition, LocatorPublic, KibanaLocation } from '../common/url_service';
 
-export { UrlGeneratorStateMapping } from './url_generators/url_generator_definition';
+export type { UrlGeneratorStateMapping } from './url_generators/url_generator_definition';
 
-export { SharePluginSetup, SharePluginStart } from './plugin';
+export type { SharePluginSetup, SharePluginStart } from './plugin';
 
-export {
+export type {
   ShareContext,
   ShareMenuProvider,
   ShareMenuItem,
@@ -24,15 +24,15 @@ export {
   ShareContextMenuPanelItem,
 } from './types';
 
-export {
+export type {
   UrlGeneratorId,
   UrlGeneratorState,
   UrlGeneratorsDefinition,
   UrlGeneratorContract,
-  UrlGeneratorsService,
 } from './url_generators';
+export { UrlGeneratorsService } from './url_generators';
 
-export { RedirectOptions } from '../common/url_service';
+export type { RedirectOptions } from '../common/url_service';
 export { useLocatorUrl } from '../common/url_service/locators/use_locator_url';
 
 import { SharePlugin } from './plugin';
diff --git a/src/plugins/share/public/url_generators/url_generator_contract.ts b/src/plugins/share/public/url_generators/url_generator_contract.ts
index b21e0f2a35c88..22ccae8909a69 100644
--- a/src/plugins/share/public/url_generators/url_generator_contract.ts
+++ b/src/plugins/share/public/url_generators/url_generator_contract.ts
@@ -12,8 +12,4 @@ export interface UrlGeneratorContract<Id extends UrlGeneratorId> {
   id: Id;
   createUrl(state: UrlGeneratorStateMapping[Id]['State']): Promise<string>;
   isDeprecated: boolean;
-  migrate(state: UrlGeneratorStateMapping[Id]['State']): Promise<{
-    state: UrlGeneratorStateMapping[Id]['MigratedState'];
-    id: UrlGeneratorStateMapping[Id]['MigratedId'];
-  }>;
 }
diff --git a/src/plugins/share/public/url_generators/url_generator_internal.ts b/src/plugins/share/public/url_generators/url_generator_internal.ts
index 9059a26566f92..7f7dc0f63f87b 100644
--- a/src/plugins/share/public/url_generators/url_generator_internal.ts
+++ b/src/plugins/share/public/url_generators/url_generator_internal.ts
@@ -72,17 +72,6 @@ export class UrlGeneratorInternal<Id extends UrlGeneratorId> {
         return this.spec.createUrl!(state);
       },
       isDeprecated: !!this.spec.isDeprecated,
-      migrate: async (state: UrlGeneratorStateMapping[Id]['State']) => {
-        if (!this.spec.isDeprecated) {
-          throw new Error(
-            i18n.translate('share.urlGenerators.error.migrateCalledNotDeprecated', {
-              defaultMessage: 'You cannot call migrate on a non-deprecated generator.',
-            })
-          );
-        }
-
-        return this.spec.migrate!(state);
-      },
     };
   }
 }
diff --git a/src/plugins/share/public/url_generators/url_generator_service.test.ts b/src/plugins/share/public/url_generators/url_generator_service.test.ts
index cb70f1af2c195..c07aa3f915b2e 100644
--- a/src/plugins/share/public/url_generators/url_generator_service.test.ts
+++ b/src/plugins/share/public/url_generators/url_generator_service.test.ts
@@ -29,12 +29,8 @@ test('Registering and retrieving a generator', async () => {
       "createUrl": [Function],
       "id": "TEST_GENERATOR",
       "isDeprecated": false,
-      "migrate": [Function],
     }
   `);
-  await expect(generator.migrate({})).rejects.toEqual(
-    new Error('You cannot call migrate on a non-deprecated generator.')
-  );
   expect(await generator.createUrl({})).toBe('myurl');
 
   const retrievedGenerator = start.getUrlGenerator('TEST_GENERATOR');
@@ -43,12 +39,8 @@ test('Registering and retrieving a generator', async () => {
       "createUrl": [Function],
       "id": "TEST_GENERATOR",
       "isDeprecated": false,
-      "migrate": [Function],
     }
   `);
-  await expect(generator.migrate({})).rejects.toEqual(
-    new Error('You cannot call migrate on a non-deprecated generator.')
-  );
   expect(await generator.createUrl({})).toBe('myurl');
 });
 
@@ -124,6 +116,5 @@ test('Generator returns migrated url', async () => {
 
   const generator = start.getUrlGenerator('v1');
   expect(generator.isDeprecated).toBe(true);
-  expect(await generator.migrate({ bar: 'hi' })).toEqual({ id: 'v2', state: { foo: 'hi' } });
   expect(await generator.createUrl({ bar: 'hi' })).toEqual('www.hi.com');
 });
diff --git a/src/plugins/share/server/index.ts b/src/plugins/share/server/index.ts
index d820a362131a4..73cd4cc89af70 100644
--- a/src/plugins/share/server/index.ts
+++ b/src/plugins/share/server/index.ts
@@ -9,7 +9,7 @@
 import { PluginInitializerContext } from '../../../core/server';
 import { SharePlugin } from './plugin';
 
-export { SharePluginSetup, SharePluginStart } from './plugin';
+export type { SharePluginSetup, SharePluginStart } from './plugin';
 
 export { CSV_QUOTE_VALUES_SETTING, CSV_SEPARATOR_SETTING } from '../common/constants';
 
diff --git a/src/plugins/ui_actions/public/index.ts b/src/plugins/ui_actions/public/index.ts
index 0804ed43cbe10..8a6b7ed931490 100644
--- a/src/plugins/ui_actions/public/index.ts
+++ b/src/plugins/ui_actions/public/index.ts
@@ -13,33 +13,29 @@ export function plugin(initializerContext: PluginInitializerContext) {
   return new UiActionsPlugin(initializerContext);
 }
 
-export { UiActionsSetup, UiActionsStart } from './plugin';
-export { UiActionsServiceParams, UiActionsService } from './service';
-export {
-  Action,
-  ActionDefinition as UiActionsActionDefinition,
-  createAction,
-  IncompatibleActionError,
-} from './actions';
+export type { UiActionsSetup, UiActionsStart } from './plugin';
+export type { UiActionsServiceParams } from './service';
+export { UiActionsService } from './service';
+export type { Action, ActionDefinition as UiActionsActionDefinition } from './actions';
+export { createAction, IncompatibleActionError } from './actions';
 export { buildContextMenuForActions } from './context_menu';
-export {
+export type {
   Presentable as UiActionsPresentable,
   PresentableGrouping as UiActionsPresentableGrouping,
 } from './util';
+export type { Trigger, RowClickContext } from './triggers';
 export {
-  Trigger,
   VISUALIZE_FIELD_TRIGGER,
   visualizeFieldTrigger,
   VISUALIZE_GEO_FIELD_TRIGGER,
   visualizeGeoFieldTrigger,
   ROW_CLICK_TRIGGER,
   rowClickTrigger,
-  RowClickContext,
 } from './triggers';
+export type { VisualizeFieldContext } from './types';
 export {
-  VisualizeFieldContext,
   ACTION_VISUALIZE_FIELD,
   ACTION_VISUALIZE_GEO_FIELD,
   ACTION_VISUALIZE_LENS_FIELD,
 } from './types';
-export { ActionExecutionContext, ActionExecutionMeta } from './actions';
+export type { ActionExecutionContext, ActionExecutionMeta } from './actions';
diff --git a/src/plugins/vis_default_editor/public/components/options/index.ts b/src/plugins/vis_default_editor/public/components/options/index.ts
index 62ce76014f9fc..4d45da690c3c8 100644
--- a/src/plugins/vis_default_editor/public/components/options/index.ts
+++ b/src/plugins/vis_default_editor/public/components/options/index.ts
@@ -9,8 +9,10 @@
 export { BasicOptions } from './basic_options';
 export { SwitchOption } from './switch';
 export { SelectOption } from './select';
-export { ColorRanges, SetColorRangeValue } from './color_ranges';
-export { ColorSchemaOptions, SetColorSchemaOptionsValue } from './color_schema';
+export type { SetColorRangeValue } from './color_ranges';
+export { ColorRanges } from './color_ranges';
+export type { SetColorSchemaOptionsValue } from './color_schema';
+export { ColorSchemaOptions } from './color_schema';
 export { NumberInputOption } from './number_input';
 export { RangeOption } from './range';
 export { RequiredNumberInputOption } from './required_number_input';
diff --git a/src/plugins/vis_default_editor/public/index.ts b/src/plugins/vis_default_editor/public/index.ts
index ec1f514b9f2ff..d89a898467b98 100644
--- a/src/plugins/vis_default_editor/public/index.ts
+++ b/src/plugins/vis_default_editor/public/index.ts
@@ -17,7 +17,8 @@ export { DefaultEditorController };
 export { useValidation } from './components/controls/utils';
 export { PalettePicker } from './components/controls/palette_picker';
 export * from './components/options';
-export { RangesParamEditor, RangeValues } from './components/controls/ranges';
+export type { RangeValues } from './components/controls/ranges';
+export { RangesParamEditor } from './components/controls/ranges';
 export * from './editor_size';
 export * from './utils';
 
diff --git a/src/plugins/vis_types/pie/public/index.ts b/src/plugins/vis_types/pie/public/index.ts
index adf8b2d073f39..d7c5e9a2dfb2a 100644
--- a/src/plugins/vis_types/pie/public/index.ts
+++ b/src/plugins/vis_types/pie/public/index.ts
@@ -9,6 +9,6 @@
 import { VisTypePiePlugin } from './plugin';
 
 export { pieVisType } from './vis_type';
-export { Dimensions, Dimension } from './types';
+export type { Dimensions, Dimension } from './types';
 
 export const plugin = () => new VisTypePiePlugin();
diff --git a/src/plugins/vis_types/table/common/index.ts b/src/plugins/vis_types/table/common/index.ts
index ad8e27c95a5ec..c5737c58fdbb3 100644
--- a/src/plugins/vis_types/table/common/index.ts
+++ b/src/plugins/vis_types/table/common/index.ts
@@ -6,4 +6,5 @@
  * Side Public License, v 1.
  */
 
-export { AggTypes, TableVisParams, VIS_TYPE_TABLE } from './types';
+export type { TableVisParams } from './types';
+export { AggTypes, VIS_TYPE_TABLE } from './types';
diff --git a/src/plugins/vis_types/timelion/public/index.ts b/src/plugins/vis_types/timelion/public/index.ts
index 8161f844e8f73..960eda3dc558f 100644
--- a/src/plugins/vis_types/timelion/public/index.ts
+++ b/src/plugins/vis_types/timelion/public/index.ts
@@ -13,4 +13,4 @@ export function plugin(initializerContext: PluginInitializerContext) {
   return new Plugin(initializerContext);
 }
 
-export { VisTypeTimelionPluginStart } from './plugin';
+export type { VisTypeTimelionPluginStart } from './plugin';
diff --git a/src/plugins/vis_types/timelion/server/types.ts b/src/plugins/vis_types/timelion/server/types.ts
index 06b6afa613b06..0cbf2b0882089 100644
--- a/src/plugins/vis_types/timelion/server/types.ts
+++ b/src/plugins/vis_types/timelion/server/types.ts
@@ -6,4 +6,7 @@
  * Side Public License, v 1.
  */
 
-export { TimelionFunctionInterface, TimelionFunctionConfig } from './lib/classes/timelion_function';
+export type {
+  TimelionFunctionInterface,
+  TimelionFunctionConfig,
+} from './lib/classes/timelion_function';
diff --git a/src/plugins/vis_types/timeseries/common/types/index.ts b/src/plugins/vis_types/timeseries/common/types/index.ts
index 123b6723d8ccd..5e04fee0d015c 100644
--- a/src/plugins/vis_types/timeseries/common/types/index.ts
+++ b/src/plugins/vis_types/timeseries/common/types/index.ts
@@ -9,8 +9,8 @@
 import { Filter, IndexPattern, Query } from '../../../../data/common';
 import { Panel } from './panel_model';
 
-export { Metric, Series, Panel, MetricType } from './panel_model';
-export { TimeseriesVisData, PanelData, SeriesData, TableData } from './vis_data';
+export type { Metric, Series, Panel, MetricType } from './panel_model';
+export type { TimeseriesVisData, PanelData, SeriesData, TableData } from './vis_data';
 
 export interface FetchedIndexPattern {
   indexPattern: IndexPattern | undefined | null;
diff --git a/src/plugins/vis_types/timeseries/public/application/components/lib/index_pattern_select/index.ts b/src/plugins/vis_types/timeseries/public/application/components/lib/index_pattern_select/index.ts
index 4920677a04a2e..24b49ca8f4d47 100644
--- a/src/plugins/vis_types/timeseries/public/application/components/lib/index_pattern_select/index.ts
+++ b/src/plugins/vis_types/timeseries/public/application/components/lib/index_pattern_select/index.ts
@@ -6,4 +6,5 @@
  * Side Public License, v 1.
  */
 
-export { IndexPatternSelect, IndexPatternSelectProps } from './index_pattern_select';
+export type { IndexPatternSelectProps } from './index_pattern_select';
+export { IndexPatternSelect } from './index_pattern_select';
diff --git a/src/plugins/vis_types/timeseries/server/index.ts b/src/plugins/vis_types/timeseries/server/index.ts
index 7a10740a53d32..d6b1174177bb6 100644
--- a/src/plugins/vis_types/timeseries/server/index.ts
+++ b/src/plugins/vis_types/timeseries/server/index.ts
@@ -10,7 +10,7 @@ import { PluginInitializerContext, PluginConfigDescriptor } from 'src/core/serve
 import { VisTypeTimeseriesConfig, config as configSchema } from './config';
 import { VisTypeTimeseriesPlugin } from './plugin';
 
-export { VisTypeTimeseriesSetup } from './plugin';
+export type { VisTypeTimeseriesSetup } from './plugin';
 
 export const config: PluginConfigDescriptor<VisTypeTimeseriesConfig> = {
   schema: configSchema,
@@ -20,5 +20,5 @@ export function plugin(initializerContext: PluginInitializerContext) {
   return new VisTypeTimeseriesPlugin(initializerContext);
 }
 
-export { TimeseriesVisData } from '../common/types';
+export type { TimeseriesVisData } from '../common/types';
 export { isVisSeriesData, isVisTableData } from '../common/vis_data_utils';
diff --git a/src/plugins/vis_types/vega/public/vega_inspector/index.ts b/src/plugins/vis_types/vega/public/vega_inspector/index.ts
index e79d2ee356aef..72dc539dc2ea7 100644
--- a/src/plugins/vis_types/vega/public/vega_inspector/index.ts
+++ b/src/plugins/vis_types/vega/public/vega_inspector/index.ts
@@ -6,8 +6,5 @@
  * Side Public License, v 1.
  */
 
-export {
-  createInspectorAdapters,
-  getVegaInspectorView,
-  VegaInspectorAdapters,
-} from './vega_inspector';
+export type { VegaInspectorAdapters } from './vega_inspector';
+export { createInspectorAdapters, getVegaInspectorView } from './vega_inspector';
diff --git a/src/plugins/vis_types/vega/server/index.ts b/src/plugins/vis_types/vega/server/index.ts
index 9c448f6c618d3..62bc9a1494acf 100644
--- a/src/plugins/vis_types/vega/server/index.ts
+++ b/src/plugins/vis_types/vega/server/index.ts
@@ -22,4 +22,4 @@ export function plugin(initializerContext: PluginInitializerContext) {
   return new VisTypeVegaPlugin(initializerContext);
 }
 
-export { VisTypeVegaPluginStart, VisTypeVegaPluginSetup } from './types';
+export type { VisTypeVegaPluginStart, VisTypeVegaPluginSetup } from './types';
diff --git a/src/plugins/vis_types/xy/public/editor/components/common/index.ts b/src/plugins/vis_types/xy/public/editor/components/common/index.ts
index 5eec1fff7b7a6..5a91629c50611 100644
--- a/src/plugins/vis_types/xy/public/editor/components/common/index.ts
+++ b/src/plugins/vis_types/xy/public/editor/components/common/index.ts
@@ -7,4 +7,5 @@
  */
 
 export { TruncateLabelsOption } from './truncate_labels';
-export { ValidationWrapper, ValidationVisOptionsProps } from './validation_wrapper';
+export type { ValidationVisOptionsProps } from './validation_wrapper';
+export { ValidationWrapper } from './validation_wrapper';
diff --git a/src/plugins/vis_types/xy/public/expression_functions/index.ts b/src/plugins/vis_types/xy/public/expression_functions/index.ts
index 32c50e3adff1e..4d6b2305a3651 100644
--- a/src/plugins/vis_types/xy/public/expression_functions/index.ts
+++ b/src/plugins/vis_types/xy/public/expression_functions/index.ts
@@ -8,10 +8,17 @@
 
 export { visTypeXyVisFn } from './xy_vis_fn';
 
-export { categoryAxis, ExpressionValueCategoryAxis } from './category_axis';
-export { timeMarker, ExpressionValueTimeMarker } from './time_marker';
-export { valueAxis, ExpressionValueValueAxis } from './value_axis';
-export { seriesParam, ExpressionValueSeriesParam } from './series_param';
-export { thresholdLine, ExpressionValueThresholdLine } from './threshold_line';
-export { label, ExpressionValueLabel } from './label';
-export { visScale, ExpressionValueScale } from './vis_scale';
+export type { ExpressionValueCategoryAxis } from './category_axis';
+export { categoryAxis } from './category_axis';
+export type { ExpressionValueTimeMarker } from './time_marker';
+export { timeMarker } from './time_marker';
+export type { ExpressionValueValueAxis } from './value_axis';
+export { valueAxis } from './value_axis';
+export type { ExpressionValueSeriesParam } from './series_param';
+export { seriesParam } from './series_param';
+export type { ExpressionValueThresholdLine } from './threshold_line';
+export { thresholdLine } from './threshold_line';
+export type { ExpressionValueLabel } from './label';
+export { label } from './label';
+export type { ExpressionValueScale } from './vis_scale';
+export { visScale } from './vis_scale';
diff --git a/src/plugins/vis_types/xy/public/index.ts b/src/plugins/vis_types/xy/public/index.ts
index 1ee96fab35253..41a8e08fa1ad2 100644
--- a/src/plugins/vis_types/xy/public/index.ts
+++ b/src/plugins/vis_types/xy/public/index.ts
@@ -11,11 +11,11 @@
 
 import { VisTypeXyPlugin as Plugin } from './plugin';
 
-export { VisTypeXyPluginSetup } from './plugin';
+export type { VisTypeXyPluginSetup } from './plugin';
 
 // TODO: Remove when vis_type_vislib is removed
 // https://github.com/elastic/kibana/issues/56143
-export {
+export type {
   CategoryAxis,
   ThresholdLine,
   ValueAxis,
@@ -23,9 +23,8 @@ export {
   SeriesParam,
   Dimension,
   Dimensions,
-  ScaleType,
-  AxisType,
 } from './types';
+export { ScaleType, AxisType } from './types';
 export type { ValidationVisOptionsProps } from './editor/components/common/validation_wrapper';
 export { TruncateLabelsOption } from './editor/components/common/truncate_labels';
 export { getPositions } from './editor/positions';
diff --git a/src/plugins/visualizations/public/index.ts b/src/plugins/visualizations/public/index.ts
index e6ea3cd489556..8ae0c426689ac 100644
--- a/src/plugins/visualizations/public/index.ts
+++ b/src/plugins/visualizations/public/index.ts
@@ -22,17 +22,17 @@ export { VisualizationContainer } from './components';
 export { getVisSchemas } from './vis_schemas';
 
 /** @public types */
-export { VisualizationsSetup, VisualizationsStart };
+export type { VisualizationsSetup, VisualizationsStart };
 export { VisGroups } from './vis_types/vis_groups_enum';
 export type { BaseVisType, VisTypeAlias, VisTypeDefinition, Schema, ISchemas } from './vis_types';
 export type { Vis, SerializedVis, SerializedVisData, VisData } from './vis';
 export type VisualizeEmbeddableFactoryContract = PublicContract<VisualizeEmbeddableFactory>;
 export type VisualizeEmbeddableContract = PublicContract<VisualizeEmbeddable>;
-export { VisualizeInput } from './embeddable';
-export { SchemaConfig } from './vis_schemas';
+export type { VisualizeInput } from './embeddable';
+export type { SchemaConfig } from './vis_schemas';
 export { updateOldState } from './legacy/vis_update_state';
 export type { PersistedState } from './persisted_state';
-export {
+export type {
   ISavedVis,
   VisSavedObject,
   VisToExpressionAst,
@@ -40,11 +40,15 @@ export {
   VisEditorOptionsProps,
   GetVisOptions,
 } from './types';
-export { VisualizationListItem, VisualizationStage } from './vis_types/vis_type_alias_registry';
+export type {
+  VisualizationListItem,
+  VisualizationStage,
+} from './vis_types/vis_type_alias_registry';
 export { VISUALIZE_ENABLE_LABS_SETTING } from '../common/constants';
-export { SavedVisState, VisParams, prepareLogTable, Dimension } from '../common';
-export { ExpressionValueVisDimension } from '../common/expression_functions/vis_dimension';
-export {
+export type { SavedVisState, VisParams, Dimension } from '../common';
+export { prepareLogTable } from '../common';
+export type { ExpressionValueVisDimension } from '../common/expression_functions/vis_dimension';
+export type {
   ExpressionValueXYDimension,
   DateHistogramParams,
   FakeParams,
diff --git a/src/plugins/visualizations/public/vis_types/types_service.ts b/src/plugins/visualizations/public/vis_types/types_service.ts
index 567da272dfd0a..ae8ba8b8ad518 100644
--- a/src/plugins/visualizations/public/vis_types/types_service.ts
+++ b/src/plugins/visualizations/public/vis_types/types_service.ts
@@ -110,4 +110,4 @@ export type TypesSetup = ReturnType<TypesService['setup']>;
 export type TypesStart = ReturnType<TypesService['start']>;
 
 /** @public types */
-export { VisTypeAlias };
+export type { VisTypeAlias };
diff --git a/src/plugins/visualizations/server/index.ts b/src/plugins/visualizations/server/index.ts
index d093a6829f307..f10caf44b3ccd 100644
--- a/src/plugins/visualizations/server/index.ts
+++ b/src/plugins/visualizations/server/index.ts
@@ -18,4 +18,4 @@ export function plugin(initializerContext: PluginInitializerContext) {
   return new VisualizationsPlugin(initializerContext);
 }
 
-export { VisualizationsPluginSetup, VisualizationsPluginStart } from './types';
+export type { VisualizationsPluginSetup, VisualizationsPluginStart } from './types';
diff --git a/src/plugins/visualize/public/application/types.ts b/src/plugins/visualize/public/application/types.ts
index e77520c962d88..b15b521f6251d 100644
--- a/src/plugins/visualize/public/application/types.ts
+++ b/src/plugins/visualize/public/application/types.ts
@@ -145,4 +145,4 @@ export interface EditorRenderProps {
   linked: boolean;
 }
 
-export { PureVisState };
+export type { PureVisState };
diff --git a/src/plugins/visualize/public/index.ts b/src/plugins/visualize/public/index.ts
index ff1b2ba4c3bf5..dd77987f6a722 100644
--- a/src/plugins/visualize/public/index.ts
+++ b/src/plugins/visualize/public/index.ts
@@ -11,9 +11,9 @@ import { VisualizePlugin, VisualizePluginSetup } from './plugin';
 
 export { VisualizeConstants } from './application/visualize_constants';
 
-export { IEditorController, EditorRenderProps } from './application/types';
+export type { IEditorController, EditorRenderProps } from './application/types';
 
-export { VisualizePluginSetup };
+export type { VisualizePluginSetup };
 
 export const plugin = (context: PluginInitializerContext) => {
   return new VisualizePlugin(context);
diff --git a/test/api_integration/apis/custom_integration/integrations.ts b/test/api_integration/apis/custom_integration/integrations.ts
index 0784a86e4b546..036eb2ef33c78 100644
--- a/test/api_integration/apis/custom_integration/integrations.ts
+++ b/test/api_integration/apis/custom_integration/integrations.ts
@@ -22,7 +22,7 @@ export default function ({ getService }: FtrProviderContext) {
 
         expect(resp.body).to.be.an('array');
 
-        expect(resp.body.length).to.be(33);
+        expect(resp.body.length).to.be(34);
 
         // Test for sample data card
         expect(resp.body.findIndex((c: { id: string }) => c.id === 'sample_data_all')).to.be.above(
@@ -40,7 +40,7 @@ export default function ({ getService }: FtrProviderContext) {
 
         expect(resp.body).to.be.an('array');
 
-        expect(resp.body.length).to.be.above(109); // at least the beats + apm
+        expect(resp.body.length).to.be(109); // the beats
       });
     });
   });
diff --git a/test/functional/apps/discover/_discover.ts b/test/functional/apps/discover/_discover.ts
index 0a8f56ee250ea..8374ccbc389f7 100644
--- a/test/functional/apps/discover/_discover.ts
+++ b/test/functional/apps/discover/_discover.ts
@@ -28,16 +28,16 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   describe('discover test', function describeIndexTests() {
     before(async function () {
       log.debug('load kibana index with default index pattern');
-
-      await kibanaServer.importExport.load('test/functional/fixtures/kbn_archiver/discover.json');
-
+      await kibanaServer.importExport.load('test/functional/fixtures/kbn_archiver/discover');
       // and load a set of makelogs data
       await esArchiver.loadIfNeeded('test/functional/fixtures/es_archiver/logstash_functional');
       await kibanaServer.uiSettings.replace(defaultSettings);
       await PageObjects.common.navigateToApp('discover');
       await PageObjects.timePicker.setDefaultAbsoluteRange();
     });
-
+    after(async () => {
+      await kibanaServer.savedObjects.clean({ types: ['search', 'index-pattern'] });
+    });
     describe('query', function () {
       const queryName1 = 'Query # 1';
 
diff --git a/test/functional/page_objects/common_page.ts b/test/functional/page_objects/common_page.ts
index a40465b00dbeb..69fbf7e49df3c 100644
--- a/test/functional/page_objects/common_page.ts
+++ b/test/functional/page_objects/common_page.ts
@@ -11,6 +11,7 @@ import expect from '@kbn/expect';
 // @ts-ignore
 import fetch from 'node-fetch';
 import { getUrl } from '@kbn/test';
+import moment from 'moment';
 import { FtrService } from '../ftr_provider_context';
 
 interface NavigateProps {
@@ -502,11 +503,47 @@ export class CommonPageObject extends FtrService {
     }
   }
 
-  async setTime(time: { from: string; to: string }) {
-    await this.kibanaServer.uiSettings.replace({ 'timepicker:timeDefaults': JSON.stringify(time) });
+  /**
+   * Due to a warning thrown, documented at:
+   * https://github.com/elastic/kibana/pull/114997#issuecomment-950823874
+   * this fn formats time in a format specified, or defaulted
+   * to the same format in
+   * [getTimeDurationInHours()](https://github.com/elastic/kibana/blob/main/test/functional/page_objects/time_picker.ts#L256)
+   * @param time
+   * @param fmt
+   */
+  formatTime(time: TimeStrings, fmt: string = 'MMM D, YYYY @ HH:mm:ss.SSS') {
+    return Object.keys(time)
+      .map((x) => moment(time[x], [fmt]).format())
+      .reduce(
+        (acc, curr, idx) => {
+          if (idx === 0) acc.from = curr;
+          acc.to = curr;
+          return acc;
+        },
+        { from: '', to: '' }
+      );
+  }
+
+  /**
+   * Previously, many tests were using the time picker.
+   * To speed things up, we are now setting time here.
+   * The formatting fn is called here, such that the tests
+   * that were using the time picker can use the same time
+   * parameters as before, but they are auto-formatted.
+   * @param time
+   */
+  async setTime(time: TimeStrings) {
+    await this.kibanaServer.uiSettings.replace({
+      'timepicker:timeDefaults': JSON.stringify(this.formatTime(time)),
+    });
   }
 
   async unsetTime() {
     await this.kibanaServer.uiSettings.unset('timepicker:timeDefaults');
   }
 }
+export interface TimeStrings extends Record<string, any> {
+  from: string;
+  to: string;
+}
diff --git a/test/functional/services/common/index.ts b/test/functional/services/common/index.ts
index 95f58027fd5fb..c5f442c191543 100644
--- a/test/functional/services/common/index.ts
+++ b/test/functional/services/common/index.ts
@@ -6,7 +6,8 @@
  * Side Public License, v 1.
  */
 
-export { BrowserProvider, Browser } from './browser';
+export type { Browser } from './browser';
+export { BrowserProvider } from './browser';
 export { FailureDebuggingProvider } from './failure_debugging';
 export { FindProvider } from './find';
 export { ScreenshotsService } from './screenshots';
diff --git a/test/interpreter_functional/plugins/kbn_tp_run_pipeline/public/index.ts b/test/interpreter_functional/plugins/kbn_tp_run_pipeline/public/index.ts
index 22afda2fdce1b..897fbf832d561 100644
--- a/test/interpreter_functional/plugins/kbn_tp_run_pipeline/public/index.ts
+++ b/test/interpreter_functional/plugins/kbn_tp_run_pipeline/public/index.ts
@@ -8,7 +8,7 @@
 
 import { PluginInitializer, PluginInitializerContext } from 'src/core/public';
 import { Plugin, StartDeps } from './plugin';
-export { StartDeps };
+export type { StartDeps };
 
 export const plugin: PluginInitializer<void, void, {}, StartDeps> = (
   initializerContext: PluginInitializerContext
diff --git a/test/interpreter_functional/plugins/kbn_tp_run_pipeline/public/types.ts b/test/interpreter_functional/plugins/kbn_tp_run_pipeline/public/types.ts
index a9b597ebf1e05..02872843cf8bc 100644
--- a/test/interpreter_functional/plugins/kbn_tp_run_pipeline/public/types.ts
+++ b/test/interpreter_functional/plugins/kbn_tp_run_pipeline/public/types.ts
@@ -9,4 +9,5 @@
 import { ExpressionsStart, ExpressionRenderHandler } from 'src/plugins/expressions/public';
 import { Adapters } from 'src/plugins/inspector/public';
 
-export { ExpressionsStart, ExpressionRenderHandler, Adapters };
+export type { ExpressionsStart, Adapters };
+export { ExpressionRenderHandler };
diff --git a/test/plugin_functional/plugins/core_plugin_a/server/index.ts b/test/plugin_functional/plugins/core_plugin_a/server/index.ts
index f4b9f96f1bcdd..7fad3cf7a9e3b 100644
--- a/test/plugin_functional/plugins/core_plugin_a/server/index.ts
+++ b/test/plugin_functional/plugins/core_plugin_a/server/index.ts
@@ -7,6 +7,6 @@
  */
 
 import { CorePluginAPlugin } from './plugin';
-export { PluginAApiRequestContext } from './plugin';
+export type { PluginAApiRequestContext } from './plugin';
 
 export const plugin = () => new CorePluginAPlugin();
diff --git a/typings/@elastic/eui/index.d.ts b/typings/@elastic/eui/index.d.ts
index f5baf73df7057..814a386a3b5e7 100644
--- a/typings/@elastic/eui/index.d.ts
+++ b/typings/@elastic/eui/index.d.ts
@@ -11,7 +11,3 @@
 declare module '@elastic/eui/lib/services' {
   export const RIGHT_ALIGNMENT: any;
 }
-
-declare module '@elastic/eui/lib/services/format' {
-  export const dateFormatAliases: any;
-}
diff --git a/typings/accept.d.ts b/typings/accept.d.ts
deleted file mode 100644
index e868063c7f7c0..0000000000000
--- a/typings/accept.d.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-declare module 'accept' {
-  // @types/accept does not include the `preferences` argument so we override the type to include it
-  export function encodings(encodingHeader?: string, preferences?: string[]): string[];
-}
diff --git a/typings/js_levenshtein.d.ts b/typings/js_levenshtein.d.ts
deleted file mode 100644
index 7c934333dbc7b..0000000000000
--- a/typings/js_levenshtein.d.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0 and the Server Side Public License, v 1; you may not use this file except
- * in compliance with, at your election, the Elastic License 2.0 or the Server
- * Side Public License, v 1.
- */
-
-declare module 'js-levenshtein' {
-  const levenshtein: (a: string, b: string) => number;
-  export = levenshtein;
-}
diff --git a/x-pack/examples/reporting_example/common/index.ts b/x-pack/examples/reporting_example/common/index.ts
index 893bd4dee8ae1..991ec30a03b14 100644
--- a/x-pack/examples/reporting_example/common/index.ts
+++ b/x-pack/examples/reporting_example/common/index.ts
@@ -8,10 +8,7 @@
 export const PLUGIN_ID = 'reportingExample';
 export const PLUGIN_NAME = 'reportingExample';
 
-export { MyForwardableState } from './types';
+export type { MyForwardableState } from './types';
 
-export {
-  REPORTING_EXAMPLE_LOCATOR_ID,
-  ReportingExampleLocatorDefinition,
-  ReportingExampleLocatorParams,
-} from './locator';
+export type { ReportingExampleLocatorParams } from './locator';
+export { REPORTING_EXAMPLE_LOCATOR_ID, ReportingExampleLocatorDefinition } from './locator';
diff --git a/x-pack/examples/reporting_example/public/containers/main.tsx b/x-pack/examples/reporting_example/public/containers/main.tsx
index 8673c476fdc7b..e3f45b4359556 100644
--- a/x-pack/examples/reporting_example/public/containers/main.tsx
+++ b/x-pack/examples/reporting_example/public/containers/main.tsx
@@ -34,9 +34,12 @@ import { BrowserRouter as Router, useHistory } from 'react-router-dom';
 import * as Rx from 'rxjs';
 import { takeWhile } from 'rxjs/operators';
 import { ScreenshotModePluginSetup } from 'src/plugins/screenshot_mode/public';
+import type {
+  JobAppParamsPDF,
+  JobParamsPDFV2,
+  JobParamsPNGV2,
+} from '../../../../plugins/reporting/public';
 import { constants, ReportingStart } from '../../../../plugins/reporting/public';
-import type { JobParamsPDFV2 } from '../../../../plugins/reporting/server/export_types/printable_pdf_v2/types';
-import type { JobParamsPNGV2 } from '../../../../plugins/reporting/server/export_types/png_v2/types';
 
 import { REPORTING_EXAMPLE_LOCATOR_ID } from '../../common';
 
@@ -81,7 +84,7 @@ export const Main = ({ basename, reporting, screenshotMode }: ReportingExampleAp
       });
   });
 
-  const getPDFJobParamsDefault = () => {
+  const getPDFJobParamsDefault = (): JobAppParamsPDF => {
     return {
       layout: {
         id: constants.LAYOUT_TYPES.PRESERVE_LAYOUT,
diff --git a/x-pack/examples/reporting_example/public/index.ts b/x-pack/examples/reporting_example/public/index.ts
index f9f749e2b0cd0..c4c0a9b48f2cb 100644
--- a/x-pack/examples/reporting_example/public/index.ts
+++ b/x-pack/examples/reporting_example/public/index.ts
@@ -10,4 +10,4 @@ import { ReportingExamplePlugin } from './plugin';
 export function plugin() {
   return new ReportingExamplePlugin();
 }
-export { PluginSetup, PluginStart } from './types';
+export type { PluginSetup, PluginStart } from './types';
diff --git a/x-pack/examples/ui_actions_enhanced_examples/public/drilldowns/dashboard_to_discover_drilldown/index.ts b/x-pack/examples/ui_actions_enhanced_examples/public/drilldowns/dashboard_to_discover_drilldown/index.ts
index f6e1f28864140..f6c6f48e1774c 100644
--- a/x-pack/examples/ui_actions_enhanced_examples/public/drilldowns/dashboard_to_discover_drilldown/index.ts
+++ b/x-pack/examples/ui_actions_enhanced_examples/public/drilldowns/dashboard_to_discover_drilldown/index.ts
@@ -6,11 +6,9 @@
  */
 
 export { SAMPLE_DASHBOARD_TO_DISCOVER_DRILLDOWN } from './constants';
-export {
-  DashboardToDiscoverDrilldown,
-  Params as DashboardToDiscoverDrilldownParams,
-} from './drilldown';
-export {
+export type { Params as DashboardToDiscoverDrilldownParams } from './drilldown';
+export { DashboardToDiscoverDrilldown } from './drilldown';
+export type {
   ActionContext as DashboardToDiscoverActionContext,
   Config as DashboardToDiscoverConfig,
 } from './types';
diff --git a/x-pack/plugins/actions/server/builtin_action_types/index.ts b/x-pack/plugins/actions/server/builtin_action_types/index.ts
index 3351a36b38344..9988e951ae86d 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/index.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/index.ts
@@ -25,36 +25,30 @@ import { getActionType as getJiraActionType } from './jira';
 import { getActionType as getResilientActionType } from './resilient';
 import { getActionType as getTeamsActionType } from './teams';
 import { ENABLE_ITOM } from '../constants/connectors';
-export { ActionParamsType as EmailActionParams, ActionTypeId as EmailActionTypeId } from './email';
+export type { ActionParamsType as EmailActionParams } from './email';
+export { ActionTypeId as EmailActionTypeId } from './email';
+export type { ActionParamsType as IndexActionParams } from './es_index';
+export { ActionTypeId as IndexActionTypeId } from './es_index';
+export type { ActionParamsType as PagerDutyActionParams } from './pagerduty';
+export { ActionTypeId as PagerDutyActionTypeId } from './pagerduty';
+export type { ActionParamsType as ServerLogActionParams } from './server_log';
+export { ActionTypeId as ServerLogActionTypeId } from './server_log';
+export type { ActionParamsType as SlackActionParams } from './slack';
+export { ActionTypeId as SlackActionTypeId } from './slack';
+export type { ActionParamsType as WebhookActionParams } from './webhook';
+export { ActionTypeId as WebhookActionTypeId } from './webhook';
+export type { ActionParamsType as ServiceNowActionParams } from './servicenow';
 export {
-  ActionParamsType as IndexActionParams,
-  ActionTypeId as IndexActionTypeId,
-} from './es_index';
-export {
-  ActionParamsType as PagerDutyActionParams,
-  ActionTypeId as PagerDutyActionTypeId,
-} from './pagerduty';
-export {
-  ActionParamsType as ServerLogActionParams,
-  ActionTypeId as ServerLogActionTypeId,
-} from './server_log';
-export { ActionParamsType as SlackActionParams, ActionTypeId as SlackActionTypeId } from './slack';
-export {
-  ActionParamsType as WebhookActionParams,
-  ActionTypeId as WebhookActionTypeId,
-} from './webhook';
-export {
-  ActionParamsType as ServiceNowActionParams,
   ServiceNowITSMActionTypeId,
   ServiceNowSIRActionTypeId,
   ServiceNowITOMActionTypeId,
 } from './servicenow';
-export { ActionParamsType as JiraActionParams, ActionTypeId as JiraActionTypeId } from './jira';
-export {
-  ActionParamsType as ResilientActionParams,
-  ActionTypeId as ResilientActionTypeId,
-} from './resilient';
-export { ActionParamsType as TeamsActionParams, ActionTypeId as TeamsActionTypeId } from './teams';
+export type { ActionParamsType as JiraActionParams } from './jira';
+export { ActionTypeId as JiraActionTypeId } from './jira';
+export type { ActionParamsType as ResilientActionParams } from './resilient';
+export { ActionTypeId as ResilientActionTypeId } from './resilient';
+export type { ActionParamsType as TeamsActionParams } from './teams';
+export { ActionTypeId as TeamsActionTypeId } from './teams';
 
 export function registerBuiltInActionTypes({
   actionsConfigUtils: configurationUtilities,
diff --git a/x-pack/plugins/actions/server/lib/errors/index.ts b/x-pack/plugins/actions/server/lib/errors/index.ts
index e4035213359a3..bae42db6dd1e9 100644
--- a/x-pack/plugins/actions/server/lib/errors/index.ts
+++ b/x-pack/plugins/actions/server/lib/errors/index.ts
@@ -13,4 +13,5 @@ export function isErrorThatHandlesItsOwnResponse(
   return typeof (e as ErrorThatHandlesItsOwnResponse).sendResponse === 'function';
 }
 
-export { ActionTypeDisabledError, ActionTypeDisabledReason } from './action_type_disabled';
+export type { ActionTypeDisabledReason } from './action_type_disabled';
+export { ActionTypeDisabledError } from './action_type_disabled';
diff --git a/x-pack/plugins/actions/server/lib/index.ts b/x-pack/plugins/actions/server/lib/index.ts
index c52a8b14ee6d8..d981b3bcc82e0 100644
--- a/x-pack/plugins/actions/server/lib/index.ts
+++ b/x-pack/plugins/actions/server/lib/index.ts
@@ -13,8 +13,10 @@ export {
   validateConnector,
 } from './validate_with_schema';
 export { TaskRunnerFactory } from './task_runner_factory';
-export { ActionExecutor, ActionExecutorContract } from './action_executor';
-export { ILicenseState, LicenseState } from './license_state';
+export type { ActionExecutorContract } from './action_executor';
+export { ActionExecutor } from './action_executor';
+export type { ILicenseState } from './license_state';
+export { LicenseState } from './license_state';
 export { verifyApiAccess } from './verify_api_access';
 export { getActionTypeFeatureUsageName } from './get_action_type_feature_usage_name';
 export { spaceIdToNamespace } from './space_id_to_namespace';
@@ -22,13 +24,10 @@ export {
   extractSavedObjectReferences,
   injectSavedObjectReferences,
 } from './action_task_params_utils';
+export type { ActionTypeDisabledReason } from './errors';
+export { ActionTypeDisabledError, isErrorThatHandlesItsOwnResponse } from './errors';
+export type { ActionExecutionSource } from './action_execution_source';
 export {
-  ActionTypeDisabledError,
-  ActionTypeDisabledReason,
-  isErrorThatHandlesItsOwnResponse,
-} from './errors';
-export {
-  ActionExecutionSource,
   asSavedObjectExecutionSource,
   isSavedObjectExecutionSource,
   asHttpRequestExecutionSource,
diff --git a/x-pack/plugins/actions/server/types.ts b/x-pack/plugins/actions/server/types.ts
index 627cd7028e5b1..9b7a8280cd27c 100644
--- a/x-pack/plugins/actions/server/types.ts
+++ b/x-pack/plugins/actions/server/types.ts
@@ -20,11 +20,11 @@ import {
 } from '../../../../src/core/server';
 import { ActionTypeExecutorResult } from '../common';
 import { TaskInfo } from './lib/action_executor';
-export { ActionTypeExecutorResult } from '../common';
-export { GetFieldsByIssueTypeResponse as JiraGetFieldsResponse } from './builtin_action_types/jira/types';
-export { GetCommonFieldsResponse as ServiceNowGetFieldsResponse } from './builtin_action_types/servicenow/types';
-export { GetCommonFieldsResponse as ResilientGetFieldsResponse } from './builtin_action_types/resilient/types';
-export { SwimlanePublicConfigurationType } from './builtin_action_types/swimlane/types';
+export type { ActionTypeExecutorResult } from '../common';
+export type { GetFieldsByIssueTypeResponse as JiraGetFieldsResponse } from './builtin_action_types/jira/types';
+export type { GetCommonFieldsResponse as ServiceNowGetFieldsResponse } from './builtin_action_types/servicenow/types';
+export type { GetCommonFieldsResponse as ResilientGetFieldsResponse } from './builtin_action_types/resilient/types';
+export type { SwimlanePublicConfigurationType } from './builtin_action_types/swimlane/types';
 export type WithoutQueryAndParams<T> = Pick<T, Exclude<keyof T, 'query' | 'params'>>;
 export type GetServicesFunction = (request: KibanaRequest) => Services;
 export type ActionTypeRegistryContract = PublicMethodsOf<ActionTypeRegistry>;
diff --git a/x-pack/plugins/alerting/server/alert_instance/index.ts b/x-pack/plugins/alerting/server/alert_instance/index.ts
index c342c2f6bd051..7b5dd064c5dca 100644
--- a/x-pack/plugins/alerting/server/alert_instance/index.ts
+++ b/x-pack/plugins/alerting/server/alert_instance/index.ts
@@ -5,5 +5,6 @@
  * 2.0.
  */
 
-export { AlertInstance, PublicAlertInstance } from './alert_instance';
+export type { PublicAlertInstance } from './alert_instance';
+export { AlertInstance } from './alert_instance';
 export { createAlertInstanceFactory } from './create_alert_instance_factory';
diff --git a/x-pack/plugins/alerting/server/index.ts b/x-pack/plugins/alerting/server/index.ts
index 2ddb6ff711c46..8ed91cc821412 100644
--- a/x-pack/plugins/alerting/server/index.ts
+++ b/x-pack/plugins/alerting/server/index.ts
@@ -30,9 +30,9 @@ export type {
   RuleParamsAndRefs,
 } from './types';
 export { DEFAULT_MAX_EPHEMERAL_ACTIONS_PER_ALERT } from './config';
-export { PluginSetupContract, PluginStartContract } from './plugin';
-export { FindResult } from './rules_client';
-export { PublicAlertInstance as AlertInstance } from './alert_instance';
+export type { PluginSetupContract, PluginStartContract } from './plugin';
+export type { FindResult } from './rules_client';
+export type { PublicAlertInstance as AlertInstance } from './alert_instance';
 export { parseDuration } from './lib';
 export { getEsErrorMessage } from './lib/errors';
 export {
diff --git a/x-pack/plugins/alerting/server/lib/errors/index.ts b/x-pack/plugins/alerting/server/lib/errors/index.ts
index 66db39916832a..36ca30bc95ba8 100644
--- a/x-pack/plugins/alerting/server/lib/errors/index.ts
+++ b/x-pack/plugins/alerting/server/lib/errors/index.ts
@@ -14,5 +14,7 @@ export function isErrorThatHandlesItsOwnResponse(
   return typeof (e as ErrorThatHandlesItsOwnResponse).sendResponse === 'function';
 }
 
-export { ErrorThatHandlesItsOwnResponse, ElasticsearchError, getEsErrorMessage };
-export { AlertTypeDisabledError, AlertTypeDisabledReason } from './alert_type_disabled';
+export type { ErrorThatHandlesItsOwnResponse, ElasticsearchError };
+export { getEsErrorMessage };
+export type { AlertTypeDisabledReason } from './alert_type_disabled';
+export { AlertTypeDisabledError } from './alert_type_disabled';
diff --git a/x-pack/plugins/alerting/server/lib/index.ts b/x-pack/plugins/alerting/server/lib/index.ts
index ed55548307e7c..24f2513e1c650 100644
--- a/x-pack/plugins/alerting/server/lib/index.ts
+++ b/x-pack/plugins/alerting/server/lib/index.ts
@@ -6,18 +6,18 @@
  */
 
 export { parseDuration, validateDurationSchema } from '../../common/parse_duration';
-export { ILicenseState, LicenseState } from './license_state';
+export type { ILicenseState } from './license_state';
+export { LicenseState } from './license_state';
 export { validateAlertTypeParams } from './validate_alert_type_params';
 export { getAlertNotifyWhenType } from './get_alert_notify_when_type';
 export { verifyApiAccess } from './license_api_access';
 export { ErrorWithReason, getReasonFromError, isErrorWithReason } from './error_with_reason';
-export {
-  AlertTypeDisabledError,
+export type {
   AlertTypeDisabledReason,
   ErrorThatHandlesItsOwnResponse,
-  isErrorThatHandlesItsOwnResponse,
   ElasticsearchError,
 } from './errors';
+export { AlertTypeDisabledError, isErrorThatHandlesItsOwnResponse } from './errors';
 export {
   executionStatusFromState,
   executionStatusFromError,
diff --git a/x-pack/plugins/alerting/server/routes/lib/index.ts b/x-pack/plugins/alerting/server/routes/lib/index.ts
index dc8f3ac3b5de9..2c14660ae47de 100644
--- a/x-pack/plugins/alerting/server/routes/lib/index.ts
+++ b/x-pack/plugins/alerting/server/routes/lib/index.ts
@@ -11,6 +11,10 @@ export {
   isSecurityPluginDisabledError,
 } from './error_handler';
 export { renameKeys } from './rename_keys';
-export { AsApiContract, RewriteRequestCase, RewriteResponseCase } from './rewrite_request_case';
+export type {
+  AsApiContract,
+  RewriteRequestCase,
+  RewriteResponseCase,
+} from './rewrite_request_case';
 export { verifyAccessAndContext } from './verify_access_and_context';
 export { countUsageOfPredefinedIds } from './count_usage_of_predefined_ids';
diff --git a/x-pack/plugins/apm/dev_docs/routing_and_linking.md b/x-pack/plugins/apm/dev_docs/routing_and_linking.md
index a1fdff3821c4c..1f6160a6c4a99 100644
--- a/x-pack/plugins/apm/dev_docs/routing_and_linking.md
+++ b/x-pack/plugins/apm/dev_docs/routing_and_linking.md
@@ -52,7 +52,7 @@ const {
 
 `useApmParams` will strip query parameters for which there is no validation. The route path should match exactly, but you can also use wildcards: `useApmParams('/*)`. In that case, the return type will be a union type of all possible matching routes.
 
-Previously we used `useUrlParams` for path and query parameters, which we are trying to get away from. When possible, any usage of `useUrlParams` should be replaced by `useApmParams` or other custom hooks that use `useApmParams` internally.
+Previously we used `useLegacyUrlParams` for path and query parameters, which we are trying to get away from. When possible, any usage of `useLegacyUrlParams` should be replaced by `useApmParams` or other custom hooks that use `useApmParams` internally.
 
 ## Linking
 
diff --git a/x-pack/plugins/apm/dev_docs/testing.md b/x-pack/plugins/apm/dev_docs/testing.md
index 95ba2467befcd..2a7533402ecca 100644
--- a/x-pack/plugins/apm/dev_docs/testing.md
+++ b/x-pack/plugins/apm/dev_docs/testing.md
@@ -27,7 +27,7 @@ API tests are separated in two suites:
 node scripts/test/api [--trial] [--help]
 ```
 
-The API tests are located in `x-pack/test/apm_api_integration/`.
+The API tests are located in [`x-pack/test/apm_api_integration/`](/x-pack/test/apm_api_integration/).
 
 **API Test tips**
 
@@ -43,11 +43,12 @@ The API tests are located in `x-pack/test/apm_api_integration/`.
 node scripts/test/e2e [--trial] [--help]
 ```
 
-The E2E tests are located [here](../ftr_e2e)
+The E2E tests are located in [`x-pack/plugins/apm/ftr_e2e`](../ftr_e2e)
 
 ---
 
 ## Functional tests (Security and Correlations tests)
+
 TODO: We could try moving this tests to the new e2e tests located at `x-pack/plugins/apm/ftr_e2e`.
 
 **Start server**
@@ -66,10 +67,10 @@ APM tests are located in `x-pack/test/functional/apps/apm`.
 For debugging access Elasticsearch on http://localhost:9220` (elastic/changeme)
 diff --git a/x-pack/plugins/apm/scripts/test/README.md b/x-pack/plugins/apm/scripts/test/README.md
 
-
 ## Storybook
 
 ### Start
+
 ```
 yarn storybook apm
 ```
@@ -77,6 +78,7 @@ yarn storybook apm
 All files with a .stories.tsx extension will be loaded. You can access the development environment at http://localhost:9001.
 
 ## Data generation
+
 For end-to-end (e.g. agent -> apm server -> elasticsearch <- kibana) development and testing of Elastic APM please check the the [APM Integration Testing repository](https://github.com/elastic/apm-integration-testing).
 
-Data can also be generated using the [elastic-apm-synthtrace](../../../../packages/elastic-apm-synthtrace/README.md) CLI.
\ No newline at end of file
+Data can also be generated using the [elastic-apm-synthtrace](../../../../packages/elastic-apm-synthtrace/README.md) CLI.
diff --git a/x-pack/plugins/apm/ftr_e2e/cypress_open.ts b/x-pack/plugins/apm/ftr_e2e/cypress_open.ts
deleted file mode 100644
index 3f7758b40b90d..0000000000000
--- a/x-pack/plugins/apm/ftr_e2e/cypress_open.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { FtrConfigProviderContext } from '@kbn/test';
-import { cypressOpenTests } from './cypress_start';
-
-async function openE2ETests({ readConfigFile }: FtrConfigProviderContext) {
-  const kibanaConfig = await readConfigFile(require.resolve('./config.ts'));
-  return {
-    ...kibanaConfig.getAll(),
-    testRunner: cypressOpenTests,
-  };
-}
-
-// eslint-disable-next-line import/no-default-export
-export default openE2ETests;
diff --git a/x-pack/plugins/apm/ftr_e2e/cypress_run.ts b/x-pack/plugins/apm/ftr_e2e/cypress_run.ts
deleted file mode 100644
index 16f93b39910f3..0000000000000
--- a/x-pack/plugins/apm/ftr_e2e/cypress_run.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-import { argv } from 'yargs';
-import { FtrConfigProviderContext } from '@kbn/test';
-import { cypressRunTests } from './cypress_start';
-
-const specArg = argv.spec as string | undefined;
-
-async function runE2ETests({ readConfigFile }: FtrConfigProviderContext) {
-  const kibanaConfig = await readConfigFile(require.resolve('./config.ts'));
-  return {
-    ...kibanaConfig.getAll(),
-    testRunner: cypressRunTests(specArg),
-  };
-}
-
-// eslint-disable-next-line import/no-default-export
-export default runE2ETests;
diff --git a/x-pack/plugins/apm/ftr_e2e/cypress_start.ts b/x-pack/plugins/apm/ftr_e2e/cypress_start.ts
index 2d0be8c007089..c8ab216cbce5c 100644
--- a/x-pack/plugins/apm/ftr_e2e/cypress_start.ts
+++ b/x-pack/plugins/apm/ftr_e2e/cypress_start.ts
@@ -7,30 +7,16 @@
 
 /* eslint-disable no-console */
 
+import { argv } from 'yargs';
 import Url from 'url';
 import cypress from 'cypress';
 import { FtrProviderContext } from './ftr_provider_context';
 import { createApmUsersAndRoles } from '../scripts/create-apm-users-and-roles/create_apm_users_and_roles';
 import { esArchiverLoad, esArchiverUnload } from './cypress/tasks/es_archiver';
 
-export function cypressRunTests(spec?: string) {
-  return async ({ getService }: FtrProviderContext) => {
-    const result = await cypressStart(getService, cypress.run, spec);
-
-    if (result && (result.status === 'failed' || result.totalFailed > 0)) {
-      throw new Error(`APM Cypress tests failed`);
-    }
-  };
-}
-
-export async function cypressOpenTests({ getService }: FtrProviderContext) {
-  await cypressStart(getService, cypress.open);
-}
-
-async function cypressStart(
+export async function cypressStart(
   getService: FtrProviderContext['getService'],
-  cypressExecution: typeof cypress.run | typeof cypress.open,
-  spec?: string
+  cypressExecution: typeof cypress.run | typeof cypress.open
 ) {
   const config = getService('config');
 
@@ -68,8 +54,9 @@ async function cypressStart(
   console.log(`Loading ES archive "${archiveName}"`);
   await esArchiverLoad(archiveName);
 
+  const spec = argv.grep as string | undefined;
   const res = await cypressExecution({
-    ...(spec !== undefined ? { spec } : {}),
+    ...(spec ? { spec } : {}),
     config: { baseUrl: kibanaUrl },
     env: {
       KIBANA_URL: kibanaUrl,
diff --git a/x-pack/plugins/apm/ftr_e2e/config.ts b/x-pack/plugins/apm/ftr_e2e/ftr_config.ts
similarity index 100%
rename from x-pack/plugins/apm/ftr_e2e/config.ts
rename to x-pack/plugins/apm/ftr_e2e/ftr_config.ts
diff --git a/x-pack/plugins/apm/ftr_e2e/ftr_config_open.ts b/x-pack/plugins/apm/ftr_e2e/ftr_config_open.ts
new file mode 100644
index 0000000000000..92f605d328789
--- /dev/null
+++ b/x-pack/plugins/apm/ftr_e2e/ftr_config_open.ts
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrConfigProviderContext } from '@kbn/test';
+import cypress from 'cypress';
+import { FtrProviderContext } from './ftr_provider_context';
+import { cypressStart } from './cypress_start';
+
+async function ftrConfigOpen({ readConfigFile }: FtrConfigProviderContext) {
+  const kibanaConfig = await readConfigFile(require.resolve('./ftr_config.ts'));
+  return {
+    ...kibanaConfig.getAll(),
+    testRunner,
+  };
+}
+
+export async function testRunner({ getService }: FtrProviderContext) {
+  await cypressStart(getService, cypress.open);
+}
+
+// eslint-disable-next-line import/no-default-export
+export default ftrConfigOpen;
diff --git a/x-pack/plugins/apm/ftr_e2e/ftr_config_run.ts b/x-pack/plugins/apm/ftr_e2e/ftr_config_run.ts
new file mode 100644
index 0000000000000..51c859a8477f2
--- /dev/null
+++ b/x-pack/plugins/apm/ftr_e2e/ftr_config_run.ts
@@ -0,0 +1,30 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrConfigProviderContext } from '@kbn/test';
+import cypress from 'cypress';
+import { cypressStart } from './cypress_start';
+import { FtrProviderContext } from './ftr_provider_context';
+
+async function ftrConfigRun({ readConfigFile }: FtrConfigProviderContext) {
+  const kibanaConfig = await readConfigFile(require.resolve('./ftr_config.ts'));
+  return {
+    ...kibanaConfig.getAll(),
+    testRunner,
+  };
+}
+
+async function testRunner({ getService }: FtrProviderContext) {
+  const result = await cypressStart(getService, cypress.run);
+
+  if (result && (result.status === 'failed' || result.totalFailed > 0)) {
+    throw new Error(`APM Cypress tests failed`);
+  }
+}
+
+// eslint-disable-next-line import/no-default-export
+export default ftrConfigRun;
diff --git a/x-pack/plugins/apm/jest.config.js b/x-pack/plugins/apm/jest.config.js
index 66b4b164a794c..cc985407698bf 100644
--- a/x-pack/plugins/apm/jest.config.js
+++ b/x-pack/plugins/apm/jest.config.js
@@ -19,5 +19,6 @@ module.exports = {
   coverageReporters: ['text', 'html'],
   collectCoverageFrom: [
     '<rootDir>/x-pack/plugins/apm/{common,public,server}/**/*.{js,ts,tsx}',
+    '!<rootDir>/**/*.stories.*',
   ],
 };
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/ActionMenu/index.tsx b/x-pack/plugins/apm/public/components/app/RumDashboard/ActionMenu/index.tsx
index 593de7c3a6f70..3bf21de7487de 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/ActionMenu/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/ActionMenu/index.tsx
@@ -12,7 +12,7 @@ import {
   createExploratoryViewUrl,
   HeaderMenuPortal,
 } from '../../../../../../observability/public';
-import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../context/url_params_context/use_url_params';
 import { useKibana } from '../../../../../../../../src/plugins/kibana_react/public';
 import { AppMountParameters } from '../../../../../../../../src/core/public';
 import { InspectorHeaderLink } from '../../../shared/apm_header_action_menu/inspector_header_link';
@@ -38,7 +38,7 @@ export function UXActionMenu({
   const {
     services: { http },
   } = useKibana();
-  const { urlParams } = useUrlParams();
+  const { urlParams } = useLegacyUrlParams();
   const { rangeTo, rangeFrom, serviceName } = urlParams;
 
   const uxExploratoryViewLink = createExploratoryViewUrl(
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/Charts/PageViewsChart.tsx b/x-pack/plugins/apm/public/components/app/RumDashboard/Charts/PageViewsChart.tsx
index 6be2eada6a9ec..e5ee427e16677 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/Charts/PageViewsChart.tsx
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/Charts/PageViewsChart.tsx
@@ -28,7 +28,7 @@ import moment from 'moment';
 import React from 'react';
 import { useHistory } from 'react-router-dom';
 import { useUiSetting$ } from '../../../../../../../../src/plugins/kibana_react/public';
-import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../context/url_params_context/use_url_params';
 import { fromQuery, toQuery } from '../../../shared/Links/url_helpers';
 import { ChartWrapper } from '../ChartWrapper';
 import { I18LABELS } from '../translations';
@@ -43,7 +43,7 @@ interface Props {
 
 export function PageViewsChart({ data, loading }: Props) {
   const history = useHistory();
-  const { urlParams } = useUrlParams();
+  const { urlParams } = useLegacyUrlParams();
 
   const { start, end } = urlParams;
   const diffInDays = moment(new Date(end as string)).diff(
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/ClientMetrics/index.tsx b/x-pack/plugins/apm/public/components/app/RumDashboard/ClientMetrics/index.tsx
index c525a71ea4589..7c48531d21990 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/ClientMetrics/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/ClientMetrics/index.tsx
@@ -15,13 +15,13 @@ import {
 } from '@elastic/eui';
 import { I18LABELS } from '../translations';
 import { getPercentileLabel } from '../UXMetrics/translations';
-import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../context/url_params_context/use_url_params';
 import { Metrics } from './Metrics';
 
 export function ClientMetrics() {
   const {
     urlParams: { percentile },
-  } = useUrlParams();
+  } = useLegacyUrlParams();
 
   return (
     <EuiPanel hasBorder={true}>
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/ImpactfulMetrics/JSErrors.tsx b/x-pack/plugins/apm/public/components/app/RumDashboard/ImpactfulMetrics/JSErrors.tsx
index c8956c091d267..b8bdc36ed4e0d 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/ImpactfulMetrics/JSErrors.tsx
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/ImpactfulMetrics/JSErrors.tsx
@@ -18,7 +18,7 @@ import {
 import numeral from '@elastic/numeral';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../context/url_params_context/use_url_params';
 import { FETCH_STATUS, useFetcher } from '../../../../hooks/use_fetcher';
 import { I18LABELS } from '../translations';
 import { CsmSharedContext } from '../CsmSharedContext';
@@ -31,7 +31,7 @@ interface JSErrorItem {
 }
 
 export function JSErrors() {
-  const { urlParams, uxUiFilters } = useUrlParams();
+  const { urlParams, uxUiFilters } = useLegacyUrlParams();
 
   const { start, end, serviceName, searchTerm } = urlParams;
 
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/LocalUIFilters/SelectedFilters.tsx b/x-pack/plugins/apm/public/components/app/RumDashboard/LocalUIFilters/SelectedFilters.tsx
index ee0827c4d81e5..d9f9154c5c100 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/LocalUIFilters/SelectedFilters.tsx
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/LocalUIFilters/SelectedFilters.tsx
@@ -9,7 +9,7 @@ import React, { Fragment } from 'react';
 import { EuiButtonEmpty, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import styled from 'styled-components';
-import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../context/url_params_context/use_url_params';
 import { FilterValueLabel } from '../../../../../../observability/public';
 import { FiltersUIHook } from '../hooks/useLocalUIFilters';
 import { UxLocalUIFilterName } from '../../../../../common/ux_ui_filter';
@@ -38,7 +38,7 @@ export function SelectedFilters({
   const {
     uxUiFilters,
     urlParams: { searchTerm },
-  } = useUrlParams();
+  } = useLegacyUrlParams();
   const { transactionUrl } = uxUiFilters;
 
   const urlValues = transactionUrl ?? [];
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/LocalUIFilters/selected_wildcards.tsx b/x-pack/plugins/apm/public/components/app/RumDashboard/LocalUIFilters/selected_wildcards.tsx
index 1bc0807bd2f71..6a9dfd1fddd11 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/LocalUIFilters/selected_wildcards.tsx
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/LocalUIFilters/selected_wildcards.tsx
@@ -9,7 +9,7 @@ import * as React from 'react';
 import { useCallback } from 'react';
 import { useHistory } from 'react-router-dom';
 import { FilterValueLabel } from '../../../../../../observability/public';
-import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../context/url_params_context/use_url_params';
 import { fromQuery, toQuery } from '../../../shared/Links/url_helpers';
 import { TRANSACTION_URL } from '../../../../../common/elasticsearch_fieldnames';
 import { IndexPattern } from '../../../../../../../../src/plugins/data_views/common';
@@ -22,7 +22,7 @@ export function SelectedWildcards({ indexPattern }: Props) {
 
   const {
     urlParams: { searchTerm },
-  } = useUrlParams();
+  } = useLegacyUrlParams();
 
   const updateSearchTerm = useCallback(
     (searchTermN: string) => {
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/PageLoadDistribution/index.tsx b/x-pack/plugins/apm/public/components/app/RumDashboard/PageLoadDistribution/index.tsx
index a9dac0a37c353..f75d0fd093b5a 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/PageLoadDistribution/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/PageLoadDistribution/index.tsx
@@ -14,7 +14,7 @@ import {
   EuiTitle,
 } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../context/url_params_context/use_url_params';
 import { useFetcher } from '../../../../hooks/use_fetcher';
 import { I18LABELS } from '../translations';
 import { BreakdownFilter } from '../Breakdowns/BreakdownFilter';
@@ -34,7 +34,7 @@ export function PageLoadDistribution() {
     services: { http },
   } = useKibana();
 
-  const { urlParams, uxUiFilters } = useUrlParams();
+  const { urlParams, uxUiFilters } = useLegacyUrlParams();
 
   const { start, end, rangeFrom, rangeTo, searchTerm } = urlParams;
 
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/PageLoadDistribution/use_breakdowns.ts b/x-pack/plugins/apm/public/components/app/RumDashboard/PageLoadDistribution/use_breakdowns.ts
index e43ba9c7e557e..0cfa293c87844 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/PageLoadDistribution/use_breakdowns.ts
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/PageLoadDistribution/use_breakdowns.ts
@@ -6,7 +6,7 @@
  */
 
 import { useFetcher } from '../../../../hooks/use_fetcher';
-import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../context/url_params_context/use_url_params';
 import { PercentileRange } from './index';
 
 interface Props {
@@ -16,7 +16,7 @@ interface Props {
 }
 
 export const useBreakdowns = ({ percentileRange, field, value }: Props) => {
-  const { urlParams, uxUiFilters } = useUrlParams();
+  const { urlParams, uxUiFilters } = useLegacyUrlParams();
   const { start, end, searchTerm } = urlParams;
   const { min: minP, max: maxP } = percentileRange ?? {};
 
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/PageViewsTrend/index.tsx b/x-pack/plugins/apm/public/components/app/RumDashboard/PageViewsTrend/index.tsx
index 5f7c0738e5642..581260f5931e7 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/PageViewsTrend/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/PageViewsTrend/index.tsx
@@ -14,7 +14,7 @@ import {
   EuiTitle,
 } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../context/url_params_context/use_url_params';
 import { useFetcher } from '../../../../hooks/use_fetcher';
 import { I18LABELS } from '../translations';
 import { BreakdownFilter } from '../Breakdowns/BreakdownFilter';
@@ -28,7 +28,7 @@ export function PageViewsTrend() {
     services: { http },
   } = useKibana();
 
-  const { urlParams, uxUiFilters } = useUrlParams();
+  const { urlParams, uxUiFilters } = useLegacyUrlParams();
   const { serviceName } = uxUiFilters;
 
   const { start, end, searchTerm, rangeTo, rangeFrom } = urlParams;
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/Panels/WebApplicationSelect.tsx b/x-pack/plugins/apm/public/components/app/RumDashboard/Panels/WebApplicationSelect.tsx
index 58cffb39d0a04..5b1cca0ec44fa 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/Panels/WebApplicationSelect.tsx
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/Panels/WebApplicationSelect.tsx
@@ -9,12 +9,12 @@ import React from 'react';
 import { ServiceNameFilter } from '../URLFilter/ServiceNameFilter';
 import { useFetcher } from '../../../../hooks/use_fetcher';
 import { RUM_AGENT_NAMES } from '../../../../../common/agent_name';
-import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../context/url_params_context/use_url_params';
 
 export function WebApplicationSelect() {
   const {
     urlParams: { start, end },
-  } = useUrlParams();
+  } = useLegacyUrlParams();
 
   const { data, status } = useFetcher(
     (callApmApi) => {
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/RumHome.tsx b/x-pack/plugins/apm/public/components/app/RumDashboard/RumHome.tsx
index cc4bd0d14e290..54c34121ea0cb 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/RumHome.tsx
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/RumHome.tsx
@@ -48,7 +48,7 @@ export function RumHome() {
                     'Enable RUM with the APM agent to collect user experience data.',
                 }
               ),
-              href: core.http.basePath.prepend(`integrations/detail/apm`),
+              href: core.http.basePath.prepend(`/app/home#/tutorial/apm`),
             },
           },
           docsLink: core.docLinks.links.observability.guide,
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/URLFilter/ServiceNameFilter/index.tsx b/x-pack/plugins/apm/public/components/app/RumDashboard/URLFilter/ServiceNameFilter/index.tsx
index 5750dd9cf441e..f6891a5d8fb67 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/URLFilter/ServiceNameFilter/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/URLFilter/ServiceNameFilter/index.tsx
@@ -9,7 +9,7 @@ import { EuiSelect } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import React, { useEffect, useCallback } from 'react';
 import { useHistory } from 'react-router-dom';
-import { useUrlParams } from '../../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../../context/url_params_context/use_url_params';
 import { fromQuery, toQuery } from '../../../../shared/Links/url_helpers';
 
 interface Props {
@@ -21,7 +21,7 @@ function ServiceNameFilter({ loading, serviceNames }: Props) {
   const history = useHistory();
   const {
     urlParams: { serviceName: selectedServiceName },
-  } = useUrlParams();
+  } = useLegacyUrlParams();
 
   const options = serviceNames.map((type) => ({
     text: type,
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/URLFilter/URLSearch/index.tsx b/x-pack/plugins/apm/public/components/app/RumDashboard/URLFilter/URLSearch/index.tsx
index 7aa8d5d85e539..e34270f963599 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/URLFilter/URLSearch/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/URLFilter/URLSearch/index.tsx
@@ -8,7 +8,7 @@
 import React, { useEffect, useState } from 'react';
 import { isEqual, map } from 'lodash';
 import { i18n } from '@kbn/i18n';
-import { useUrlParams } from '../../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../../context/url_params_context/use_url_params';
 import { I18LABELS } from '../../translations';
 import { formatToSec } from '../../UXMetrics/KeyUXMetrics';
 import { getPercentileLabel } from '../../UXMetrics/translations';
@@ -93,7 +93,7 @@ export function URLSearch({
   const {
     uxUiFilters: { transactionUrl, transactionUrlExcluded },
     urlParams,
-  } = useUrlParams();
+  } = useLegacyUrlParams();
 
   const { searchTerm, percentile } = urlParams;
 
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/URLFilter/URLSearch/use_url_search.tsx b/x-pack/plugins/apm/public/components/app/RumDashboard/URLFilter/URLSearch/use_url_search.tsx
index 64f51714ed66e..7b6b093c70367 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/URLFilter/URLSearch/use_url_search.tsx
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/URLFilter/URLSearch/use_url_search.tsx
@@ -9,7 +9,7 @@ import useDebounce from 'react-use/lib/useDebounce';
 import { useState } from 'react';
 import { useFetcher } from '../../../../../hooks/use_fetcher';
 import { useUxQuery } from '../../hooks/useUxQuery';
-import { useUrlParams } from '../../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../../context/url_params_context/use_url_params';
 
 interface Props {
   popoverIsOpen: boolean;
@@ -19,7 +19,7 @@ interface Props {
 export const useUrlSearch = ({ popoverIsOpen, query }: Props) => {
   const uxQuery = useUxQuery();
 
-  const { uxUiFilters } = useUrlParams();
+  const { uxUiFilters } = useLegacyUrlParams();
 
   const { transactionUrl, transactionUrlExcluded, ...restFilters } =
     uxUiFilters;
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/UXMetrics/index.tsx b/x-pack/plugins/apm/public/components/app/RumDashboard/UXMetrics/index.tsx
index dd93a0143c05a..673f045ecfb97 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/UXMetrics/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/UXMetrics/index.tsx
@@ -20,13 +20,13 @@ import { useFetcher } from '../../../../hooks/use_fetcher';
 import { useUxQuery } from '../hooks/useUxQuery';
 import { getCoreVitalsComponent } from '../../../../../../observability/public';
 import { CsmSharedContext } from '../CsmSharedContext';
-import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../context/url_params_context/use_url_params';
 import { getPercentileLabel } from './translations';
 
 export function UXMetrics() {
   const {
     urlParams: { percentile },
-  } = useUrlParams();
+  } = useLegacyUrlParams();
 
   const uxQuery = useUxQuery();
 
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/UserPercentile/index.tsx b/x-pack/plugins/apm/public/components/app/RumDashboard/UserPercentile/index.tsx
index 0a5669095c2e5..7d05b188e9bbe 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/UserPercentile/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/UserPercentile/index.tsx
@@ -9,7 +9,7 @@ import React, { useCallback, useEffect } from 'react';
 
 import { EuiSelect } from '@elastic/eui';
 import { useHistory } from 'react-router-dom';
-import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../context/url_params_context/use_url_params';
 import { fromQuery, toQuery } from '../../../shared/Links/url_helpers';
 import { I18LABELS } from '../translations';
 
@@ -20,7 +20,7 @@ export function UserPercentile() {
 
   const {
     urlParams: { percentile },
-  } = useUrlParams();
+  } = useLegacyUrlParams();
 
   const updatePercentile = useCallback(
     (percentileN?: number, replaceHistory?: boolean) => {
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/VisitorBreakdown/index.tsx b/x-pack/plugins/apm/public/components/app/RumDashboard/VisitorBreakdown/index.tsx
index a4edd56310ea1..f044890a9b649 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/VisitorBreakdown/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/VisitorBreakdown/index.tsx
@@ -10,10 +10,10 @@ import { EuiFlexGroup, EuiFlexItem, EuiTitle, EuiSpacer } from '@elastic/eui';
 import { VisitorBreakdownChart } from '../Charts/VisitorBreakdownChart';
 import { I18LABELS, VisitorBreakdownLabel } from '../translations';
 import { useFetcher } from '../../../../hooks/use_fetcher';
-import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../context/url_params_context/use_url_params';
 
 export function VisitorBreakdown() {
-  const { urlParams, uxUiFilters } = useUrlParams();
+  const { urlParams, uxUiFilters } = useLegacyUrlParams();
 
   const { start, end, searchTerm } = urlParams;
 
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/VisitorBreakdownMap/EmbeddedMap.tsx b/x-pack/plugins/apm/public/components/app/RumDashboard/VisitorBreakdownMap/EmbeddedMap.tsx
index b468b5c913387..17a380f4d5e35 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/VisitorBreakdownMap/EmbeddedMap.tsx
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/VisitorBreakdownMap/EmbeddedMap.tsx
@@ -21,7 +21,7 @@ import {
   isErrorEmbeddable,
 } from '../../../../../../../../src/plugins/embeddable/public';
 import { useLayerList } from './useLayerList';
-import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../context/url_params_context/use_url_params';
 import { useApmPluginContext } from '../../../../context/apm_plugin/use_apm_plugin_context';
 import type { RenderTooltipContentParams } from '../../../../../../maps/public';
 import { MapToolTip } from './MapToolTip';
@@ -50,7 +50,7 @@ interface KibanaDeps {
   embeddable: EmbeddableStart;
 }
 export function EmbeddedMapComponent() {
-  const { urlParams } = useUrlParams();
+  const { urlParams } = useLegacyUrlParams();
   const apmPluginContext = useApmPluginContext();
 
   const { start, end, serviceName } = urlParams;
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/VisitorBreakdownMap/useLayerList.ts b/x-pack/plugins/apm/public/components/app/RumDashboard/VisitorBreakdownMap/useLayerList.ts
index ce42b530b80f5..7f81e9d105186 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/VisitorBreakdownMap/useLayerList.ts
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/VisitorBreakdownMap/useLayerList.ts
@@ -22,7 +22,7 @@ import {
 } from '../../../../../../maps/common';
 
 import { APM_STATIC_INDEX_PATTERN_ID } from '../../../../../common/index_pattern_constants';
-import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../context/url_params_context/use_url_params';
 import {
   SERVICE_NAME,
   TRANSACTION_TYPE,
@@ -84,7 +84,7 @@ interface VectorLayerDescriptor extends BaseVectorLayerDescriptor {
 }
 
 export function useLayerList() {
-  const { urlParams } = useUrlParams();
+  const { urlParams } = useLegacyUrlParams();
 
   const { serviceName } = urlParams;
 
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/VisitorBreakdownMap/useMapFilters.ts b/x-pack/plugins/apm/public/components/app/RumDashboard/VisitorBreakdownMap/useMapFilters.ts
index c9e8b41c26ea0..0c1b7b6b9e7ee 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/VisitorBreakdownMap/useMapFilters.ts
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/VisitorBreakdownMap/useMapFilters.ts
@@ -7,7 +7,7 @@
 
 import { useMemo } from 'react';
 import { FieldFilter as Filter } from '@kbn/es-query';
-import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../context/url_params_context/use_url_params';
 import {
   CLIENT_GEO_COUNTRY_ISO_CODE,
   SERVICE_NAME,
@@ -92,7 +92,7 @@ const existFilter: Filter = {
 };
 
 export const useMapFilters = (): Filter[] => {
-  const { urlParams, uxUiFilters } = useUrlParams();
+  const { urlParams, uxUiFilters } = useLegacyUrlParams();
 
   const { serviceName, searchTerm } = urlParams;
 
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/hooks/useLocalUIFilters.ts b/x-pack/plugins/apm/public/components/app/RumDashboard/hooks/useLocalUIFilters.ts
index 28c9488d7c82c..8045e4947dcb0 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/hooks/useLocalUIFilters.ts
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/hooks/useLocalUIFilters.ts
@@ -17,7 +17,7 @@ import {
   toQuery,
 } from '../../../../components/shared/Links/url_helpers';
 import { removeUndefinedProps } from '../../../../context/url_params_context/helpers';
-import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../context/url_params_context/use_url_params';
 import { getExcludedName } from '../LocalUIFilters';
 
 export type FiltersUIHook = ReturnType<typeof useLocalUIFilters>;
@@ -28,7 +28,7 @@ export function useLocalUIFilters({
   filterNames: UxLocalUIFilterName[];
 }) {
   const history = useHistory();
-  const { uxUiFilters } = useUrlParams();
+  const { uxUiFilters } = useLegacyUrlParams();
 
   const setFilterValue = (name: UxLocalUIFilterName, value: string[]) => {
     const search = omit(toQuery(history.location.search), name);
diff --git a/x-pack/plugins/apm/public/components/app/RumDashboard/hooks/useUxQuery.ts b/x-pack/plugins/apm/public/components/app/RumDashboard/hooks/useUxQuery.ts
index 585070d479fa8..e3f697e02a295 100644
--- a/x-pack/plugins/apm/public/components/app/RumDashboard/hooks/useUxQuery.ts
+++ b/x-pack/plugins/apm/public/components/app/RumDashboard/hooks/useUxQuery.ts
@@ -6,10 +6,10 @@
  */
 
 import { useMemo } from 'react';
-import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../context/url_params_context/use_url_params';
 
 export function useUxQuery() {
-  const { urlParams, uxUiFilters } = useUrlParams();
+  const { urlParams, uxUiFilters } = useLegacyUrlParams();
 
   const { start, end, searchTerm, percentile } = urlParams;
 
diff --git a/x-pack/plugins/apm/public/components/app/backend_detail_overview/backend_detail_dependencies_table.tsx b/x-pack/plugins/apm/public/components/app/backend_detail_overview/backend_detail_dependencies_table.tsx
index 72273bf8c9e19..4e3f7f4bee811 100644
--- a/x-pack/plugins/apm/public/components/app/backend_detail_overview/backend_detail_dependencies_table.tsx
+++ b/x-pack/plugins/apm/public/components/app/backend_detail_overview/backend_detail_dependencies_table.tsx
@@ -9,7 +9,7 @@ import { i18n } from '@kbn/i18n';
 import React from 'react';
 import { getNodeName, NodeType } from '../../../../common/connections';
 import { useApmParams } from '../../../hooks/use_apm_params';
-import { useUrlParams } from '../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../context/url_params_context/use_url_params';
 import { useFetcher } from '../../../hooks/use_fetcher';
 import { getTimeRangeComparison } from '../../shared/time_comparison/get_time_range_comparison';
 import { DependenciesTable } from '../../shared/dependencies_table';
@@ -19,7 +19,7 @@ import { useTimeRange } from '../../../hooks/use_time_range';
 export function BackendDetailDependenciesTable() {
   const {
     urlParams: { comparisonEnabled, comparisonType },
-  } = useUrlParams();
+  } = useLegacyUrlParams();
 
   const {
     query: { backendName, rangeFrom, rangeTo, kuery, environment },
diff --git a/x-pack/plugins/apm/public/components/app/backend_inventory/backend_inventory_dependencies_table/index.tsx b/x-pack/plugins/apm/public/components/app/backend_inventory/backend_inventory_dependencies_table/index.tsx
index b84e8830aae5f..9782afc8df3e8 100644
--- a/x-pack/plugins/apm/public/components/app/backend_inventory/backend_inventory_dependencies_table/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/backend_inventory/backend_inventory_dependencies_table/index.tsx
@@ -10,7 +10,7 @@ import { i18n } from '@kbn/i18n';
 import React from 'react';
 import { useUiTracker } from '../../../../../../observability/public';
 import { getNodeName, NodeType } from '../../../../../common/connections';
-import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../context/url_params_context/use_url_params';
 import { useApmParams } from '../../../../hooks/use_apm_params';
 import { useFetcher } from '../../../../hooks/use_fetcher';
 import { useTimeRange } from '../../../../hooks/use_time_range';
@@ -21,7 +21,7 @@ import { getTimeRangeComparison } from '../../../shared/time_comparison/get_time
 export function BackendInventoryDependenciesTable() {
   const {
     urlParams: { comparisonEnabled, comparisonType },
-  } = useUrlParams();
+  } = useLegacyUrlParams();
 
   const {
     query: { rangeFrom, rangeTo, environment, kuery },
diff --git a/x-pack/plugins/apm/public/components/app/error_group_details/Distribution/index.tsx b/x-pack/plugins/apm/public/components/app/error_group_details/Distribution/index.tsx
index abff050457359..4c6aa78278093 100644
--- a/x-pack/plugins/apm/public/components/app/error_group_details/Distribution/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/error_group_details/Distribution/index.tsx
@@ -29,7 +29,7 @@ import { getAlertAnnotations } from '../../../shared/charts/helper/get_alert_ann
 import { ChartContainer } from '../../../shared/charts/chart_container';
 import { useApmPluginContext } from '../../../../context/apm_plugin/use_apm_plugin_context';
 import { LazyAlertsFlyout } from '../../../../../../observability/public';
-import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../context/url_params_context/use_url_params';
 import { getTimeZone } from '../../../shared/charts/helper/timezone';
 
 const ALERT_RULE_TYPE_ID: typeof ALERT_RULE_TYPE_ID_TYPED =
@@ -48,7 +48,7 @@ export function ErrorDistribution({ distribution, title, fetchStatus }: Props) {
   const { core } = useApmPluginContext();
   const theme = useTheme();
 
-  const { urlParams } = useUrlParams();
+  const { urlParams } = useLegacyUrlParams();
   const { comparisonEnabled } = urlParams;
 
   const timeseries = [
diff --git a/x-pack/plugins/apm/public/components/app/error_group_details/index.tsx b/x-pack/plugins/apm/public/components/app/error_group_details/index.tsx
index bc12b0c64f179..f3bd8812dfd36 100644
--- a/x-pack/plugins/apm/public/components/app/error_group_details/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/error_group_details/index.tsx
@@ -20,7 +20,7 @@ import { euiStyled } from '../../../../../../../src/plugins/kibana_react/common'
 import { NOT_AVAILABLE_LABEL } from '../../../../common/i18n';
 import { useApmServiceContext } from '../../../context/apm_service/use_apm_service_context';
 import { useBreadcrumb } from '../../../context/breadcrumbs/use_breadcrumb';
-import { useUrlParams } from '../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../context/url_params_context/use_url_params';
 import { useApmParams } from '../../../hooks/use_apm_params';
 import { useApmRouter } from '../../../hooks/use_apm_router';
 import { useErrorGroupDistributionFetcher } from '../../../hooks/use_error_group_distribution_fetcher';
@@ -94,7 +94,7 @@ function ErrorGroupHeader({
 }
 
 export function ErrorGroupDetails() {
-  const { urlParams } = useUrlParams();
+  const { urlParams } = useLegacyUrlParams();
 
   const { serviceName } = useApmServiceContext();
 
diff --git a/x-pack/plugins/apm/public/components/app/error_group_overview/error_group_list/index.tsx b/x-pack/plugins/apm/public/components/app/error_group_overview/error_group_list/index.tsx
index d7c5b1f4bc358..7facc9a4ca376 100644
--- a/x-pack/plugins/apm/public/components/app/error_group_overview/error_group_list/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/error_group_overview/error_group_list/index.tsx
@@ -16,7 +16,7 @@ import { i18n } from '@kbn/i18n';
 import React, { useMemo } from 'react';
 import { euiStyled } from '../../../../../../../../src/plugins/kibana_react/common';
 import { NOT_AVAILABLE_LABEL } from '../../../../../common/i18n';
-import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../context/url_params_context/use_url_params';
 import { APIReturnType } from '../../../../services/rest/createCallApmApi';
 import { truncate, unit } from '../../../../utils/style';
 import { ErrorDetailLink } from '../../../shared/Links/apm/ErrorDetailLink';
@@ -56,7 +56,7 @@ interface Props {
 }
 
 function ErrorGroupList({ items, serviceName }: Props) {
-  const { urlParams } = useUrlParams();
+  const { urlParams } = useLegacyUrlParams();
 
   const columns = useMemo(() => {
     return [
diff --git a/x-pack/plugins/apm/public/components/app/service_inventory/index.tsx b/x-pack/plugins/apm/public/components/app/service_inventory/index.tsx
index aea7c1faab601..155de8fbdd947 100644
--- a/x-pack/plugins/apm/public/components/app/service_inventory/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_inventory/index.tsx
@@ -17,7 +17,7 @@ import uuid from 'uuid';
 import { toMountPoint } from '../../../../../../../src/plugins/kibana_react/public';
 import { useAnomalyDetectionJobsContext } from '../../../context/anomaly_detection_jobs/use_anomaly_detection_jobs_context';
 import { useApmPluginContext } from '../../../context/apm_plugin/use_apm_plugin_context';
-import { useUrlParams } from '../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../context/url_params_context/use_url_params';
 import { useLocalStorage } from '../../../hooks/useLocalStorage';
 import { useApmParams } from '../../../hooks/use_apm_params';
 import { FETCH_STATUS, useFetcher } from '../../../hooks/use_fetcher';
@@ -42,7 +42,7 @@ let hasDisplayedToast = false;
 function useServicesFetcher() {
   const {
     urlParams: { comparisonEnabled, comparisonType },
-  } = useUrlParams();
+  } = useLegacyUrlParams();
 
   const {
     query: { rangeFrom, rangeTo, environment, kuery },
diff --git a/x-pack/plugins/apm/public/components/app/service_inventory/service_inventory.stories.tsx b/x-pack/plugins/apm/public/components/app/service_inventory/service_inventory.stories.tsx
new file mode 100644
index 0000000000000..0a4adc07e1a98
--- /dev/null
+++ b/x-pack/plugins/apm/public/components/app/service_inventory/service_inventory.stories.tsx
@@ -0,0 +1,81 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { Meta, Story } from '@storybook/react';
+import React from 'react';
+import { MemoryRouter } from 'react-router-dom';
+import { CoreStart } from '../../../../../../../src/core/public';
+import { createKibanaReactContext } from '../../../../../../../src/plugins/kibana_react/public';
+import { TimeRangeComparisonEnum } from '../../../../common/runtime_types/comparison_type_rt';
+import { AnomalyDetectionJobsContext } from '../../../context/anomaly_detection_jobs/anomaly_detection_jobs_context';
+import { ApmPluginContextValue } from '../../../context/apm_plugin/apm_plugin_context';
+import { MockApmPluginContextWrapper } from '../../../context/apm_plugin/mock_apm_plugin_context';
+import { MockUrlParamsContextProvider } from '../../../context/url_params_context/mock_url_params_context_provider';
+import { FETCH_STATUS } from '../../../hooks/use_fetcher';
+import { ServiceInventory } from './';
+
+const stories: Meta<{}> = {
+  title: 'app/ServiceInventory',
+  component: ServiceInventory,
+  decorators: [
+    (StoryComponent) => {
+      const coreMock = {
+        http: {
+          get: (endpoint: string) => {
+            switch (endpoint) {
+              case '/internal/apm/services':
+                return { items: [] };
+              default:
+                return {};
+            }
+            return {};
+          },
+        },
+        notifications: { toasts: { add: () => {}, addWarning: () => {} } },
+        uiSettings: { get: () => [] },
+      } as unknown as CoreStart;
+
+      const KibanaReactContext = createKibanaReactContext(coreMock);
+
+      const anomlyDetectionJobsContextValue = {
+        anomalyDetectionJobsData: { jobs: [], hasLegacyJobs: false },
+        anomalyDetectionJobsStatus: FETCH_STATUS.SUCCESS,
+        anomalyDetectionJobsRefetch: () => {},
+      };
+
+      return (
+        <MemoryRouter
+          initialEntries={['/services?rangeFrom=now-15m&rangeTo=now']}
+        >
+          <KibanaReactContext.Provider>
+            <MockUrlParamsContextProvider
+              params={{
+                comparisonEnabled: true,
+                comparisonType: TimeRangeComparisonEnum.DayBefore,
+              }}
+            >
+              <MockApmPluginContextWrapper
+                value={{ core: coreMock } as ApmPluginContextValue}
+              >
+                <AnomalyDetectionJobsContext.Provider
+                  value={anomlyDetectionJobsContextValue}
+                >
+                  <StoryComponent />
+                </AnomalyDetectionJobsContext.Provider>
+              </MockApmPluginContextWrapper>
+            </MockUrlParamsContextProvider>
+          </KibanaReactContext.Provider>
+        </MemoryRouter>
+      );
+    },
+  ],
+};
+export default stories;
+
+export const Example: Story<{}> = () => {
+  return <ServiceInventory />;
+};
diff --git a/x-pack/plugins/apm/public/components/app/service_inventory/service_inventory.test.tsx b/x-pack/plugins/apm/public/components/app/service_inventory/service_inventory.test.tsx
index 4a020f9b0db4e..36b1053248d25 100644
--- a/x-pack/plugins/apm/public/components/app/service_inventory/service_inventory.test.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_inventory/service_inventory.test.tsx
@@ -5,249 +5,17 @@
  * 2.0.
  */
 
-import { render, waitFor } from '@testing-library/react';
-import { CoreStart } from 'kibana/public';
-import { merge } from 'lodash';
-import React, { ReactNode } from 'react';
-import { MemoryRouter } from 'react-router-dom';
-import { EuiThemeProvider } from '../../../../../../../src/plugins/kibana_react/common';
-import { createKibanaReactContext } from '../../../../../../../src/plugins/kibana_react/public';
-import { ServiceHealthStatus } from '../../../../common/service_health_status';
-import { TimeRangeComparisonEnum } from '../../../../common/runtime_types/comparison_type_rt';
-import { ServiceInventory } from '.';
-import { ApmPluginContextValue } from '../../../context/apm_plugin/apm_plugin_context';
-import {
-  mockApmPluginContextValue,
-  MockApmPluginContextWrapper,
-} from '../../../context/apm_plugin/mock_apm_plugin_context';
-import { FETCH_STATUS } from '../../../hooks/use_fetcher';
-import { clearCache } from '../../../services/rest/callApi';
-import * as useDynamicDataViewHooks from '../../../hooks/use_dynamic_data_view';
-import { SessionStorageMock } from '../../../services/__mocks__/SessionStorageMock';
-import { MockUrlParamsContextProvider } from '../../../context/url_params_context/mock_url_params_context_provider';
-import * as hook from '../../../context/anomaly_detection_jobs/use_anomaly_detection_jobs_context';
+import { composeStories } from '@storybook/testing-react';
+import { render, screen } from '@testing-library/react';
+import React from 'react';
+import * as stories from './service_inventory.stories';
 
-const KibanaReactContext = createKibanaReactContext({
-  usageCollection: { reportUiCounter: () => {} },
-} as Partial<CoreStart>);
-
-const addWarning = jest.fn();
-const httpGet = jest.fn();
-
-function wrapper({ children }: { children?: ReactNode }) {
-  const mockPluginContext = merge({}, mockApmPluginContextValue, {
-    core: {
-      http: {
-        get: httpGet,
-      },
-      notifications: {
-        toasts: {
-          addWarning,
-        },
-      },
-    },
-  }) as unknown as ApmPluginContextValue;
-
-  return (
-    <MemoryRouter initialEntries={['/services?rangeFrom=now-15m&rangeTo=now']}>
-      <EuiThemeProvider>
-        <KibanaReactContext.Provider>
-          <MockApmPluginContextWrapper value={mockPluginContext}>
-            <MockUrlParamsContextProvider
-              params={{
-                rangeFrom: 'now-15m',
-                rangeTo: 'now',
-                start: '2021-02-12T13:20:43.344Z',
-                end: '2021-02-12T13:20:58.344Z',
-                comparisonEnabled: true,
-                comparisonType: TimeRangeComparisonEnum.DayBefore,
-              }}
-            >
-              {children}
-            </MockUrlParamsContextProvider>
-          </MockApmPluginContextWrapper>
-        </KibanaReactContext.Provider>
-      </EuiThemeProvider>
-    </MemoryRouter>
-  );
-}
+const { Example } = composeStories(stories);
 
 describe('ServiceInventory', () => {
-  beforeEach(() => {
-    // @ts-expect-error
-    global.sessionStorage = new SessionStorageMock();
-    clearCache();
-
-    jest.spyOn(hook, 'useAnomalyDetectionJobsContext').mockReturnValue({
-      anomalyDetectionJobsData: { jobs: [], hasLegacyJobs: false },
-      anomalyDetectionJobsStatus: FETCH_STATUS.SUCCESS,
-      anomalyDetectionJobsRefetch: () => {},
-    });
-
-    jest
-      .spyOn(useDynamicDataViewHooks, 'useDynamicDataViewFetcher')
-      .mockReturnValue({
-        dataView: undefined,
-        status: FETCH_STATUS.SUCCESS,
-      });
-  });
-
-  afterEach(() => {
-    jest.resetAllMocks();
-  });
-
-  it('should render services, when list is not empty', async () => {
-    // mock rest requests
-    httpGet
-      .mockResolvedValueOnce({ fallbackToTransactions: false })
-      .mockResolvedValueOnce({
-        hasLegacyData: false,
-        hasHistoricalData: true,
-        items: [
-          {
-            serviceName: 'My Python Service',
-            agentName: 'python',
-            transactionsPerMinute: 100,
-            errorsPerMinute: 200,
-            avgResponseTime: 300,
-            environments: ['test', 'dev'],
-            healthStatus: ServiceHealthStatus.warning,
-          },
-          {
-            serviceName: 'My Go Service',
-            agentName: 'go',
-            transactionsPerMinute: 400,
-            errorsPerMinute: 500,
-            avgResponseTime: 600,
-            environments: [],
-            severity: ServiceHealthStatus.healthy,
-          },
-        ],
-      });
-
-    const { container, findByText } = render(<ServiceInventory />, { wrapper });
-
-    // wait for requests to be made
-    await waitFor(() => expect(httpGet).toHaveBeenCalledTimes(2));
-    await findByText('My Python Service');
-
-    expect(container.querySelectorAll('.euiTableRow')).toHaveLength(2);
-  });
-
-  it('should render empty message, when list is empty and historical data is found', async () => {
-    httpGet
-      .mockResolvedValueOnce({ fallbackToTransactions: false })
-      .mockResolvedValueOnce({
-        hasLegacyData: false,
-        hasHistoricalData: true,
-        items: [],
-      });
-
-    const { findByText } = render(<ServiceInventory />, { wrapper });
-
-    // wait for requests to be made
-    await waitFor(() => expect(httpGet).toHaveBeenCalledTimes(2));
-    const noServicesText = await findByText('No services found');
-
-    expect(noServicesText).not.toBeEmptyDOMElement();
-  });
-
-  describe('when legacy data is found', () => {
-    it('renders an upgrade migration notification', async () => {
-      httpGet
-        .mockResolvedValueOnce({ fallbackToTransactions: false })
-        .mockResolvedValueOnce({
-          hasLegacyData: true,
-          hasHistoricalData: true,
-          items: [],
-        });
-
-      render(<ServiceInventory />, { wrapper });
-
-      // wait for requests to be made
-      await waitFor(() => expect(httpGet).toHaveBeenCalledTimes(2));
-
-      expect(addWarning).toHaveBeenLastCalledWith(
-        expect.objectContaining({
-          title: 'Legacy data was detected within the selected time range',
-        })
-      );
-    });
-  });
-
-  describe('when legacy data is not found', () => {
-    it('does not render an upgrade migration notification', async () => {
-      httpGet
-        .mockResolvedValueOnce({ fallbackToTransactions: false })
-        .mockResolvedValueOnce({
-          hasLegacyData: false,
-          hasHistoricalData: true,
-          items: [],
-        });
-
-      render(<ServiceInventory />, { wrapper });
-
-      // wait for requests to be made
-      await waitFor(() => expect(httpGet).toHaveBeenCalledTimes(2));
-
-      expect(addWarning).not.toHaveBeenCalled();
-    });
-  });
-
-  describe('when ML data is not found', () => {
-    it('does not render the health column', async () => {
-      httpGet
-        .mockResolvedValueOnce({ fallbackToTransactions: false })
-        .mockResolvedValueOnce({
-          hasLegacyData: false,
-          hasHistoricalData: true,
-          items: [
-            {
-              serviceName: 'My Python Service',
-              agentName: 'python',
-              transactionsPerMinute: 100,
-              errorsPerMinute: 200,
-              avgResponseTime: 300,
-              environments: ['test', 'dev'],
-            },
-          ],
-        });
-
-      const { queryByText } = render(<ServiceInventory />, { wrapper });
-
-      // wait for requests to be made
-      await waitFor(() => expect(httpGet).toHaveBeenCalledTimes(2));
-
-      expect(queryByText('Health')).toBeNull();
-    });
-  });
-
-  describe('when ML data is found', () => {
-    it('renders the health column', async () => {
-      httpGet
-        .mockResolvedValueOnce({ fallbackToTransactions: false })
-        .mockResolvedValueOnce({
-          hasLegacyData: false,
-          hasHistoricalData: true,
-          items: [
-            {
-              serviceName: 'My Python Service',
-              agentName: 'python',
-              transactionsPerMinute: 100,
-              errorsPerMinute: 200,
-              avgResponseTime: 300,
-              environments: ['test', 'dev'],
-              healthStatus: ServiceHealthStatus.warning,
-            },
-          ],
-        });
-
-      const { queryAllByText } = render(<ServiceInventory />, { wrapper });
-
-      // wait for requests to be made
-      await waitFor(() => expect(httpGet).toHaveBeenCalledTimes(2));
+  it('renders', async () => {
+    render(<Example />);
 
-      expect(queryAllByText('Health').length).toBeGreaterThan(1);
-    });
+    expect(await screen.findByRole('table')).toBeInTheDocument();
   });
 });
diff --git a/x-pack/plugins/apm/public/components/app/service_map/Controls.tsx b/x-pack/plugins/apm/public/components/app/service_map/Controls.tsx
index 69644216fc267..4605952a6f396 100644
--- a/x-pack/plugins/apm/public/components/app/service_map/Controls.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_map/Controls.tsx
@@ -11,8 +11,8 @@ import React, { useContext, useEffect, useState } from 'react';
 import { euiStyled } from '../../../../../../../src/plugins/kibana_react/common';
 import { useApmPluginContext } from '../../../context/apm_plugin/use_apm_plugin_context';
 import { useTheme } from '../../../hooks/use_theme';
-import { useUrlParams } from '../../../context/url_params_context/use_url_params';
 import { getLegacyApmHref } from '../../shared/Links/apm/APMLink';
+import { useLegacyUrlParams } from '../../../context/url_params_context/use_url_params';
 import { APMQueryParams } from '../../shared/Links/url_helpers';
 import { CytoscapeContext } from './Cytoscape';
 import { getAnimationOptions, getNodeHeight } from './cytoscape_options';
@@ -103,7 +103,7 @@ export function Controls() {
   const { basePath } = core.http;
   const theme = useTheme();
   const cy = useContext(CytoscapeContext);
-  const { urlParams } = useUrlParams();
+  const { urlParams } = useLegacyUrlParams();
 
   const {
     query: { kuery },
diff --git a/x-pack/plugins/apm/public/components/app/service_overview/service_overview.stories.tsx b/x-pack/plugins/apm/public/components/app/service_overview/service_overview.stories.tsx
new file mode 100644
index 0000000000000..b632d3a33dea8
--- /dev/null
+++ b/x-pack/plugins/apm/public/components/app/service_overview/service_overview.stories.tsx
@@ -0,0 +1,76 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { Meta, Story } from '@storybook/react';
+import React from 'react';
+import { MemoryRouter } from 'react-router-dom';
+import type { CoreStart } from '../../../../../../../src/core/public';
+import { createKibanaReactContext } from '../../../../../../../src/plugins/kibana_react/public';
+import type { ApmPluginContextValue } from '../../../context/apm_plugin/apm_plugin_context';
+import { MockApmPluginContextWrapper } from '../../../context/apm_plugin/mock_apm_plugin_context';
+import {
+  APMServiceContext,
+  APMServiceContextValue,
+} from '../../../context/apm_service/apm_service_context';
+import { ServiceOverview } from './';
+
+const stories: Meta<{}> = {
+  title: 'app/ServiceOverview',
+  component: ServiceOverview,
+  decorators: [
+    (StoryComponent) => {
+      const serviceName = 'testServiceName';
+      const mockCore = {
+        http: {
+          basePath: { prepend: () => {} },
+          get: (endpoint: string) => {
+            switch (endpoint) {
+              case `/api/apm/services/${serviceName}/annotation/search`:
+                return { annotations: [] };
+              case '/internal/apm/fallback_to_transactions':
+                return { fallbackToTransactions: false };
+              case `/internal/apm/services/${serviceName}/dependencies`:
+                return { serviceDependencies: [] };
+              default:
+                return {};
+            }
+          },
+        },
+        notifications: { toasts: { add: () => {} } },
+        uiSettings: { get: () => 'Browser' },
+      } as unknown as CoreStart;
+      const serviceContextValue = {
+        alerts: [],
+        serviceName,
+      } as unknown as APMServiceContextValue;
+      const KibanaReactContext = createKibanaReactContext(mockCore);
+
+      return (
+        <MemoryRouter
+          initialEntries={[
+            `/services/${serviceName}/overview?environment=ENVIRONMENT_ALL&rangeFrom=now-15m&rangeTo=now`,
+          ]}
+        >
+          <KibanaReactContext.Provider>
+            <MockApmPluginContextWrapper
+              value={{ core: mockCore } as ApmPluginContextValue}
+            >
+              <APMServiceContext.Provider value={serviceContextValue}>
+                <StoryComponent />
+              </APMServiceContext.Provider>
+            </MockApmPluginContextWrapper>
+          </KibanaReactContext.Provider>
+        </MemoryRouter>
+      );
+    },
+  ],
+};
+export default stories;
+
+export const Example: Story<{}> = () => {
+  return <ServiceOverview />;
+};
diff --git a/x-pack/plugins/apm/public/components/app/service_overview/service_overview.test.tsx b/x-pack/plugins/apm/public/components/app/service_overview/service_overview.test.tsx
index 7e9b4325591d9..fb60604aa53b2 100644
--- a/x-pack/plugins/apm/public/components/app/service_overview/service_overview.test.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_overview/service_overview.test.tsx
@@ -5,178 +5,19 @@
  * 2.0.
  */
 
-import React, { ReactNode } from 'react';
-import { MemoryRouter } from 'react-router-dom';
-import { CoreStart } from 'src/core/public';
-import { isEqual } from 'lodash';
-import { createKibanaReactContext } from '../../../../../../../src/plugins/kibana_react/public';
-import { ApmPluginContextValue } from '../../../context/apm_plugin/apm_plugin_context';
-import {
-  mockApmPluginContextValue,
-  MockApmPluginContextWrapper,
-} from '../../../context/apm_plugin/mock_apm_plugin_context';
-import * as useDynamicDataViewHooks from '../../../hooks/use_dynamic_data_view';
-import { FETCH_STATUS } from '../../../hooks/use_fetcher';
-import * as useAnnotationsHooks from '../../../context/annotations/use_annotations_context';
-import * as useTransactionBreakdownHooks from '../../shared/charts/transaction_breakdown_chart/use_transaction_breakdown';
-import { renderWithTheme } from '../../../utils/testHelpers';
-import { ServiceOverview } from './';
-import { waitFor } from '@testing-library/dom';
-import * as useApmServiceContextHooks from '../../../context/apm_service/use_apm_service_context';
-import { LatencyAggregationType } from '../../../../common/latency_aggregation_types';
-import {
-  getCallApmApiSpy,
-  getCreateCallApmApiSpy,
-} from '../../../services/rest/callApmApiSpy';
-import { fromQuery } from '../../shared/Links/url_helpers';
-import { MockUrlParamsContextProvider } from '../../../context/url_params_context/mock_url_params_context_provider';
-import { uiSettingsServiceMock } from '../../../../../../../src/core/public/mocks';
+import { composeStories } from '@storybook/testing-react';
+import { render, screen } from '@testing-library/react';
+import React from 'react';
+import * as stories from './service_overview.stories';
 
-const uiSettings = uiSettingsServiceMock.create().setup({} as any);
-
-const KibanaReactContext = createKibanaReactContext({
-  notifications: { toasts: { add: () => {} } },
-  uiSettings,
-  usageCollection: { reportUiCounter: () => {} },
-} as unknown as Partial<CoreStart>);
-
-const mockParams = {
-  rangeFrom: 'now-15m',
-  rangeTo: 'now',
-  latencyAggregationType: LatencyAggregationType.avg,
-};
-
-const location = {
-  pathname: '/services/test%20service%20name/overview',
-  search: fromQuery(mockParams),
-};
-
-function Wrapper({ children }: { children?: ReactNode }) {
-  const value = {
-    ...mockApmPluginContextValue,
-    core: {
-      ...mockApmPluginContextValue.core,
-      http: {
-        basePath: { prepend: () => {} },
-        get: () => {},
-      },
-    },
-  } as unknown as ApmPluginContextValue;
-
-  return (
-    <MemoryRouter initialEntries={[location]}>
-      <KibanaReactContext.Provider>
-        <MockApmPluginContextWrapper value={value}>
-          <MockUrlParamsContextProvider params={mockParams}>
-            {children}
-          </MockUrlParamsContextProvider>
-        </MockApmPluginContextWrapper>
-      </KibanaReactContext.Provider>
-    </MemoryRouter>
-  );
-}
+const { Example } = composeStories(stories);
 
 describe('ServiceOverview', () => {
   it('renders', async () => {
-    jest
-      .spyOn(useApmServiceContextHooks, 'useApmServiceContext')
-      .mockReturnValue({
-        serviceName: 'test service name',
-        agentName: 'java',
-        transactionType: 'request',
-        transactionTypes: ['request'],
-        alerts: [],
-      });
-    jest
-      .spyOn(useAnnotationsHooks, 'useAnnotationsContext')
-      .mockReturnValue({ annotations: [] });
-    jest
-      .spyOn(useDynamicDataViewHooks, 'useDynamicDataViewFetcher')
-      .mockReturnValue({
-        dataView: undefined,
-        status: FETCH_STATUS.SUCCESS,
-      });
-
-    /* eslint-disable @typescript-eslint/naming-convention */
-    const calls = {
-      'GET /internal/apm/services/{serviceName}/error_groups/main_statistics': {
-        error_groups: [] as any[],
-      },
-      'GET /internal/apm/services/{serviceName}/transactions/groups/main_statistics':
-        {
-          transactionGroups: [] as any[],
-          totalTransactionGroups: 0,
-          isAggregationAccurate: true,
-        },
-      'GET /internal/apm/services/{serviceName}/dependencies': {
-        serviceDependencies: [],
-      },
-      'GET /internal/apm/services/{serviceName}/service_overview_instances/main_statistics':
-        [],
-      'GET /internal/apm/services/{serviceName}/transactions/charts/latency': {
-        currentPeriod: {
-          overallAvgDuration: null,
-          latencyTimeseries: [],
-        },
-        previousPeriod: {
-          overallAvgDuration: null,
-          latencyTimeseries: [],
-        },
-      },
-      'GET /internal/apm/services/{serviceName}/throughput': {
-        currentPeriod: [],
-        previousPeriod: [],
-      },
-      'GET /internal/apm/services/{serviceName}/transactions/charts/error_rate':
-        {
-          currentPeriod: {
-            timeseries: [],
-            average: null,
-          },
-          previousPeriod: {
-            timeseries: [],
-            average: null,
-          },
-        },
-      'GET /api/apm/services/{serviceName}/annotation/search': {
-        annotations: [],
-      },
-      'GET /internal/apm/fallback_to_transactions': {
-        fallbackToTransactions: false,
-      },
-    };
-    /* eslint-enable @typescript-eslint/naming-convention */
-
-    const callApmApiSpy = getCallApmApiSpy().mockImplementation(
-      ({ endpoint }) => {
-        const response = calls[endpoint as keyof typeof calls];
-
-        return response
-          ? Promise.resolve(response)
-          : Promise.reject(`Response for ${endpoint} is not defined`);
-      }
-    );
-
-    getCreateCallApmApiSpy().mockImplementation(() => callApmApiSpy as any);
-    jest
-      .spyOn(useTransactionBreakdownHooks, 'useTransactionBreakdown')
-      .mockReturnValue({
-        data: { timeseries: [] },
-        error: undefined,
-        status: FETCH_STATUS.SUCCESS,
-      });
-
-    const { findAllByText } = renderWithTheme(<ServiceOverview />, {
-      wrapper: Wrapper,
-    });
-
-    await waitFor(() => {
-      const endpoints = callApmApiSpy.mock.calls.map(
-        (call) => call[0].endpoint
-      );
-      return isEqual(endpoints.sort(), Object.keys(calls).sort());
-    });
+    render(<Example />);
 
-    expect((await findAllByText('Latency')).length).toBeGreaterThan(0);
+    expect(
+      await screen.findByRole('heading', { name: /Latency/ })
+    ).toBeInTheDocument();
   });
 });
diff --git a/x-pack/plugins/apm/public/components/app/service_overview/service_overview_dependencies_table/index.tsx b/x-pack/plugins/apm/public/components/app/service_overview/service_overview_dependencies_table/index.tsx
index 208d1a30a46d1..cbf60b7b59e4d 100644
--- a/x-pack/plugins/apm/public/components/app/service_overview/service_overview_dependencies_table/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_overview/service_overview_dependencies_table/index.tsx
@@ -11,7 +11,7 @@ import React, { ReactNode } from 'react';
 import { useUiTracker } from '../../../../../../observability/public';
 import { getNodeName, NodeType } from '../../../../../common/connections';
 import { useApmServiceContext } from '../../../../context/apm_service/use_apm_service_context';
-import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../context/url_params_context/use_url_params';
 import { useApmParams } from '../../../../hooks/use_apm_params';
 import { useFetcher } from '../../../../hooks/use_fetcher';
 import { useTimeRange } from '../../../../hooks/use_time_range';
@@ -33,7 +33,7 @@ export function ServiceOverviewDependenciesTable({
 }: ServiceOverviewDependenciesTableProps) {
   const {
     urlParams: { comparisonEnabled, comparisonType, latencyAggregationType },
-  } = useUrlParams();
+  } = useLegacyUrlParams();
 
   const {
     query: { environment, kuery, rangeFrom, rangeTo },
diff --git a/x-pack/plugins/apm/public/components/app/service_overview/service_overview_errors_table/index.tsx b/x-pack/plugins/apm/public/components/app/service_overview/service_overview_errors_table/index.tsx
index d711676378039..ce4ba85b233e2 100644
--- a/x-pack/plugins/apm/public/components/app/service_overview/service_overview_errors_table/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_overview/service_overview_errors_table/index.tsx
@@ -16,7 +16,7 @@ import { orderBy } from 'lodash';
 import React, { useState } from 'react';
 import uuid from 'uuid';
 import { useApmServiceContext } from '../../../../context/apm_service/use_apm_service_context';
-import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../context/url_params_context/use_url_params';
 import { FETCH_STATUS, useFetcher } from '../../../../hooks/use_fetcher';
 import { APIReturnType } from '../../../../services/rest/createCallApmApi';
 import { ErrorOverviewLink } from '../../../shared/Links/apm/ErrorOverviewLink';
@@ -61,7 +61,7 @@ const INITIAL_STATE_DETAILED_STATISTICS: ErrorGroupDetailedStatistics = {
 export function ServiceOverviewErrorsTable({ serviceName }: Props) {
   const {
     urlParams: { comparisonType, comparisonEnabled },
-  } = useUrlParams();
+  } = useLegacyUrlParams();
   const { transactionType } = useApmServiceContext();
   const [tableOptions, setTableOptions] = useState<{
     pageIndex: number;
diff --git a/x-pack/plugins/apm/public/components/app/service_overview/service_overview_instances_chart_and_table.tsx b/x-pack/plugins/apm/public/components/app/service_overview/service_overview_instances_chart_and_table.tsx
index 74a9a60afd915..07e4e81e4d216 100644
--- a/x-pack/plugins/apm/public/components/app/service_overview/service_overview_instances_chart_and_table.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_overview/service_overview_instances_chart_and_table.tsx
@@ -10,7 +10,7 @@ import { orderBy } from 'lodash';
 import React, { useState } from 'react';
 import uuid from 'uuid';
 import { useApmServiceContext } from '../../../context/apm_service/use_apm_service_context';
-import { useUrlParams } from '../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../context/url_params_context/use_url_params';
 import { useApmParams } from '../../../hooks/use_apm_params';
 import { FETCH_STATUS, useFetcher } from '../../../hooks/use_fetcher';
 import { useTimeRange } from '../../../hooks/use_time_range';
@@ -78,7 +78,7 @@ export function ServiceOverviewInstancesChartAndTable({
 
   const {
     urlParams: { latencyAggregationType, comparisonType, comparisonEnabled },
-  } = useUrlParams();
+  } = useLegacyUrlParams();
 
   const { start, end } = useTimeRange({ rangeFrom, rangeTo });
 
diff --git a/x-pack/plugins/apm/public/components/app/service_overview/service_overview_instances_table/index.tsx b/x-pack/plugins/apm/public/components/app/service_overview/service_overview_instances_table/index.tsx
index 9084ffdda59f8..71ea1412c6426 100644
--- a/x-pack/plugins/apm/public/components/app/service_overview/service_overview_instances_table/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_overview/service_overview_instances_table/index.tsx
@@ -14,7 +14,7 @@ import {
 import { i18n } from '@kbn/i18n';
 import React, { ReactNode, useEffect, useState } from 'react';
 import { useApmServiceContext } from '../../../../context/apm_service/use_apm_service_context';
-import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../context/url_params_context/use_url_params';
 import { FETCH_STATUS } from '../../../../hooks/use_fetcher';
 import { APIReturnType } from '../../../../services/rest/createCallApmApi';
 import {
@@ -76,7 +76,7 @@ export function ServiceOverviewInstancesTable({
 
   const {
     urlParams: { latencyAggregationType, comparisonEnabled },
-  } = useUrlParams();
+  } = useLegacyUrlParams();
 
   const [itemIdToOpenActionMenuRowMap, setItemIdToOpenActionMenuRowMap] =
     useState<Record<string, boolean>>({});
diff --git a/x-pack/plugins/apm/public/components/app/service_overview/service_overview_throughput_chart.tsx b/x-pack/plugins/apm/public/components/app/service_overview/service_overview_throughput_chart.tsx
index 6648eaec80fa6..058c7d97b43cc 100644
--- a/x-pack/plugins/apm/public/components/app/service_overview/service_overview_throughput_chart.tsx
+++ b/x-pack/plugins/apm/public/components/app/service_overview/service_overview_throughput_chart.tsx
@@ -16,7 +16,7 @@ import { i18n } from '@kbn/i18n';
 import React from 'react';
 import { asExactTransactionRate } from '../../../../common/utils/formatters';
 import { useApmServiceContext } from '../../../context/apm_service/use_apm_service_context';
-import { useUrlParams } from '../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../context/url_params_context/use_url_params';
 import { useApmParams } from '../../../hooks/use_apm_params';
 import { useFetcher } from '../../../hooks/use_fetcher';
 import { useTheme } from '../../../hooks/use_theme';
@@ -48,7 +48,7 @@ export function ServiceOverviewThroughputChart({
 
   const {
     urlParams: { comparisonEnabled, comparisonType },
-  } = useUrlParams();
+  } = useLegacyUrlParams();
 
   const {
     query: { rangeFrom, rangeTo },
diff --git a/x-pack/plugins/apm/public/components/app/transaction_details/distribution/index.tsx b/x-pack/plugins/apm/public/components/app/transaction_details/distribution/index.tsx
index 8862596fd6d2a..ad52adfa13a52 100644
--- a/x-pack/plugins/apm/public/components/app/transaction_details/distribution/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/transaction_details/distribution/index.tsx
@@ -25,7 +25,7 @@ import { useUiTracker } from '../../../../../../observability/public';
 import { getDurationFormatter } from '../../../../../common/utils/formatters';
 import { DEFAULT_PERCENTILE_THRESHOLD } from '../../../../../common/search_strategies/constants';
 
-import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../context/url_params_context/use_url_params';
 import { FETCH_STATUS } from '../../../../hooks/use_fetcher';
 
 import { TransactionDistributionChart } from '../../../shared/charts/transaction_distribution_chart';
@@ -69,7 +69,7 @@ export function TransactionDistribution({
   traceSamples,
 }: TransactionDistributionProps) {
   const transactionColors = useTransactionColors();
-  const { urlParams } = useUrlParams();
+  const { urlParams } = useLegacyUrlParams();
   const { waterfall, status: waterfallStatus } = useWaterfallFetcher();
 
   const markerCurrentTransaction =
diff --git a/x-pack/plugins/apm/public/components/app/transaction_details/distribution/use_transaction_distribution_chart_data.ts b/x-pack/plugins/apm/public/components/app/transaction_details/distribution/use_transaction_distribution_chart_data.ts
index 0edf5f648a980..9fb945100414f 100644
--- a/x-pack/plugins/apm/public/components/app/transaction_details/distribution/use_transaction_distribution_chart_data.ts
+++ b/x-pack/plugins/apm/public/components/app/transaction_details/distribution/use_transaction_distribution_chart_data.ts
@@ -16,7 +16,7 @@ import { EventOutcome } from '../../../../../common/event_outcome';
 
 import { useApmPluginContext } from '../../../../context/apm_plugin/use_apm_plugin_context';
 import { useApmServiceContext } from '../../../../context/apm_service/use_apm_service_context';
-import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../context/url_params_context/use_url_params';
 import { useApmParams } from '../../../../hooks/use_apm_params';
 import { useFetcher, FETCH_STATUS } from '../../../../hooks/use_fetcher';
 import { useTimeRange } from '../../../../hooks/use_time_range';
@@ -37,7 +37,7 @@ export const useTransactionDistributionChartData = () => {
     core: { notifications },
   } = useApmPluginContext();
 
-  const { urlParams } = useUrlParams();
+  const { urlParams } = useLegacyUrlParams();
   const { transactionName } = urlParams;
 
   const {
diff --git a/x-pack/plugins/apm/public/components/app/transaction_details/transaction_details_tabs.tsx b/x-pack/plugins/apm/public/components/app/transaction_details/transaction_details_tabs.tsx
index 9ccca9886e679..f379369e86643 100644
--- a/x-pack/plugins/apm/public/components/app/transaction_details/transaction_details_tabs.tsx
+++ b/x-pack/plugins/apm/public/components/app/transaction_details/transaction_details_tabs.tsx
@@ -13,7 +13,7 @@ import { useHistory } from 'react-router-dom';
 import { XYBrushEvent } from '@elastic/charts';
 import { EuiPanel, EuiSpacer, EuiTabs, EuiTab } from '@elastic/eui';
 
-import { useUrlParams } from '../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../context/url_params_context/use_url_params';
 import { useApmParams } from '../../../hooks/use_apm_params';
 import { useTransactionTraceSamplesFetcher } from '../../../hooks/use_transaction_trace_samples_fetcher';
 
@@ -34,7 +34,7 @@ const tabs = [
 export function TransactionDetailsTabs() {
   const { query } = useApmParams('/services/{serviceName}/transactions/view');
 
-  const { urlParams } = useUrlParams();
+  const { urlParams } = useLegacyUrlParams();
   const history = useHistory();
 
   const [currentTab, setCurrentTab] = useState(traceSamplesTab.key);
diff --git a/x-pack/plugins/apm/public/components/app/transaction_details/use_waterfall_fetcher.ts b/x-pack/plugins/apm/public/components/app/transaction_details/use_waterfall_fetcher.ts
index e7fbc315522e4..4f26a5875347c 100644
--- a/x-pack/plugins/apm/public/components/app/transaction_details/use_waterfall_fetcher.ts
+++ b/x-pack/plugins/apm/public/components/app/transaction_details/use_waterfall_fetcher.ts
@@ -6,7 +6,7 @@
  */
 
 import { useMemo } from 'react';
-import { useUrlParams } from '../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../context/url_params_context/use_url_params';
 import { useApmParams } from '../../../hooks/use_apm_params';
 import { useFetcher } from '../../../hooks/use_fetcher';
 import { useTimeRange } from '../../../hooks/use_time_range';
@@ -19,7 +19,7 @@ const INITIAL_DATA = {
 };
 
 export function useWaterfallFetcher() {
-  const { urlParams } = useUrlParams();
+  const { urlParams } = useLegacyUrlParams();
   const { traceId, transactionId } = urlParams;
 
   const {
diff --git a/x-pack/plugins/apm/public/components/app/transaction_details/waterfall_with_summary/MaybeViewTraceLink.tsx b/x-pack/plugins/apm/public/components/app/transaction_details/waterfall_with_summary/MaybeViewTraceLink.tsx
index 359dcdfda0a14..c18bc42a98b2c 100644
--- a/x-pack/plugins/apm/public/components/app/transaction_details/waterfall_with_summary/MaybeViewTraceLink.tsx
+++ b/x-pack/plugins/apm/public/components/app/transaction_details/waterfall_with_summary/MaybeViewTraceLink.tsx
@@ -9,7 +9,7 @@ import { EuiButton, EuiFlexItem, EuiToolTip } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import React from 'react';
 import { getNextEnvironmentUrlParam } from '../../../../../common/environment_filter_values';
-import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../context/url_params_context/use_url_params';
 import { Transaction as ITransaction } from '../../../../../typings/es_schemas/ui/transaction';
 import { TransactionDetailLink } from '../../../shared/Links/apm/transaction_detail_link';
 import { IWaterfall } from './waterfall_container/Waterfall/waterfall_helpers/waterfall_helpers';
@@ -26,7 +26,7 @@ export function MaybeViewTraceLink({
 }) {
   const {
     urlParams: { latencyAggregationType },
-  } = useUrlParams();
+  } = useLegacyUrlParams();
 
   const viewFullTraceButtonLabel = i18n.translate(
     'xpack.apm.transactionDetails.viewFullTraceButtonLabel',
diff --git a/x-pack/plugins/apm/public/components/app/transaction_details/waterfall_with_summary/waterfall_container/Waterfall/FlyoutTopLevelProperties.tsx b/x-pack/plugins/apm/public/components/app/transaction_details/waterfall_with_summary/waterfall_container/Waterfall/FlyoutTopLevelProperties.tsx
index 8954081f9ab47..e34fdd893ff7f 100644
--- a/x-pack/plugins/apm/public/components/app/transaction_details/waterfall_with_summary/waterfall_container/Waterfall/FlyoutTopLevelProperties.tsx
+++ b/x-pack/plugins/apm/public/components/app/transaction_details/waterfall_with_summary/waterfall_container/Waterfall/FlyoutTopLevelProperties.tsx
@@ -13,7 +13,7 @@ import {
 } from '../../../../../../../common/elasticsearch_fieldnames';
 import { getNextEnvironmentUrlParam } from '../../../../../../../common/environment_filter_values';
 import { Transaction } from '../../../../../../../typings/es_schemas/ui/transaction';
-import { useUrlParams } from '../../../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../../../context/url_params_context/use_url_params';
 import { useApmParams } from '../../../../../../hooks/use_apm_params';
 import { TransactionDetailLink } from '../../../../../shared/Links/apm/transaction_detail_link';
 import { ServiceLink } from '../../../../../shared/service_link';
@@ -26,7 +26,7 @@ interface Props {
 export function FlyoutTopLevelProperties({ transaction }: Props) {
   const {
     urlParams: { latencyAggregationType },
-  } = useUrlParams();
+  } = useLegacyUrlParams();
   const { query } = useApmParams('/services/{serviceName}/transactions/view');
 
   if (!transaction) {
diff --git a/x-pack/plugins/apm/public/components/fleet_integration/apm_policy_form/settings_definition/apm_settings.ts b/x-pack/plugins/apm/public/components/fleet_integration/apm_policy_form/settings_definition/apm_settings.ts
index 2b88e1a1df9ed..ec9f740932376 100644
--- a/x-pack/plugins/apm/public/components/fleet_integration/apm_policy_form/settings_definition/apm_settings.ts
+++ b/x-pack/plugins/apm/public/components/fleet_integration/apm_policy_form/settings_definition/apm_settings.ts
@@ -33,7 +33,7 @@ export function getApmSettings({
         'xpack.apm.fleet_integration.settings.apm.hostDescription',
         {
           defaultMessage:
-            'Choose a name and description to help identify how this integration will be used.',
+            'Host defines the host and port the server is listening on. URL is the unchangeable, publicly reachable server URL for deployments on Elastic Cloud or ECK.',
         }
       ),
 
@@ -164,10 +164,7 @@ export function getApmSettings({
           ),
           rowDescription: i18n.translate(
             'xpack.apm.fleet_integration.settings.apm.responseHeadersDescription',
-            {
-              defaultMessage:
-                'Set limits on request headers sizes and timing configurations.',
-            }
+            { defaultMessage: 'Custom HTTP headers added to HTTP responses' }
           ),
         },
         {
diff --git a/x-pack/plugins/apm/public/components/fleet_integration/apm_policy_form/typings.ts b/x-pack/plugins/apm/public/components/fleet_integration/apm_policy_form/typings.ts
index 7df1ccf1fb18f..4f741ceb46f49 100644
--- a/x-pack/plugins/apm/public/components/fleet_integration/apm_policy_form/typings.ts
+++ b/x-pack/plugins/apm/public/components/fleet_integration/apm_policy_form/typings.ts
@@ -7,12 +7,12 @@
 import * as t from 'io-ts';
 import { PackagePolicyConfigRecordEntry } from '../../../../../fleet/common';
 
-export {
+export type {
   PackagePolicyCreateExtensionComponentProps,
   PackagePolicyEditExtensionComponentProps,
 } from '../../../../../fleet/public';
 
-export {
+export type {
   NewPackagePolicy,
   PackagePolicy,
   PackagePolicyConfigRecordEntry,
diff --git a/x-pack/plugins/apm/public/components/shared/Links/MachineLearningLinks/MLExplorerLink.tsx b/x-pack/plugins/apm/public/components/shared/Links/MachineLearningLinks/MLExplorerLink.tsx
index 11b29f00155fc..72a29a079bc67 100644
--- a/x-pack/plugins/apm/public/components/shared/Links/MachineLearningLinks/MLExplorerLink.tsx
+++ b/x-pack/plugins/apm/public/components/shared/Links/MachineLearningLinks/MLExplorerLink.tsx
@@ -10,7 +10,7 @@ import { EuiLink } from '@elastic/eui';
 import { UI_SETTINGS } from '../../../../../../../../src/plugins/data/common';
 import { useApmPluginContext } from '../../../../context/apm_plugin/use_apm_plugin_context';
 import { useMlHref, ML_PAGES } from '../../../../../../ml/public';
-import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../context/url_params_context/use_url_params';
 import { TimePickerRefreshInterval } from '../../DatePicker/typings';
 
 interface Props {
@@ -37,7 +37,7 @@ export function useExplorerHref({ jobId }: { jobId: string }) {
     core,
     plugins: { ml },
   } = useApmPluginContext();
-  const { urlParams } = useUrlParams();
+  const { urlParams } = useLegacyUrlParams();
 
   const timePickerRefreshIntervalDefaults =
     core.uiSettings.get<TimePickerRefreshInterval>(
diff --git a/x-pack/plugins/apm/public/components/shared/Links/MachineLearningLinks/MLManageJobsLink.tsx b/x-pack/plugins/apm/public/components/shared/Links/MachineLearningLinks/MLManageJobsLink.tsx
index 5c8d464204090..eb7b531121753 100644
--- a/x-pack/plugins/apm/public/components/shared/Links/MachineLearningLinks/MLManageJobsLink.tsx
+++ b/x-pack/plugins/apm/public/components/shared/Links/MachineLearningLinks/MLManageJobsLink.tsx
@@ -10,7 +10,7 @@ import React from 'react';
 import { UI_SETTINGS } from '../../../../../../../../src/plugins/data/common';
 import { useApmPluginContext } from '../../../../context/apm_plugin/use_apm_plugin_context';
 import { useMlHref, ML_PAGES } from '../../../../../../ml/public';
-import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../context/url_params_context/use_url_params';
 import { TimePickerRefreshInterval } from '../../DatePicker/typings';
 
 interface Props {
@@ -24,7 +24,7 @@ export function MLManageJobsLink({ children, external }: Props) {
     plugins: { ml },
   } = useApmPluginContext();
 
-  const { urlParams } = useUrlParams();
+  const { urlParams } = useLegacyUrlParams();
 
   const timePickerRefreshIntervalDefaults =
     core.uiSettings.get<TimePickerRefreshInterval>(
diff --git a/x-pack/plugins/apm/public/components/shared/Links/MachineLearningLinks/MLSingleMetricLink.tsx b/x-pack/plugins/apm/public/components/shared/Links/MachineLearningLinks/MLSingleMetricLink.tsx
index a36beccd16be5..2964a8e2578c7 100644
--- a/x-pack/plugins/apm/public/components/shared/Links/MachineLearningLinks/MLSingleMetricLink.tsx
+++ b/x-pack/plugins/apm/public/components/shared/Links/MachineLearningLinks/MLSingleMetricLink.tsx
@@ -10,7 +10,7 @@ import { EuiLink } from '@elastic/eui';
 import { UI_SETTINGS } from '../../../../../../../../src/plugins/data/common';
 import { useApmPluginContext } from '../../../../context/apm_plugin/use_apm_plugin_context';
 import { useMlHref, ML_PAGES } from '../../../../../../ml/public';
-import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../context/url_params_context/use_url_params';
 import { TimePickerRefreshInterval } from '../../DatePicker/typings';
 
 interface Props {
@@ -53,7 +53,7 @@ export function useSingleMetricHref({
     core,
     plugins: { ml },
   } = useApmPluginContext();
-  const { urlParams } = useUrlParams();
+  const { urlParams } = useLegacyUrlParams();
 
   const timePickerRefreshIntervalDefaults =
     core.uiSettings.get<TimePickerRefreshInterval>(
diff --git a/x-pack/plugins/apm/public/components/shared/Links/apm/APMLink.tsx b/x-pack/plugins/apm/public/components/shared/Links/apm/APMLink.tsx
index fbf4dff24fbf4..bcb305bd38ec3 100644
--- a/x-pack/plugins/apm/public/components/shared/Links/apm/APMLink.tsx
+++ b/x-pack/plugins/apm/public/components/shared/Links/apm/APMLink.tsx
@@ -13,7 +13,7 @@ import { useLocation } from 'react-router-dom';
 import url from 'url';
 import { pickKeys } from '../../../../../common/utils/pick_keys';
 import { useApmPluginContext } from '../../../../context/apm_plugin/use_apm_plugin_context';
-import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../context/url_params_context/use_url_params';
 import { APMQueryParams, fromQuery, toQuery } from '../url_helpers';
 
 interface Props extends EuiLinkAnchorProps {
@@ -46,7 +46,7 @@ export function useAPMHref({
   persistedFilters?: Array<keyof APMQueryParams>;
   query?: APMQueryParams;
 }) {
-  const { urlParams } = useUrlParams();
+  const { urlParams } = useLegacyUrlParams();
   const { basePath } = useApmPluginContext().core.http;
   const { search } = useLocation();
   const nextQuery = {
diff --git a/x-pack/plugins/apm/public/components/shared/Links/apm/ErrorOverviewLink.tsx b/x-pack/plugins/apm/public/components/shared/Links/apm/ErrorOverviewLink.tsx
index b06de47472a11..ccd9bdff960b6 100644
--- a/x-pack/plugins/apm/public/components/shared/Links/apm/ErrorOverviewLink.tsx
+++ b/x-pack/plugins/apm/public/components/shared/Links/apm/ErrorOverviewLink.tsx
@@ -7,7 +7,7 @@
 
 import React from 'react';
 import { pickKeys } from '../../../../../common/utils/pick_keys';
-import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../context/url_params_context/use_url_params';
 import { APMQueryParams } from '../url_helpers';
 import { APMLink, APMLinkExtendProps } from './APMLink';
 
@@ -24,7 +24,7 @@ interface Props extends APMLinkExtendProps {
 }
 
 export function ErrorOverviewLink({ serviceName, query, ...rest }: Props) {
-  const { urlParams } = useUrlParams();
+  const { urlParams } = useLegacyUrlParams();
 
   return (
     <APMLink
diff --git a/x-pack/plugins/apm/public/components/shared/Links/apm/transaction_detail_link.tsx b/x-pack/plugins/apm/public/components/shared/Links/apm/transaction_detail_link.tsx
index 06db6c9d42382..8b885526fb67c 100644
--- a/x-pack/plugins/apm/public/components/shared/Links/apm/transaction_detail_link.tsx
+++ b/x-pack/plugins/apm/public/components/shared/Links/apm/transaction_detail_link.tsx
@@ -10,7 +10,7 @@ import { useLocation } from 'react-router-dom';
 import { EuiLink } from '@elastic/eui';
 import { pickBy, identity } from 'lodash';
 import { getLegacyApmHref, APMLinkExtendProps } from './APMLink';
-import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../context/url_params_context/use_url_params';
 import { pickKeys } from '../../../../../common/utils/pick_keys';
 import { APMQueryParams } from '../url_helpers';
 import { useApmPluginContext } from '../../../../context/apm_plugin/use_apm_plugin_context';
@@ -40,7 +40,7 @@ export function TransactionDetailLink({
   environment,
   ...rest
 }: Props) {
-  const { urlParams } = useUrlParams();
+  const { urlParams } = useLegacyUrlParams();
   const { core } = useApmPluginContext();
   const location = useLocation();
   const href = getLegacyApmHref({
diff --git a/x-pack/plugins/apm/public/components/shared/MetadataTable/index.tsx b/x-pack/plugins/apm/public/components/shared/MetadataTable/index.tsx
index 248fa240fd557..5e2c180bcfd55 100644
--- a/x-pack/plugins/apm/public/components/shared/MetadataTable/index.tsx
+++ b/x-pack/plugins/apm/public/components/shared/MetadataTable/index.tsx
@@ -20,7 +20,7 @@ import { isEmpty } from 'lodash';
 import React, { useCallback } from 'react';
 import { useHistory, useLocation } from 'react-router-dom';
 import { EuiLoadingSpinner } from '@elastic/eui';
-import { useUrlParams } from '../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../context/url_params_context/use_url_params';
 import { HeightRetainer } from '../HeightRetainer';
 import { fromQuery, toQuery } from '../Links/url_helpers';
 import { filterSectionsByTerm } from './helper';
@@ -36,7 +36,7 @@ interface Props {
 export function MetadataTable({ sections, isLoading }: Props) {
   const history = useHistory();
   const location = useLocation();
-  const { urlParams } = useUrlParams();
+  const { urlParams } = useLegacyUrlParams();
   const { searchTerm = '' } = urlParams;
   const { docLinks } = useApmPluginContext().core;
 
diff --git a/x-pack/plugins/apm/public/components/shared/charts/Timeline/Marker/error_marker.tsx b/x-pack/plugins/apm/public/components/shared/charts/Timeline/Marker/error_marker.tsx
index 305488b9d39d2..a1e3f42cb5684 100644
--- a/x-pack/plugins/apm/public/components/shared/charts/Timeline/Marker/error_marker.tsx
+++ b/x-pack/plugins/apm/public/components/shared/charts/Timeline/Marker/error_marker.tsx
@@ -13,7 +13,7 @@ import {
   TRANSACTION_ID,
 } from '../../../../../../common/elasticsearch_fieldnames';
 import { asDuration } from '../../../../../../common/utils/formatters';
-import { useUrlParams } from '../../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../../context/url_params_context/use_url_params';
 import { useTheme } from '../../../../../hooks/use_theme';
 import { ErrorMark } from '../../../../app/transaction_details/waterfall_with_summary/waterfall_container/Marks/get_error_marks';
 import { ErrorDetailLink } from '../../../Links/apm/ErrorDetailLink';
@@ -55,7 +55,7 @@ function truncateMessage(errorMessage?: string) {
 
 export function ErrorMarker({ mark }: Props) {
   const theme = useTheme();
-  const { urlParams } = useUrlParams();
+  const { urlParams } = useLegacyUrlParams();
   const [isPopoverOpen, showPopover] = useState(false);
 
   const togglePopover = () => showPopover(!isPopoverOpen);
diff --git a/x-pack/plugins/apm/public/components/shared/charts/failed_transaction_rate_chart/index.tsx b/x-pack/plugins/apm/public/components/shared/charts/failed_transaction_rate_chart/index.tsx
index cda0058bdacd3..a5952a363a9e0 100644
--- a/x-pack/plugins/apm/public/components/shared/charts/failed_transaction_rate_chart/index.tsx
+++ b/x-pack/plugins/apm/public/components/shared/charts/failed_transaction_rate_chart/index.tsx
@@ -14,7 +14,7 @@ import { APIReturnType } from '../../../../services/rest/createCallApmApi';
 import { asPercent } from '../../../../../common/utils/formatters';
 import { useFetcher } from '../../../../hooks/use_fetcher';
 import { useTheme } from '../../../../hooks/use_theme';
-import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../context/url_params_context/use_url_params';
 import { TimeseriesChart } from '../timeseries_chart';
 import { useApmServiceContext } from '../../../../context/apm_service/use_apm_service_context';
 import {
@@ -58,7 +58,7 @@ export function FailedTransactionRateChart({
   const theme = useTheme();
   const {
     urlParams: { transactionName, comparisonEnabled, comparisonType },
-  } = useUrlParams();
+  } = useLegacyUrlParams();
 
   const {
     query: { rangeFrom, rangeTo },
diff --git a/x-pack/plugins/apm/public/components/shared/charts/latency_chart/index.tsx b/x-pack/plugins/apm/public/components/shared/charts/latency_chart/index.tsx
index 3cee9c22174ad..e19f78006d9fe 100644
--- a/x-pack/plugins/apm/public/components/shared/charts/latency_chart/index.tsx
+++ b/x-pack/plugins/apm/public/components/shared/charts/latency_chart/index.tsx
@@ -17,7 +17,7 @@ import { useApmServiceContext } from '../../../../context/apm_service/use_apm_se
 import { LatencyAggregationType } from '../../../../../common/latency_aggregation_types';
 import { getDurationFormatter } from '../../../../../common/utils/formatters';
 import { useLicenseContext } from '../../../../context/license/use_license_context';
-import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../context/url_params_context/use_url_params';
 import { useTheme } from '../../../../hooks/use_theme';
 import { useTransactionLatencyChartsFetcher } from '../../../../hooks/use_transaction_latency_chart_fetcher';
 import { TimeseriesChart } from '../../../shared/charts/timeseries_chart';
@@ -52,7 +52,7 @@ export function LatencyChart({ height, kuery, environment }: Props) {
   const history = useHistory();
   const theme = useTheme();
   const comparisonChartTheme = getComparisonChartTheme(theme);
-  const { urlParams } = useUrlParams();
+  const { urlParams } = useLegacyUrlParams();
   const { latencyAggregationType, comparisonEnabled } = urlParams;
   const license = useLicenseContext();
 
diff --git a/x-pack/plugins/apm/public/components/shared/charts/transaction_breakdown_chart/use_transaction_breakdown.ts b/x-pack/plugins/apm/public/components/shared/charts/transaction_breakdown_chart/use_transaction_breakdown.ts
index 079b8455de7ad..a32f7ededea40 100644
--- a/x-pack/plugins/apm/public/components/shared/charts/transaction_breakdown_chart/use_transaction_breakdown.ts
+++ b/x-pack/plugins/apm/public/components/shared/charts/transaction_breakdown_chart/use_transaction_breakdown.ts
@@ -6,7 +6,7 @@
  */
 
 import { useFetcher } from '../../../../hooks/use_fetcher';
-import { useUrlParams } from '../../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../../context/url_params_context/use_url_params';
 import { useApmServiceContext } from '../../../../context/apm_service/use_apm_service_context';
 import { useApmParams } from '../../../../hooks/use_apm_params';
 import { useTimeRange } from '../../../../hooks/use_time_range';
@@ -20,7 +20,7 @@ export function useTransactionBreakdown({
 }) {
   const {
     urlParams: { transactionName },
-  } = useUrlParams();
+  } = useLegacyUrlParams();
 
   const {
     query: { rangeFrom, rangeTo },
diff --git a/x-pack/plugins/apm/public/components/shared/kuery_bar/index.tsx b/x-pack/plugins/apm/public/components/shared/kuery_bar/index.tsx
index 4dc24567259e6..20484e691d50b 100644
--- a/x-pack/plugins/apm/public/components/shared/kuery_bar/index.tsx
+++ b/x-pack/plugins/apm/public/components/shared/kuery_bar/index.tsx
@@ -16,7 +16,7 @@ import {
   QuerySuggestion,
 } from '../../../../../../../src/plugins/data/public';
 import { useApmPluginContext } from '../../../context/apm_plugin/use_apm_plugin_context';
-import { useUrlParams } from '../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../context/url_params_context/use_url_params';
 import { useApmParams } from '../../../hooks/use_apm_params';
 import { useDynamicDataViewFetcher } from '../../../hooks/use_dynamic_data_view';
 import { fromQuery, toQuery } from '../Links/url_helpers';
@@ -52,7 +52,7 @@ export function KueryBar(props: {
     suggestions: [],
     isLoadingSuggestions: false,
   });
-  const { urlParams } = useUrlParams();
+  const { urlParams } = useLegacyUrlParams();
   const location = useLocation();
   const { data } = useApmPluginContext().plugins;
 
diff --git a/x-pack/plugins/apm/public/components/shared/managed_table/index.tsx b/x-pack/plugins/apm/public/components/shared/managed_table/index.tsx
index f1776abe83e97..5d49f1d9a8f18 100644
--- a/x-pack/plugins/apm/public/components/shared/managed_table/index.tsx
+++ b/x-pack/plugins/apm/public/components/shared/managed_table/index.tsx
@@ -10,7 +10,7 @@ import { EuiBasicTable, EuiBasicTableColumn } from '@elastic/eui';
 import { orderBy } from 'lodash';
 import React, { ReactNode, useCallback, useMemo } from 'react';
 import { useHistory } from 'react-router-dom';
-import { useUrlParams } from '../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../context/url_params_context/use_url_params';
 import { fromQuery, toQuery } from '../Links/url_helpers';
 
 // TODO: this should really be imported from EUI
@@ -79,7 +79,7 @@ function UnoptimizedManagedTable<T>(props: Props<T>) {
       sortField = initialSortField,
       sortDirection = initialSortDirection,
     },
-  } = useUrlParams();
+  } = useLegacyUrlParams();
 
   const renderedItems = useMemo(() => {
     const sortedItems = sortItems
diff --git a/x-pack/plugins/apm/public/components/shared/time_comparison/index.tsx b/x-pack/plugins/apm/public/components/shared/time_comparison/index.tsx
index 35a6bc7634813..9d077713ff12e 100644
--- a/x-pack/plugins/apm/public/components/shared/time_comparison/index.tsx
+++ b/x-pack/plugins/apm/public/components/shared/time_comparison/index.tsx
@@ -13,7 +13,7 @@ import { useHistory } from 'react-router-dom';
 import { euiStyled } from '../../../../../../../src/plugins/kibana_react/common';
 import { useUiTracker } from '../../../../../observability/public';
 import { TimeRangeComparisonEnum } from '../../../../common/runtime_types/comparison_type_rt';
-import { useUrlParams } from '../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../context/url_params_context/use_url_params';
 import { useApmParams } from '../../../hooks/use_apm_params';
 import { useBreakpoints } from '../../../hooks/use_breakpoints';
 import { useTimeRange } from '../../../hooks/use_time_range';
@@ -127,7 +127,7 @@ export function TimeComparison() {
 
   const {
     urlParams: { comparisonEnabled, comparisonType },
-  } = useUrlParams();
+  } = useLegacyUrlParams();
 
   const comparisonTypes = getComparisonTypes({
     start: exactStart,
diff --git a/x-pack/plugins/apm/public/components/shared/transaction_action_menu/TransactionActionMenu.tsx b/x-pack/plugins/apm/public/components/shared/transaction_action_menu/TransactionActionMenu.tsx
index a4f7c2b663484..2f856dce387bf 100644
--- a/x-pack/plugins/apm/public/components/shared/transaction_action_menu/TransactionActionMenu.tsx
+++ b/x-pack/plugins/apm/public/components/shared/transaction_action_menu/TransactionActionMenu.tsx
@@ -21,7 +21,7 @@ import {
 import { Transaction } from '../../../../typings/es_schemas/ui/transaction';
 import { useApmPluginContext } from '../../../context/apm_plugin/use_apm_plugin_context';
 import { useLicenseContext } from '../../../context/license/use_license_context';
-import { useUrlParams } from '../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../context/url_params_context/use_url_params';
 import { CustomLinkMenuSection } from './custom_link_menu_section';
 import { getSections } from './sections';
 
@@ -45,7 +45,7 @@ export function TransactionActionMenu({ transaction }: Props) {
 
   const { core } = useApmPluginContext();
   const location = useLocation();
-  const { urlParams } = useUrlParams();
+  const { urlParams } = useLegacyUrlParams();
 
   const [isActionPopoverOpen, setIsActionPopoverOpen] = useState(false);
 
diff --git a/x-pack/plugins/apm/public/components/shared/transactions_table/index.tsx b/x-pack/plugins/apm/public/components/shared/transactions_table/index.tsx
index d6d955b8ef5ab..6c934cc51e2f7 100644
--- a/x-pack/plugins/apm/public/components/shared/transactions_table/index.tsx
+++ b/x-pack/plugins/apm/public/components/shared/transactions_table/index.tsx
@@ -20,7 +20,7 @@ import { FormattedMessage } from '@kbn/i18n/react';
 import { EuiCode } from '@elastic/eui';
 import { APIReturnType } from '../../../services/rest/createCallApmApi';
 import { useApmServiceContext } from '../../../context/apm_service/use_apm_service_context';
-import { useUrlParams } from '../../../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../../../context/url_params_context/use_url_params';
 import { FETCH_STATUS, useFetcher } from '../../../hooks/use_fetcher';
 import { TransactionOverviewLink } from '../Links/apm/transaction_overview_link';
 import { getTimeRangeComparison } from '../time_comparison/get_time_range_comparison';
@@ -100,7 +100,7 @@ export function TransactionsTable({
   const { transactionType, serviceName } = useApmServiceContext();
   const {
     urlParams: { latencyAggregationType, comparisonType, comparisonEnabled },
-  } = useUrlParams();
+  } = useLegacyUrlParams();
 
   const { comparisonStart, comparisonEnd } = getTimeRangeComparison({
     start,
diff --git a/x-pack/plugins/apm/public/context/apm_service/apm_service_context.tsx b/x-pack/plugins/apm/public/context/apm_service/apm_service_context.tsx
index 9d207eee2fbaa..c99ef519f9e69 100644
--- a/x-pack/plugins/apm/public/context/apm_service/apm_service_context.tsx
+++ b/x-pack/plugins/apm/public/context/apm_service/apm_service_context.tsx
@@ -23,14 +23,20 @@ export type APMServiceAlert = ValuesType<
   APIReturnType<'GET /internal/apm/services/{serviceName}/alerts'>['alerts']
 >;
 
-export const APMServiceContext = createContext<{
+export interface APMServiceContextValue {
   serviceName: string;
   agentName?: string;
   transactionType?: string;
   transactionTypes: string[];
   alerts: APMServiceAlert[];
   runtimeName?: string;
-}>({ serviceName: '', transactionTypes: [], alerts: [] });
+}
+
+export const APMServiceContext = createContext<APMServiceContextValue>({
+  serviceName: '',
+  transactionTypes: [],
+  alerts: [],
+});
 
 export function ApmServiceContextProvider({
   children,
diff --git a/x-pack/plugins/apm/public/context/url_params_context/use_url_params.tsx b/x-pack/plugins/apm/public/context/url_params_context/use_url_params.tsx
index 5e91bfd1549ed..7c7a00da728ad 100644
--- a/x-pack/plugins/apm/public/context/url_params_context/use_url_params.tsx
+++ b/x-pack/plugins/apm/public/context/url_params_context/use_url_params.tsx
@@ -10,7 +10,7 @@ import { useMemo, useContext } from 'react';
 import type { ApmUrlParams } from './types';
 import { UrlParamsContext } from './url_params_context';
 
-export function useUrlParams(): Assign<
+export function useLegacyUrlParams(): Assign<
   React.ContextType<typeof UrlParamsContext>,
   { urlParams: ApmUrlParams }
 > {
diff --git a/x-pack/plugins/apm/public/hooks/use_comparison.ts b/x-pack/plugins/apm/public/hooks/use_comparison.ts
index 2875d973a5e18..dbd37c25784cf 100644
--- a/x-pack/plugins/apm/public/hooks/use_comparison.ts
+++ b/x-pack/plugins/apm/public/hooks/use_comparison.ts
@@ -9,7 +9,7 @@ import {
   getComparisonChartTheme,
   getTimeRangeComparison,
 } from '../components/shared/time_comparison/get_time_range_comparison';
-import { useUrlParams } from '../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../context/url_params_context/use_url_params';
 import { useApmParams } from './use_apm_params';
 import { useTheme } from './use_theme';
 import { useTimeRange } from './use_time_range';
@@ -31,7 +31,7 @@ export function useComparison() {
 
   const {
     urlParams: { comparisonType, comparisonEnabled },
-  } = useUrlParams();
+  } = useLegacyUrlParams();
 
   const { offset } = getTimeRangeComparison({
     start,
diff --git a/x-pack/plugins/apm/public/hooks/use_search_strategy.ts b/x-pack/plugins/apm/public/hooks/use_search_strategy.ts
index 275eddb68ae00..95bc8cb7435a2 100644
--- a/x-pack/plugins/apm/public/hooks/use_search_strategy.ts
+++ b/x-pack/plugins/apm/public/hooks/use_search_strategy.ts
@@ -31,7 +31,7 @@ import {
   APM_SEARCH_STRATEGIES,
 } from '../../common/search_strategies/constants';
 import { useApmServiceContext } from '../context/apm_service/use_apm_service_context';
-import { useUrlParams } from '../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../context/url_params_context/use_url_params';
 
 import { ApmPluginStartDeps } from '../plugin';
 
@@ -103,7 +103,7 @@ export function useSearchStrategy<
     query: { kuery, environment, rangeFrom, rangeTo },
   } = useApmParams('/services/{serviceName}/transactions/view');
   const { start, end } = useTimeRange({ rangeFrom, rangeTo });
-  const { urlParams } = useUrlParams();
+  const { urlParams } = useLegacyUrlParams();
   const { transactionName } = urlParams;
 
   const [rawResponse, setRawResponse] = useReducer(
diff --git a/x-pack/plugins/apm/public/hooks/use_transaction_latency_chart_fetcher.ts b/x-pack/plugins/apm/public/hooks/use_transaction_latency_chart_fetcher.ts
index d44ec853a242c..0ed3de14c129f 100644
--- a/x-pack/plugins/apm/public/hooks/use_transaction_latency_chart_fetcher.ts
+++ b/x-pack/plugins/apm/public/hooks/use_transaction_latency_chart_fetcher.ts
@@ -7,7 +7,7 @@
 
 import { useMemo } from 'react';
 import { useFetcher } from './use_fetcher';
-import { useUrlParams } from '../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../context/url_params_context/use_url_params';
 import { useApmServiceContext } from '../context/apm_service/use_apm_service_context';
 import { getLatencyChartSelector } from '../selectors/latency_chart_selectors';
 import { useTheme } from './use_theme';
@@ -31,7 +31,7 @@ export function useTransactionLatencyChartsFetcher({
       comparisonType,
       comparisonEnabled,
     },
-  } = useUrlParams();
+  } = useLegacyUrlParams();
 
   const {
     query: { rangeFrom, rangeTo },
diff --git a/x-pack/plugins/apm/public/hooks/use_transaction_trace_samples_fetcher.ts b/x-pack/plugins/apm/public/hooks/use_transaction_trace_samples_fetcher.ts
index 741100aca16e9..93349d3f955b8 100644
--- a/x-pack/plugins/apm/public/hooks/use_transaction_trace_samples_fetcher.ts
+++ b/x-pack/plugins/apm/public/hooks/use_transaction_trace_samples_fetcher.ts
@@ -6,7 +6,7 @@
  */
 
 import { useFetcher } from './use_fetcher';
-import { useUrlParams } from '../context/url_params_context/use_url_params';
+import { useLegacyUrlParams } from '../context/url_params_context/use_url_params';
 import { useApmServiceContext } from '../context/apm_service/use_apm_service_context';
 import { useApmParams } from './use_apm_params';
 import { useTimeRange } from './use_time_range';
@@ -39,7 +39,7 @@ export function useTransactionTraceSamplesFetcher({
 
   const {
     urlParams: { transactionId, traceId, sampleRangeFrom, sampleRangeTo },
-  } = useUrlParams();
+  } = useLegacyUrlParams();
 
   const {
     data = INITIAL_DATA,
diff --git a/x-pack/plugins/apm/public/index.ts b/x-pack/plugins/apm/public/index.ts
index 2734269b9cff9..9b2175dd465bc 100644
--- a/x-pack/plugins/apm/public/index.ts
+++ b/x-pack/plugins/apm/public/index.ts
@@ -23,4 +23,4 @@ export const plugin: PluginInitializer<ApmPluginSetup, ApmPluginStart> = (
   pluginInitializerContext: PluginInitializerContext<ConfigSchema>
 ) => new ApmPlugin(pluginInitializerContext);
 
-export { ApmPluginSetup, ApmPluginStart };
+export type { ApmPluginSetup, ApmPluginStart };
diff --git a/x-pack/plugins/apm/scripts/test/api.js b/x-pack/plugins/apm/scripts/test/api.js
index 4f0d82d0c1163..1905c8eb7c2dd 100644
--- a/x-pack/plugins/apm/scripts/test/api.js
+++ b/x-pack/plugins/apm/scripts/test/api.js
@@ -33,9 +33,15 @@ const { argv } = yargs(process.argv.slice(2))
     description:
       'Run all tests (an instance of Elasticsearch and kibana are needs to be available)',
   })
+  .option('grep', {
+    alias: 'spec',
+    default: false,
+    type: 'string',
+    description: 'Specify the spec files to run',
+  })
   .help();
 
-const { trial, server, runner } = argv;
+const { trial, server, runner, grep } = argv;
 
 const license = trial ? 'trial' : 'basic';
 console.log(`License: ${license}`);
@@ -46,7 +52,10 @@ if (server) {
 } else if (runner) {
   ftrScript = 'functional_test_runner';
 }
-childProcess.execSync(
-  `node ../../../../scripts/${ftrScript} --config ../../../../test/apm_api_integration/${license}/config.ts`,
-  { cwd: path.join(__dirname), stdio: 'inherit' }
-);
+
+const grepArg = grep ? `--grep "${grep}"` : '';
+const cmd = `node ../../../../scripts/${ftrScript} ${grepArg} --config ../../../../test/apm_api_integration/${license}/config.ts`;
+
+console.log(`Running ${cmd}`);
+
+childProcess.execSync(cmd, { cwd: path.join(__dirname), stdio: 'inherit' });
diff --git a/x-pack/plugins/apm/scripts/test/e2e.js b/x-pack/plugins/apm/scripts/test/e2e.js
index b3ce510a8e569..13055dce2fec5 100644
--- a/x-pack/plugins/apm/scripts/test/e2e.js
+++ b/x-pack/plugins/apm/scripts/test/e2e.js
@@ -20,7 +20,7 @@ const { argv } = yargs(process.argv.slice(2))
   .option('server', {
     default: false,
     type: 'boolean',
-    description: 'Start Elasticsearch and kibana',
+    description: 'Start Elasticsearch and Kibana',
   })
   .option('runner', {
     default: false,
@@ -28,14 +28,26 @@ const { argv } = yargs(process.argv.slice(2))
     description:
       'Run all tests (an instance of Elasticsearch and kibana are needs to be available)',
   })
+  .option('grep', {
+    alias: 'spec',
+    default: false,
+    type: 'string',
+    description:
+      'Specify the spec files to run (use doublequotes for glob matching)',
+  })
   .option('open', {
     default: false,
     type: 'boolean',
     description: 'Opens the Cypress Test Runner',
   })
+  .option('bail', {
+    default: false,
+    type: 'boolean',
+    description: 'stop tests after the first failure',
+  })
   .help();
 
-const { server, runner, open, kibanaInstallDir } = argv;
+const { server, runner, open, grep, bail, kibanaInstallDir } = argv;
 
 const e2eDir = path.join(__dirname, '../../ftr_e2e');
 
@@ -46,9 +58,10 @@ if (server) {
   ftrScript = 'functional_test_runner';
 }
 
-const config = open ? './cypress_open.ts' : './cypress_run.ts';
+const config = open ? './ftr_config_open.ts' : './ftr_config_run.ts';
+const grepArg = grep ? `--grep "${grep}"` : '';
+const bailArg = bail ? `--bail` : '';
+const cmd = `node ../../../../scripts/${ftrScript} --config ${config} ${grepArg} ${bailArg} --kibana-install-dir '${kibanaInstallDir}'`;
 
-childProcess.execSync(
-  `node ../../../../scripts/${ftrScript} --config ${config} --kibana-install-dir '${kibanaInstallDir}'`,
-  { cwd: e2eDir, stdio: 'inherit' }
-);
+console.log(`Running ${cmd}`);
+childProcess.execSync(cmd, { cwd: e2eDir, stdio: 'inherit' });
diff --git a/x-pack/plugins/apm/server/index.ts b/x-pack/plugins/apm/server/index.ts
index 4b5c2b5d6134d..bd30f9e212687 100644
--- a/x-pack/plugins/apm/server/index.ts
+++ b/x-pack/plugins/apm/server/index.ts
@@ -37,7 +37,7 @@ const configSchema = schema.object({
       schema.literal(SearchAggregatedTransactionSetting.always),
       schema.literal(SearchAggregatedTransactionSetting.never),
     ],
-    { defaultValue: SearchAggregatedTransactionSetting.never }
+    { defaultValue: SearchAggregatedTransactionSetting.auto }
   ),
   telemetryCollectionEnabled: schema.boolean({ defaultValue: true }),
   metricsInterval: schema.number({ defaultValue: 30 }),
@@ -112,11 +112,11 @@ export const plugin = (initContext: PluginInitializerContext) =>
 
 export { APM_SERVER_FEATURE_ID } from '../common/alert_types';
 export { APMPlugin } from './plugin';
-export { APMPluginSetup } from './types';
-export {
+export type { APMPluginSetup } from './types';
+export type {
   APMServerRouteRepository,
   APIEndpoint,
 } from './routes/get_global_apm_server_route_repository';
-export { APMRouteHandlerResources } from './routes/typings';
+export type { APMRouteHandlerResources } from './routes/typings';
 
 export type { ProcessorEvent } from '../common/processor_event';
diff --git a/x-pack/plugins/apm/server/lib/helpers/transactions/index.ts b/x-pack/plugins/apm/server/lib/helpers/transactions/index.ts
index 473d34cd5b6fc..edaae8cadc1d5 100644
--- a/x-pack/plugins/apm/server/lib/helpers/transactions/index.ts
+++ b/x-pack/plugins/apm/server/lib/helpers/transactions/index.ts
@@ -63,18 +63,23 @@ export async function getSearchAggregatedTransactions({
   apmEventClient: APMEventClient;
   kuery: string;
 }): Promise<boolean> {
-  const searchAggregatedTransactions = config.searchAggregatedTransactions;
+  switch (config.searchAggregatedTransactions) {
+    case SearchAggregatedTransactionSetting.always:
+      return kuery
+        ? getHasAggregatedTransactions({ start, end, apmEventClient, kuery })
+        : true;
 
-  if (
-    kuery ||
-    searchAggregatedTransactions === SearchAggregatedTransactionSetting.auto
-  ) {
-    return getHasAggregatedTransactions({ start, end, apmEventClient, kuery });
-  }
+    case SearchAggregatedTransactionSetting.auto:
+      return getHasAggregatedTransactions({
+        start,
+        end,
+        apmEventClient,
+        kuery,
+      });
 
-  return (
-    searchAggregatedTransactions === SearchAggregatedTransactionSetting.always
-  );
+    case SearchAggregatedTransactionSetting.never:
+      return false;
+  }
 }
 
 export function getTransactionDurationFieldForTransactions(
diff --git a/x-pack/plugins/apm/server/lib/services/get_services_detailed_statistics/get_service_transaction_detailed_statistics.ts b/x-pack/plugins/apm/server/lib/services/get_services_detailed_statistics/get_service_transaction_detailed_statistics.ts
index 686555e7764ab..ea153a5ddcd4c 100644
--- a/x-pack/plugins/apm/server/lib/services/get_services_detailed_statistics/get_service_transaction_detailed_statistics.ts
+++ b/x-pack/plugins/apm/server/lib/services/get_services_detailed_statistics/get_service_transaction_detailed_statistics.ts
@@ -70,7 +70,7 @@ export async function getServiceTransactionDetailedStatistics({
   };
 
   const response = await apmEventClient.search(
-    'get_service_transaction_stats',
+    'get_service_transaction_detail_stats',
     {
       apm: {
         events: [
@@ -82,6 +82,7 @@ export async function getServiceTransactionDetailedStatistics({
         query: {
           bool: {
             filter: [
+              { terms: { [SERVICE_NAME]: serviceNames } },
               ...getDocumentTypeFilterForTransactions(
                 searchAggregatedTransactions
               ),
@@ -95,8 +96,6 @@ export async function getServiceTransactionDetailedStatistics({
           services: {
             terms: {
               field: SERVICE_NAME,
-              include: serviceNames,
-              size: serviceNames.length,
             },
             aggs: {
               transactionType: {
diff --git a/x-pack/plugins/apm/server/lib/settings/apm_indices/get_apm_indices.ts b/x-pack/plugins/apm/server/lib/settings/apm_indices/get_apm_indices.ts
index 107493af1a0c0..a37720cbc3790 100644
--- a/x-pack/plugins/apm/server/lib/settings/apm_indices/get_apm_indices.ts
+++ b/x-pack/plugins/apm/server/lib/settings/apm_indices/get_apm_indices.ts
@@ -16,7 +16,7 @@ import { APMRouteHandlerResources } from '../../../routes/typings';
 import { withApmSpan } from '../../../utils/with_apm_span';
 import { ApmIndicesConfig } from '../../../../../observability/common/typings';
 
-export { ApmIndicesConfig };
+export type { ApmIndicesConfig };
 
 type ISavedObjectsClient = Pick<SavedObjectsClient, 'get'>;
 
diff --git a/x-pack/plugins/apm/server/tutorial/index.ts b/x-pack/plugins/apm/server/tutorial/index.ts
index 66ff8f5b2c92c..f04b794091ff2 100644
--- a/x-pack/plugins/apm/server/tutorial/index.ts
+++ b/x-pack/plugins/apm/server/tutorial/index.ts
@@ -103,7 +103,6 @@ It allows you to monitor the performance of thousands of applications in real ti
         }
       ),
       euiIconType: 'apmApp',
-      eprPackageOverlap: 'apm',
       integrationBrowserCategories: ['web'],
       artifacts,
       customStatusCheckName: 'apm_fleet_server_status_check',
diff --git a/x-pack/plugins/banners/common/index.ts b/x-pack/plugins/banners/common/index.ts
index a4c38a58ab572..348d42adb7d8f 100644
--- a/x-pack/plugins/banners/common/index.ts
+++ b/x-pack/plugins/banners/common/index.ts
@@ -5,4 +5,4 @@
  * 2.0.
  */
 
-export { BannerInfoResponse, BannerPlacement, BannerConfiguration } from './types';
+export type { BannerInfoResponse, BannerPlacement, BannerConfiguration } from './types';
diff --git a/x-pack/plugins/canvas/canvas_plugin_src/expression_types/embeddable.ts b/x-pack/plugins/canvas/canvas_plugin_src/expression_types/embeddable.ts
index ac2e8e8babee1..66cb95a4a210a 100644
--- a/x-pack/plugins/canvas/canvas_plugin_src/expression_types/embeddable.ts
+++ b/x-pack/plugins/canvas/canvas_plugin_src/expression_types/embeddable.ts
@@ -10,7 +10,8 @@ import { EmbeddableInput } from '../../../../../src/plugins/embeddable/common/';
 import { EmbeddableTypes } from './embeddable_types';
 
 export const EmbeddableExpressionType = 'embeddable';
-export { EmbeddableTypes, EmbeddableInput };
+export type { EmbeddableInput };
+export { EmbeddableTypes };
 
 export interface EmbeddableExpression<Input extends EmbeddableInput> {
   /**
diff --git a/x-pack/plugins/canvas/common/index.ts b/x-pack/plugins/canvas/common/index.ts
index 5bae69e8601b2..51a661f6e8d1e 100644
--- a/x-pack/plugins/canvas/common/index.ts
+++ b/x-pack/plugins/canvas/common/index.ts
@@ -9,4 +9,5 @@ export const UI_SETTINGS = {
   ENABLE_LABS_UI: 'labs:canvas:enable_ui',
 };
 
-export { CANVAS_APP_LOCATOR, CanvasAppLocator, CanvasAppLocatorParams } from './locator';
+export type { CanvasAppLocator, CanvasAppLocatorParams } from './locator';
+export { CANVAS_APP_LOCATOR } from './locator';
diff --git a/x-pack/plugins/canvas/public/components/color_manager/index.ts b/x-pack/plugins/canvas/public/components/color_manager/index.ts
index 17856a88bcc00..937afeb438006 100644
--- a/x-pack/plugins/canvas/public/components/color_manager/index.ts
+++ b/x-pack/plugins/canvas/public/components/color_manager/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { ColorManager, Props } from './color_manager';
+export type { Props } from './color_manager';
+export { ColorManager } from './color_manager';
diff --git a/x-pack/plugins/canvas/public/components/color_picker/index.ts b/x-pack/plugins/canvas/public/components/color_picker/index.ts
index ba411db1129e5..709b3535b5d58 100644
--- a/x-pack/plugins/canvas/public/components/color_picker/index.ts
+++ b/x-pack/plugins/canvas/public/components/color_picker/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { ColorPicker, Props } from './color_picker';
+export type { Props } from './color_picker';
+export { ColorPicker } from './color_picker';
diff --git a/x-pack/plugins/canvas/public/components/color_picker_popover/index.ts b/x-pack/plugins/canvas/public/components/color_picker_popover/index.ts
index 76663397ff695..08bf41f2fbc03 100644
--- a/x-pack/plugins/canvas/public/components/color_picker_popover/index.ts
+++ b/x-pack/plugins/canvas/public/components/color_picker_popover/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { ColorPickerPopover, Props } from './color_picker_popover';
+export type { Props } from './color_picker_popover';
+export { ColorPickerPopover } from './color_picker_popover';
diff --git a/x-pack/plugins/canvas/public/components/embeddable_flyout/index.ts b/x-pack/plugins/canvas/public/components/embeddable_flyout/index.ts
index 6acc4051e1ecc..98943a820e37a 100644
--- a/x-pack/plugins/canvas/public/components/embeddable_flyout/index.ts
+++ b/x-pack/plugins/canvas/public/components/embeddable_flyout/index.ts
@@ -6,7 +6,5 @@
  */
 
 export { EmbeddableFlyoutPortal, AddEmbeddablePanel } from './flyout';
-export {
-  AddEmbeddableFlyout as AddEmbeddableFlyoutComponent,
-  Props as AddEmbeddableFlyoutComponentProps,
-} from './flyout.component';
+export type { Props as AddEmbeddableFlyoutComponentProps } from './flyout.component';
+export { AddEmbeddableFlyout as AddEmbeddableFlyoutComponent } from './flyout.component';
diff --git a/x-pack/plugins/canvas/public/components/paginate/index.tsx b/x-pack/plugins/canvas/public/components/paginate/index.tsx
index f320860bd903b..12717a07f4cf9 100644
--- a/x-pack/plugins/canvas/public/components/paginate/index.tsx
+++ b/x-pack/plugins/canvas/public/components/paginate/index.tsx
@@ -9,7 +9,7 @@ import React, { useState, useEffect, useRef } from 'react';
 import PropTypes from 'prop-types';
 import { Paginate as Component, PaginateProps, PaginateChildProps } from './paginate';
 
-export { PaginateProps, PaginateChildProps };
+export type { PaginateProps, PaginateChildProps };
 export interface InPaginateProps {
   perPage?: number;
   startPage?: number;
diff --git a/x-pack/plugins/canvas/public/components/popover/index.ts b/x-pack/plugins/canvas/public/components/popover/index.ts
index e1d8a5c63c28b..f9d7e3c0501a8 100644
--- a/x-pack/plugins/canvas/public/components/popover/index.ts
+++ b/x-pack/plugins/canvas/public/components/popover/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { Popover, ClosePopoverFn } from './popover';
+export type { ClosePopoverFn } from './popover';
+export { Popover } from './popover';
diff --git a/x-pack/plugins/canvas/public/components/saved_elements_modal/index.ts b/x-pack/plugins/canvas/public/components/saved_elements_modal/index.ts
index 9656dfa8ad487..b4b5d78646aa4 100644
--- a/x-pack/plugins/canvas/public/components/saved_elements_modal/index.ts
+++ b/x-pack/plugins/canvas/public/components/saved_elements_modal/index.ts
@@ -6,7 +6,5 @@
  */
 
 export { SavedElementsModal } from './saved_elements_modal';
-export {
-  SavedElementsModal as SavedElementsModalComponent,
-  Props as SavedElementsModalComponentProps,
-} from './saved_elements_modal.component';
+export type { Props as SavedElementsModalComponentProps } from './saved_elements_modal.component';
+export { SavedElementsModal as SavedElementsModalComponent } from './saved_elements_modal.component';
diff --git a/x-pack/plugins/canvas/public/components/workpad/workpad.component.tsx b/x-pack/plugins/canvas/public/components/workpad/workpad.component.tsx
index 1ac737bc543eb..740f71eab085a 100644
--- a/x-pack/plugins/canvas/public/components/workpad/workpad.component.tsx
+++ b/x-pack/plugins/canvas/public/components/workpad/workpad.component.tsx
@@ -11,7 +11,11 @@ import Style from 'style-it';
 // @ts-expect-error
 import { WorkpadPage } from '../workpad_page';
 import { Fullscreen } from '../fullscreen';
-import { HEADER_BANNER_HEIGHT, WORKPAD_CANVAS_BUFFER } from '../../../common/lib/constants';
+import {
+  HEADER_BANNER_HEIGHT,
+  WORKPAD_CANVAS_BUFFER,
+  DEFAULT_WORKPAD_CSS,
+} from '../../../common/lib/constants';
 import { CommitFn, CanvasPage } from '../../../types';
 import { WorkpadShortcuts } from './workpad_shortcuts.component';
 
@@ -122,7 +126,7 @@ export const Workpad: FC<Props> = ({
 
             // NOTE: the data-shared-* attributes here are used for reporting
             return Style.it(
-              workpadCss,
+              workpadCss || DEFAULT_WORKPAD_CSS,
               <div
                 className={`canvasWorkpad ${isFullscreenProp ? 'fullscreen' : ''}`}
                 style={fsStyle}
diff --git a/x-pack/plugins/canvas/public/components/workpad_header/share_menu/flyout/flyout.tsx b/x-pack/plugins/canvas/public/components/workpad_header/share_menu/flyout/flyout.tsx
index 5ff3f8dd5bb86..9b7a6435f5f5c 100644
--- a/x-pack/plugins/canvas/public/components/workpad_header/share_menu/flyout/flyout.tsx
+++ b/x-pack/plugins/canvas/public/components/workpad_header/share_menu/flyout/flyout.tsx
@@ -20,7 +20,7 @@ import { CanvasRenderedWorkpad } from '../../../../../shareable_runtime/types';
 import { renderFunctionNames } from '../../../../../shareable_runtime/supported_renderers';
 
 import { OnCloseFn } from '../share_menu.component';
-export { OnDownloadFn, OnCopyFn } from './flyout.component';
+export type { OnDownloadFn, OnCopyFn } from './flyout.component';
 
 const getUnsupportedRenderers = (state: State) => {
   const renderers: string[] = [];
diff --git a/x-pack/plugins/canvas/public/components/workpad_header/share_menu/utils.ts b/x-pack/plugins/canvas/public/components/workpad_header/share_menu/utils.ts
index 311ef73e1c973..bee0e1f3a5177 100644
--- a/x-pack/plugins/canvas/public/components/workpad_header/share_menu/utils.ts
+++ b/x-pack/plugins/canvas/public/components/workpad_header/share_menu/utils.ts
@@ -9,6 +9,7 @@ import type { RedirectOptions } from 'src/plugins/share/public';
 import { CANVAS_APP_LOCATOR } from '../../../../common/locator';
 import { CanvasAppLocatorParams } from '../../../../common/locator';
 import { CanvasWorkpad } from '../../../../types';
+import { JobAppParamsPDFV2 } from '../../../../../reporting/public';
 
 export interface CanvasWorkpadSharingData {
   workpad: Pick<CanvasWorkpad, 'id' | 'name' | 'height' | 'width'>;
@@ -18,7 +19,7 @@ export interface CanvasWorkpadSharingData {
 export function getPdfJobParams(
   { workpad: { id, name: title, width, height }, pageCount }: CanvasWorkpadSharingData,
   version: string
-) {
+): JobAppParamsPDFV2 {
   // The viewport in Reporting by specifying the dimensions. In order for things to work,
   // we need a viewport that will include all of the pages in the workpad. The viewport
   // also needs to include any offset values from the 0,0 position, otherwise the cropped
diff --git a/x-pack/plugins/canvas/public/index.ts b/x-pack/plugins/canvas/public/index.ts
index a15b15fcae333..95d4333c6e9e5 100644
--- a/x-pack/plugins/canvas/public/index.ts
+++ b/x-pack/plugins/canvas/public/index.ts
@@ -10,7 +10,7 @@ import { CoreStart } from '../../../../src/core/public';
 import { CanvasServices } from './services';
 import { CanvasSetup, CanvasStart, CanvasStartDeps, CanvasPlugin } from './plugin';
 
-export { CanvasSetup, CanvasStart };
+export type { CanvasSetup, CanvasStart };
 
 export interface WithKibanaProps {
   kibana: {
diff --git a/x-pack/plugins/canvas/public/plugin.tsx b/x-pack/plugins/canvas/public/plugin.tsx
index 723d1afea2860..5d1f05fdbe8bf 100644
--- a/x-pack/plugins/canvas/public/plugin.tsx
+++ b/x-pack/plugins/canvas/public/plugin.tsx
@@ -37,7 +37,7 @@ import { getPluginApi, CanvasApi } from './plugin_api';
 import { setupExpressions } from './setup_expressions';
 import { pluginServiceRegistry } from './services/kibana';
 
-export { CoreStart, CoreSetup };
+export type { CoreStart, CoreSetup };
 
 /**
  * These are the private interfaces for the services your plugin depends on.
diff --git a/x-pack/plugins/canvas/public/routes/workpad/index.tsx b/x-pack/plugins/canvas/public/routes/workpad/index.tsx
index 0b6153bc06afd..1b46a5cf78df1 100644
--- a/x-pack/plugins/canvas/public/routes/workpad/index.tsx
+++ b/x-pack/plugins/canvas/public/routes/workpad/index.tsx
@@ -9,7 +9,8 @@ import { RouteComponentProps } from 'react-router-dom';
 
 export { WorkpadRoute, ExportWorkpadRoute } from './workpad_route';
 
-export { WorkpadRoutingContext, WorkpadRoutingContextType } from './workpad_routing_context';
+export type { WorkpadRoutingContextType } from './workpad_routing_context';
+export { WorkpadRoutingContext } from './workpad_routing_context';
 
 export interface WorkpadRouteParams {
   id: string;
diff --git a/x-pack/plugins/canvas/public/services/legacy/index.ts b/x-pack/plugins/canvas/public/services/legacy/index.ts
index fdc4e30cabe51..82ef3f248f7fd 100644
--- a/x-pack/plugins/canvas/public/services/legacy/index.ts
+++ b/x-pack/plugins/canvas/public/services/legacy/index.ts
@@ -10,7 +10,7 @@ import { CoreSetup, CoreStart, AppUpdater } from '../../../../../../src/core/pub
 import { CanvasSetupDeps, CanvasStartDeps } from '../../plugin';
 import { searchServiceFactory } from './search';
 
-export { SearchService } from './search';
+export type { SearchService } from './search';
 export { ExpressionsService } from '../../../../../../src/plugins/expressions/common';
 export * from './context';
 
diff --git a/x-pack/plugins/canvas/server/mocks/index.ts b/x-pack/plugins/canvas/server/mocks/index.ts
index 1cb39c690df97..f3d3ef955d0e4 100644
--- a/x-pack/plugins/canvas/server/mocks/index.ts
+++ b/x-pack/plugins/canvas/server/mocks/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { workpadRouteContextMock, MockWorkpadRouteContext } from './workpad_route_context';
+export type { MockWorkpadRouteContext } from './workpad_route_context';
+export { workpadRouteContextMock } from './workpad_route_context';
diff --git a/x-pack/plugins/cases/common/api/runtime_types.ts b/x-pack/plugins/cases/common/api/runtime_types.ts
index 7edc1162c0e81..c807d4b31b751 100644
--- a/x-pack/plugins/cases/common/api/runtime_types.ts
+++ b/x-pack/plugins/cases/common/api/runtime_types.ts
@@ -60,7 +60,7 @@ export const decodeOrThrow =
 const getExcessProps = (props: rt.Props, r: Record<string, unknown>): string[] => {
   const ex: string[] = [];
   for (const k of Object.keys(r)) {
-    if (!props.hasOwnProperty(k)) {
+    if (!Object.prototype.hasOwnProperty.call(props, k)) {
       ex.push(k);
     }
   }
@@ -89,5 +89,5 @@ export function excess<C extends rt.InterfaceType<rt.Props> | rt.PartialType<rt.
     codec.encode,
     codec.props
   );
-  return r as any;
+  return r as C;
 }
diff --git a/x-pack/plugins/cases/common/ui/types.ts b/x-pack/plugins/cases/common/ui/types.ts
index b4ed4f7db177e..402e44618c7cc 100644
--- a/x-pack/plugins/cases/common/ui/types.ts
+++ b/x-pack/plugins/cases/common/ui/types.ts
@@ -255,10 +255,19 @@ export interface SignalEcs {
   threshold_result?: unknown;
 }
 
+export type SignalEcsAAD = Exclude<SignalEcs, 'rule' | 'status'> & {
+  rule?: Exclude<RuleEcs, 'id'> & { uuid: string[] };
+  building_block_type?: string[];
+  workflow_status?: string[];
+};
+
 export interface Ecs {
   _id: string;
   _index?: string;
   signal?: SignalEcs;
+  kibana?: {
+    alert: SignalEcsAAD;
+  };
 }
 
 export type CaseActionConnector = ActionConnector;
diff --git a/x-pack/plugins/cases/public/common/lib/kibana/kibana_react.mock.ts b/x-pack/plugins/cases/public/common/lib/kibana/kibana_react.mock.ts
index 09f0215f5629f..19276a7afd1b8 100644
--- a/x-pack/plugins/cases/public/common/lib/kibana/kibana_react.mock.ts
+++ b/x-pack/plugins/cases/public/common/lib/kibana/kibana_react.mock.ts
@@ -5,6 +5,8 @@
  * 2.0.
  */
 
+/* eslint-disable react/display-name */
+
 import React from 'react';
 
 import { RecursivePartial } from '@elastic/eui/src/components/common';
diff --git a/x-pack/plugins/cases/public/common/shared_imports.ts b/x-pack/plugins/cases/public/common/shared_imports.ts
index 4641fcfa2167c..21040543fae69 100644
--- a/x-pack/plugins/cases/public/common/shared_imports.ts
+++ b/x-pack/plugins/cases/public/common/shared_imports.ts
@@ -5,31 +5,33 @@
  * 2.0.
  */
 
+export type {
+  FieldHook,
+  FieldValidateResponse,
+  FormData,
+  FormHook,
+  FormSchema,
+  ValidationError,
+  ValidationFunc,
+  FieldConfig,
+  ValidationConfig,
+} from '../../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib';
 export {
   getUseField,
   getFieldValidityAndErrorMessage,
-  FieldHook,
-  FieldValidateResponse,
   FIELD_TYPES,
   Form,
-  FormData,
   FormDataProvider,
-  FormHook,
-  FormSchema,
   UseField,
   UseMultiFields,
   useForm,
   useFormContext,
   useFormData,
-  ValidationError,
-  ValidationFunc,
   VALIDATION_TYPES,
-  FieldConfig,
-  ValidationConfig,
 } from '../../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib';
 export {
   Field,
   SelectField,
 } from '../../../../../src/plugins/es_ui_shared/static/forms/components';
 export { fieldValidators } from '../../../../../src/plugins/es_ui_shared/static/forms/helpers';
-export { ERROR_CODE } from '../../../../../src/plugins/es_ui_shared/static/forms/helpers/field_validators/types';
+export type { ERROR_CODE } from '../../../../../src/plugins/es_ui_shared/static/forms/helpers/field_validators/types';
diff --git a/x-pack/plugins/cases/public/components/__mock__/form.ts b/x-pack/plugins/cases/public/components/__mock__/form.ts
index aa40ea0421b4c..a2bd59d5dd541 100644
--- a/x-pack/plugins/cases/public/components/__mock__/form.ts
+++ b/x-pack/plugins/cases/public/components/__mock__/form.ts
@@ -36,7 +36,7 @@ export const mockFormHook = {
   __readFieldConfigFromSchema: jest.fn(),
 };
 
-export const getFormMock = (sampleData: any) => ({
+export const getFormMock = (sampleData: unknown) => ({
   ...mockFormHook,
   submit: () =>
     Promise.resolve({
diff --git a/x-pack/plugins/cases/public/components/all_cases/expanded_row.tsx b/x-pack/plugins/cases/public/components/all_cases/expanded_row.tsx
index 59efcf868c9ee..2b43fbf63095e 100644
--- a/x-pack/plugins/cases/public/components/all_cases/expanded_row.tsx
+++ b/x-pack/plugins/cases/public/components/all_cases/expanded_row.tsx
@@ -6,7 +6,7 @@
  */
 
 import React from 'react';
-import { EuiBasicTable as _EuiBasicTable } from '@elastic/eui';
+import { EuiBasicTable } from '@elastic/eui';
 import styled from 'styled-components';
 import { Case, SubCase } from '../../containers/types';
 import { CasesColumns } from './columns';
@@ -14,7 +14,7 @@ import { AssociationType } from '../../../common';
 
 type ExpandedRowMap = Record<string, Element> | {};
 
-const EuiBasicTable: any = _EuiBasicTable;
+// @ts-expect-error TS2769
 const BasicTable = styled(EuiBasicTable)`
   thead {
     display: none;
diff --git a/x-pack/plugins/cases/public/components/all_cases/index.test.tsx b/x-pack/plugins/cases/public/components/all_cases/index.test.tsx
index a387c5eae3834..f55c871f4922a 100644
--- a/x-pack/plugins/cases/public/components/all_cases/index.test.tsx
+++ b/x-pack/plugins/cases/public/components/all_cases/index.test.tsx
@@ -303,7 +303,10 @@ describe('AllCasesGeneric', () => {
 
     await waitFor(() => {
       result.current.map(
-        (i, key) => i.name != null && !i.hasOwnProperty('actions') && checkIt(`${i.name}`, key)
+        (i, key) =>
+          i.name != null &&
+          !Object.prototype.hasOwnProperty.call(i, 'actions') &&
+          checkIt(`${i.name}`, key)
       );
     });
   });
@@ -378,7 +381,9 @@ describe('AllCasesGeneric', () => {
       })
     );
     await waitFor(() => {
-      result.current.map((i) => i.name != null && !i.hasOwnProperty('actions'));
+      result.current.map(
+        (i) => i.name != null && !Object.prototype.hasOwnProperty.call(i, 'actions')
+      );
       expect(wrapper.find(`a[data-test-subj="case-details-link"]`).exists()).toBeFalsy();
     });
   });
diff --git a/x-pack/plugins/cases/public/components/all_cases/selector_modal/index.tsx b/x-pack/plugins/cases/public/components/all_cases/selector_modal/index.tsx
index 4e8334ebceec0..cbfb24f18c97e 100644
--- a/x-pack/plugins/cases/public/components/all_cases/selector_modal/index.tsx
+++ b/x-pack/plugins/cases/public/components/all_cases/selector_modal/index.tsx
@@ -87,5 +87,8 @@ export const AllCasesSelectorModal: React.FC<AllCasesSelectorModalProps> = React
     </OwnerProvider>
   );
 });
+
+AllCasesSelectorModal.displayName = 'AllCasesSelectorModal';
+
 // eslint-disable-next-line import/no-default-export
 export { AllCasesSelectorModal as default };
diff --git a/x-pack/plugins/cases/public/components/all_cases/table.tsx b/x-pack/plugins/cases/public/components/all_cases/table.tsx
index 876007494d276..3f80fc8f0d7c4 100644
--- a/x-pack/plugins/cases/public/components/all_cases/table.tsx
+++ b/x-pack/plugins/cases/public/components/all_cases/table.tsx
@@ -10,7 +10,7 @@ import {
   EuiEmptyPrompt,
   EuiLoadingContent,
   EuiTableSelectionType,
-  EuiBasicTable as _EuiBasicTable,
+  EuiBasicTable,
   EuiBasicTableProps,
 } from '@elastic/eui';
 import classnames from 'classnames';
@@ -40,12 +40,12 @@ interface CasesTableProps {
   selection: EuiTableSelectionType<Case>;
   showActions: boolean;
   sorting: EuiBasicTableProps<Case>['sorting'];
-  tableRef: MutableRefObject<_EuiBasicTable | undefined>;
+  tableRef: MutableRefObject<EuiBasicTable | undefined>;
   tableRowProps: EuiBasicTableProps<Case>['rowProps'];
   userCanCrud: boolean;
 }
 
-const EuiBasicTable: any = _EuiBasicTable;
+// @ts-expect-error TS2769
 const BasicTable = styled(EuiBasicTable)`
   ${({ theme }) => `
     .euiTableRow-isExpandedRow.euiTableRow-isSelectable .euiTableCellContent {
diff --git a/x-pack/plugins/cases/public/components/configure_cases/index.tsx b/x-pack/plugins/cases/public/components/configure_cases/index.tsx
index 788c6eeb61b32..cf7962f08db93 100644
--- a/x-pack/plugins/cases/public/components/configure_cases/index.tsx
+++ b/x-pack/plugins/cases/public/components/configure_cases/index.tsx
@@ -242,5 +242,7 @@ export const ConfigureCases: React.FC<ConfigureCasesProps> = React.memo((props)
   );
 });
 
+ConfigureCases.displayName = 'ConfigureCases';
+
 // eslint-disable-next-line import/no-default-export
 export default ConfigureCases;
diff --git a/x-pack/plugins/cases/public/components/connectors/connectors_registry.ts b/x-pack/plugins/cases/public/components/connectors/connectors_registry.ts
index 2e02cb290c3c8..8174733301348 100644
--- a/x-pack/plugins/cases/public/components/connectors/connectors_registry.ts
+++ b/x-pack/plugins/cases/public/components/connectors/connectors_registry.ts
@@ -9,8 +9,25 @@ import { i18n } from '@kbn/i18n';
 import { CaseConnector, CaseConnectorsRegistry } from './types';
 
 export const createCaseConnectorsRegistry = (): CaseConnectorsRegistry => {
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
   const connectors: Map<string, CaseConnector<any>> = new Map();
 
+  function assertConnectorExists(
+    connector: CaseConnector | undefined | null,
+    id: string
+  ): asserts connector {
+    if (!connector) {
+      throw new Error(
+        i18n.translate('xpack.cases.connecors.get.missingCaseConnectorErrorMessage', {
+          defaultMessage: 'Object type "{id}" is not registered.',
+          values: {
+            id,
+          },
+        })
+      );
+    }
+  }
+
   const registry: CaseConnectorsRegistry = {
     has: (id: string) => connectors.has(id),
     register: <UIProps>(connector: CaseConnector<UIProps>) => {
@@ -28,17 +45,9 @@ export const createCaseConnectorsRegistry = (): CaseConnectorsRegistry => {
       connectors.set(connector.id, connector);
     },
     get: <UIProps>(id: string): CaseConnector<UIProps> => {
-      if (!connectors.has(id)) {
-        throw new Error(
-          i18n.translate('xpack.cases.connecors.get.missingCaseConnectorErrorMessage', {
-            defaultMessage: 'Object type "{id}" is not registered.',
-            values: {
-              id,
-            },
-          })
-        );
-      }
-      return connectors.get(id)!;
+      const connector = connectors.get(id);
+      assertConnectorExists(connector, id);
+      return connector;
     },
     list: () => {
       return Array.from(connectors).map(([id, connector]) => connector);
diff --git a/x-pack/plugins/cases/public/components/connectors/types.ts b/x-pack/plugins/cases/public/components/connectors/types.ts
index 5bbd77c790901..8bc978152b796 100644
--- a/x-pack/plugins/cases/public/components/connectors/types.ts
+++ b/x-pack/plugins/cases/public/components/connectors/types.ts
@@ -15,7 +15,7 @@ import {
 } from '../../../common';
 import { CaseActionConnector } from '../types';
 
-export { ThirdPartyField as AllThirdPartyFields } from '../../../common';
+export type { ThirdPartyField as AllThirdPartyFields } from '../../../common';
 
 export interface ThirdPartyField {
   label: string;
diff --git a/x-pack/plugins/cases/public/components/create/description.tsx b/x-pack/plugins/cases/public/components/create/description.tsx
index e1bd563a3d798..c1545a42df3f5 100644
--- a/x-pack/plugins/cases/public/components/create/description.tsx
+++ b/x-pack/plugins/cases/public/components/create/description.tsx
@@ -21,7 +21,7 @@ const DescriptionComponent: React.FC<Props> = ({ isLoading }) => {
     useLensDraftComment();
   const { setFieldValue } = useFormContext();
   const [{ title, tags }] = useFormData({ watch: ['title', 'tags'] });
-  const editorRef = useRef<Record<string, any>>();
+  const editorRef = useRef<Record<string, unknown>>();
 
   useEffect(() => {
     if (draftComment?.commentId === fieldName && editorRef.current) {
diff --git a/x-pack/plugins/cases/public/components/create/index.tsx b/x-pack/plugins/cases/public/components/create/index.tsx
index d3eaba1ea0bc4..39f10a89290d8 100644
--- a/x-pack/plugins/cases/public/components/create/index.tsx
+++ b/x-pack/plugins/cases/public/components/create/index.tsx
@@ -98,5 +98,8 @@ export const CreateCase: React.FC<CreateCaseProps> = React.memo((props) => (
     <CreateCaseComponent {...props} />
   </OwnerProvider>
 ));
+
+CreateCase.displayName = 'CreateCase';
+
 // eslint-disable-next-line import/no-default-export
 export { CreateCase as default };
diff --git a/x-pack/plugins/cases/public/components/markdown_editor/editor.tsx b/x-pack/plugins/cases/public/components/markdown_editor/editor.tsx
index 4bf25b23403e1..e2067d75e843e 100644
--- a/x-pack/plugins/cases/public/components/markdown_editor/editor.tsx
+++ b/x-pack/plugins/cases/public/components/markdown_editor/editor.tsx
@@ -96,4 +96,6 @@ const MarkdownEditorComponent = forwardRef<MarkdownEditorRef, MarkdownEditorProp
   }
 );
 
+MarkdownEditorComponent.displayName = 'MarkdownEditorComponent';
+
 export const MarkdownEditor = memo(MarkdownEditorComponent);
diff --git a/x-pack/plugins/cases/public/components/markdown_editor/eui_form.tsx b/x-pack/plugins/cases/public/components/markdown_editor/eui_form.tsx
index 94881e30e10f3..1e5186447e8c0 100644
--- a/x-pack/plugins/cases/public/components/markdown_editor/eui_form.tsx
+++ b/x-pack/plugins/cases/public/components/markdown_editor/eui_form.tsx
@@ -75,3 +75,5 @@ export const MarkdownEditorForm = React.memo(
     }
   )
 );
+
+MarkdownEditorForm.displayName = 'MarkdownEditorForm';
diff --git a/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/plugin.tsx b/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/plugin.tsx
index 4766719b43946..106c9bf054549 100644
--- a/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/plugin.tsx
+++ b/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/plugin.tsx
@@ -140,7 +140,7 @@ const LensEditorComponent: LensEuiMarkdownEditorUiPlugin['editor'] = ({
     });
 
     lens?.navigateToPrefilledEditor(undefined, {
-      originatingApp: currentAppId!,
+      originatingApp: currentAppId,
       originatingPath,
     });
   }, [
@@ -174,7 +174,7 @@ const LensEditorComponent: LensEuiMarkdownEditorUiPlugin['editor'] = ({
             }
           : undefined,
         {
-          originatingApp: currentAppId!,
+          originatingApp: currentAppId,
           originatingPath,
         }
       );
@@ -310,7 +310,6 @@ const LensEditorComponent: LensEuiMarkdownEditorUiPlugin['editor'] = ({
 
       if (draftComment) {
         handleAdd(incomingEmbeddablePackage?.input.attributes, newTimeRange);
-        return;
       }
     }
   }, [embeddable, storage, timefilter, currentAppId, handleAdd, handleUpdate, draftComment]);
diff --git a/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx b/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx
index 7dcc1d847d076..76dc0e265dbdb 100644
--- a/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx
+++ b/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx
@@ -201,10 +201,10 @@ export class SavedObjectFinderUi extends React.Component<
 
   public render() {
     return (
-      <React.Fragment>
+      <>
         {this.renderSearchBar()}
         {this.renderListing()}
-      </React.Fragment>
+      </>
     );
   }
 
@@ -481,16 +481,23 @@ export class SavedObjectFinderUi extends React.Component<
               {items.map((item) => {
                 const currentSavedObjectMetaData = savedObjectMetaData.find(
                   (metaData) => metaData.type === item.type
-                )!;
+                );
+
+                if (currentSavedObjectMetaData == null) {
+                  return null;
+                }
+
                 const fullName = currentSavedObjectMetaData.getTooltipForSavedObject
                   ? currentSavedObjectMetaData.getTooltipForSavedObject(item.savedObject)
-                  : `${item.title} (${currentSavedObjectMetaData!.name})`;
+                  : `${item.title} (${currentSavedObjectMetaData.name})`;
+
                 const iconType = (
                   currentSavedObjectMetaData ||
                   ({
                     getIconForSavedObject: () => 'document',
                   } as Pick<SavedObjectMetaData<{ title: string }>, 'getIconForSavedObject'>)
                 ).getIconForSavedObject(item.savedObject);
+
                 return (
                   <EuiListGroupItem
                     key={item.id}
diff --git a/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/use_lens_button_toggle.ts b/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/use_lens_button_toggle.ts
index 34b45080e13de..2735727f299a1 100644
--- a/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/use_lens_button_toggle.ts
+++ b/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/use_lens_button_toggle.ts
@@ -5,6 +5,8 @@
  * 2.0.
  */
 
+/* eslint-disable @typescript-eslint/no-non-null-assertion */
+
 import { some } from 'lodash';
 import useDebounce from 'react-use/lib/useDebounce';
 import { ContextShape } from '@elastic/eui/src/components/markdown_editor/markdown_context';
@@ -112,6 +114,7 @@ export const useLensButtonToggle = ({
             ) {
               if (child.type === 'text') break outer; // don't dive into `text` nodes
               node = child;
+              // eslint-disable-next-line no-continue
               continue outer;
             }
           }
diff --git a/x-pack/plugins/cases/public/components/markdown_editor/renderer.tsx b/x-pack/plugins/cases/public/components/markdown_editor/renderer.tsx
index 6a91dda97a892..c57283106c6c8 100644
--- a/x-pack/plugins/cases/public/components/markdown_editor/renderer.tsx
+++ b/x-pack/plugins/cases/public/components/markdown_editor/renderer.tsx
@@ -16,16 +16,25 @@ interface Props {
   disableLinks?: boolean;
 }
 
+const withDisabledLinks = (disableLinks?: boolean): React.FC<EuiLinkAnchorProps> => {
+  const MarkdownLinkProcessingComponent: React.FC<EuiLinkAnchorProps> = memo((props) => (
+    <MarkdownLink {...props} disableLinks={disableLinks} />
+  ));
+
+  MarkdownLinkProcessingComponent.displayName = 'MarkdownLinkProcessingComponent';
+
+  return MarkdownLinkProcessingComponent;
+};
+
 const MarkdownRendererComponent: React.FC<Props> = ({ children, disableLinks }) => {
   const { processingPlugins, parsingPlugins } = usePlugins();
-  const MarkdownLinkProcessingComponent: React.FC<EuiLinkAnchorProps> = useMemo(
-    () => (props) => <MarkdownLink {...props} disableLinks={disableLinks} />,
-    [disableLinks]
-  );
   // Deep clone of the processing plugins to prevent affecting the markdown editor.
   const processingPluginList = cloneDeep(processingPlugins);
   // This line of code is TS-compatible and it will break if [1][1] change in the future.
-  processingPluginList[1][1].components.a = MarkdownLinkProcessingComponent;
+  processingPluginList[1][1].components.a = useMemo(
+    () => withDisabledLinks(disableLinks),
+    [disableLinks]
+  );
 
   return (
     <EuiMarkdownFormat
diff --git a/x-pack/plugins/cases/public/components/recent_cases/index.tsx b/x-pack/plugins/cases/public/components/recent_cases/index.tsx
index 2f53fde6980be..5c3b49b9a5dbb 100644
--- a/x-pack/plugins/cases/public/components/recent_cases/index.tsx
+++ b/x-pack/plugins/cases/public/components/recent_cases/index.tsx
@@ -100,5 +100,7 @@ export const RecentCases: React.FC<RecentCasesProps> = React.memo((props) => {
   );
 });
 
+RecentCases.displayName = 'RecentCases';
+
 // eslint-disable-next-line import/no-default-export
 export { RecentCases as default };
diff --git a/x-pack/plugins/cases/public/components/types.ts b/x-pack/plugins/cases/public/components/types.ts
index 07ab5814b082b..71c846eb922d7 100644
--- a/x-pack/plugins/cases/public/components/types.ts
+++ b/x-pack/plugins/cases/public/components/types.ts
@@ -5,4 +5,4 @@
  * 2.0.
  */
 
-export { CaseActionConnector } from '../../common';
+export type { CaseActionConnector } from '../../common';
diff --git a/x-pack/plugins/cases/public/components/user_action_tree/helpers.tsx b/x-pack/plugins/cases/public/components/user_action_tree/helpers.tsx
index 2eb44f91190c6..2419ac0d048e9 100644
--- a/x-pack/plugins/cases/public/components/user_action_tree/helpers.tsx
+++ b/x-pack/plugins/cases/public/components/user_action_tree/helpers.tsx
@@ -396,6 +396,8 @@ const ActionIcon = React.memo<{
   );
 });
 
+ActionIcon.displayName = 'ActionIcon';
+
 export const getActionAttachment = ({
   comment,
   userCanCrud,
diff --git a/x-pack/plugins/cases/public/components/user_action_tree/index.tsx b/x-pack/plugins/cases/public/components/user_action_tree/index.tsx
index 92640a34548e8..95c4f76eae0a2 100644
--- a/x-pack/plugins/cases/public/components/user_action_tree/index.tsx
+++ b/x-pack/plugins/cases/public/components/user_action_tree/index.tsx
@@ -12,8 +12,10 @@ import {
   EuiCommentList,
   EuiCommentProps,
 } from '@elastic/eui';
+import { ALERT_RULE_NAME, ALERT_RULE_UUID } from '@kbn/rule-data-utils';
+
 import classNames from 'classnames';
-import { isEmpty } from 'lodash';
+import { get, isEmpty } from 'lodash';
 import React, { useCallback, useMemo, useRef, useState, useEffect } from 'react';
 import { useParams } from 'react-router-dom';
 import styled from 'styled-components';
@@ -23,7 +25,7 @@ import * as i18n from './translations';
 
 import { useUpdateComment } from '../../containers/use_update_comment';
 import { useCurrentUser } from '../../common/lib/kibana';
-import { AddComment } from '../add_comment';
+import { AddComment, AddCommentRefObject } from '../add_comment';
 import {
   ActionConnector,
   ActionsCommentRequestRt,
@@ -50,7 +52,7 @@ import {
   getActionAttachment,
 } from './helpers';
 import { UserActionAvatar } from './user_action_avatar';
-import { UserActionMarkdown } from './user_action_markdown';
+import { UserActionMarkdown, UserActionMarkdownRefObject } from './user_action_markdown';
 import { UserActionTimestamp } from './user_action_timestamp';
 import { UserActionUsername } from './user_action_username';
 import { UserActionContentToolbar } from './user_action_content_toolbar';
@@ -129,6 +131,17 @@ const MyEuiCommentList = styled(EuiCommentList)`
 const DESCRIPTION_ID = 'description';
 const NEW_ID = 'newComment';
 
+const isAddCommentRef = (
+  ref: AddCommentRefObject | UserActionMarkdownRefObject | null | undefined
+): ref is AddCommentRefObject => {
+  const commentRef = ref as AddCommentRefObject;
+  if (commentRef?.addQuote != null) {
+    return true;
+  }
+
+  return false;
+};
+
 export const UserActionTree = React.memo(
   ({
     caseServices,
@@ -165,7 +178,9 @@ export const UserActionTree = React.memo(
     const { isLoadingIds, patchComment } = useUpdateComment();
     const currentUser = useCurrentUser();
     const [manageMarkdownEditIds, setManageMarkdownEditIds] = useState<string[]>([]);
-    const commentRefs = useRef<Record<string, any>>({});
+    const commentRefs = useRef<
+      Record<string, AddCommentRefObject | UserActionMarkdownRefObject | undefined | null>
+    >({});
     const { clearDraftComment, draftComment, hasIncomingLensState, openLensModal } =
       useLensDraftComment();
 
@@ -226,8 +241,9 @@ export const UserActionTree = React.memo(
 
     const handleManageQuote = useCallback(
       (quote: string) => {
-        if (commentRefs.current[NEW_ID]) {
-          commentRefs.current[NEW_ID].addQuote(quote);
+        const ref = commentRefs?.current[NEW_ID];
+        if (isAddCommentRef(ref)) {
+          ref.addQuote(quote);
         }
 
         handleOutlineComment('add-comment');
@@ -335,6 +351,8 @@ export const UserActionTree = React.memo(
     const userActions: EuiCommentProps[] = useMemo(
       () =>
         caseUserActions.reduce<EuiCommentProps[]>(
+          // TODO: Decrease complexity. https://github.com/elastic/kibana/issues/115730
+          // eslint-disable-next-line complexity
           (comments, action, index) => {
             // Comment creation
             if (action.commentId != null && action.action === 'create') {
@@ -421,9 +439,15 @@ export const UserActionTree = React.memo(
                 }
 
                 const ruleId =
-                  comment?.rule?.id ?? manualAlertsData[alertId]?.signal?.rule?.id?.[0] ?? null;
+                  comment?.rule?.id ??
+                  manualAlertsData[alertId]?.signal?.rule?.id?.[0] ??
+                  get(manualAlertsData[alertId], ALERT_RULE_UUID)[0] ??
+                  null;
                 const ruleName =
-                  comment?.rule?.name ?? manualAlertsData[alertId]?.signal?.rule?.name?.[0] ?? null;
+                  comment?.rule?.name ??
+                  manualAlertsData[alertId]?.signal?.rule?.name?.[0] ??
+                  get(manualAlertsData[alertId], ALERT_RULE_NAME)[0] ??
+                  null;
 
                 return [
                   ...comments,
@@ -656,15 +680,12 @@ export const UserActionTree = React.memo(
           return prevManageMarkdownEditIds;
         });
 
-        if (
-          commentRefs.current &&
-          commentRefs.current[draftComment.commentId] &&
-          commentRefs.current[draftComment.commentId].editor?.textarea &&
-          commentRefs.current[draftComment.commentId].editor?.toolbar
-        ) {
-          commentRefs.current[draftComment.commentId].setComment(draftComment.comment);
+        const ref = commentRefs?.current?.[draftComment.commentId];
+
+        if (isAddCommentRef(ref) && ref.editor?.textarea) {
+          ref.setComment(draftComment.comment);
           if (hasIncomingLensState) {
-            openLensModal({ editorRef: commentRefs.current[draftComment.commentId].editor });
+            openLensModal({ editorRef: ref.editor });
           } else {
             clearDraftComment();
           }
diff --git a/x-pack/plugins/cases/public/components/user_action_tree/user_action_markdown.tsx b/x-pack/plugins/cases/public/components/user_action_tree/user_action_markdown.tsx
index f7a6932b35856..93212d2b11016 100644
--- a/x-pack/plugins/cases/public/components/user_action_tree/user_action_markdown.tsx
+++ b/x-pack/plugins/cases/public/components/user_action_tree/user_action_markdown.tsx
@@ -26,7 +26,7 @@ interface UserActionMarkdownProps {
   onSaveContent: (content: string) => void;
 }
 
-interface UserActionMarkdownRefObject {
+export interface UserActionMarkdownRefObject {
   setComment: (newComment: string) => void;
 }
 
diff --git a/x-pack/plugins/cases/public/containers/api.ts b/x-pack/plugins/cases/public/containers/api.ts
index 75e8c8f58705d..14f617b19db52 100644
--- a/x-pack/plugins/cases/public/containers/api.ts
+++ b/x-pack/plugins/cases/public/containers/api.ts
@@ -87,7 +87,7 @@ export const resolveCase = async (
   signal: AbortSignal
 ): Promise<ResolvedCase> => {
   const response = await KibanaServices.get().http.fetch<CaseResolveResponse>(
-    getCaseDetailsUrl(caseId) + '/resolve',
+    `${getCaseDetailsUrl(caseId)}/resolve`,
     {
       method: 'GET',
       query: {
diff --git a/x-pack/plugins/cases/public/containers/configure/types.ts b/x-pack/plugins/cases/public/containers/configure/types.ts
index 61c81a8ce97c1..5ee09add196bd 100644
--- a/x-pack/plugins/cases/public/containers/configure/types.ts
+++ b/x-pack/plugins/cases/public/containers/configure/types.ts
@@ -17,7 +17,7 @@ import {
   ThirdPartyField,
 } from '../../../common';
 
-export {
+export type {
   ActionConnector,
   ActionTypeConnector,
   ActionType,
diff --git a/x-pack/plugins/cases/public/utils/use_mount_appended.ts b/x-pack/plugins/cases/public/utils/use_mount_appended.ts
index d43b0455f47da..48b71e6dbabfe 100644
--- a/x-pack/plugins/cases/public/utils/use_mount_appended.ts
+++ b/x-pack/plugins/cases/public/utils/use_mount_appended.ts
@@ -5,6 +5,8 @@
  * 2.0.
  */
 
+/* eslint-disable @typescript-eslint/no-explicit-any */
+
 // eslint-disable-next-line import/no-extraneous-dependencies
 import { mount } from 'enzyme';
 
diff --git a/x-pack/plugins/cases/server/authorization/authorization.ts b/x-pack/plugins/cases/server/authorization/authorization.ts
index 3598c5b8956fa..7a474ff4db402 100644
--- a/x-pack/plugins/cases/server/authorization/authorization.ts
+++ b/x-pack/plugins/cases/server/authorization/authorization.ts
@@ -231,8 +231,10 @@ export class Authorization {
           ? Array.from(featureCaseOwners)
           : privileges.kibana.reduce<string[]>((authorizedOwners, { authorized, privilege }) => {
               if (authorized && requiredPrivileges.has(privilege)) {
-                const owner = requiredPrivileges.get(privilege)!;
-                authorizedOwners.push(owner);
+                const owner = requiredPrivileges.get(privilege);
+                if (owner) {
+                  authorizedOwners.push(owner);
+                }
               }
 
               return authorizedOwners;
diff --git a/x-pack/plugins/cases/server/client/attachments/add.ts b/x-pack/plugins/cases/server/client/attachments/add.ts
index b84a6bd84c43b..159ff3b41aba9 100644
--- a/x-pack/plugins/cases/server/client/attachments/add.ts
+++ b/x-pack/plugins/cases/server/client/attachments/add.ts
@@ -263,7 +263,7 @@ async function getCombinedCase({
             id,
           }),
         ]
-      : [Promise.reject('case connector feature is disabled')]),
+      : [Promise.reject(new Error('case connector feature is disabled'))]),
   ]);
 
   if (subCasePromise.status === 'fulfilled') {
diff --git a/x-pack/plugins/cases/server/client/index.ts b/x-pack/plugins/cases/server/client/index.ts
index 7904e65ca6276..5560d535f971a 100644
--- a/x-pack/plugins/cases/server/client/index.ts
+++ b/x-pack/plugins/cases/server/client/index.ts
@@ -7,6 +7,6 @@
 
 export { CasesClient } from './client';
 export { CasesClientInternal } from './client_internal';
-export { CasesClientArgs } from './types';
+export type { CasesClientArgs } from './types';
 export { createCasesClient } from './client';
 export { createCasesClientInternal } from './client_internal';
diff --git a/x-pack/plugins/cases/server/common/error.ts b/x-pack/plugins/cases/server/common/error.ts
index 1b53eb9fdb218..3478131f65537 100644
--- a/x-pack/plugins/cases/server/common/error.ts
+++ b/x-pack/plugins/cases/server/common/error.ts
@@ -8,10 +8,14 @@
 import { Boom, isBoom } from '@hapi/boom';
 import { Logger } from 'src/core/server';
 
+export interface HTTPError extends Error {
+  statusCode: number;
+}
+
 /**
  * Helper class for wrapping errors while preserving the original thrown error.
  */
-class CaseError extends Error {
+export class CaseError extends Error {
   public readonly wrappedError?: Error;
   constructor(message?: string, originalError?: Error) {
     super(message);
@@ -51,6 +55,13 @@ export function isCaseError(error: unknown): error is CaseError {
   return error instanceof CaseError;
 }
 
+/**
+ * Type guard for determining if an error is an HTTPError
+ */
+export function isHTTPError(error: unknown): error is HTTPError {
+  return (error as HTTPError)?.statusCode != null;
+}
+
 /**
  * Create a CaseError that wraps the original thrown error. This also logs the message that will be placed in the CaseError
  * if the logger was defined.
diff --git a/x-pack/plugins/cases/server/connectors/case/schema.ts b/x-pack/plugins/cases/server/connectors/case/schema.ts
index 79d3bf62e8a9e..b8e46fdf5aa8c 100644
--- a/x-pack/plugins/cases/server/connectors/case/schema.ts
+++ b/x-pack/plugins/cases/server/connectors/case/schema.ts
@@ -83,6 +83,7 @@ const SwimlaneFieldsSchema = schema.object({
 
 const NoneFieldsSchema = schema.nullable(schema.object({}));
 
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
 const ReducedConnectorFieldsSchema: { [x: string]: any } = {
   [ConnectorTypes.jira]: JiraFieldsSchema,
   [ConnectorTypes.resilient]: ResilientFieldsSchema,
diff --git a/x-pack/plugins/cases/server/connectors/servicenow/sir_format.test.ts b/x-pack/plugins/cases/server/connectors/servicenow/sir_format.test.ts
index b09272d0a5505..706b9f2f23ab5 100644
--- a/x-pack/plugins/cases/server/connectors/servicenow/sir_format.test.ts
+++ b/x-pack/plugins/cases/server/connectors/servicenow/sir_format.test.ts
@@ -8,7 +8,7 @@
 import { CaseResponse } from '../../../common';
 import { format } from './sir_format';
 
-describe('ITSM formatter', () => {
+describe('SIR formatter', () => {
   const theCase = {
     id: 'case-id',
     connector: {
diff --git a/x-pack/plugins/cases/server/connectors/servicenow/sir_format.ts b/x-pack/plugins/cases/server/connectors/servicenow/sir_format.ts
index 9108408c4d089..02c9fe629f4f8 100644
--- a/x-pack/plugins/cases/server/connectors/servicenow/sir_format.ts
+++ b/x-pack/plugins/cases/server/connectors/servicenow/sir_format.ts
@@ -45,12 +45,16 @@ export const format: ServiceNowSIRFormat = (theCase, alerts) => {
 
   if (fieldsToAdd.length > 0) {
     sirFields = alerts.reduce<Record<SirFieldKey, string[]>>((acc, alert) => {
+      let temp = {};
       fieldsToAdd.forEach((alertField) => {
         const field = get(alertFieldMapping[alertField].alertPath, alert);
+
         if (field && !manageDuplicate[alertFieldMapping[alertField].sirFieldKey].has(field)) {
           manageDuplicate[alertFieldMapping[alertField].sirFieldKey].add(field);
-          acc = {
+
+          temp = {
             ...acc,
+            ...temp,
             [alertFieldMapping[alertField].sirFieldKey]: [
               ...acc[alertFieldMapping[alertField].sirFieldKey],
               field,
@@ -58,7 +62,8 @@ export const format: ServiceNowSIRFormat = (theCase, alerts) => {
           };
         }
       });
-      return acc;
+
+      return { ...acc, ...temp };
     }, sirFields);
   }
 
diff --git a/x-pack/plugins/cases/server/connectors/types.ts b/x-pack/plugins/cases/server/connectors/types.ts
index a8673c1262580..62b2c8e6f1551 100644
--- a/x-pack/plugins/cases/server/connectors/types.ts
+++ b/x-pack/plugins/cases/server/connectors/types.ts
@@ -11,7 +11,7 @@ import { CasesClientGetAlertsResponse } from '../client/alerts/types';
 import { CasesClientFactory } from '../client/factory';
 import { RegisterActionType } from '../types';
 
-export {
+export type {
   ContextTypeGeneratedAlertType,
   CommentSchemaType,
   ContextTypeAlertSchemaType,
diff --git a/x-pack/plugins/cases/server/index.ts b/x-pack/plugins/cases/server/index.ts
index 5e433b46b80e5..57db6e5565fff 100644
--- a/x-pack/plugins/cases/server/index.ts
+++ b/x-pack/plugins/cases/server/index.ts
@@ -22,4 +22,4 @@ export const config: PluginConfigDescriptor<ConfigType> = {
 export const plugin = (initializerContext: PluginInitializerContext) =>
   new CasePlugin(initializerContext);
 
-export { PluginStartContract } from './plugin';
+export type { PluginStartContract } from './plugin';
diff --git a/x-pack/plugins/cases/server/plugin.ts b/x-pack/plugins/cases/server/plugin.ts
index bef8d45bd86f6..9bbc7089c033c 100644
--- a/x-pack/plugins/cases/server/plugin.ts
+++ b/x-pack/plugins/cases/server/plugin.ts
@@ -126,6 +126,11 @@ export class CasePlugin {
       },
       featuresPluginStart: plugins.features,
       actionsPluginStart: plugins.actions,
+      /**
+       * Lens will be always defined as
+       * it is declared as required plugin in kibana.json
+       */
+      // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
       lensEmbeddableFactory: this.lensEmbeddableFactory!,
     });
 
diff --git a/x-pack/plugins/cases/server/routes/api/utils.test.ts b/x-pack/plugins/cases/server/routes/api/utils.test.ts
index 3fce38b27446e..fd7c038f06bc1 100644
--- a/x-pack/plugins/cases/server/routes/api/utils.test.ts
+++ b/x-pack/plugins/cases/server/routes/api/utils.test.ts
@@ -5,8 +5,9 @@
  * 2.0.
  */
 
-import { wrapError } from './utils';
 import { isBoom, boomify } from '@hapi/boom';
+import { HTTPError } from '../../common';
+import { wrapError } from './utils';
 
 describe('Utils', () => {
   describe('wrapError', () => {
@@ -25,7 +26,7 @@ describe('Utils', () => {
     });
 
     it('it set statusCode to errors status code', () => {
-      const error = new Error('Something happened') as any;
+      const error = new Error('Something happened') as HTTPError;
       error.statusCode = 404;
       const res = wrapError(error);
 
diff --git a/x-pack/plugins/cases/server/routes/api/utils.ts b/x-pack/plugins/cases/server/routes/api/utils.ts
index b2b5417ecae0f..cb4804aab0054 100644
--- a/x-pack/plugins/cases/server/routes/api/utils.ts
+++ b/x-pack/plugins/cases/server/routes/api/utils.ts
@@ -9,18 +9,21 @@ import { Boom, boomify, isBoom } from '@hapi/boom';
 
 import { schema } from '@kbn/config-schema';
 import { CustomHttpResponseOptions, ResponseError } from 'kibana/server';
-import { isCaseError } from '../../common';
+import { CaseError, isCaseError, HTTPError, isHTTPError } from '../../common';
 
 /**
  * Transforms an error into the correct format for a kibana response.
  */
-export function wrapError(error: any): CustomHttpResponseOptions<ResponseError> {
+
+export function wrapError(
+  error: CaseError | Boom | HTTPError | Error
+): CustomHttpResponseOptions<ResponseError> {
   let boom: Boom;
 
   if (isCaseError(error)) {
     boom = error.boomify();
   } else {
-    const options = { statusCode: error.statusCode ?? 500 };
+    const options = { statusCode: isHTTPError(error) ? error.statusCode : 500 };
     boom = isBoom(error) ? error : boomify(error, options);
   }
 
diff --git a/x-pack/plugins/cases/server/saved_object_types/migrations/index.ts b/x-pack/plugins/cases/server/saved_object_types/migrations/index.ts
index a4f50fbfcde5b..b0f9c7d2145de 100644
--- a/x-pack/plugins/cases/server/saved_object_types/migrations/index.ts
+++ b/x-pack/plugins/cases/server/saved_object_types/migrations/index.ts
@@ -14,7 +14,8 @@ import { SECURITY_SOLUTION_OWNER } from '../../../common';
 export { caseMigrations } from './cases';
 export { configureMigrations } from './configuration';
 export { userActionsMigrations } from './user_actions';
-export { createCommentsMigrations, CreateCommentsMigrationsDeps } from './comments';
+export type { CreateCommentsMigrationsDeps } from './comments';
+export { createCommentsMigrations } from './comments';
 
 export interface SanitizedCaseOwner {
   owner: string;
diff --git a/x-pack/plugins/cases/server/scripts/sub_cases/index.ts b/x-pack/plugins/cases/server/scripts/sub_cases/index.ts
index 3cb013bd2e3fd..28672160a0737 100644
--- a/x-pack/plugins/cases/server/scripts/sub_cases/index.ts
+++ b/x-pack/plugins/cases/server/scripts/sub_cases/index.ts
@@ -4,7 +4,11 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
+
+/* eslint-disable @typescript-eslint/no-explicit-any */
 /* eslint-disable no-console */
+/* eslint-disable no-process-exit */
+
 import yargs from 'yargs';
 import { ToolingLog } from '@kbn/dev-utils';
 import { KbnClient } from '@kbn/test';
diff --git a/x-pack/plugins/cases/server/services/alerts/index.ts b/x-pack/plugins/cases/server/services/alerts/index.ts
index 6bb2fb3ee3c56..d8a09fe1baf23 100644
--- a/x-pack/plugins/cases/server/services/alerts/index.ts
+++ b/x-pack/plugins/cases/server/services/alerts/index.ts
@@ -48,8 +48,6 @@ function isEmptyAlert(alert: AlertInfo): boolean {
 }
 
 export class AlertService {
-  constructor() {}
-
   public async updateAlertsStatus({ alerts, scopedClusterClient, logger }: UpdateAlertsStatusArgs) {
     try {
       const bucketedAlerts = bucketAlertsByIndexAndStatus(alerts, logger);
diff --git a/x-pack/plugins/cases/server/services/index.ts b/x-pack/plugins/cases/server/services/index.ts
index f910099c0cc20..a1cb5d8138c40 100644
--- a/x-pack/plugins/cases/server/services/index.ts
+++ b/x-pack/plugins/cases/server/services/index.ts
@@ -12,7 +12,8 @@ export { CasesService } from './cases';
 export { CaseConfigureService } from './configure';
 export { CaseUserActionService } from './user_actions';
 export { ConnectorMappingsService } from './connector_mappings';
-export { AlertService, AlertServiceContract } from './alerts';
+export type { AlertServiceContract } from './alerts';
+export { AlertService } from './alerts';
 export { AttachmentService } from './attachments';
 
 export interface ClientArgs {
diff --git a/x-pack/plugins/cloud/public/index.ts b/x-pack/plugins/cloud/public/index.ts
index 9f4f6b979c344..d51def6fa6641 100644
--- a/x-pack/plugins/cloud/public/index.ts
+++ b/x-pack/plugins/cloud/public/index.ts
@@ -8,7 +8,7 @@
 import { PluginInitializerContext } from '../../../../src/core/public';
 import { CloudPlugin } from './plugin';
 
-export { CloudSetup, CloudConfigType } from './plugin';
+export type { CloudSetup, CloudConfigType } from './plugin';
 export function plugin(initializerContext: PluginInitializerContext) {
   return new CloudPlugin(initializerContext);
 }
diff --git a/x-pack/plugins/cloud/server/index.ts b/x-pack/plugins/cloud/server/index.ts
index 8d212bb4e1593..eda2fa0a7324e 100644
--- a/x-pack/plugins/cloud/server/index.ts
+++ b/x-pack/plugins/cloud/server/index.ts
@@ -8,7 +8,7 @@
 import { PluginInitializerContext } from 'src/core/server';
 import { CloudPlugin } from './plugin';
 
-export { CloudSetup } from './plugin';
+export type { CloudSetup } from './plugin';
 export { config } from './config';
 export const plugin = (initializerContext: PluginInitializerContext) => {
   return new CloudPlugin(initializerContext);
diff --git a/x-pack/plugins/dashboard_enhanced/common/drilldowns/dashboard_drilldown/index.ts b/x-pack/plugins/dashboard_enhanced/common/drilldowns/dashboard_drilldown/index.ts
index dae19cf02e230..fde3b5b06de2d 100644
--- a/x-pack/plugins/dashboard_enhanced/common/drilldowns/dashboard_drilldown/index.ts
+++ b/x-pack/plugins/dashboard_enhanced/common/drilldowns/dashboard_drilldown/index.ts
@@ -7,4 +7,4 @@
 
 export { createExtract, createInject } from './dashboard_drilldown_persistable_state';
 export { EMBEDDABLE_TO_DASHBOARD_DRILLDOWN } from './constants';
-export { DrilldownConfig } from './types';
+export type { DrilldownConfig } from './types';
diff --git a/x-pack/plugins/dashboard_enhanced/public/index.ts b/x-pack/plugins/dashboard_enhanced/public/index.ts
index 82b0fc322bb83..545696abb0ac5 100644
--- a/x-pack/plugins/dashboard_enhanced/public/index.ts
+++ b/x-pack/plugins/dashboard_enhanced/public/index.ts
@@ -8,18 +8,18 @@
 import { PluginInitializerContext } from 'src/core/public';
 import { DashboardEnhancedPlugin } from './plugin';
 
-export {
+export type {
   SetupContract as DashboardEnhancedSetupContract,
   SetupDependencies as DashboardEnhancedSetupDependencies,
   StartContract as DashboardEnhancedStartContract,
   StartDependencies as DashboardEnhancedStartDependencies,
 } from './plugin';
 
-export {
-  AbstractDashboardDrilldown as DashboardEnhancedAbstractDashboardDrilldown,
+export type {
   AbstractDashboardDrilldownConfig as DashboardEnhancedAbstractDashboardDrilldownConfig,
   AbstractDashboardDrilldownParams as DashboardEnhancedAbstractDashboardDrilldownParams,
 } from './services/drilldowns/abstract_dashboard_drilldown';
+export { AbstractDashboardDrilldown as DashboardEnhancedAbstractDashboardDrilldown } from './services/drilldowns/abstract_dashboard_drilldown';
 
 export function plugin(context: PluginInitializerContext) {
   return new DashboardEnhancedPlugin(context);
diff --git a/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/abstract_dashboard_drilldown/components/index.ts b/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/abstract_dashboard_drilldown/components/index.ts
index ffdce9e91d156..9215f067fc851 100644
--- a/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/abstract_dashboard_drilldown/components/index.ts
+++ b/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/abstract_dashboard_drilldown/components/index.ts
@@ -5,7 +5,5 @@
  * 2.0.
  */
 
-export {
-  CollectConfigContainer,
-  DashboardDrilldownCollectConfigProps,
-} from './collect_config_container';
+export type { DashboardDrilldownCollectConfigProps } from './collect_config_container';
+export { CollectConfigContainer } from './collect_config_container';
diff --git a/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/abstract_dashboard_drilldown/index.ts b/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/abstract_dashboard_drilldown/index.ts
index 3acea2f76d73c..3b76303bda388 100644
--- a/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/abstract_dashboard_drilldown/index.ts
+++ b/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/abstract_dashboard_drilldown/index.ts
@@ -5,8 +5,6 @@
  * 2.0.
  */
 
-export {
-  AbstractDashboardDrilldown,
-  Params as AbstractDashboardDrilldownParams,
-} from './abstract_dashboard_drilldown';
-export { Config as AbstractDashboardDrilldownConfig } from './types';
+export type { Params as AbstractDashboardDrilldownParams } from './abstract_dashboard_drilldown';
+export { AbstractDashboardDrilldown } from './abstract_dashboard_drilldown';
+export type { Config as AbstractDashboardDrilldownConfig } from './types';
diff --git a/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/actions/flyout_create_drilldown/index.ts b/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/actions/flyout_create_drilldown/index.ts
index 3a0389ac2b546..f7d98d7681396 100644
--- a/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/actions/flyout_create_drilldown/index.ts
+++ b/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/actions/flyout_create_drilldown/index.ts
@@ -5,8 +5,5 @@
  * 2.0.
  */
 
-export {
-  FlyoutCreateDrilldownAction,
-  OpenFlyoutAddDrilldownParams,
-  OPEN_FLYOUT_ADD_DRILLDOWN,
-} from './flyout_create_drilldown';
+export type { OpenFlyoutAddDrilldownParams } from './flyout_create_drilldown';
+export { FlyoutCreateDrilldownAction, OPEN_FLYOUT_ADD_DRILLDOWN } from './flyout_create_drilldown';
diff --git a/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/actions/flyout_edit_drilldown/index.tsx b/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/actions/flyout_edit_drilldown/index.tsx
index c150c55120e59..76d61a7367d7e 100644
--- a/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/actions/flyout_edit_drilldown/index.tsx
+++ b/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/actions/flyout_edit_drilldown/index.tsx
@@ -5,8 +5,5 @@
  * 2.0.
  */
 
-export {
-  FlyoutEditDrilldownAction,
-  FlyoutEditDrilldownParams,
-  OPEN_FLYOUT_EDIT_DRILLDOWN,
-} from './flyout_edit_drilldown';
+export type { FlyoutEditDrilldownParams } from './flyout_edit_drilldown';
+export { FlyoutEditDrilldownAction, OPEN_FLYOUT_EDIT_DRILLDOWN } from './flyout_edit_drilldown';
diff --git a/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/embeddable_to_dashboard_drilldown/index.ts b/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/embeddable_to_dashboard_drilldown/index.ts
index 423007d548db5..3a34de6299fc4 100644
--- a/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/embeddable_to_dashboard_drilldown/index.ts
+++ b/x-pack/plugins/dashboard_enhanced/public/services/drilldowns/embeddable_to_dashboard_drilldown/index.ts
@@ -6,7 +6,5 @@
  */
 
 export { EMBEDDABLE_TO_DASHBOARD_DRILLDOWN } from './constants';
-export {
-  EmbeddableToDashboardDrilldown,
-  Params as EmbeddableToDashboardDrilldownParams,
-} from './embeddable_to_dashboard_drilldown';
+export type { Params as EmbeddableToDashboardDrilldownParams } from './embeddable_to_dashboard_drilldown';
+export { EmbeddableToDashboardDrilldown } from './embeddable_to_dashboard_drilldown';
diff --git a/x-pack/plugins/dashboard_enhanced/server/index.ts b/x-pack/plugins/dashboard_enhanced/server/index.ts
index 1f4659c2c781a..3351cd9547903 100644
--- a/x-pack/plugins/dashboard_enhanced/server/index.ts
+++ b/x-pack/plugins/dashboard_enhanced/server/index.ts
@@ -8,7 +8,7 @@
 import { PluginInitializerContext } from 'src/core/server';
 import { DashboardEnhancedPlugin } from './plugin';
 
-export {
+export type {
   SetupContract as DashboardEnhancedSetupContract,
   SetupDependencies as DashboardEnhancedSetupDependencies,
   StartContract as DashboardEnhancedStartContract,
diff --git a/x-pack/plugins/data_enhanced/public/index.ts b/x-pack/plugins/data_enhanced/public/index.ts
index c3adf19fabe13..38b8d7d5c5fdf 100644
--- a/x-pack/plugins/data_enhanced/public/index.ts
+++ b/x-pack/plugins/data_enhanced/public/index.ts
@@ -12,7 +12,7 @@ import { ConfigSchema } from '../config';
 export const plugin = (initializerContext: PluginInitializerContext<ConfigSchema>) =>
   new DataEnhancedPlugin(initializerContext);
 
-export { DataEnhancedSetup, DataEnhancedStart };
+export type { DataEnhancedSetup, DataEnhancedStart };
 
 export {
   ENHANCED_ES_SEARCH_STRATEGY,
diff --git a/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/components/index.tsx b/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/components/index.tsx
index f57ad73c3c760..2970c75e651d6 100644
--- a/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/components/index.tsx
+++ b/x-pack/plugins/data_enhanced/public/search/sessions_mgmt/components/index.tsx
@@ -9,7 +9,8 @@ import { EuiLinkProps, EuiText, EuiTextProps } from '@elastic/eui';
 import React from 'react';
 import extendSessionIcon from '../icons/extend_session.svg';
 
-export { OnActionComplete, PopoverActionsMenu } from './actions';
+export type { OnActionComplete } from './actions';
+export { PopoverActionsMenu } from './actions';
 
 export const TableText = ({ children, ...props }: EuiTextProps) => {
   return (
diff --git a/x-pack/plugins/data_enhanced/public/search/ui/connected_search_session_indicator/index.ts b/x-pack/plugins/data_enhanced/public/search/ui/connected_search_session_indicator/index.ts
index 122321691439d..fec61f8115486 100644
--- a/x-pack/plugins/data_enhanced/public/search/ui/connected_search_session_indicator/index.ts
+++ b/x-pack/plugins/data_enhanced/public/search/ui/connected_search_session_indicator/index.ts
@@ -5,7 +5,5 @@
  * 2.0.
  */
 
-export {
-  SearchSessionIndicatorDeps,
-  createConnectedSearchSessionIndicator,
-} from './connected_search_session_indicator';
+export type { SearchSessionIndicatorDeps } from './connected_search_session_indicator';
+export { createConnectedSearchSessionIndicator } from './connected_search_session_indicator';
diff --git a/x-pack/plugins/data_visualizer/public/application/common/components/combined_fields/index.ts b/x-pack/plugins/data_visualizer/public/application/common/components/combined_fields/index.ts
index 862128f2e856b..834813ddc2411 100644
--- a/x-pack/plugins/data_visualizer/public/application/common/components/combined_fields/index.ts
+++ b/x-pack/plugins/data_visualizer/public/application/common/components/combined_fields/index.ts
@@ -13,4 +13,4 @@ export {
 
 export { CombinedFieldsReadOnlyForm } from './combined_fields_read_only_form';
 export { CombinedFieldsForm } from './combined_fields_form';
-export { CombinedField } from './types';
+export type { CombinedField } from './types';
diff --git a/x-pack/plugins/data_visualizer/public/application/common/components/document_count_content/document_count_chart/index.ts b/x-pack/plugins/data_visualizer/public/application/common/components/document_count_content/document_count_chart/index.ts
index 97b42053b34e6..1b69f9b825165 100644
--- a/x-pack/plugins/data_visualizer/public/application/common/components/document_count_content/document_count_chart/index.ts
+++ b/x-pack/plugins/data_visualizer/public/application/common/components/document_count_content/document_count_chart/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { DocumentCountChart, DocumentCountChartPoint } from './document_count_chart';
+export type { DocumentCountChartPoint } from './document_count_chart';
+export { DocumentCountChart } from './document_count_chart';
diff --git a/x-pack/plugins/data_visualizer/public/application/common/components/multi_select_picker/index.ts b/x-pack/plugins/data_visualizer/public/application/common/components/multi_select_picker/index.ts
index 9d32228e1c4bc..a42ce68d9aa10 100644
--- a/x-pack/plugins/data_visualizer/public/application/common/components/multi_select_picker/index.ts
+++ b/x-pack/plugins/data_visualizer/public/application/common/components/multi_select_picker/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { MultiSelectPicker, Option } from './multi_select_picker';
+export type { Option } from './multi_select_picker';
+export { MultiSelectPicker } from './multi_select_picker';
diff --git a/x-pack/plugins/data_visualizer/public/application/common/components/results_links/index.ts b/x-pack/plugins/data_visualizer/public/application/common/components/results_links/index.ts
index 1dca4b7bf2254..24c36f97d7633 100644
--- a/x-pack/plugins/data_visualizer/public/application/common/components/results_links/index.ts
+++ b/x-pack/plugins/data_visualizer/public/application/common/components/results_links/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { ResultsLinks, ResultLink } from './results_links';
+export type { ResultLink } from './results_links';
+export { ResultsLinks } from './results_links';
diff --git a/x-pack/plugins/data_visualizer/public/application/common/components/results_links/results_links.tsx b/x-pack/plugins/data_visualizer/public/application/common/components/results_links/results_links.tsx
index f1de0b0b8b8fa..ed6ab29748a86 100644
--- a/x-pack/plugins/data_visualizer/public/application/common/components/results_links/results_links.tsx
+++ b/x-pack/plugins/data_visualizer/public/application/common/components/results_links/results_links.tsx
@@ -58,7 +58,13 @@ export const ResultsLinks: FC<Props> = ({
   additionalLinks,
 }) => {
   const {
-    services: { fileUpload },
+    services: {
+      fileUpload,
+      application: { getUrlForApp, capabilities },
+      share: {
+        urlGenerators: { getUrlGenerator },
+      },
+    },
   } = useDataVisualizerKibana();
 
   const [duration, setDuration] = useState({
@@ -72,15 +78,6 @@ export const ResultsLinks: FC<Props> = ({
   const [indexPatternManagementLink, setIndexPatternManagementLink] = useState('');
   const [generatedLinks, setGeneratedLinks] = useState<Record<string, string>>({});
 
-  const {
-    services: {
-      application: { getUrlForApp, capabilities },
-      share: {
-        urlGenerators: { getUrlGenerator },
-      },
-    },
-  } = useDataVisualizerKibana();
-
   useEffect(() => {
     let unmounted = false;
 
@@ -137,11 +134,14 @@ export const ResultsLinks: FC<Props> = ({
       setIndexManagementLink(
         getUrlForApp('management', { path: '/data/index_management/indices' })
       );
-      setIndexPatternManagementLink(
-        getUrlForApp('management', {
-          path: `/kibana/indexPatterns${createIndexPattern ? `/patterns/${indexPatternId}` : ''}`,
-        })
-      );
+
+      if (capabilities.indexPatterns.save === true) {
+        setIndexPatternManagementLink(
+          getUrlForApp('management', {
+            path: `/kibana/indexPatterns${createIndexPattern ? `/patterns/${indexPatternId}` : ''}`,
+          })
+        );
+      }
     }
 
     return () => {
diff --git a/x-pack/plugins/data_visualizer/public/application/common/components/stats_table/components/field_count_stats/index.ts b/x-pack/plugins/data_visualizer/public/application/common/components/stats_table/components/field_count_stats/index.ts
index d841ee2959f62..ccd7c6b73a577 100644
--- a/x-pack/plugins/data_visualizer/public/application/common/components/stats_table/components/field_count_stats/index.ts
+++ b/x-pack/plugins/data_visualizer/public/application/common/components/stats_table/components/field_count_stats/index.ts
@@ -5,9 +5,7 @@
  * 2.0.
  */
 
-export { TotalFieldsCount, TotalFieldsCountProps, TotalFieldsStats } from './total_fields_count';
-export {
-  MetricFieldsCount,
-  MetricFieldsCountProps,
-  MetricFieldsStats,
-} from './metric_fields_count';
+export type { TotalFieldsCountProps, TotalFieldsStats } from './total_fields_count';
+export { TotalFieldsCount } from './total_fields_count';
+export type { MetricFieldsCountProps, MetricFieldsStats } from './metric_fields_count';
+export { MetricFieldsCount } from './metric_fields_count';
diff --git a/x-pack/plugins/data_visualizer/public/application/common/components/stats_table/components/metric_distribution_chart/index.ts b/x-pack/plugins/data_visualizer/public/application/common/components/stats_table/components/metric_distribution_chart/index.ts
index 72947f2953cb8..5012426e8f7ca 100644
--- a/x-pack/plugins/data_visualizer/public/application/common/components/stats_table/components/metric_distribution_chart/index.ts
+++ b/x-pack/plugins/data_visualizer/public/application/common/components/stats_table/components/metric_distribution_chart/index.ts
@@ -5,5 +5,6 @@
  * 2.0.
  */
 
-export { MetricDistributionChart, MetricDistributionChartData } from './metric_distribution_chart';
+export type { MetricDistributionChartData } from './metric_distribution_chart';
+export { MetricDistributionChart } from './metric_distribution_chart';
 export { buildChartDataFromStats } from './metric_distribution_chart_data_builder';
diff --git a/x-pack/plugins/data_visualizer/public/application/common/components/stats_table/index.ts b/x-pack/plugins/data_visualizer/public/application/common/components/stats_table/index.ts
index 3009470af4858..a8aae70ccfc63 100644
--- a/x-pack/plugins/data_visualizer/public/application/common/components/stats_table/index.ts
+++ b/x-pack/plugins/data_visualizer/public/application/common/components/stats_table/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { DataVisualizerTable, ItemIdToExpandedRowMap } from './data_visualizer_stats_table';
+export type { ItemIdToExpandedRowMap } from './data_visualizer_stats_table';
+export { DataVisualizerTable } from './data_visualizer_stats_table';
diff --git a/x-pack/plugins/data_visualizer/public/application/common/components/stats_table/types/index.ts b/x-pack/plugins/data_visualizer/public/application/common/components/stats_table/types/index.ts
index 171d029482e27..00f8ac0c74eb9 100644
--- a/x-pack/plugins/data_visualizer/public/application/common/components/stats_table/types/index.ts
+++ b/x-pack/plugins/data_visualizer/public/application/common/components/stats_table/types/index.ts
@@ -5,11 +5,10 @@
  * 2.0.
  */
 
-export { FieldDataRowProps } from './field_data_row';
-export {
+export type { FieldDataRowProps } from './field_data_row';
+export type {
   FieldVisConfig,
   FileBasedFieldVisConfig,
   MetricFieldVisStats,
-  isFileBasedFieldVisConfig,
-  isIndexBasedFieldVisConfig,
 } from './field_vis_config';
+export { isFileBasedFieldVisConfig, isIndexBasedFieldVisConfig } from './field_vis_config';
diff --git a/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/components/file_data_visualizer_view/file_data_visualizer_view.js b/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/components/file_data_visualizer_view/file_data_visualizer_view.js
index 054416ad7ba36..fa437cce29268 100644
--- a/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/components/file_data_visualizer_view/file_data_visualizer_view.js
+++ b/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/components/file_data_visualizer_view/file_data_visualizer_view.js
@@ -295,12 +295,7 @@ export class FileDataVisualizerView extends Component {
       <div>
         {mode === MODE.READ && (
           <>
-            {!loading && !loaded && (
-              <AboutPanel
-                onFilePickerChange={this.onFilePickerChange}
-                disabled={!fileCouldNotBeReadPermissionError}
-              />
-            )}
+            {!loading && !loaded && <AboutPanel onFilePickerChange={this.onFilePickerChange} />}
 
             {loading && <LoadingPanel />}
 
@@ -373,6 +368,7 @@ export class FileDataVisualizerView extends Component {
               savedObjectsClient={this.savedObjectsClient}
               fileUpload={this.props.fileUpload}
               resultsLinks={this.props.resultsLinks}
+              capabilities={this.props.capabilities}
             />
 
             {bottomBarVisible && (
diff --git a/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/components/import_progress/index.ts b/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/components/import_progress/index.ts
index fe2d6ab7d826b..65ebab329a83c 100644
--- a/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/components/import_progress/index.ts
+++ b/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/components/import_progress/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { ImportProgress, IMPORT_STATUS, Statuses } from './import_progress';
+export type { Statuses } from './import_progress';
+export { ImportProgress, IMPORT_STATUS } from './import_progress';
diff --git a/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/components/import_settings/advanced.tsx b/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/components/import_settings/advanced.tsx
index 83e7c556f033f..23ad2b967bc28 100644
--- a/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/components/import_settings/advanced.tsx
+++ b/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/components/import_settings/advanced.tsx
@@ -21,6 +21,7 @@ import {
 import { CombinedField, CombinedFieldsForm } from '../../../common/components/combined_fields';
 import { JsonEditor, EDITOR_MODE } from '../json_editor';
 import { FindFileStructureResponse } from '../../../../../../file_upload/common';
+import { CreateDataViewToolTip } from './create_data_view_tooltip';
 const EDITOR_HEIGHT = '300px';
 
 interface Props {
@@ -42,6 +43,7 @@ interface Props {
   combinedFields: CombinedField[];
   onCombinedFieldsChange(combinedFields: CombinedField[]): void;
   results: FindFileStructureResponse;
+  canCreateDataView: boolean;
 }
 
 export const AdvancedSettings: FC<Props> = ({
@@ -63,6 +65,7 @@ export const AdvancedSettings: FC<Props> = ({
   combinedFields,
   onCombinedFieldsChange,
   results,
+  canCreateDataView,
 }) => {
   return (
     <React.Fragment>
@@ -98,18 +101,20 @@ export const AdvancedSettings: FC<Props> = ({
 
       <EuiSpacer size="m" />
 
-      <EuiCheckbox
-        id="createIndexPattern"
-        label={
-          <FormattedMessage
-            id="xpack.dataVisualizer.file.advancedImportSettings.createDataViewLabel"
-            defaultMessage="Create data view"
-          />
-        }
-        checked={createIndexPattern === true}
-        disabled={initialized === true}
-        onChange={onCreateIndexPatternChange}
-      />
+      <CreateDataViewToolTip showTooltip={canCreateDataView === false}>
+        <EuiCheckbox
+          id="createIndexPattern"
+          label={
+            <FormattedMessage
+              id="xpack.dataVisualizer.file.advancedImportSettings.createDataViewLabel"
+              defaultMessage="Create data view"
+            />
+          }
+          checked={createIndexPattern === true}
+          disabled={initialized === true || canCreateDataView === false}
+          onChange={onCreateIndexPatternChange}
+        />
+      </CreateDataViewToolTip>
 
       <EuiSpacer size="s" />
 
diff --git a/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/components/import_settings/create_data_view_tooltip.tsx b/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/components/import_settings/create_data_view_tooltip.tsx
new file mode 100644
index 0000000000000..84af5b08b3d49
--- /dev/null
+++ b/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/components/import_settings/create_data_view_tooltip.tsx
@@ -0,0 +1,33 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { FC } from 'react';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { EuiToolTip } from '@elastic/eui';
+
+interface Props {
+  children?: React.ReactElement;
+  showTooltip: boolean;
+}
+
+export const CreateDataViewToolTip: FC<Props> = ({ children, showTooltip }) => {
+  return (
+    <EuiToolTip
+      position="top"
+      content={
+        showTooltip ? (
+          <FormattedMessage
+            id="xpack.dataVisualizer.file.cannotCreateDataView.tooltip"
+            defaultMessage="You need permission to create data views."
+          />
+        ) : null
+      }
+    >
+      {children}
+    </EuiToolTip>
+  );
+};
diff --git a/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/components/import_settings/import_settings.tsx b/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/components/import_settings/import_settings.tsx
index 4e36dc42b54a5..c2b9779f3624d 100644
--- a/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/components/import_settings/import_settings.tsx
+++ b/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/components/import_settings/import_settings.tsx
@@ -14,6 +14,7 @@ import { SimpleSettings } from './simple';
 import { AdvancedSettings } from './advanced';
 import { CombinedField } from '../../../common/components/combined_fields';
 import { FindFileStructureResponse } from '../../../../../../file_upload/common';
+import { useDataVisualizerKibana } from '../../../kibana_context';
 
 interface Props {
   index: string;
@@ -56,6 +57,15 @@ export const ImportSettings: FC<Props> = ({
   onCombinedFieldsChange,
   results,
 }) => {
+  const {
+    services: {
+      application: { capabilities },
+    },
+  } = useDataVisualizerKibana();
+
+  const canCreateDataView =
+    capabilities.savedObjectsManagement.edit === true || capabilities.indexPatterns.save === true;
+
   const tabs = [
     {
       id: 'simple-settings',
@@ -74,6 +84,7 @@ export const ImportSettings: FC<Props> = ({
             onCreateIndexPatternChange={onCreateIndexPatternChange}
             indexNameError={indexNameError}
             combinedFields={combinedFields}
+            canCreateDataView={canCreateDataView}
           />
         </React.Fragment>
       ),
@@ -106,6 +117,7 @@ export const ImportSettings: FC<Props> = ({
             combinedFields={combinedFields}
             onCombinedFieldsChange={onCombinedFieldsChange}
             results={results}
+            canCreateDataView={canCreateDataView}
           />
         </React.Fragment>
       ),
diff --git a/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/components/import_settings/simple.tsx b/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/components/import_settings/simple.tsx
index 284a5aa3d4f3f..a080f62f54fc1 100644
--- a/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/components/import_settings/simple.tsx
+++ b/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/components/import_settings/simple.tsx
@@ -14,6 +14,7 @@ import {
   CombinedField,
   CombinedFieldsReadOnlyForm,
 } from '../../../common/components/combined_fields';
+import { CreateDataViewToolTip } from './create_data_view_tooltip';
 
 interface Props {
   index: string;
@@ -23,6 +24,7 @@ interface Props {
   onCreateIndexPatternChange(): void;
   indexNameError: string;
   combinedFields: CombinedField[];
+  canCreateDataView: boolean;
 }
 
 export const SimpleSettings: FC<Props> = ({
@@ -33,6 +35,7 @@ export const SimpleSettings: FC<Props> = ({
   onCreateIndexPatternChange,
   indexNameError,
   combinedFields,
+  canCreateDataView,
 }) => {
   return (
     <React.Fragment>
@@ -69,19 +72,21 @@ export const SimpleSettings: FC<Props> = ({
 
       <EuiSpacer size="m" />
 
-      <EuiCheckbox
-        id="createIndexPattern"
-        label={
-          <FormattedMessage
-            id="xpack.dataVisualizer.file.simpleImportSettings.createDataViewLabel"
-            defaultMessage="Create data view"
-          />
-        }
-        checked={createIndexPattern === true}
-        disabled={initialized === true}
-        onChange={onCreateIndexPatternChange}
-        data-test-subj="dataVisualizerFileCreateIndexPatternCheckbox"
-      />
+      <CreateDataViewToolTip showTooltip={canCreateDataView === false}>
+        <EuiCheckbox
+          id="createIndexPattern"
+          label={
+            <FormattedMessage
+              id="xpack.dataVisualizer.file.simpleImportSettings.createDataViewLabel"
+              defaultMessage="Create data view"
+            />
+          }
+          checked={createIndexPattern === true}
+          disabled={initialized === true || canCreateDataView === false}
+          onChange={onCreateIndexPatternChange}
+          data-test-subj="dataVisualizerFileCreateIndexPatternCheckbox"
+        />
+      </CreateDataViewToolTip>
 
       <EuiSpacer size="m" />
 
diff --git a/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/components/import_view/import_view.js b/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/components/import_view/import_view.js
index 3b3a11a5dff22..b65e2c35ff4ff 100644
--- a/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/components/import_view/import_view.js
+++ b/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/components/import_view/import_view.js
@@ -76,7 +76,7 @@ export class ImportView extends Component {
   constructor(props) {
     super(props);
 
-    this.state = getDefaultState(DEFAULT_STATE, this.props.results);
+    this.state = getDefaultState(DEFAULT_STATE, this.props.results, this.props.capabilities);
     this.savedObjectsClient = props.savedObjectsClient;
   }
 
@@ -85,7 +85,7 @@ export class ImportView extends Component {
   }
 
   clickReset = () => {
-    const state = getDefaultState(this.state, this.props.results);
+    const state = getDefaultState(this.state, this.props.results, this.props.capabilities);
     this.setState(state, () => {
       this.loadIndexPatternNames();
     });
@@ -640,7 +640,7 @@ async function createKibanaIndexPattern(indexPatternName, indexPatterns, timeFie
   }
 }
 
-function getDefaultState(state, results) {
+function getDefaultState(state, results, capabilities) {
   const indexSettingsString =
     state.indexSettingsString === ''
       ? JSON.stringify(DEFAULT_INDEX_SETTINGS, null, 2)
@@ -666,6 +666,11 @@ function getDefaultState(state, results) {
 
   const timeFieldName = results.timestamp_field;
 
+  const createIndexPattern =
+    capabilities.savedObjectsManagement.edit === false && capabilities.indexPatterns.save === false
+      ? false
+      : state.createIndexPattern;
+
   return {
     ...DEFAULT_STATE,
     indexSettingsString,
@@ -673,6 +678,7 @@ function getDefaultState(state, results) {
     pipelineString,
     timeFieldName,
     combinedFields,
+    createIndexPattern,
   };
 }
 
diff --git a/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/file_data_visualizer.tsx b/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/file_data_visualizer.tsx
index 3644f7053f1e8..a82a2b7e25d85 100644
--- a/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/file_data_visualizer.tsx
+++ b/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/file_data_visualizer.tsx
@@ -39,6 +39,7 @@ export const FileDataVisualizer: FC<Props> = ({ additionalLinks }) => {
         http={coreStart.http}
         fileUpload={fileUpload}
         resultsLinks={additionalLinks}
+        capabilities={coreStart.application.capabilities}
       />
     </KibanaContextProvider>
   );
diff --git a/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/index.ts b/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/index.ts
index ca87d73b6a758..4cd3755726ad2 100644
--- a/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/index.ts
+++ b/x-pack/plugins/data_visualizer/public/application/file_data_visualizer/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { FileDataVisualizer, FileDataVisualizerSpec } from './file_data_visualizer';
+export type { FileDataVisualizerSpec } from './file_data_visualizer';
+export { FileDataVisualizer } from './file_data_visualizer';
diff --git a/x-pack/plugins/data_visualizer/public/application/index.ts b/x-pack/plugins/data_visualizer/public/application/index.ts
index 6229f61be85e9..7e84bd84adf6f 100644
--- a/x-pack/plugins/data_visualizer/public/application/index.ts
+++ b/x-pack/plugins/data_visualizer/public/application/index.ts
@@ -5,9 +5,10 @@
  * 2.0.
  */
 
-export { FileDataVisualizer, FileDataVisualizerSpec } from './file_data_visualizer';
-export {
-  IndexDataVisualizer,
+export type { FileDataVisualizerSpec } from './file_data_visualizer';
+export { FileDataVisualizer } from './file_data_visualizer';
+export type {
   IndexDataVisualizerSpec,
   IndexDataVisualizerViewProps,
 } from './index_data_visualizer';
+export { IndexDataVisualizer } from './index_data_visualizer';
diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/full_time_range_selector/index.tsx b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/full_time_range_selector/index.tsx
index c79df59ee3f69..14ad77e2adc3a 100644
--- a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/full_time_range_selector/index.tsx
+++ b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/full_time_range_selector/index.tsx
@@ -6,4 +6,5 @@
  */
 
 export { FullTimeRangeSelector } from './full_time_range_selector';
-export { getTimeFilterRange, TimeRange } from './full_time_range_selector_service';
+export type { TimeRange } from './full_time_range_selector_service';
+export { getTimeFilterRange } from './full_time_range_selector_service';
diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/index_data_visualizer_view/index.ts b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/index_data_visualizer_view/index.ts
index bcdef0966039d..9bb579f7af55d 100644
--- a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/index_data_visualizer_view/index.ts
+++ b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/index_data_visualizer_view/index.ts
@@ -5,7 +5,5 @@
  * 2.0.
  */
 
-export {
-  IndexDataVisualizerViewProps,
-  IndexDataVisualizerView,
-} from './index_data_visualizer_view';
+export type { IndexDataVisualizerViewProps } from './index_data_visualizer_view';
+export { IndexDataVisualizerView } from './index_data_visualizer_view';
diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/index.ts b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/index.ts
index 77b6f9b5ab18c..82abdf185f9ab 100644
--- a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/index.ts
+++ b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/index.ts
@@ -5,5 +5,6 @@
  * 2.0.
  */
 
-export { IndexDataVisualizer, IndexDataVisualizerSpec } from './index_data_visualizer';
+export type { IndexDataVisualizerSpec } from './index_data_visualizer';
+export { IndexDataVisualizer } from './index_data_visualizer';
 export type { IndexDataVisualizerViewProps } from './components/index_data_visualizer_view';
diff --git a/x-pack/plugins/data_visualizer/public/index.ts b/x-pack/plugins/data_visualizer/public/index.ts
index 1a045f144c015..4a579f4e3abcc 100644
--- a/x-pack/plugins/data_visualizer/public/index.ts
+++ b/x-pack/plugins/data_visualizer/public/index.ts
@@ -11,7 +11,7 @@ export function plugin() {
   return new DataVisualizerPlugin();
 }
 
-export { DataVisualizerPluginStart } from './plugin';
+export type { DataVisualizerPluginStart } from './plugin';
 
 export type {
   FileDataVisualizerSpec,
diff --git a/x-pack/plugins/data_visualizer/public/lazy_load_bundle/lazy/index.ts b/x-pack/plugins/data_visualizer/public/lazy_load_bundle/lazy/index.ts
index a895a0eb98385..0001f912bff0d 100644
--- a/x-pack/plugins/data_visualizer/public/lazy_load_bundle/lazy/index.ts
+++ b/x-pack/plugins/data_visualizer/public/lazy_load_bundle/lazy/index.ts
@@ -5,9 +5,5 @@
  * 2.0.
  */
 
-export {
-  FileDataVisualizer,
-  IndexDataVisualizer,
-  FileDataVisualizerSpec,
-  IndexDataVisualizerSpec,
-} from '../../application';
+export type { FileDataVisualizerSpec, IndexDataVisualizerSpec } from '../../application';
+export { FileDataVisualizer, IndexDataVisualizer } from '../../application';
diff --git a/x-pack/plugins/drilldowns/url_drilldown/public/lib/url_drilldown.tsx b/x-pack/plugins/drilldowns/url_drilldown/public/lib/url_drilldown.tsx
index 4c46b84008766..163a2130f657c 100644
--- a/x-pack/plugins/drilldowns/url_drilldown/public/lib/url_drilldown.tsx
+++ b/x-pack/plugins/drilldowns/url_drilldown/public/lib/url_drilldown.tsx
@@ -93,7 +93,6 @@ export class UrlDrilldown implements Drilldown<Config, ActionContext, ActionFact
     onConfig,
     context,
   }) => {
-    // eslint-disable-next-line react-hooks/rules-of-hooks
     const variables = React.useMemo(() => this.getVariableList(context), [context]);
 
     return (
diff --git a/x-pack/plugins/embeddable_enhanced/public/index.ts b/x-pack/plugins/embeddable_enhanced/public/index.ts
index 0512bedd2a57a..8c64f376754a5 100644
--- a/x-pack/plugins/embeddable_enhanced/public/index.ts
+++ b/x-pack/plugins/embeddable_enhanced/public/index.ts
@@ -8,7 +8,7 @@
 import { PluginInitializerContext } from 'src/core/public';
 import { EmbeddableEnhancedPlugin } from './plugin';
 
-export {
+export type {
   SetupContract as EmbeddableEnhancedSetupContract,
   SetupDependencies as EmbeddableEnhancedSetupDependencies,
   StartContract as EmbeddableEnhancedStartContract,
@@ -19,6 +19,6 @@ export function plugin(context: PluginInitializerContext) {
   return new EmbeddableEnhancedPlugin(context);
 }
 
-export { EnhancedEmbeddable, EnhancedEmbeddableContext } from './types';
+export type { EnhancedEmbeddable, EnhancedEmbeddableContext } from './types';
 export { isEnhancedEmbeddable } from './embeddables';
 export { drilldownGrouping as embeddableEnhancedDrilldownGrouping } from './actions';
diff --git a/x-pack/plugins/encrypted_saved_objects/server/crypto/index.ts b/x-pack/plugins/encrypted_saved_objects/server/crypto/index.ts
index 31086f56c3b86..532702f213192 100644
--- a/x-pack/plugins/encrypted_saved_objects/server/crypto/index.ts
+++ b/x-pack/plugins/encrypted_saved_objects/server/crypto/index.ts
@@ -5,12 +5,11 @@
  * 2.0.
  */
 
-export {
-  EncryptedSavedObjectsService,
+export type {
   EncryptedSavedObjectTypeRegistration,
-  descriptorToArray,
   SavedObjectDescriptor,
 } from './encrypted_saved_objects_service';
+export { EncryptedSavedObjectsService, descriptorToArray } from './encrypted_saved_objects_service';
 export { EncryptionError, EncryptionErrorOperation } from './encryption_error';
 export { EncryptedSavedObjectAttributesDefinition } from './encrypted_saved_object_type_definition';
 export { EncryptionKeyRotationService } from './encryption_key_rotation_service';
diff --git a/x-pack/plugins/encrypted_saved_objects/server/index.ts b/x-pack/plugins/encrypted_saved_objects/server/index.ts
index d462f06939f6b..873c8c0d52cb5 100644
--- a/x-pack/plugins/encrypted_saved_objects/server/index.ts
+++ b/x-pack/plugins/encrypted_saved_objects/server/index.ts
@@ -10,9 +10,10 @@ import type { PluginConfigDescriptor, PluginInitializerContext } from 'src/core/
 import { ConfigSchema } from './config';
 import { EncryptedSavedObjectsPlugin } from './plugin';
 
-export { EncryptedSavedObjectTypeRegistration, EncryptionError } from './crypto';
-export { EncryptedSavedObjectsPluginSetup, EncryptedSavedObjectsPluginStart } from './plugin';
-export { EncryptedSavedObjectsClient } from './saved_objects';
+export type { EncryptedSavedObjectTypeRegistration } from './crypto';
+export { EncryptionError } from './crypto';
+export type { EncryptedSavedObjectsPluginSetup, EncryptedSavedObjectsPluginStart } from './plugin';
+export type { EncryptedSavedObjectsClient } from './saved_objects';
 export type { IsMigrationNeededPredicate } from './create_migration';
 
 export const config: PluginConfigDescriptor = {
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/automated_curation_history.test.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/automated_curation_history.test.tsx
index b7d1b6f9ed809..cd8ba123b5843 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/automated_curation_history.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/automated_curation_history.test.tsx
@@ -17,7 +17,7 @@ describe('AutomatedCurationHistory', () => {
   it('renders', () => {
     const wrapper = shallow(<AutomatedCurationHistory engineName="foo" query="some text" />);
     expect(wrapper.find(EntSearchLogStream).prop('query')).toEqual(
-      'appsearch.search_relevance_suggestions.query: some text and event.kind: event and event.dataset: search-relevance-suggestions and appsearch.search_relevance_suggestions.engine: foo and event.action: curation_suggestion and appsearch.search_relevance_suggestions.suggestion.new_status: automated'
+      'appsearch.adaptive_relevance.query: some text and event.kind: event and event.dataset: search-relevance-suggestions and appsearch.adaptive_relevance.engine: foo and event.action: curation_suggestion and appsearch.adaptive_relevance.suggestion.new_status: automated'
     );
   });
 });
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/automated_curation_history.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/automated_curation_history.tsx
index debe8f86cfe2b..7fb91daf2e590 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/automated_curation_history.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/automated_curation_history.tsx
@@ -19,12 +19,12 @@ interface Props {
 
 export const AutomatedCurationHistory: React.FC<Props> = ({ query, engineName }) => {
   const filters = [
-    `appsearch.search_relevance_suggestions.query: ${query}`,
+    `appsearch.adaptive_relevance.query: ${query}`,
     'event.kind: event',
     'event.dataset: search-relevance-suggestions',
-    `appsearch.search_relevance_suggestions.engine: ${engineName}`,
+    `appsearch.adaptive_relevance.engine: ${engineName}`,
     'event.action: curation_suggestion',
-    'appsearch.search_relevance_suggestions.suggestion.new_status: automated',
+    'appsearch.adaptive_relevance.suggestion.new_status: automated',
   ];
 
   return (
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/suggested_documents_callout.test.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/suggested_documents_callout.test.tsx
index b1f02b960aa8a..4fdce0bcd0299 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/suggested_documents_callout.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/suggested_documents_callout.test.tsx
@@ -28,7 +28,7 @@ const MOCK_VALUES = {
   },
   // EngineLogic
   engine: {
-    search_relevance_suggestions_active: true,
+    adaptive_relevance_suggestions_active: true,
   },
 };
 
@@ -53,7 +53,7 @@ describe('SuggestedDocumentsCallout', () => {
   });
 
   it('is empty when suggestions are not active', () => {
-    const values = set('engine.search_relevance_suggestions_active', false, MOCK_VALUES);
+    const values = set('engine.adaptive_relevance_suggestions_active', false, MOCK_VALUES);
     setMockValues(values);
 
     const wrapper = shallow(<SuggestedDocumentsCallout />);
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/suggested_documents_callout.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/suggested_documents_callout.tsx
index af76ebee16bad..ec296089a1086 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/suggested_documents_callout.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/curation/suggested_documents_callout.tsx
@@ -22,13 +22,13 @@ export const SuggestedDocumentsCallout: React.FC = () => {
     curation: { suggestion, queries },
   } = useValues(CurationLogic);
   const {
-    engine: { search_relevance_suggestions_active: searchRelevanceSuggestionsActive },
+    engine: { adaptive_relevance_suggestions_active: adaptiveRelevanceSuggestionsActive },
   } = useValues(EngineLogic);
 
   if (
     typeof suggestion === 'undefined' ||
     suggestion.status !== 'pending' ||
-    searchRelevanceSuggestionsActive === false
+    adaptiveRelevanceSuggestionsActive === false
   ) {
     return null;
   }
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations.test.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations.test.tsx
index 49d48c8c05ba6..ba3ac33be3c47 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations.test.tsx
@@ -55,7 +55,7 @@ describe('Curations', () => {
     },
     // EngineLogic
     engine: {
-      search_relevance_suggestions_active: true,
+      adaptive_relevance_suggestions_active: true,
     },
   };
 
@@ -89,7 +89,7 @@ describe('Curations', () => {
   });
 
   it('renders less tabs when suggestions are not active', () => {
-    setMockValues(set('engine.search_relevance_suggestions_active', false, values));
+    setMockValues(set('engine.adaptive_relevance_suggestions_active', false, values));
     const wrapper = shallow(<Curations />);
 
     expect(getPageTitle(wrapper)).toEqual('Curated results');
@@ -99,7 +99,7 @@ describe('Curations', () => {
   });
 
   it('renders a New! badge  when suggestions are not active', () => {
-    setMockValues(set('engine.search_relevance_suggestions_active', false, values));
+    setMockValues(set('engine.adaptive_relevance_suggestions_active', false, values));
     const wrapper = shallow(<Curations />);
 
     expect(getPageTitle(wrapper)).toEqual('Curated results');
@@ -109,7 +109,7 @@ describe('Curations', () => {
   });
 
   it('hides the badge when suggestions are active', () => {
-    setMockValues(set('engine.search_relevance_suggestions_active', true, values));
+    setMockValues(set('engine.adaptive_relevance_suggestions_active', true, values));
     const wrapper = shallow(<Curations />);
 
     expect(getPageTitle(wrapper)).toEqual('Curated results');
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations.tsx
index b0f4f03789af2..048566409ab9f 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations.tsx
@@ -30,10 +30,10 @@ export const Curations: React.FC = () => {
   const { dataLoading, meta, selectedPageTab } = useValues(CurationsLogic);
   const { loadCurations, onSelectPageTab } = useActions(CurationsLogic);
   const {
-    engine: { search_relevance_suggestions_active: searchRelevanceSuggestionsActive },
+    engine: { adaptive_relevance_suggestions_active: adaptiveRelevanceSuggestionsActive },
   } = useValues(EngineLogic);
 
-  const suggestionsEnabled = searchRelevanceSuggestionsActive;
+  const suggestionsEnabled = adaptiveRelevanceSuggestionsActive;
 
   const OVERVIEW_TAB = {
     label: i18n.translate(
@@ -72,7 +72,7 @@ export const Curations: React.FC = () => {
     ),
   };
 
-  const pageTabs = searchRelevanceSuggestionsActive
+  const pageTabs = adaptiveRelevanceSuggestionsActive
     ? [OVERVIEW_TAB, HISTORY_TAB, SETTINGS_TAB]
     : [OVERVIEW_TAB, SETTINGS_TAB];
 
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/automated_curations_history_panel.test.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/automated_curations_history_panel.test.tsx
index 044637ff1c823..36703dc0d0d85 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/automated_curations_history_panel.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/automated_curations_history_panel.test.tsx
@@ -29,7 +29,7 @@ describe('AutomatedCurationsHistoryPanel', () => {
 
     expect(wrapper.is(DataPanel)).toBe(true);
     expect(wrapper.find(EntSearchLogStream).prop('query')).toEqual(
-      'event.kind: event and event.dataset: search-relevance-suggestions and appsearch.search_relevance_suggestions.engine: some-engine and event.action: curation_suggestion and appsearch.search_relevance_suggestions.suggestion.new_status: automated'
+      'event.kind: event and event.dataset: search-relevance-suggestions and appsearch.adaptive_relevance.engine: some-engine and event.action: curation_suggestion and appsearch.adaptive_relevance.suggestion.new_status: automated'
     );
   });
 });
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/automated_curations_history_panel.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/automated_curations_history_panel.tsx
index 901609718c8ec..04f786b1ee1e1 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/automated_curations_history_panel.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/automated_curations_history_panel.tsx
@@ -21,9 +21,9 @@ export const AutomatedCurationsHistoryPanel: React.FC = () => {
   const filters = [
     'event.kind: event',
     'event.dataset: search-relevance-suggestions',
-    `appsearch.search_relevance_suggestions.engine: ${engineName}`,
+    `appsearch.adaptive_relevance.engine: ${engineName}`,
     'event.action: curation_suggestion',
-    'appsearch.search_relevance_suggestions.suggestion.new_status: automated',
+    'appsearch.adaptive_relevance.suggestion.new_status: automated',
   ];
 
   return (
@@ -54,7 +54,7 @@ export const AutomatedCurationsHistoryPanel: React.FC = () => {
         columns={[
           {
             type: 'field',
-            field: 'appsearch.search_relevance_suggestions.query',
+            field: 'appsearch.adaptive_relevance.query',
             header: i18n.translate(
               'xpack.enterpriseSearch.appSearch.engine.curations.automatedCurationsHistoryPanel.queryColumnHeader',
               { defaultMessage: 'Query' }
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/rejected_curations_history_panel.test.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/rejected_curations_history_panel.test.tsx
index 28bb317941e1c..58bf89a36d5ee 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/rejected_curations_history_panel.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/rejected_curations_history_panel.test.tsx
@@ -29,7 +29,7 @@ describe('RejectedCurationsHistoryPanel', () => {
 
     expect(wrapper.is(DataPanel)).toBe(true);
     expect(wrapper.find(EntSearchLogStream).prop('query')).toEqual(
-      'event.kind: event and event.dataset: search-relevance-suggestions and appsearch.search_relevance_suggestions.engine: some-engine and event.action: curation_suggestion and appsearch.search_relevance_suggestions.suggestion.new_status: rejected'
+      'event.kind: event and event.dataset: search-relevance-suggestions and appsearch.adaptive_relevance.engine: some-engine and event.action: curation_suggestion and appsearch.adaptive_relevance.suggestion.new_status: rejected'
     );
   });
 });
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/rejected_curations_history_panel.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/rejected_curations_history_panel.tsx
index 275083f91c0fb..e7d66fc35a506 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/rejected_curations_history_panel.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_history/components/rejected_curations_history_panel.tsx
@@ -21,9 +21,9 @@ export const RejectedCurationsHistoryPanel: React.FC = () => {
   const filters = [
     'event.kind: event',
     'event.dataset: search-relevance-suggestions',
-    `appsearch.search_relevance_suggestions.engine: ${engineName}`,
+    `appsearch.adaptive_relevance.engine: ${engineName}`,
     'event.action: curation_suggestion',
-    'appsearch.search_relevance_suggestions.suggestion.new_status: rejected',
+    'appsearch.adaptive_relevance.suggestion.new_status: rejected',
   ];
 
   return (
@@ -53,7 +53,7 @@ export const RejectedCurationsHistoryPanel: React.FC = () => {
         columns={[
           {
             type: 'field',
-            field: 'appsearch.search_relevance_suggestions.query',
+            field: 'appsearch.adaptive_relevance.query',
             header: i18n.translate(
               'xpack.enterpriseSearch.appSearch.engine.curations.rejectedCurationsHistoryPanel.queryColumnHeader',
               { defaultMessage: 'Query' }
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_overview.test.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_overview.test.tsx
index 43ef9dfd7ad2b..b7da6d64b6a8a 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_overview.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_overview.test.tsx
@@ -36,7 +36,7 @@ const MOCK_VALUES = {
   ],
   // EngineLogic
   engine: {
-    search_relevance_suggestions_active: true,
+    adaptive_relevance_suggestions_active: true,
   },
 };
 
@@ -71,14 +71,14 @@ describe('CurationsOverview', () => {
   });
 
   it('renders a suggestions table when suggestions are active', () => {
-    setMockValues(set('engine.search_relevance_suggestions_active', true, MOCK_VALUES));
+    setMockValues(set('engine.adaptive_relevance_suggestions_active', true, MOCK_VALUES));
     const wrapper = shallow(<CurationsOverview />);
 
     expect(wrapper.find(SuggestionsTable).exists()).toBe(true);
   });
 
   it('doesn\t render a suggestions table when suggestions are not active', () => {
-    setMockValues(set('engine.search_relevance_suggestions_active', false, MOCK_VALUES));
+    setMockValues(set('engine.adaptive_relevance_suggestions_active', false, MOCK_VALUES));
     const wrapper = shallow(<CurationsOverview />);
 
     expect(wrapper.find(SuggestionsTable).exists()).toBe(false);
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_overview.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_overview.tsx
index a611ca88cefd4..f763c297ea1de 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_overview.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/views/curations_overview.tsx
@@ -19,10 +19,10 @@ import { CurationsLogic } from '../curations_logic';
 export const CurationsOverview: React.FC = () => {
   const { curations } = useValues(CurationsLogic);
   const {
-    engine: { search_relevance_suggestions_active: searchRelevanceSuggestionsActive },
+    engine: { adaptive_relevance_suggestions_active: adaptiveRelevanceSuggestionsActive },
   } = useValues(EngineLogic);
 
-  const shouldShowSuggestions = searchRelevanceSuggestionsActive;
+  const shouldShowSuggestions = adaptiveRelevanceSuggestionsActive;
 
   return (
     <>
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine/engine_logic.test.ts b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine/engine_logic.test.ts
index bb30190833dd3..adcc6bc546629 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine/engine_logic.test.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine/engine_logic.test.ts
@@ -43,7 +43,7 @@ describe('EngineLogic', () => {
     schema: { test: SchemaType.Text },
     apiTokens: [],
     apiKey: 'some-key',
-    search_relevance_suggestions_active: true,
+    adaptive_relevance_suggestions_active: true,
   };
 
   const DEFAULT_VALUES = {
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine/types.ts b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine/types.ts
index 0bfbc185b85f3..6faa749f95864 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine/types.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine/types.ts
@@ -53,8 +53,8 @@ export interface EngineDetails extends Engine {
   isMeta: boolean;
   engine_count?: number;
   includedEngines?: EngineDetails[];
-  search_relevance_suggestions?: SearchRelevanceSuggestionDetails;
-  search_relevance_suggestions_active: boolean;
+  adaptive_relevance_suggestions?: SearchRelevanceSuggestionDetails;
+  adaptive_relevance_suggestions_active: boolean;
 }
 
 interface ResultField {
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine_overview/components/suggested_curations_callout.test.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine_overview/components/suggested_curations_callout.test.tsx
index c65d95a5254ee..2fb9bb255110d 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine_overview/components/suggested_curations_callout.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine_overview/components/suggested_curations_callout.test.tsx
@@ -19,12 +19,12 @@ import { SuggestedCurationsCallout } from './suggested_curations_callout';
 
 const MOCK_VALUES = {
   engine: {
-    search_relevance_suggestions: {
+    adaptive_relevance_suggestions: {
       curation: {
         pending: 1,
       },
     },
-    search_relevance_suggestions_active: true,
+    adaptive_relevance_suggestions_active: true,
   },
 };
 
@@ -44,7 +44,7 @@ describe('SuggestedCurationsCallout', () => {
     setMockValues({
       ...MOCK_VALUES,
       engine: {
-        search_relevance_suggestions_active: true,
+        adaptive_relevance_suggestions_active: true,
       },
     });
 
@@ -54,7 +54,7 @@ describe('SuggestedCurationsCallout', () => {
   });
 
   it('is empty when suggestions are not active', () => {
-    const values = set('engine.search_relevance_suggestions_active', false, MOCK_VALUES);
+    const values = set('engine.adaptive_relevance_suggestions_active', false, MOCK_VALUES);
     setMockValues(values);
 
     const wrapper = shallow(<SuggestedCurationsCallout />);
@@ -63,7 +63,7 @@ describe('SuggestedCurationsCallout', () => {
   });
 
   it('is empty when no pending curations', () => {
-    const values = set('engine.search_relevance_suggestions.curation.pending', 0, MOCK_VALUES);
+    const values = set('engine.adaptive_relevance_suggestions.curation.pending', 0, MOCK_VALUES);
     setMockValues(values);
 
     const wrapper = shallow(<SuggestedCurationsCallout />);
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine_overview/components/suggested_curations_callout.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine_overview/components/suggested_curations_callout.tsx
index 04b2d2b207e94..e1f984581438f 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine_overview/components/suggested_curations_callout.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine_overview/components/suggested_curations_callout.tsx
@@ -17,17 +17,17 @@ import { EngineLogic, generateEnginePath } from '../../engine';
 export const SuggestedCurationsCallout: React.FC = () => {
   const {
     engine: {
-      search_relevance_suggestions: searchRelevanceSuggestions,
-      search_relevance_suggestions_active: searchRelevanceSuggestionsActive,
+      adaptive_relevance_suggestions: adaptiveRelevanceSuggestions,
+      adaptive_relevance_suggestions_active: adaptiveRelevanceSuggestionsActive,
     },
   } = useValues(EngineLogic);
 
-  const pendingCount = searchRelevanceSuggestions?.curation.pending;
+  const pendingCount = adaptiveRelevanceSuggestions?.curation.pending;
 
   if (
-    typeof searchRelevanceSuggestions === 'undefined' ||
+    typeof adaptiveRelevanceSuggestions === 'undefined' ||
     pendingCount === 0 ||
-    searchRelevanceSuggestionsActive === false
+    adaptiveRelevanceSuggestionsActive === false
   ) {
     return null;
   }
@@ -46,7 +46,7 @@ export const SuggestedCurationsCallout: React.FC = () => {
         }
       )}
       buttonTo={generateEnginePath(ENGINE_CURATIONS_PATH)}
-      lastUpdatedTimestamp={searchRelevanceSuggestions.curation.last_updated}
+      lastUpdatedTimestamp={adaptiveRelevanceSuggestions.curation.last_updated}
     />
   );
 };
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/types.ts b/x-pack/plugins/enterprise_search/public/applications/app_search/types.ts
index ca3e67129846b..0efa8880cca22 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/types.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/types.ts
@@ -6,5 +6,5 @@
  */
 
 export * from '../../../common/types/app_search';
-export { Role, RoleTypes, AbilityTypes, ASRoleMapping, AdvanceRoleType } from './utils/role';
-export { Engine } from './components/engine/types';
+export type { Role, RoleTypes, AbilityTypes, ASRoleMapping, AdvanceRoleType } from './utils/role';
+export type { Engine } from './components/engine/types';
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/flash_messages/index.ts b/x-pack/plugins/enterprise_search/public/applications/shared/flash_messages/index.ts
index 38a5d6e8b0b30..097d38e0691c5 100644
--- a/x-pack/plugins/enterprise_search/public/applications/shared/flash_messages/index.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/flash_messages/index.ts
@@ -7,7 +7,7 @@
 
 export { FlashMessages, Toasts } from './flash_messages';
 export { FlashMessagesLogic, mountFlashMessagesLogic } from './flash_messages_logic';
-export { IFlashMessage } from './types';
+export type { IFlashMessage } from './types';
 export { flashAPIErrors } from './handle_api_errors';
 export {
   setSuccessMessage,
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/layout/index.ts b/x-pack/plugins/enterprise_search/public/applications/shared/layout/index.ts
index 41f8869ad5f61..79919e925c625 100644
--- a/x-pack/plugins/enterprise_search/public/applications/shared/layout/index.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/layout/index.ts
@@ -5,5 +5,6 @@
  * 2.0.
  */
 
-export { EnterpriseSearchPageTemplate, PageTemplateProps } from './page_template';
+export type { PageTemplateProps } from './page_template';
+export { EnterpriseSearchPageTemplate } from './page_template';
 export { generateNavLink } from './nav_link_helpers';
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/react_router_helpers/index.ts b/x-pack/plugins/enterprise_search/public/applications/shared/react_router_helpers/index.ts
index fe76c13c2b707..a05792d5fb545 100644
--- a/x-pack/plugins/enterprise_search/public/applications/shared/react_router_helpers/index.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/react_router_helpers/index.ts
@@ -6,8 +6,10 @@
  */
 
 export { letBrowserHandleEvent } from './link_events';
-export { createHref, CreateHrefOptions } from './create_href';
-export { generateReactRouterProps, ReactRouterProps } from './generate_react_router_props';
+export type { CreateHrefOptions } from './create_href';
+export { createHref } from './create_href';
+export type { ReactRouterProps } from './generate_react_router_props';
+export { generateReactRouterProps } from './generate_react_router_props';
 export {
   EuiLinkTo,
   EuiButtonTo,
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/source_row/index.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/source_row/index.ts
index 9bc16553b1a0c..7b0ba4206cff4 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/source_row/index.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/components/shared/source_row/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { SourceRow, ISourceRow } from './source_row';
+export type { ISourceRow } from './source_row';
+export { SourceRow } from './source_row';
diff --git a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source_logic.ts b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source_logic.ts
index 06055e9562676..05a5fd5a73fe8 100644
--- a/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source_logic.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/workplace_search/views/content_sources/components/add_source/add_source_logic.ts
@@ -546,8 +546,8 @@ export const AddSourceLogic = kea<MakeLogicType<AddSourceValues, AddSourceAction
           navigateToUrl(getSourcesPath(SOURCES_PATH, isOrganization));
         }
       } catch (e) {
-        flashAPIErrors(e);
         navigateToUrl(getSourcesPath(SOURCES_PATH, isOrganization));
+        flashAPIErrors(e);
       }
     },
     createContentSource: async ({ serviceType, successCallback, errorCallback }) => {
diff --git a/x-pack/plugins/event_log/server/es/index.ts b/x-pack/plugins/event_log/server/es/index.ts
index 2631df882cc07..a5bc5dce7f250 100644
--- a/x-pack/plugins/event_log/server/es/index.ts
+++ b/x-pack/plugins/event_log/server/es/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { EsContext, createEsContext } from './context';
+export type { EsContext } from './context';
+export { createEsContext } from './context';
diff --git a/x-pack/plugins/event_log/server/index.ts b/x-pack/plugins/event_log/server/index.ts
index 14c121664d4a8..877c39a02edc5 100644
--- a/x-pack/plugins/event_log/server/index.ts
+++ b/x-pack/plugins/event_log/server/index.ts
@@ -9,7 +9,7 @@ import { PluginInitializerContext, PluginConfigDescriptor } from 'src/core/serve
 import { ConfigSchema, IEventLogConfig } from './types';
 import { Plugin } from './plugin';
 
-export {
+export type {
   IEventLogService,
   IEventLogger,
   IEventLogClientService,
@@ -17,8 +17,8 @@ export {
   IValidatedEvent,
   IEventLogClient,
   QueryEventsBySavedObjectResult,
-  SAVED_OBJECT_REL_PRIMARY,
 } from './types';
+export { SAVED_OBJECT_REL_PRIMARY } from './types';
 
 export { ClusterClientAdapter } from './es/cluster_client_adapter';
 
diff --git a/x-pack/plugins/event_log/server/types.ts b/x-pack/plugins/event_log/server/types.ts
index 6ffde7fd6dbe0..0cc2e7a145147 100644
--- a/x-pack/plugins/event_log/server/types.ts
+++ b/x-pack/plugins/event_log/server/types.ts
@@ -8,11 +8,12 @@
 import { schema, TypeOf } from '@kbn/config-schema';
 import type { IRouter, KibanaRequest, RequestHandlerContext } from 'src/core/server';
 
-export { IEvent, IValidatedEvent, EventSchema, ECS_VERSION } from '../generated/schemas';
+export type { IEvent, IValidatedEvent } from '../generated/schemas';
+export { EventSchema, ECS_VERSION } from '../generated/schemas';
 import { IEvent } from '../generated/schemas';
 import { FindOptionsType } from './event_log_client';
 import { QueryEventsBySavedObjectResult } from './es/cluster_client_adapter';
-export { QueryEventsBySavedObjectResult } from './es/cluster_client_adapter';
+export type { QueryEventsBySavedObjectResult } from './es/cluster_client_adapter';
 import { SavedObjectProvider } from './saved_object_provider_registry';
 
 export const SAVED_OBJECT_REL_PRIMARY = 'primary';
diff --git a/x-pack/plugins/features/common/index.ts b/x-pack/plugins/features/common/index.ts
index 450b474744fe9..9db2a1073cd07 100644
--- a/x-pack/plugins/features/common/index.ts
+++ b/x-pack/plugins/features/common/index.ts
@@ -5,14 +5,16 @@
  * 2.0.
  */
 
-export { FeatureElasticsearchPrivileges } from './feature_elasticsearch_privileges';
-export { FeatureKibanaPrivileges } from './feature_kibana_privileges';
-export { ElasticsearchFeature, ElasticsearchFeatureConfig } from './elasticsearch_feature';
-export { KibanaFeature, KibanaFeatureConfig } from './kibana_feature';
-export {
-  SubFeature,
+export type { FeatureElasticsearchPrivileges } from './feature_elasticsearch_privileges';
+export type { FeatureKibanaPrivileges } from './feature_kibana_privileges';
+export type { ElasticsearchFeatureConfig } from './elasticsearch_feature';
+export { ElasticsearchFeature } from './elasticsearch_feature';
+export type { KibanaFeatureConfig } from './kibana_feature';
+export { KibanaFeature } from './kibana_feature';
+export type {
   SubFeatureConfig,
   SubFeaturePrivilegeConfig,
   SubFeaturePrivilegeGroupConfig,
   SubFeaturePrivilegeGroupType,
 } from './sub_feature';
+export { SubFeature } from './sub_feature';
diff --git a/x-pack/plugins/features/public/index.ts b/x-pack/plugins/features/public/index.ts
index d1a828f51029a..2895d83ed114e 100644
--- a/x-pack/plugins/features/public/index.ts
+++ b/x-pack/plugins/features/public/index.ts
@@ -8,15 +8,15 @@
 import { PluginInitializer } from 'src/core/public';
 import { FeaturesPlugin, FeaturesPluginSetup, FeaturesPluginStart } from './plugin';
 
-export {
-  KibanaFeature,
+export type {
   KibanaFeatureConfig,
   FeatureKibanaPrivileges,
   SubFeatureConfig,
   SubFeaturePrivilegeConfig,
 } from '../common';
+export { KibanaFeature } from '../common';
 
-export { FeaturesPluginSetup, FeaturesPluginStart } from './plugin';
+export type { FeaturesPluginSetup, FeaturesPluginStart } from './plugin';
 
 export const plugin: PluginInitializer<FeaturesPluginSetup, FeaturesPluginStart> = () =>
   new FeaturesPlugin();
diff --git a/x-pack/plugins/features/server/index.ts b/x-pack/plugins/features/server/index.ts
index 0890274fed950..934fcd9d556f6 100644
--- a/x-pack/plugins/features/server/index.ts
+++ b/x-pack/plugins/features/server/index.ts
@@ -14,15 +14,14 @@ import { FeaturesPlugin } from './plugin';
 // run-time contracts.
 export { uiCapabilitiesRegex } from './feature_schema';
 
-export {
-  KibanaFeature,
+export type {
   KibanaFeatureConfig,
   FeatureKibanaPrivileges,
-  ElasticsearchFeature,
   ElasticsearchFeatureConfig,
   FeatureElasticsearchPrivileges,
 } from '../common';
-export { PluginSetupContract, PluginStartContract } from './plugin';
+export { KibanaFeature, ElasticsearchFeature } from '../common';
+export type { PluginSetupContract, PluginStartContract } from './plugin';
 
 export const plugin = (initializerContext: PluginInitializerContext) =>
   new FeaturesPlugin(initializerContext);
diff --git a/x-pack/plugins/file_upload/public/components/geojson_upload_form/index.ts b/x-pack/plugins/file_upload/public/components/geojson_upload_form/index.ts
index 6168835a3a145..837c8a0f02694 100644
--- a/x-pack/plugins/file_upload/public/components/geojson_upload_form/index.ts
+++ b/x-pack/plugins/file_upload/public/components/geojson_upload_form/index.ts
@@ -6,4 +6,4 @@
  */
 
 export { GeoJsonUploadForm } from './geojson_upload_form';
-export { OnFileSelectParameters } from './geojson_file_picker';
+export type { OnFileSelectParameters } from './geojson_file_picker';
diff --git a/x-pack/plugins/file_upload/public/importer/geojson_importer/index.ts b/x-pack/plugins/file_upload/public/importer/geojson_importer/index.ts
index b5f6845e28324..7d9d8e144fd25 100644
--- a/x-pack/plugins/file_upload/public/importer/geojson_importer/index.ts
+++ b/x-pack/plugins/file_upload/public/importer/geojson_importer/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { GeoJsonImporter, GeoJsonPreview, GEOJSON_FILE_TYPES } from './geojson_importer';
+export type { GeoJsonPreview } from './geojson_importer';
+export { GeoJsonImporter, GEOJSON_FILE_TYPES } from './geojson_importer';
diff --git a/x-pack/plugins/file_upload/public/index.ts b/x-pack/plugins/file_upload/public/index.ts
index b9e289ef00eeb..00b39dca1180d 100644
--- a/x-pack/plugins/file_upload/public/index.ts
+++ b/x-pack/plugins/file_upload/public/index.ts
@@ -16,7 +16,7 @@ export function plugin() {
 
 export * from './importer/types';
 
-export { Props as IndexNameFormProps } from './components/geojson_upload_form/index_name_form';
+export type { Props as IndexNameFormProps } from './components/geojson_upload_form/index_name_form';
 
-export { FileUploadPluginStart } from './plugin';
-export { FileUploadComponentProps, FileUploadGeoResults } from './lazy_load_bundle';
+export type { FileUploadPluginStart } from './plugin';
+export type { FileUploadComponentProps, FileUploadGeoResults } from './lazy_load_bundle';
diff --git a/x-pack/plugins/fleet/common/services/index.ts b/x-pack/plugins/fleet/common/services/index.ts
index a6f4cd319b970..ba3fb44753643 100644
--- a/x-pack/plugins/fleet/common/services/index.ts
+++ b/x-pack/plugins/fleet/common/services/index.ts
@@ -21,10 +21,12 @@ export { isDiffPathProtocol } from './is_diff_path_protocol';
 export { LicenseService } from './license';
 export { isAgentUpgradeable } from './is_agent_upgradeable';
 export { doesPackageHaveIntegrations } from './packages_with_integrations';
-export {
+export type {
   PackagePolicyValidationResults,
   PackagePolicyConfigValidationResults,
   PackagePolicyInputValidationResults,
+} from './validate_package_policy';
+export {
   validatePackagePolicy,
   validatePackagePolicyConfig,
   validationHasErrors,
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/services/index.ts b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/services/index.ts
index 0e1953316fd53..38ef2a60e41d0 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/services/index.ts
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/services/index.ts
@@ -7,10 +7,12 @@
 
 export { isAdvancedVar } from './is_advanced_var';
 export { hasInvalidButRequiredVar } from './has_invalid_but_required_var';
-export {
+export type {
   PackagePolicyValidationResults,
   PackagePolicyConfigValidationResults,
   PackagePolicyInputValidationResults,
+} from '../../../../services';
+export {
   validatePackagePolicy,
   validatePackagePolicyConfig,
   validationHasErrors,
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/step_define_package_policy.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/step_define_package_policy.tsx
index e11aaabb4fd95..63e9ba64ad753 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/step_define_package_policy.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/step_define_package_policy.tsx
@@ -22,16 +22,12 @@ import {
 
 import styled from 'styled-components';
 
-import type {
-  AgentPolicy,
-  PackageInfo,
-  PackagePolicy,
-  NewPackagePolicy,
-  RegistryVarsEntry,
-} from '../../../types';
+import type { AgentPolicy, PackageInfo, NewPackagePolicy, RegistryVarsEntry } from '../../../types';
 import { packageToPackagePolicy, pkgKeyFromPackageInfo } from '../../../services';
 import { Loading } from '../../../components';
-import { useStartServices } from '../../../hooks';
+import { useStartServices, useGetPackagePolicies } from '../../../hooks';
+import { PACKAGE_POLICY_SAVED_OBJECT_TYPE } from '../../../../../constants';
+import { SO_SEARCH_LIMIT } from '../../../../../../common';
 
 import { isAdvancedVar } from './services';
 import type { PackagePolicyValidationResults } from './services';
@@ -65,6 +61,14 @@ export const StepDefinePackagePolicy: React.FunctionComponent<{
     submitAttempted,
   }) => {
     const { docLinks } = useStartServices();
+
+    // Fetch all packagePolicies having the package name
+    const { data: packagePolicyData, isLoading: isLoadingPackagePolicies } = useGetPackagePolicies({
+      perPage: SO_SEARCH_LIMIT,
+      page: 1,
+      kuery: `${PACKAGE_POLICY_SAVED_OBJECT_TYPE}.package.name:${packageInfo.name}`,
+    });
+
     // Form show/hide states
     const [isShowingAdvanced, setIsShowingAdvanced] = useState<boolean>(false);
 
@@ -84,33 +88,37 @@ export const StepDefinePackagePolicy: React.FunctionComponent<{
 
     // Update package policy's package and agent policy info
     useEffect(() => {
+      if (isLoadingPackagePolicies) {
+        return;
+      }
       const pkg = packagePolicy.package;
       const currentPkgKey = pkg ? pkgKeyFromPackageInfo(pkg) : '';
       const pkgKey = pkgKeyFromPackageInfo(packageInfo);
 
       // If package has changed, create shell package policy with input&stream values based on package info
       if (currentPkgKey !== pkgKey) {
-        // Existing package policies on the agent policy using the package name, retrieve highest number appended to package policy name
+        // Retrieve highest number appended to package policy name and increment it by one
         const pkgPoliciesNamePattern = new RegExp(`${packageInfo.name}-(\\d+)`);
-        const pkgPoliciesWithMatchingNames = agentPolicy
-          ? (agentPolicy.package_policies as PackagePolicy[])
+        const pkgPoliciesWithMatchingNames = packagePolicyData?.items
+          ? packagePolicyData.items
               .filter((ds) => Boolean(ds.name.match(pkgPoliciesNamePattern)))
               .map((ds) => parseInt(ds.name.match(pkgPoliciesNamePattern)![1], 10))
               .sort((a, b) => a - b)
           : [];
 
+        const incrementedName = `${packageInfo.name}-${
+          pkgPoliciesWithMatchingNames.length
+            ? pkgPoliciesWithMatchingNames[pkgPoliciesWithMatchingNames.length - 1] + 1
+            : 1
+        }`;
+
         updatePackagePolicy(
           packageToPackagePolicy(
             packageInfo,
             agentPolicy?.id || '',
             packagePolicy.output_id,
             packagePolicy.namespace,
-            packagePolicy.name ||
-              `${packageInfo.name}-${
-                pkgPoliciesWithMatchingNames.length
-                  ? pkgPoliciesWithMatchingNames[pkgPoliciesWithMatchingNames.length - 1] + 1
-                  : 1
-              }`,
+            packagePolicy.name || incrementedName,
             packagePolicy.description,
             integrationToEnable
           )
@@ -124,7 +132,15 @@ export const StepDefinePackagePolicy: React.FunctionComponent<{
           namespace: agentPolicy.namespace,
         });
       }
-    }, [packagePolicy, agentPolicy, packageInfo, updatePackagePolicy, integrationToEnable]);
+    }, [
+      packagePolicy,
+      agentPolicy,
+      packageInfo,
+      updatePackagePolicy,
+      integrationToEnable,
+      packagePolicyData,
+      isLoadingPackagePolicies,
+    ]);
 
     return validationResults ? (
       <FormGroupResponsiveFields
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/index.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/index.tsx
index 5411e6313ebb7..76a7f0514a8a2 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/index.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/index.tsx
@@ -56,7 +56,7 @@ export const AgentLogs: React.FunctionComponent<Pick<AgentLogsProps, 'agent' | '
     const [isSyncReady, setIsSyncReady] = useState<boolean>(false);
 
     useEffect(() => {
-      const stateStorage = createKbnUrlStateStorage();
+      const stateStorage = createKbnUrlStateStorage({ useHashQuery: false, useHash: false });
       const { start, stop } = syncState({
         storageKey: STATE_STORAGE_KEY,
         stateContainer: stateContainer as INullableBaseStateContainer<AgentLogsState>,
diff --git a/x-pack/plugins/fleet/public/applications/integrations/app.tsx b/x-pack/plugins/fleet/public/applications/integrations/app.tsx
index c2f6f53627e38..3a091c30bb792 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/app.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/app.tsx
@@ -5,21 +5,14 @@
  * 2.0.
  */
 
-import React, { memo, useEffect, useState } from 'react';
+import React, { memo } from 'react';
 import type { AppMountParameters } from 'kibana/public';
 import { EuiErrorBoundary, EuiPortal } from '@elastic/eui';
 import type { History } from 'history';
 import { Router, Redirect, Route, Switch } from 'react-router-dom';
-import { FormattedMessage } from '@kbn/i18n/react';
 import useObservable from 'react-use/lib/useObservable';
 
-import {
-  ConfigContext,
-  FleetStatusProvider,
-  KibanaVersionContext,
-  sendGetPermissionsCheck,
-  sendSetup,
-} from '../../hooks';
+import { ConfigContext, FleetStatusProvider, KibanaVersionContext } from '../../hooks';
 
 import type { FleetConfigType, FleetStartServices } from '../../plugin';
 
@@ -32,91 +25,14 @@ import { EuiThemeProvider } from '../../../../../../src/plugins/kibana_react/com
 import { AgentPolicyContextProvider, useUrlModal } from './hooks';
 import { INTEGRATIONS_ROUTING_PATHS, pagePathGetters } from './constants';
 
-import { Error, Loading, SettingFlyout } from './components';
+import { SettingFlyout } from './components';
 
 import type { UIExtensionsStorage } from './types';
 
 import { EPMApp } from './sections/epm';
-import { DefaultLayout } from './layouts';
-import { PackageInstallProvider } from './hooks';
-import { useBreadcrumbs, UIExtensionsContext } from './hooks';
+import { PackageInstallProvider, UIExtensionsContext } from './hooks';
 import { IntegrationsHeader } from './components/header';
 
-const ErrorLayout = ({ children }: { children: JSX.Element }) => (
-  <EuiErrorBoundary>
-    <DefaultLayout>{children}</DefaultLayout>
-  </EuiErrorBoundary>
-);
-
-export const WithPermissionsAndSetup: React.FC = memo(({ children }) => {
-  useBreadcrumbs('integrations');
-
-  const [isPermissionsLoading, setIsPermissionsLoading] = useState<boolean>(false);
-  const [isInitialized, setIsInitialized] = useState(false);
-  const [initializationError, setInitializationError] = useState<Error | null>(null);
-
-  useEffect(() => {
-    (async () => {
-      setIsInitialized(false);
-      setInitializationError(null);
-      try {
-        // Attempt Fleet Setup if user has permissions, otherwise skip
-        setIsPermissionsLoading(true);
-        const permissionsResponse = await sendGetPermissionsCheck();
-        setIsPermissionsLoading(false);
-
-        if (permissionsResponse.data?.success) {
-          try {
-            const setupResponse = await sendSetup();
-            if (setupResponse.error) {
-              setInitializationError(setupResponse.error);
-            }
-          } catch (err) {
-            setInitializationError(err);
-          }
-          setIsInitialized(true);
-        } else {
-          setIsInitialized(true);
-        }
-      } catch {
-        // If there's an error checking permissions, default to proceeding without running setup
-        // User will only have access to EPM endpoints if they actually have permission
-        setIsInitialized(true);
-      }
-    })();
-  }, []);
-
-  if (isPermissionsLoading) {
-    return (
-      <ErrorLayout>
-        <Loading />
-      </ErrorLayout>
-    );
-  }
-
-  if (!isInitialized || initializationError) {
-    return (
-      <ErrorLayout>
-        {initializationError ? (
-          <Error
-            title={
-              <FormattedMessage
-                id="xpack.fleet.initializationErrorMessageTitle"
-                defaultMessage="Unable to initialize Fleet"
-              />
-            }
-            error={initializationError}
-          />
-        ) : (
-          <Loading />
-        )}
-      </ErrorLayout>
-    );
-  }
-
-  return <>{children}</>;
-});
-
 /**
  * Fleet Application context all the way down to the Router, but with no permissions or setup checks
  * and no routes defined
diff --git a/x-pack/plugins/fleet/public/applications/integrations/hooks/use_merge_epr_with_replacements.test.ts b/x-pack/plugins/fleet/public/applications/integrations/hooks/use_merge_epr_with_replacements.test.ts
index d5d8aa093e300..f69132d9a6452 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/hooks/use_merge_epr_with_replacements.test.ts
+++ b/x-pack/plugins/fleet/public/applications/integrations/hooks/use_merge_epr_with_replacements.test.ts
@@ -120,6 +120,17 @@ describe('useMergeEprWithReplacements', () => {
     ]);
   });
 
+  test('should filter out apm from package list', () => {
+    const eprPackages: PackageListItem[] = mockEprPackages([
+      {
+        name: 'apm',
+        release: 'beta',
+      },
+    ]);
+
+    expect(useMergeEprPackagesWithReplacements(eprPackages, [])).toEqual([]);
+  });
+
   test('should consists of all 3 types (ga eprs, replacements for non-ga eprs, replacements without epr equivalent', () => {
     const eprPackages: PackageListItem[] = mockEprPackages([
       {
@@ -136,6 +147,10 @@ describe('useMergeEprWithReplacements', () => {
         name: 'activemq',
         release: 'beta',
       },
+      {
+        name: 'apm',
+        release: 'ga',
+      },
     ]);
     const replacements: CustomIntegration[] = mockIntegrations([
       {
diff --git a/x-pack/plugins/fleet/public/applications/integrations/hooks/use_merge_epr_with_replacements.ts b/x-pack/plugins/fleet/public/applications/integrations/hooks/use_merge_epr_with_replacements.ts
index 4c59f0ef45123..ff1b51ef19a81 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/hooks/use_merge_epr_with_replacements.ts
+++ b/x-pack/plugins/fleet/public/applications/integrations/hooks/use_merge_epr_with_replacements.ts
@@ -8,6 +8,7 @@
 import type { PackageListItem } from '../../../../common/types/models';
 import type { CustomIntegration } from '../../../../../../../src/plugins/custom_integrations/common';
 import { filterCustomIntegrations } from '../../../../../../../src/plugins/custom_integrations/public';
+import { FLEET_APM_PACKAGE } from '../../../../common/constants';
 
 // Export this as a utility to find replacements for a package (e.g. in the overview-page for an EPR package)
 function findReplacementsForEprPackage(
@@ -22,12 +23,17 @@ function findReplacementsForEprPackage(
 }
 
 export function useMergeEprPackagesWithReplacements(
-  eprPackages: PackageListItem[],
+  rawEprPackages: PackageListItem[],
   replacements: CustomIntegration[]
 ): Array<PackageListItem | CustomIntegration> {
   const merged: Array<PackageListItem | CustomIntegration> = [];
   const filteredReplacements = replacements;
 
+  // APM EPR-packages should _never_ show. They have special handling.
+  const eprPackages = rawEprPackages.filter((p) => {
+    return p.name !== FLEET_APM_PACKAGE;
+  });
+
   // Either select replacement or select beat
   eprPackages.forEach((eprPackage: PackageListItem) => {
     const hits = findReplacementsForEprPackage(
diff --git a/x-pack/plugins/fleet/public/applications/integrations/index.tsx b/x-pack/plugins/fleet/public/applications/integrations/index.tsx
index 4099879538afa..620cf83fd762d 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/index.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/index.tsx
@@ -15,7 +15,7 @@ import type { FleetConfigType, FleetStartServices } from '../../plugin';
 import { licenseService } from '../../hooks';
 import type { UIExtensionsStorage } from '../../types';
 
-import { AppRoutes, IntegrationsAppContext, WithPermissionsAndSetup } from './app';
+import { AppRoutes, IntegrationsAppContext } from './app';
 
 export interface ProtectedRouteProps extends RouteProps {
   isAllowed?: boolean;
@@ -58,9 +58,7 @@ const IntegrationsApp = ({
       extensions={extensions}
       setHeaderActionMenu={setHeaderActionMenu}
     >
-      <WithPermissionsAndSetup>
-        <AppRoutes />
-      </WithPermissionsAndSetup>
+      <AppRoutes />
     </IntegrationsAppContext>
   );
 };
diff --git a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/available_packages.tsx b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/available_packages.tsx
index f1d0717584e2e..ca932554290bb 100644
--- a/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/available_packages.tsx
+++ b/x-pack/plugins/fleet/public/applications/integrations/sections/epm/screens/home/available_packages.tsx
@@ -221,6 +221,7 @@ export const AvailablePackages: React.FC = memo(() => {
     if (selectedCategory === '') {
       return true;
     }
+
     return c.categories.includes(selectedCategory);
   });
 
@@ -255,7 +256,7 @@ export const AvailablePackages: React.FC = memo(() => {
                 defaultMessage:
                   'Monitor, detect and diagnose complex performance issues from your application.',
               })}
-              href={addBasePath('/app/integrations/detail/apm')}
+              href={addBasePath('/app/home#/tutorial/apm')}
               icon={<EuiIcon type="logoObservability" size="xxl" />}
             />
           </TrackApplicationView>
diff --git a/x-pack/plugins/fleet/public/components/home_integration/tutorial_module_notice.tsx b/x-pack/plugins/fleet/public/components/home_integration/tutorial_module_notice.tsx
index 24d9dc8e2c100..1b0d90098fa48 100644
--- a/x-pack/plugins/fleet/public/components/home_integration/tutorial_module_notice.tsx
+++ b/x-pack/plugins/fleet/public/components/home_integration/tutorial_module_notice.tsx
@@ -13,6 +13,7 @@ import type { TutorialModuleNoticeComponent } from 'src/plugins/home/public';
 
 import { useGetPackages, useLink, useCapabilities } from '../../hooks';
 import { pkgKeyFromPackageInfo } from '../../services';
+import { FLEET_APM_PACKAGE } from '../../../common/constants';
 
 const TutorialModuleNotice: TutorialModuleNoticeComponent = memo(({ moduleName }) => {
   const { getHref } = useLink();
@@ -22,7 +23,7 @@ const TutorialModuleNotice: TutorialModuleNoticeComponent = memo(({ moduleName }
   const pkgInfo =
     !isLoading &&
     packagesData?.response &&
-    packagesData.response.find((pkg) => pkg.name === moduleName);
+    packagesData.response.find((pkg) => pkg.name === moduleName && pkg.name !== FLEET_APM_PACKAGE); // APM needs special handling
 
   if (hasIngestManager && pkgInfo) {
     return (
diff --git a/x-pack/plugins/fleet/public/components/index.ts b/x-pack/plugins/fleet/public/components/index.ts
index 3252315312d02..9015071450bf0 100644
--- a/x-pack/plugins/fleet/public/components/index.ts
+++ b/x-pack/plugins/fleet/public/components/index.ts
@@ -13,7 +13,8 @@ export { LinkedAgentCount } from './linked_agent_count';
 export { ExtensionWrapper } from './extension_wrapper';
 export { AlphaMessaging } from './alpha_messaging';
 export { AlphaFlyout } from './alpha_flyout';
-export { HeaderProps, Header } from './header';
+export type { HeaderProps } from './header';
+export { Header } from './header';
 export { NewEnrollmentTokenModal } from './new_enrollment_key_modal';
 export { AgentPolicyPackageBadges } from './agent_policy_package_badges';
 export { DangerEuiContextMenuItem } from './danger_eui_context_menu_item';
diff --git a/x-pack/plugins/fleet/public/hooks/index.ts b/x-pack/plugins/fleet/public/hooks/index.ts
index c41dd1ad42a72..16454a266c3c4 100644
--- a/x-pack/plugins/fleet/public/hooks/index.ts
+++ b/x-pack/plugins/fleet/public/hooks/index.ts
@@ -12,8 +12,10 @@ export { useKibanaVersion, KibanaVersionContext } from './use_kibana_version';
 export { licenseService, useLicense } from './use_license';
 export { useLink } from './use_link';
 export { useKibanaLink, getHrefToObjectInKibanaApp } from './use_kibana_link';
-export { usePackageIconType, UsePackageIconType } from './use_package_icon_type';
-export { usePagination, Pagination, PAGE_SIZE_OPTIONS } from './use_pagination';
+export type { UsePackageIconType } from './use_package_icon_type';
+export { usePackageIconType } from './use_package_icon_type';
+export type { Pagination } from './use_pagination';
+export { usePagination, PAGE_SIZE_OPTIONS } from './use_pagination';
 export { useUrlPagination } from './use_url_pagination';
 export { useSorting } from './use_sorting';
 export { useDebounce } from './use_debounce';
diff --git a/x-pack/plugins/fleet/public/index.ts b/x-pack/plugins/fleet/public/index.ts
index b54d00eafdaab..ee4fe526fb0e4 100644
--- a/x-pack/plugins/fleet/public/index.ts
+++ b/x-pack/plugins/fleet/public/index.ts
@@ -12,7 +12,7 @@ import type { PluginInitializerContext } from 'src/core/public';
 
 import { FleetPlugin } from './plugin';
 
-export { FleetSetup, FleetStart } from './plugin';
+export type { FleetSetup, FleetStart } from './plugin';
 
 export const plugin = (initializerContext: PluginInitializerContext) => {
   return new FleetPlugin(initializerContext);
@@ -24,7 +24,5 @@ export * from './types/ui_extensions';
 
 export { pagePathGetters } from './constants';
 export { pkgKeyFromPackageInfo } from './services';
-export {
-  CustomAssetsAccordion,
-  CustomAssetsAccordionProps,
-} from './components/custom_assets_accordion';
+export type { CustomAssetsAccordionProps } from './components/custom_assets_accordion';
+export { CustomAssetsAccordion } from './components/custom_assets_accordion';
diff --git a/x-pack/plugins/fleet/public/layouts/index.ts b/x-pack/plugins/fleet/public/layouts/index.ts
index e6e366654a866..62e3c5b889ca8 100644
--- a/x-pack/plugins/fleet/public/layouts/index.ts
+++ b/x-pack/plugins/fleet/public/layouts/index.ts
@@ -5,5 +5,6 @@
  * 2.0.
  */
 
-export { WithHeaderLayout, WithHeaderLayoutProps } from './with_header';
+export type { WithHeaderLayoutProps } from './with_header';
+export { WithHeaderLayout } from './with_header';
 export { WithoutHeaderLayout } from './without_header';
diff --git a/x-pack/plugins/fleet/public/plugin.ts b/x-pack/plugins/fleet/public/plugin.ts
index b0e4e56aa344a..039c1da9b934c 100644
--- a/x-pack/plugins/fleet/public/plugin.ts
+++ b/x-pack/plugins/fleet/public/plugin.ts
@@ -52,7 +52,7 @@ import { createExtensionRegistrationCallback } from './services/ui_extensions';
 import type { UIExtensionRegistrationCallback, UIExtensionsStorage } from './types';
 import { LazyCustomLogsAssetsExtension } from './lazy_custom_logs_assets_extension';
 
-export { FleetConfigType } from '../common/types';
+export type { FleetConfigType } from '../common/types';
 
 import { setCustomIntegrations } from './services/custom_integrations';
 
diff --git a/x-pack/plugins/fleet/public/services/index.ts b/x-pack/plugins/fleet/public/services/index.ts
index fbd3bddde744b..10dfe6b59d6ba 100644
--- a/x-pack/plugins/fleet/public/services/index.ts
+++ b/x-pack/plugins/fleet/public/services/index.ts
@@ -7,6 +7,11 @@
 
 export { getFlattenedObject } from '@kbn/std';
 
+export type {
+  PackagePolicyValidationResults,
+  PackagePolicyConfigValidationResults,
+  PackagePolicyInputValidationResults,
+} from '../../common';
 export {
   AgentStatusKueryHelper,
   agentPolicyRouteService,
@@ -30,9 +35,6 @@ export {
   LicenseService,
   isAgentUpgradeable,
   doesPackageHaveIntegrations,
-  PackagePolicyValidationResults,
-  PackagePolicyConfigValidationResults,
-  PackagePolicyInputValidationResults,
   validatePackagePolicy,
   validatePackagePolicyConfig,
   validationHasErrors,
diff --git a/x-pack/plugins/fleet/public/types/index.ts b/x-pack/plugins/fleet/public/types/index.ts
index 3ff0a760b5882..d61223f0cebc7 100644
--- a/x-pack/plugins/fleet/public/types/index.ts
+++ b/x-pack/plugins/fleet/public/types/index.ts
@@ -5,10 +5,7 @@
  * 2.0.
  */
 
-export {
-  // utility function
-  entries,
-  // Object types
+export type {
   Agent,
   AgentMetadata,
   AgentPolicy,
@@ -28,9 +25,7 @@ export {
   Output,
   DataStream,
   Settings,
-  // API schema - misc setup, status
   GetFleetStatusResponse,
-  // API schemas - Agent policy
   GetAgentPoliciesRequest,
   GetAgentPoliciesResponse,
   GetAgentPoliciesResponseItem,
@@ -44,7 +39,6 @@ export {
   CopyAgentPolicyResponse,
   DeleteAgentPolicyRequest,
   DeleteAgentPolicyResponse,
-  // API schemas - Package policy
   CreatePackagePolicyRequest,
   CreatePackagePolicyResponse,
   UpdatePackagePolicyRequest,
@@ -53,9 +47,7 @@ export {
   DryRunPackagePolicy,
   UpgradePackagePolicyResponse,
   UpgradePackagePolicyDryRunResponse,
-  // API schemas - Data streams
   GetDataStreamsResponse,
-  // API schemas - Agents
   GetAgentsResponse,
   GetAgentsRequest,
   GetOneAgentResponse,
@@ -75,24 +67,19 @@ export {
   PostBulkAgentReassignResponse,
   PostNewAgentActionResponse,
   PostNewAgentActionRequest,
-  // API schemas - Enrollment API Keys
   GetEnrollmentAPIKeysResponse,
   GetEnrollmentAPIKeysRequest,
   GetOneEnrollmentAPIKeyResponse,
   PostEnrollmentAPIKeyRequest,
   PostEnrollmentAPIKeyResponse,
-  // API schemas - Outputs
   GetOutputsResponse,
   PutOutputRequest,
   PutOutputResponse,
-  // API schemas - Settings
   GetSettingsResponse,
   PutSettingsRequest,
   PutSettingsResponse,
-  // API schemas - app
   CheckPermissionsResponse,
   GenerateServiceTokenResponse,
-  // EPM types
   AssetReference,
   AssetsGroupedByServiceByType,
   AssetType,
@@ -100,8 +87,6 @@ export {
   CategoryId,
   CategorySummaryItem,
   CategorySummaryList,
-  ElasticsearchAssetType,
-  KibanaAssetType,
   PackageInfo,
   RegistryVarsEntry,
   RegistryInput,
@@ -123,7 +108,6 @@ export {
   InstallPackageResponse,
   DeletePackageResponse,
   DetailViewPanelName,
-  InstallStatus,
   InstallationStatus,
   Installable,
   RegistryRelease,
@@ -131,6 +115,7 @@ export {
   UpdatePackageRequest,
   UpdatePackageResponse,
 } from '../../common';
+export { entries, ElasticsearchAssetType, KibanaAssetType, InstallStatus } from '../../common';
 
 export * from './intra_app_route_state';
 export * from './ui_extensions';
diff --git a/x-pack/plugins/fleet/server/index.ts b/x-pack/plugins/fleet/server/index.ts
index cdc0dfddc01e5..e1ee2652594cc 100644
--- a/x-pack/plugins/fleet/server/index.ts
+++ b/x-pack/plugins/fleet/server/index.ts
@@ -18,18 +18,18 @@ import {
 import { FleetPlugin } from './plugin';
 
 export { default as apm } from 'elastic-apm-node';
-export {
+export type {
   AgentService,
   ESIndexPatternService,
-  getRegistryUrl,
   PackageService,
   AgentPolicyServiceInterface,
   ArtifactsClientInterface,
   Artifact,
   ListArtifactsProps,
 } from './services';
+export { getRegistryUrl } from './services';
 
-export { FleetSetupContract, FleetSetupDeps, FleetStartContract } from './plugin';
+export type { FleetSetupContract, FleetSetupDeps, FleetStartContract } from './plugin';
 export type {
   ExternalCallback,
   PutPackagePolicyUpdateCallback,
@@ -45,42 +45,59 @@ export const config: PluginConfigDescriptor = {
   },
   deprecations: ({ renameFromRoot, unused, unusedFromRoot }) => [
     // Fleet plugin was named ingestManager before
-    renameFromRoot('xpack.ingestManager.enabled', 'xpack.fleet.enabled'),
-    renameFromRoot('xpack.ingestManager.registryUrl', 'xpack.fleet.registryUrl'),
-    renameFromRoot('xpack.ingestManager.registryProxyUrl', 'xpack.fleet.registryProxyUrl'),
-    renameFromRoot('xpack.ingestManager.fleet', 'xpack.ingestManager.agents'),
-    renameFromRoot('xpack.ingestManager.agents.enabled', 'xpack.fleet.agents.enabled'),
-    renameFromRoot('xpack.ingestManager.agents.elasticsearch', 'xpack.fleet.agents.elasticsearch'),
+    renameFromRoot('xpack.ingestManager.enabled', 'xpack.fleet.enabled', { level: 'critical' }),
+    renameFromRoot('xpack.ingestManager.registryUrl', 'xpack.fleet.registryUrl', {
+      level: 'critical',
+    }),
+    renameFromRoot('xpack.ingestManager.registryProxyUrl', 'xpack.fleet.registryProxyUrl', {
+      level: 'critical',
+    }),
+    renameFromRoot('xpack.ingestManager.fleet', 'xpack.ingestManager.agents', {
+      level: 'critical',
+    }),
+    renameFromRoot('xpack.ingestManager.agents.enabled', 'xpack.fleet.agents.enabled', {
+      level: 'critical',
+    }),
+    renameFromRoot('xpack.ingestManager.agents.elasticsearch', 'xpack.fleet.agents.elasticsearch', {
+      level: 'critical',
+    }),
     renameFromRoot(
       'xpack.ingestManager.agents.tlsCheckDisabled',
-      'xpack.fleet.agents.tlsCheckDisabled'
+      'xpack.fleet.agents.tlsCheckDisabled',
+      { level: 'critical' }
     ),
     renameFromRoot(
       'xpack.ingestManager.agents.pollingRequestTimeout',
-      'xpack.fleet.agents.pollingRequestTimeout'
+      'xpack.fleet.agents.pollingRequestTimeout',
+      { level: 'critical' }
     ),
     renameFromRoot(
       'xpack.ingestManager.agents.maxConcurrentConnections',
-      'xpack.fleet.agents.maxConcurrentConnections'
+      'xpack.fleet.agents.maxConcurrentConnections',
+      { level: 'critical' }
     ),
-    renameFromRoot('xpack.ingestManager.agents.kibana', 'xpack.fleet.agents.kibana'),
+    renameFromRoot('xpack.ingestManager.agents.kibana', 'xpack.fleet.agents.kibana', {
+      level: 'critical',
+    }),
     renameFromRoot(
       'xpack.ingestManager.agents.agentPolicyRolloutRateLimitIntervalMs',
-      'xpack.fleet.agents.agentPolicyRolloutRateLimitIntervalMs'
+      'xpack.fleet.agents.agentPolicyRolloutRateLimitIntervalMs',
+      { level: 'critical' }
     ),
     renameFromRoot(
       'xpack.ingestManager.agents.agentPolicyRolloutRateLimitRequestPerInterval',
-      'xpack.fleet.agents.agentPolicyRolloutRateLimitRequestPerInterval'
+      'xpack.fleet.agents.agentPolicyRolloutRateLimitRequestPerInterval',
+      { level: 'critical' }
     ),
-    unusedFromRoot('xpack.ingestManager'),
+    unusedFromRoot('xpack.ingestManager', { level: 'critical' }),
     // Unused settings before Fleet server exists
-    unused('agents.kibana'),
-    unused('agents.maxConcurrentConnections'),
-    unused('agents.agentPolicyRolloutRateLimitIntervalMs'),
-    unused('agents.agentPolicyRolloutRateLimitRequestPerInterval'),
-    unused('agents.pollingRequestTimeout'),
-    unused('agents.tlsCheckDisabled'),
-    unused('agents.fleetServerEnabled'),
+    unused('agents.kibana', { level: 'critical' }),
+    unused('agents.maxConcurrentConnections', { level: 'critical' }),
+    unused('agents.agentPolicyRolloutRateLimitIntervalMs', { level: 'critical' }),
+    unused('agents.agentPolicyRolloutRateLimitRequestPerInterval', { level: 'critical' }),
+    unused('agents.pollingRequestTimeout', { level: 'critical' }),
+    unused('agents.tlsCheckDisabled', { level: 'critical' }),
+    unused('agents.fleetServerEnabled', { level: 'critical' }),
     // Renaming elasticsearch.host => elasticsearch.hosts
     (fullConfig, fromPath, addDeprecation) => {
       const oldValue = fullConfig?.xpack?.fleet?.agents?.elasticsearch?.host;
@@ -95,6 +112,7 @@ export const config: PluginConfigDescriptor = {
               `Use [xpack.fleet.agents.elasticsearch.hosts] with an array of host instead.`,
             ],
           },
+          level: 'critical',
         });
       }
 
@@ -129,7 +147,7 @@ export const config: PluginConfigDescriptor = {
 
 export type FleetConfigType = TypeOf<typeof config.schema>;
 
-export { PackagePolicyServiceInterface } from './services/package_policy';
+export type { PackagePolicyServiceInterface } from './services/package_policy';
 
 export { relativeDownloadUrlFromArtifact } from './services/artifacts/mappings';
 
diff --git a/x-pack/plugins/fleet/server/services/agent_policy.ts b/x-pack/plugins/fleet/server/services/agent_policy.ts
index 321bc7f289594..7de907b9a15fa 100644
--- a/x-pack/plugins/fleet/server/services/agent_policy.ts
+++ b/x-pack/plugins/fleet/server/services/agent_policy.ts
@@ -410,12 +410,16 @@ class AgentPolicyService {
       options
     );
 
-    // Copy all package policies
+    // Copy all package policies and append (copy) to their names
     if (baseAgentPolicy.package_policies.length) {
       const newPackagePolicies = (baseAgentPolicy.package_policies as PackagePolicy[]).map(
         (packagePolicy: PackagePolicy) => {
           const { id: packagePolicyId, version, ...newPackagePolicy } = packagePolicy;
-          return newPackagePolicy;
+          const updatedPackagePolicy = {
+            ...newPackagePolicy,
+            name: `${packagePolicy.name} (copy)`,
+          };
+          return updatedPackagePolicy;
         }
       );
       await packagePolicyService.bulkCreate(
diff --git a/x-pack/plugins/fleet/server/services/epm/packages/get.ts b/x-pack/plugins/fleet/server/services/epm/packages/get.ts
index 8d3c1fbe0daa4..b6a1850fed5b8 100644
--- a/x-pack/plugins/fleet/server/services/epm/packages/get.ts
+++ b/x-pack/plugins/fleet/server/services/epm/packages/get.ts
@@ -30,7 +30,8 @@ import { normalizeKuery } from '../../saved_object';
 
 import { createInstallableFrom, isUnremovablePackage } from './index';
 
-export { getFile, SearchParams } from '../registry';
+export type { SearchParams } from '../registry';
+export { getFile } from '../registry';
 
 function nameAsTitle(name: string) {
   return name.charAt(0).toUpperCase() + name.substr(1).toLowerCase();
diff --git a/x-pack/plugins/fleet/server/services/epm/packages/index.ts b/x-pack/plugins/fleet/server/services/epm/packages/index.ts
index 58e7c9e8928d8..a6970a8d19db4 100644
--- a/x-pack/plugins/fleet/server/services/epm/packages/index.ts
+++ b/x-pack/plugins/fleet/server/services/epm/packages/index.ts
@@ -12,6 +12,7 @@ import { KibanaAssetType } from '../../../types';
 import type { AssetType, Installable, Installation } from '../../../types';
 
 export { bulkInstallPackages, isBulkInstallError } from './bulk_install_packages';
+export type { SearchParams } from './get';
 export {
   getCategories,
   getFile,
@@ -21,16 +22,10 @@ export {
   getPackageInfo,
   getPackages,
   getLimitedPackages,
-  SearchParams,
 } from './get';
 
-export {
-  BulkInstallResponse,
-  IBulkInstallPackageError,
-  handleInstallPackageFailure,
-  installPackage,
-  ensureInstalledPackage,
-} from './install';
+export type { BulkInstallResponse, IBulkInstallPackageError } from './install';
+export { handleInstallPackageFailure, installPackage, ensureInstalledPackage } from './install';
 export { removeInstallation } from './remove';
 
 export function isUnremovablePackage(value: string): boolean {
diff --git a/x-pack/plugins/fleet/server/services/package_policy.ts b/x-pack/plugins/fleet/server/services/package_policy.ts
index 8968b1b4af3fd..985351c3e981b 100644
--- a/x-pack/plugins/fleet/server/services/package_policy.ts
+++ b/x-pack/plugins/fleet/server/services/package_policy.ts
@@ -42,7 +42,6 @@ import type {
 } from '../../common';
 import { PACKAGE_POLICY_SAVED_OBJECT_TYPE } from '../constants';
 import {
-  HostedAgentPolicyRestrictionRelatedError,
   IngestManagerError,
   ingestErrorToResponseOptions,
   PackagePolicyIneligibleForUpgradeError,
@@ -99,24 +98,14 @@ class PackagePolicyService {
       skipEnsureInstalled?: boolean;
     }
   ): Promise<PackagePolicy> {
-    // Check that its agent policy does not have a package policy with the same name
-    const parentAgentPolicy = await agentPolicyService.get(soClient, packagePolicy.policy_id);
-    if (!parentAgentPolicy) {
-      throw new Error('Agent policy not found');
-    }
-    if (parentAgentPolicy.is_managed && !options?.force) {
-      throw new HostedAgentPolicyRestrictionRelatedError(
-        `Cannot add integrations to hosted agent policy ${parentAgentPolicy.id}`
-      );
-    }
-    if (
-      (parentAgentPolicy.package_policies as PackagePolicy[]).find(
-        (siblingPackagePolicy) => siblingPackagePolicy.name === packagePolicy.name
-      )
-    ) {
-      throw new IngestManagerError(
-        'There is already a package with the same name on this agent policy'
-      );
+    const existingPoliciesWithName = await this.list(soClient, {
+      perPage: 1,
+      kuery: `${PACKAGE_POLICY_SAVED_OBJECT_TYPE}.name: "${packagePolicy.name}"`,
+    });
+
+    // Check that the name does not exist already
+    if (existingPoliciesWithName.items.length > 0) {
+      throw new IngestManagerError('There is already a package with the same name');
     }
     let elasticsearch: PackagePolicy['elasticsearch'];
     // Add ids to stream
@@ -320,12 +309,12 @@ class PackagePolicyService {
     });
 
     return {
-      items: packagePolicies.saved_objects.map((packagePolicySO) => ({
+      items: packagePolicies?.saved_objects.map((packagePolicySO) => ({
         id: packagePolicySO.id,
         version: packagePolicySO.version,
         ...packagePolicySO.attributes,
       })),
-      total: packagePolicies.total,
+      total: packagePolicies?.total,
       page,
       perPage,
     };
@@ -369,19 +358,15 @@ class PackagePolicyService {
     if (!oldPackagePolicy) {
       throw new Error('Package policy not found');
     }
+    // Check that the name does not exist already but exclude the current package policy
+    const existingPoliciesWithName = await this.list(soClient, {
+      perPage: 1,
+      kuery: `${PACKAGE_POLICY_SAVED_OBJECT_TYPE}.name: "${packagePolicy.name}"`,
+    });
+    const filtered = (existingPoliciesWithName?.items || []).filter((p) => p.id !== id);
 
-    // Check that its agent policy does not have a package policy with the same name
-    const parentAgentPolicy = await agentPolicyService.get(soClient, packagePolicy.policy_id);
-    if (!parentAgentPolicy) {
-      throw new Error('Agent policy not found');
-    }
-    if (
-      (parentAgentPolicy.package_policies as PackagePolicy[]).find(
-        (siblingPackagePolicy) =>
-          siblingPackagePolicy.id !== id && siblingPackagePolicy.name === packagePolicy.name
-      )
-    ) {
-      throw new Error('There is already a package with the same name on this agent policy');
+    if (filtered.length > 0) {
+      throw new IngestManagerError('There is already a package with the same name');
     }
 
     let inputs = restOfPackagePolicy.inputs.map((input) =>
diff --git a/x-pack/plugins/fleet/server/types/index.tsx b/x-pack/plugins/fleet/server/types/index.tsx
index 5bdd95ef0b874..174aac03d6a3c 100644
--- a/x-pack/plugins/fleet/server/types/index.tsx
+++ b/x-pack/plugins/fleet/server/types/index.tsx
@@ -5,8 +5,7 @@
  * 2.0.
  */
 
-export {
-  // Object types
+export type {
   Agent,
   AgentMetadata,
   AgentSOAttributes,
@@ -51,13 +50,10 @@ export {
   AssetReference,
   EsAssetReference,
   KibanaAssetReference,
-  ElasticsearchAssetType,
   RegistryPackage,
   InstallablePackage,
   AssetType,
   Installable,
-  KibanaAssetType,
-  KibanaSavedObjectType,
   AssetParts,
   AssetsGroupedByServiceByType,
   CategoryId,
@@ -74,13 +70,17 @@ export {
   InstallResult,
   GetCategoriesRequest,
   DataType,
-  dataTypes,
-  // Fleet Server types
   FleetServerEnrollmentAPIKey,
   FleetServerAgent,
   FleetServerAgentAction,
   FleetServerPolicy,
 } from '../../common';
+export {
+  ElasticsearchAssetType,
+  KibanaAssetType,
+  KibanaSavedObjectType,
+  dataTypes,
+} from '../../common';
 
 export type AgentPolicyUpdateHandler = (
   action: 'created' | 'updated' | 'deleted',
@@ -96,4 +96,4 @@ export interface BulkActionResult {
 export * from './models';
 export * from './rest_spec';
 export * from './extensions';
-export { FleetRequestHandler, FleetRequestHandlerContext } from './request_context';
+export type { FleetRequestHandler, FleetRequestHandlerContext } from './request_context';
diff --git a/x-pack/plugins/global_search/public/index.ts b/x-pack/plugins/global_search/public/index.ts
index adb392cc61a5a..55a16407eb603 100644
--- a/x-pack/plugins/global_search/public/index.ts
+++ b/x-pack/plugins/global_search/public/index.ts
@@ -20,7 +20,7 @@ export const plugin: PluginInitializer<
   GlobalSearchPluginStartDeps
 > = (context) => new GlobalSearchPlugin(context);
 
-export {
+export type {
   GlobalSearchBatchedResults,
   GlobalSearchProviderFindOptions,
   GlobalSearchProviderResult,
@@ -29,9 +29,9 @@ export {
   GlobalSearchFindParams,
   GlobalSearchProviderFindParams,
 } from '../common/types';
-export {
+export type {
   GlobalSearchPluginSetup,
   GlobalSearchPluginStart,
   GlobalSearchResultProvider,
 } from './types';
-export { GlobalSearchFindOptions } from './services/types';
+export type { GlobalSearchFindOptions } from './services/types';
diff --git a/x-pack/plugins/global_search/public/services/index.ts b/x-pack/plugins/global_search/public/services/index.ts
index 0405a6d8899c8..b178d3e76f849 100644
--- a/x-pack/plugins/global_search/public/services/index.ts
+++ b/x-pack/plugins/global_search/public/services/index.ts
@@ -5,5 +5,6 @@
  * 2.0.
  */
 
-export { SearchService, SearchServiceSetup, SearchServiceStart } from './search_service';
-export { GlobalSearchFindOptions } from './types';
+export type { SearchServiceSetup, SearchServiceStart } from './search_service';
+export { SearchService } from './search_service';
+export type { GlobalSearchFindOptions } from './types';
diff --git a/x-pack/plugins/global_search/server/index.ts b/x-pack/plugins/global_search/server/index.ts
index 1da9a10fad84a..d98e10f404306 100644
--- a/x-pack/plugins/global_search/server/index.ts
+++ b/x-pack/plugins/global_search/server/index.ts
@@ -22,14 +22,14 @@ export const plugin: PluginInitializer<
 
 export { config } from './config';
 
-export {
+export type {
   GlobalSearchBatchedResults,
   GlobalSearchProviderFindOptions,
   GlobalSearchProviderResult,
   GlobalSearchProviderResultUrl,
   GlobalSearchResult,
 } from '../common/types';
-export {
+export type {
   GlobalSearchFindOptions,
   GlobalSearchProviderContext,
   GlobalSearchPluginStart,
diff --git a/x-pack/plugins/global_search/server/services/index.ts b/x-pack/plugins/global_search/server/services/index.ts
index 32ae3805038db..ac5b326dd5c05 100644
--- a/x-pack/plugins/global_search/server/services/index.ts
+++ b/x-pack/plugins/global_search/server/services/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { SearchService, SearchServiceSetup, SearchServiceStart } from './search_service';
+export type { SearchServiceSetup, SearchServiceStart } from './search_service';
+export { SearchService } from './search_service';
diff --git a/x-pack/plugins/global_search_bar/public/search_syntax/index.ts b/x-pack/plugins/global_search_bar/public/search_syntax/index.ts
index 87d370d0c9055..7bf8ee39df148 100644
--- a/x-pack/plugins/global_search_bar/public/search_syntax/index.ts
+++ b/x-pack/plugins/global_search_bar/public/search_syntax/index.ts
@@ -6,4 +6,4 @@
  */
 
 export { parseSearchParams } from './parse_search_params';
-export { ParsedSearchParams, FilterValues, FilterValueType } from './types';
+export type { ParsedSearchParams, FilterValues, FilterValueType } from './types';
diff --git a/x-pack/plugins/global_search_bar/public/suggestions/index.ts b/x-pack/plugins/global_search_bar/public/suggestions/index.ts
index 0c19601f21ebb..32fcdea79550f 100644
--- a/x-pack/plugins/global_search_bar/public/suggestions/index.ts
+++ b/x-pack/plugins/global_search_bar/public/suggestions/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { getSuggestions, SearchSuggestion } from './get_suggestions';
+export type { SearchSuggestion } from './get_suggestions';
+export { getSuggestions } from './get_suggestions';
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/form/index.ts b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/form/index.ts
index f31fedfac6681..0439e9d5ec13d 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/form/index.ts
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/form/index.ts
@@ -19,10 +19,7 @@ export { ConfigurationProvider, useConfiguration } from './configuration_context
 
 export { FormErrorsProvider, useFormErrorsContext } from './form_errors_context';
 
-export {
-  PhaseTimingsProvider,
-  usePhaseTimings,
-  PhaseTimingConfiguration,
-} from './phase_timings_context';
+export type { PhaseTimingConfiguration } from './phase_timings_context';
+export { PhaseTimingsProvider, usePhaseTimings } from './phase_timings_context';
 
 export { useGlobalFields, globalFields } from './global_fields_context';
diff --git a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/lib/index.ts b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/lib/index.ts
index 607c62cd3ce8b..5bc887c5a3c73 100644
--- a/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/lib/index.ts
+++ b/x-pack/plugins/index_lifecycle_management/public/application/sections/edit_policy/lib/index.ts
@@ -5,13 +5,15 @@
  * 2.0.
  */
 
+export type {
+  AbsoluteTimings,
+  PhaseAgeInMilliseconds,
+  RelativePhaseTimingInMs,
+} from './absolute_timing_to_relative_timing';
 export {
   calculateRelativeFromAbsoluteMilliseconds,
   formDataToAbsoluteTimings,
   getPhaseMinAgeInMilliseconds,
-  AbsoluteTimings,
-  PhaseAgeInMilliseconds,
-  RelativePhaseTimingInMs,
 } from './absolute_timing_to_relative_timing';
 
 export { getDefaultRepository } from './get_default_repository';
diff --git a/x-pack/plugins/index_lifecycle_management/public/index.ts b/x-pack/plugins/index_lifecycle_management/public/index.ts
index cbd23a14a6114..2b8573902781b 100644
--- a/x-pack/plugins/index_lifecycle_management/public/index.ts
+++ b/x-pack/plugins/index_lifecycle_management/public/index.ts
@@ -14,4 +14,5 @@ export const plugin = (initializerContext: PluginInitializerContext) => {
   return new IndexLifecycleManagementPlugin(initializerContext);
 };
 
-export { ILM_LOCATOR_ID, IlmLocatorParams } from './locator';
+export type { IlmLocatorParams } from './locator';
+export { ILM_LOCATOR_ID } from './locator';
diff --git a/x-pack/plugins/index_lifecycle_management/public/shared_imports.ts b/x-pack/plugins/index_lifecycle_management/public/shared_imports.ts
index e191c4bd799a1..dab299c476eea 100644
--- a/x-pack/plugins/index_lifecycle_management/public/shared_imports.ts
+++ b/x-pack/plugins/index_lifecycle_management/public/shared_imports.ts
@@ -8,10 +8,7 @@
 import { AppServicesContext } from './types';
 import { useKibana as _useKibana } from '../../../../src/plugins/kibana_react/public';
 
-export {
-  useForm,
-  useFormData,
-  Form,
+export type {
   FormHook,
   FieldHook,
   FormData,
@@ -19,11 +16,16 @@ export {
   FieldConfig,
   OnFormUpdateArg,
   ValidationFunc,
-  getFieldValidityAndErrorMessage,
-  useFormContext,
   FormSchema,
   ValidationConfig,
   ValidationError,
+} from '../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib';
+export {
+  useForm,
+  useFormData,
+  Form,
+  getFieldValidityAndErrorMessage,
+  useFormContext,
   UseMultiFields,
 } from '../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib';
 
diff --git a/x-pack/plugins/index_lifecycle_management/server/shared_imports.ts b/x-pack/plugins/index_lifecycle_management/server/shared_imports.ts
index 5c91a0a57ce5e..4598814d63c02 100644
--- a/x-pack/plugins/index_lifecycle_management/server/shared_imports.ts
+++ b/x-pack/plugins/index_lifecycle_management/server/shared_imports.ts
@@ -6,4 +6,4 @@
  */
 
 export { handleEsError } from '../../../../src/plugins/es_ui_shared/server';
-export { ILicense, LicenseType } from '../../licensing/common/types';
+export type { ILicense, LicenseType } from '../../licensing/common/types';
diff --git a/x-pack/plugins/index_management/__jest__/client_integration/helpers/index.ts b/x-pack/plugins/index_management/__jest__/client_integration/helpers/index.ts
index 997f234cf3090..79df6e8e9f20c 100644
--- a/x-pack/plugins/index_management/__jest__/client_integration/helpers/index.ts
+++ b/x-pack/plugins/index_management/__jest__/client_integration/helpers/index.ts
@@ -7,7 +7,8 @@
 
 import './mocks';
 
-export { nextTick, getRandomString, findTestSubject, TestBed } from '@kbn/test/jest';
+export type { TestBed } from '@kbn/test/jest';
+export { nextTick, getRandomString, findTestSubject } from '@kbn/test/jest';
 
 export {
   setupEnvironment,
@@ -16,4 +17,4 @@ export {
   kibanaVersion,
 } from './setup_environment';
 
-export { TestSubjects } from './test_subjects';
+export type { TestSubjects } from './test_subjects';
diff --git a/x-pack/plugins/index_management/common/types/index.ts b/x-pack/plugins/index_management/common/types/index.ts
index 9908e9598412b..0cc514b47024f 100644
--- a/x-pack/plugins/index_management/common/types/index.ts
+++ b/x-pack/plugins/index_management/common/types/index.ts
@@ -13,6 +13,6 @@ export * from './mappings';
 
 export * from './templates';
 
-export { DataStreamFromEs, Health, DataStream, DataStreamIndex } from './data_streams';
+export type { DataStreamFromEs, Health, DataStream, DataStreamIndex } from './data_streams';
 
 export * from './component_templates';
diff --git a/x-pack/plugins/index_management/public/application/components/component_templates/component_template_details/index.ts b/x-pack/plugins/index_management/public/application/components/component_templates/component_template_details/index.ts
index 2545c47e47c22..fd65eb0401608 100644
--- a/x-pack/plugins/index_management/public/application/components/component_templates/component_template_details/index.ts
+++ b/x-pack/plugins/index_management/public/application/components/component_templates/component_template_details/index.ts
@@ -5,8 +5,8 @@
  * 2.0.
  */
 
+export type { Props as ComponentTemplateDetailsProps } from './component_template_details';
 export {
   ComponentTemplateDetailsFlyoutContent,
   defaultFlyoutProps,
-  Props as ComponentTemplateDetailsProps,
 } from './component_template_details';
diff --git a/x-pack/plugins/index_management/public/application/components/component_templates/shared_imports.ts b/x-pack/plugins/index_management/public/application/components/component_templates/shared_imports.ts
index 15528f5b4e8e5..2f5b98e59bb22 100644
--- a/x-pack/plugins/index_management/public/application/components/component_templates/shared_imports.ts
+++ b/x-pack/plugins/index_management/public/application/components/component_templates/shared_imports.ts
@@ -5,11 +5,14 @@
  * 2.0.
  */
 
-export {
+export type {
   UseRequestConfig,
   UseRequestResponse,
   SendRequestConfig,
   SendRequestResponse,
+  Error,
+} from '../../../../../../../src/plugins/es_ui_shared/public';
+export {
   sendRequest,
   useRequest,
   WithPrivileges,
@@ -18,7 +21,6 @@ export {
   SectionLoading,
   PageLoading,
   PageError,
-  Error,
   useAuthorizationContext,
   NotAuthorizedSection,
   Forms,
@@ -32,11 +34,13 @@ export {
   fieldFormatters,
 } from '../../../../../../../src/plugins/es_ui_shared/static/forms/helpers';
 
-export {
+export type {
   FormSchema,
+  FieldConfig,
+} from '../../../../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib';
+export {
   FIELD_TYPES,
   VALIDATION_TYPES,
-  FieldConfig,
   useForm,
   Form,
   getUseField,
@@ -50,17 +54,17 @@ export {
 
 export { isJSON } from '../../../../../../../src/plugins/es_ui_shared/static/validators/string';
 
+export type { CommonWizardSteps } from '../shared';
 export {
   TabMappings,
   TabSettings,
   TabAliases,
-  CommonWizardSteps,
   StepSettingsContainer,
   StepMappingsContainer,
   StepAliasesContainer,
 } from '../shared';
 
-export {
+export type {
   ComponentTemplateSerialized,
   ComponentTemplateDeserialized,
   ComponentTemplateListItem,
diff --git a/x-pack/plugins/index_management/public/application/components/index.ts b/x-pack/plugins/index_management/public/application/components/index.ts
index eeba6e16b543c..fe3e41c34a870 100644
--- a/x-pack/plugins/index_management/public/application/components/index.ts
+++ b/x-pack/plugins/index_management/public/application/components/index.ts
@@ -5,7 +5,8 @@
  * 2.0.
  */
 
-export { SectionError, Error } from './section_error';
+export type { Error } from './section_error';
+export { SectionError } from './section_error';
 export { NoMatch } from './no_match';
 export { TemplateDeleteModal } from './template_delete_modal';
 export { TemplateForm } from './template_form';
diff --git a/x-pack/plugins/index_management/public/application/components/index_templates/index.ts b/x-pack/plugins/index_management/public/application/components/index_templates/index.ts
index d460175543ac5..f51fe3f5d6fe3 100644
--- a/x-pack/plugins/index_management/public/application/components/index_templates/index.ts
+++ b/x-pack/plugins/index_management/public/application/components/index_templates/index.ts
@@ -5,12 +5,11 @@
  * 2.0.
  */
 
+export type { SimulateTemplateProps, SimulateTemplateFilters } from './simulate_template';
 export {
   SimulateTemplateFlyoutContent,
   simulateTemplateFlyoutProps,
-  SimulateTemplateProps,
   SimulateTemplate,
-  SimulateTemplateFilters,
 } from './simulate_template';
 
 export { LegacyIndexTemplatesDeprecation } from './legacy_index_template_deprecation';
diff --git a/x-pack/plugins/index_management/public/application/components/index_templates/simulate_template/index.ts b/x-pack/plugins/index_management/public/application/components/index_templates/simulate_template/index.ts
index 91273dc82f902..2837eb8f1f40c 100644
--- a/x-pack/plugins/index_management/public/application/components/index_templates/simulate_template/index.ts
+++ b/x-pack/plugins/index_management/public/application/components/index_templates/simulate_template/index.ts
@@ -5,10 +5,11 @@
  * 2.0.
  */
 
+export type { Props as SimulateTemplateProps } from './simulate_template_flyout';
 export {
   SimulateTemplateFlyoutContent,
   defaultFlyoutProps as simulateTemplateFlyoutProps,
-  Props as SimulateTemplateProps,
 } from './simulate_template_flyout';
 
-export { SimulateTemplate, Filters as SimulateTemplateFilters } from './simulate_template';
+export type { Filters as SimulateTemplateFilters } from './simulate_template';
+export { SimulateTemplate } from './simulate_template';
diff --git a/x-pack/plugins/index_management/public/application/components/mappings_editor/__jest__/client_integration/helpers/index.ts b/x-pack/plugins/index_management/public/application/components/mappings_editor/__jest__/client_integration/helpers/index.ts
index fbe24557ae6a1..d436492756659 100644
--- a/x-pack/plugins/index_management/public/application/components/mappings_editor/__jest__/client_integration/helpers/index.ts
+++ b/x-pack/plugins/index_management/public/application/components/mappings_editor/__jest__/client_integration/helpers/index.ts
@@ -12,11 +12,12 @@ import {
   getMappingsEditorDataFactory,
 } from './mappings_editor.helpers';
 
-export { nextTick, getRandomString, findTestSubject, TestBed } from '@kbn/test/jest';
+export type { TestBed } from '@kbn/test/jest';
+export { nextTick, getRandomString, findTestSubject } from '@kbn/test/jest';
 export { kibanaVersion } from './setup_environment';
 
 export const componentHelpers = {
   mappingsEditor: { setup: mappingsEditorSetup, getMappingsEditorDataFactory },
 };
 
-export { MappingsEditorTestBed, DomFields };
+export type { MappingsEditorTestBed, DomFields };
diff --git a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/edit_field/index.ts b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/edit_field/index.ts
index a171959daf2cb..4b3e2657ba6ac 100644
--- a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/edit_field/index.ts
+++ b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/edit_field/index.ts
@@ -5,11 +5,8 @@
  * 2.0.
  */
 
-export {
-  EditFieldContainer,
-  defaultFlyoutProps,
-  Props as EditFieldContainerProps,
-} from './edit_field_container';
+export type { Props as EditFieldContainerProps } from './edit_field_container';
+export { EditFieldContainer, defaultFlyoutProps } from './edit_field_container';
 
 export * from './basic_parameters_section';
 
diff --git a/x-pack/plugins/index_management/public/application/components/mappings_editor/index.ts b/x-pack/plugins/index_management/public/application/components/mappings_editor/index.ts
index 9692e5d6c22b0..2d284297041e7 100644
--- a/x-pack/plugins/index_management/public/application/components/mappings_editor/index.ts
+++ b/x-pack/plugins/index_management/public/application/components/mappings_editor/index.ts
@@ -13,4 +13,4 @@ export { LoadMappingsFromJsonButton, LoadMappingsProvider } from './components/l
 
 export { MappingsEditorProvider } from './mappings_editor_context';
 
-export { IndexSettings, OnUpdateHandler } from './types';
+export type { IndexSettings, OnUpdateHandler } from './types';
diff --git a/x-pack/plugins/index_management/public/application/components/mappings_editor/shared_imports.ts b/x-pack/plugins/index_management/public/application/components/mappings_editor/shared_imports.ts
index 4ea8412d4ffe3..de9c1985239f5 100644
--- a/x-pack/plugins/index_management/public/application/components/mappings_editor/shared_imports.ts
+++ b/x-pack/plugins/index_management/public/application/components/mappings_editor/shared_imports.ts
@@ -5,26 +5,28 @@
  * 2.0.
  */
 
-export {
-  FIELD_TYPES,
+export type {
   FieldConfig,
   FieldHook,
-  Form,
-  FormDataProvider,
   FormHook,
   FormSchema,
-  getUseField,
   OnFormUpdateArg,
   SerializerFunc,
+  ArrayItem,
+  ValidationFunc,
+  ValidationFuncArg,
+} from '../../../../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib';
+export {
+  FIELD_TYPES,
+  Form,
+  FormDataProvider,
+  getUseField,
   UseField,
   UseArray,
-  ArrayItem,
   useForm,
   useFormContext,
   UseMultiFields,
   VALIDATION_TYPES,
-  ValidationFunc,
-  ValidationFuncArg,
 } from '../../../../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib';
 
 export {
@@ -47,20 +49,17 @@ export {
   fieldValidators,
 } from '../../../../../../../src/plugins/es_ui_shared/static/forms/helpers';
 
-export {
-  JsonEditor,
-  OnJsonEditorUpdateHandler,
-  GlobalFlyout,
-} from '../../../../../../../src/plugins/es_ui_shared/public';
+export type { OnJsonEditorUpdateHandler } from '../../../../../../../src/plugins/es_ui_shared/public';
+export { JsonEditor, GlobalFlyout } from '../../../../../../../src/plugins/es_ui_shared/public';
 
 export { documentationService } from '../../services/documentation';
 
-export {
+export type {
   RuntimeField,
-  RuntimeFieldEditorFlyoutContent,
   RuntimeFieldEditorFlyoutContentProps,
 } from '../../../../../runtime_fields/public';
+export { RuntimeFieldEditorFlyoutContent } from '../../../../../runtime_fields/public';
 
 export { createKibanaReactContext } from '../../../../../../../src/plugins/kibana_react/public';
 
-export { DocLinksStart } from '../../../../../../../src/core/public';
+export type { DocLinksStart } from '../../../../../../../src/core/public';
diff --git a/x-pack/plugins/index_management/public/application/components/shared/components/index.ts b/x-pack/plugins/index_management/public/application/components/shared/components/index.ts
index 6011bd6aed4f9..3c564c0caf6e3 100644
--- a/x-pack/plugins/index_management/public/application/components/shared/components/index.ts
+++ b/x-pack/plugins/index_management/public/application/components/shared/components/index.ts
@@ -7,11 +7,7 @@
 
 export { TabAliases, TabMappings, TabSettings } from './details_panel';
 
-export {
-  StepAliasesContainer,
-  StepMappingsContainer,
-  StepSettingsContainer,
-  CommonWizardSteps,
-} from './wizard_steps';
+export type { CommonWizardSteps } from './wizard_steps';
+export { StepAliasesContainer, StepMappingsContainer, StepSettingsContainer } from './wizard_steps';
 
 export { TemplateContentIndicator } from './template_content_indicator';
diff --git a/x-pack/plugins/index_management/public/application/components/shared/components/wizard_steps/index.ts b/x-pack/plugins/index_management/public/application/components/shared/components/wizard_steps/index.ts
index 224c753b82304..2197e5140fc98 100644
--- a/x-pack/plugins/index_management/public/application/components/shared/components/wizard_steps/index.ts
+++ b/x-pack/plugins/index_management/public/application/components/shared/components/wizard_steps/index.ts
@@ -9,4 +9,4 @@ export { StepAliasesContainer } from './step_aliases_container';
 export { StepMappingsContainer } from './step_mappings_container';
 export { StepSettingsContainer } from './step_settings_container';
 
-export { CommonWizardSteps } from './types';
+export type { CommonWizardSteps } from './types';
diff --git a/x-pack/plugins/index_management/public/application/components/shared/index.ts b/x-pack/plugins/index_management/public/application/components/shared/index.ts
index 96b4131f8282d..06899e202ef82 100644
--- a/x-pack/plugins/index_management/public/application/components/shared/index.ts
+++ b/x-pack/plugins/index_management/public/application/components/shared/index.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+export type { CommonWizardSteps } from './components';
 export {
   TabAliases,
   TabMappings,
@@ -12,6 +13,5 @@ export {
   StepAliasesContainer,
   StepMappingsContainer,
   StepSettingsContainer,
-  CommonWizardSteps,
   TemplateContentIndicator,
 } from './components';
diff --git a/x-pack/plugins/index_management/public/application/index.tsx b/x-pack/plugins/index_management/public/application/index.tsx
index b7a4bd2135147..854826681adae 100644
--- a/x-pack/plugins/index_management/public/application/index.tsx
+++ b/x-pack/plugins/index_management/public/application/index.tsx
@@ -93,4 +93,5 @@ const useKibana = () => {
   return useKibanaReactPlugin<KibanaReactContextServices>();
 };
 
-export { AppDependencies, useKibana };
+export type { AppDependencies };
+export { useKibana };
diff --git a/x-pack/plugins/index_management/public/application/sections/home/components/index.ts b/x-pack/plugins/index_management/public/application/sections/home/components/index.ts
index df1218f6f0686..8cd35ead5d308 100644
--- a/x-pack/plugins/index_management/public/application/sections/home/components/index.ts
+++ b/x-pack/plugins/index_management/public/application/sections/home/components/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { FilterListButton, Filters } from './filter_list_button';
+export type { Filters } from './filter_list_button';
+export { FilterListButton } from './filter_list_button';
diff --git a/x-pack/plugins/index_management/public/index.ts b/x-pack/plugins/index_management/public/index.ts
index f9ccc788a36c0..01635ed2a9b8f 100644
--- a/x-pack/plugins/index_management/public/index.ts
+++ b/x-pack/plugins/index_management/public/index.ts
@@ -14,7 +14,7 @@ export const plugin = (ctx: PluginInitializerContext) => {
   return new IndexMgmtUIPlugin(ctx);
 };
 
-export { IndexManagementPluginSetup } from './types';
+export type { IndexManagementPluginSetup } from './types';
 
 export { getIndexListUri, getTemplateDetailsLink } from './application/services/routing';
 
diff --git a/x-pack/plugins/index_management/public/services/index.ts b/x-pack/plugins/index_management/public/services/index.ts
index fe91e700236cc..f32787a427b89 100644
--- a/x-pack/plugins/index_management/public/services/index.ts
+++ b/x-pack/plugins/index_management/public/services/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { ExtensionsService, ExtensionsSetup } from './extensions_service';
+export type { ExtensionsSetup } from './extensions_service';
+export { ExtensionsService } from './extensions_service';
diff --git a/x-pack/plugins/index_management/public/shared_imports.ts b/x-pack/plugins/index_management/public/shared_imports.ts
index 4e1c420795904..7fadcd9e71502 100644
--- a/x-pack/plugins/index_management/public/shared_imports.ts
+++ b/x-pack/plugins/index_management/public/shared_imports.ts
@@ -7,11 +7,14 @@
 
 export { APP_WRAPPER_CLASS } from '../../../../src/core/public';
 
-export {
+export type {
   SendRequestConfig,
   SendRequestResponse,
   UseRequestConfig,
   UseRequestResponse,
+  Error,
+} from '../../../../src/plugins/es_ui_shared/public';
+export {
   sendRequest,
   useRequest,
   Forms,
@@ -20,16 +23,17 @@ export {
   attemptToURIDecode,
   PageLoading,
   PageError,
-  Error,
   SectionLoading,
   EuiCodeEditor,
 } from '../../../../src/plugins/es_ui_shared/public';
 
-export {
+export type {
   FormSchema,
+  FieldConfig,
+} from '../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib';
+export {
   FIELD_TYPES,
   VALIDATION_TYPES,
-  FieldConfig,
   useForm,
   useFormData,
   Form,
diff --git a/x-pack/plugins/index_management/server/index.ts b/x-pack/plugins/index_management/server/index.ts
index 29291116e44fc..8eb882d29de2d 100644
--- a/x-pack/plugins/index_management/server/index.ts
+++ b/x-pack/plugins/index_management/server/index.ts
@@ -14,7 +14,7 @@ export { config } from './config';
 export const plugin = (context: PluginInitializerContext) => new IndexMgmtServerPlugin(context);
 
 /** @public */
-export { Dependencies } from './types';
-export { IndexManagementPluginSetup } from './plugin';
-export { Index, LegacyTemplateSerialized } from '../common';
-export { IndexManagementConfig } from './config';
+export type { Dependencies } from './types';
+export type { IndexManagementPluginSetup } from './plugin';
+export type { Index, LegacyTemplateSerialized } from '../common';
+export type { IndexManagementConfig } from './config';
diff --git a/x-pack/plugins/index_management/server/services/index.ts b/x-pack/plugins/index_management/server/services/index.ts
index 576d7c46fa086..bd62f2df80cc8 100644
--- a/x-pack/plugins/index_management/server/services/index.ts
+++ b/x-pack/plugins/index_management/server/services/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { IndexDataEnricher, Enricher } from './index_data_enricher';
+export type { Enricher } from './index_data_enricher';
+export { IndexDataEnricher } from './index_data_enricher';
diff --git a/x-pack/plugins/infra/common/constants.ts b/x-pack/plugins/infra/common/constants.ts
index 1c3aa550f2f62..4c70e34c9899f 100644
--- a/x-pack/plugins/infra/common/constants.ts
+++ b/x-pack/plugins/infra/common/constants.ts
@@ -8,7 +8,6 @@
 export const DEFAULT_SOURCE_ID = 'default';
 export const METRICS_INDEX_PATTERN = 'metrics-*,metricbeat-*';
 export const LOGS_INDEX_PATTERN = 'logs-*,filebeat-*,kibana_sample_data_logs*';
-export const TIMESTAMP_FIELD = '@timestamp';
 export const METRICS_APP = 'metrics';
 export const LOGS_APP = 'logs';
 
@@ -16,3 +15,9 @@ export const METRICS_FEATURE_ID = 'infrastructure';
 export const LOGS_FEATURE_ID = 'logs';
 
 export type InfraFeatureId = typeof METRICS_FEATURE_ID | typeof LOGS_FEATURE_ID;
+
+export const TIMESTAMP_FIELD = '@timestamp';
+export const TIEBREAKER_FIELD = '_doc';
+export const HOST_FIELD = 'host.name';
+export const CONTAINER_FIELD = 'container.id';
+export const POD_FIELD = 'kubernetes.pod.uid';
diff --git a/x-pack/plugins/infra/common/http_api/host_details/process_list.ts b/x-pack/plugins/infra/common/http_api/host_details/process_list.ts
index 79835a0a78f26..395b1527379a9 100644
--- a/x-pack/plugins/infra/common/http_api/host_details/process_list.ts
+++ b/x-pack/plugins/infra/common/http_api/host_details/process_list.ts
@@ -14,7 +14,6 @@ const AggValueRT = rt.type({
 
 export const ProcessListAPIRequestRT = rt.type({
   hostTerm: rt.record(rt.string, rt.string),
-  timefield: rt.string,
   indexPattern: rt.string,
   to: rt.number,
   sortBy: rt.type({
@@ -102,7 +101,6 @@ export type ProcessListAPIResponse = rt.TypeOf<typeof ProcessListAPIResponseRT>;
 
 export const ProcessListAPIChartRequestRT = rt.type({
   hostTerm: rt.record(rt.string, rt.string),
-  timefield: rt.string,
   indexPattern: rt.string,
   to: rt.number,
   command: rt.string,
diff --git a/x-pack/plugins/infra/common/http_api/metrics_api.ts b/x-pack/plugins/infra/common/http_api/metrics_api.ts
index c2449707647d7..315a42380397b 100644
--- a/x-pack/plugins/infra/common/http_api/metrics_api.ts
+++ b/x-pack/plugins/infra/common/http_api/metrics_api.ts
@@ -10,7 +10,6 @@ import { MetricsUIAggregationRT } from '../inventory_models/types';
 import { afterKeyObjectRT } from './metrics_explorer';
 
 export const MetricsAPITimerangeRT = rt.type({
-  field: rt.string,
   from: rt.number,
   to: rt.number,
   interval: rt.string,
diff --git a/x-pack/plugins/infra/common/http_api/metrics_explorer.ts b/x-pack/plugins/infra/common/http_api/metrics_explorer.ts
index 5617bd0954f5d..de00d521126e3 100644
--- a/x-pack/plugins/infra/common/http_api/metrics_explorer.ts
+++ b/x-pack/plugins/infra/common/http_api/metrics_explorer.ts
@@ -41,7 +41,6 @@ export const metricsExplorerMetricRT = rt.intersection([
 ]);
 
 export const timeRangeRT = rt.type({
-  field: rt.string,
   from: rt.number,
   to: rt.number,
   interval: rt.string,
diff --git a/x-pack/plugins/infra/common/inventory_models/index.ts b/x-pack/plugins/infra/common/inventory_models/index.ts
index 6350e76ca7f29..81f89be8cd6a6 100644
--- a/x-pack/plugins/infra/common/inventory_models/index.ts
+++ b/x-pack/plugins/infra/common/inventory_models/index.ts
@@ -6,6 +6,7 @@
  */
 
 import { i18n } from '@kbn/i18n';
+import { POD_FIELD, HOST_FIELD, CONTAINER_FIELD } from '../constants';
 import { host } from './host';
 import { pod } from './pod';
 import { awsEC2 } from './aws_ec2';
@@ -30,31 +31,23 @@ export const findInventoryModel = (type: InventoryItemType) => {
   return model;
 };
 
-interface InventoryFields {
-  host: string;
-  pod: string;
-  container: string;
-  timestamp: string;
-  tiebreaker: string;
-}
-
 const LEGACY_TYPES = ['host', 'pod', 'container'];
 
-const getFieldByType = (type: InventoryItemType, fields: InventoryFields) => {
+export const getFieldByType = (type: InventoryItemType) => {
   switch (type) {
     case 'pod':
-      return fields.pod;
+      return POD_FIELD;
     case 'host':
-      return fields.host;
+      return HOST_FIELD;
     case 'container':
-      return fields.container;
+      return CONTAINER_FIELD;
   }
 };
 
-export const findInventoryFields = (type: InventoryItemType, fields?: InventoryFields) => {
+export const findInventoryFields = (type: InventoryItemType) => {
   const inventoryModel = findInventoryModel(type);
-  if (fields && LEGACY_TYPES.includes(type)) {
-    const id = getFieldByType(type, fields) || inventoryModel.fields.id;
+  if (LEGACY_TYPES.includes(type)) {
+    const id = getFieldByType(type) || inventoryModel.fields.id;
     return {
       ...inventoryModel.fields,
       id,
diff --git a/x-pack/plugins/infra/common/log_search_result/index.ts b/x-pack/plugins/infra/common/log_search_result/index.ts
index d1b2672fbfbaf..592b23dfc70ad 100644
--- a/x-pack/plugins/infra/common/log_search_result/index.ts
+++ b/x-pack/plugins/infra/common/log_search_result/index.ts
@@ -5,9 +5,9 @@
  * 2.0.
  */
 
+export type { SearchResult } from './log_search_result';
 export {
   getSearchResultIndexBeforeTime,
   getSearchResultIndexAfterTime,
   getSearchResultKey,
-  SearchResult,
 } from './log_search_result';
diff --git a/x-pack/plugins/infra/common/log_search_summary/index.ts b/x-pack/plugins/infra/common/log_search_summary/index.ts
index feb64dee7d31a..32652753f7799 100644
--- a/x-pack/plugins/infra/common/log_search_summary/index.ts
+++ b/x-pack/plugins/infra/common/log_search_summary/index.ts
@@ -5,4 +5,4 @@
  * 2.0.
  */
 
-export { SearchSummaryBucket } from './log_search_summary';
+export type { SearchSummaryBucket } from './log_search_summary';
diff --git a/x-pack/plugins/infra/common/log_sources/log_source_configuration.ts b/x-pack/plugins/infra/common/log_sources/log_source_configuration.ts
index ab98ad75b8433..5d46ce59457da 100644
--- a/x-pack/plugins/infra/common/log_sources/log_source_configuration.ts
+++ b/x-pack/plugins/infra/common/log_sources/log_source_configuration.ts
@@ -16,11 +16,6 @@ export const logSourceConfigurationOriginRT = rt.keyof({
 export type LogSourceConfigurationOrigin = rt.TypeOf<typeof logSourceConfigurationOriginRT>;
 
 const logSourceFieldsConfigurationRT = rt.strict({
-  container: rt.string,
-  host: rt.string,
-  pod: rt.string,
-  timestamp: rt.string,
-  tiebreaker: rt.string,
   message: rt.array(rt.string),
 });
 
diff --git a/x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts b/x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts
index c6bc10901fcb8..d3459b30a060e 100644
--- a/x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts
+++ b/x-pack/plugins/infra/common/log_sources/resolved_log_source_configuration.ts
@@ -8,6 +8,7 @@
 import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import { DataView, DataViewsContract } from '../../../../../src/plugins/data_views/common';
 import { ObjectEntries } from '../utility_types';
+import { TIMESTAMP_FIELD, TIEBREAKER_FIELD } from '../constants';
 import { ResolveLogSourceConfigurationError } from './errors';
 import {
   LogSourceColumnConfiguration,
@@ -61,8 +62,8 @@ const resolveLegacyReference = async (
 
   return {
     indices: sourceConfiguration.logIndices.indexName,
-    timestampField: sourceConfiguration.fields.timestamp,
-    tiebreakerField: sourceConfiguration.fields.tiebreaker,
+    timestampField: TIMESTAMP_FIELD,
+    tiebreakerField: TIEBREAKER_FIELD,
     messageField: sourceConfiguration.fields.message,
     fields,
     runtimeMappings: {},
@@ -91,8 +92,8 @@ const resolveKibanaIndexPatternReference = async (
 
   return {
     indices: indexPattern.title,
-    timestampField: indexPattern.timeFieldName ?? '@timestamp',
-    tiebreakerField: '_doc',
+    timestampField: indexPattern.timeFieldName ?? TIMESTAMP_FIELD,
+    tiebreakerField: TIEBREAKER_FIELD,
     messageField: ['message'],
     fields: indexPattern.fields,
     runtimeMappings: resolveRuntimeMappings(indexPattern),
diff --git a/x-pack/plugins/infra/common/metrics_sources/index.ts b/x-pack/plugins/infra/common/metrics_sources/index.ts
index a697c65e5a0aa..7fae908707a89 100644
--- a/x-pack/plugins/infra/common/metrics_sources/index.ts
+++ b/x-pack/plugins/infra/common/metrics_sources/index.ts
@@ -6,7 +6,6 @@
  */
 
 import * as rt from 'io-ts';
-import { omit } from 'lodash';
 import {
   SourceConfigurationRT,
   SourceStatusRuntimeType,
@@ -22,7 +21,6 @@ export const metricsSourceConfigurationPropertiesRT = rt.strict({
   metricAlias: SourceConfigurationRT.props.metricAlias,
   inventoryDefaultView: SourceConfigurationRT.props.inventoryDefaultView,
   metricsExplorerDefaultView: SourceConfigurationRT.props.metricsExplorerDefaultView,
-  fields: rt.strict(omit(SourceConfigurationRT.props.fields.props, 'message')),
   anomalyThreshold: rt.number,
 });
 
@@ -32,9 +30,6 @@ export type MetricsSourceConfigurationProperties = rt.TypeOf<
 
 export const partialMetricsSourceConfigurationPropertiesRT = rt.partial({
   ...metricsSourceConfigurationPropertiesRT.type.props,
-  fields: rt.partial({
-    ...metricsSourceConfigurationPropertiesRT.type.props.fields.type.props,
-  }),
 });
 
 export type PartialMetricsSourceConfigurationProperties = rt.TypeOf<
diff --git a/x-pack/plugins/infra/common/source_configuration/source_configuration.ts b/x-pack/plugins/infra/common/source_configuration/source_configuration.ts
index 257cccc86595c..0c30c3d678b2a 100644
--- a/x-pack/plugins/infra/common/source_configuration/source_configuration.ts
+++ b/x-pack/plugins/infra/common/source_configuration/source_configuration.ts
@@ -50,12 +50,7 @@ export const sourceConfigurationConfigFilePropertiesRT = rt.type({
   sources: rt.type({
     default: rt.partial({
       fields: rt.partial({
-        timestamp: rt.string,
         message: rt.array(rt.string),
-        tiebreaker: rt.string,
-        host: rt.string,
-        container: rt.string,
-        pod: rt.string,
       }),
     }),
   }),
@@ -113,11 +108,6 @@ export type InfraSourceConfigurationColumn = rt.TypeOf<typeof SourceConfiguratio
  */
 
 const SourceConfigurationFieldsRT = rt.type({
-  container: rt.string,
-  host: rt.string,
-  pod: rt.string,
-  tiebreaker: rt.string,
-  timestamp: rt.string,
   message: rt.array(rt.string),
 });
 
diff --git a/x-pack/plugins/infra/common/typed_json.ts b/x-pack/plugins/infra/common/typed_json.ts
index fee846b437a7a..95d5d4274c3b6 100644
--- a/x-pack/plugins/infra/common/typed_json.ts
+++ b/x-pack/plugins/infra/common/typed_json.ts
@@ -8,7 +8,7 @@
 import * as rt from 'io-ts';
 import { JsonArray, JsonObject, JsonValue } from '@kbn/utility-types';
 
-export { JsonArray, JsonObject, JsonValue };
+export type { JsonArray, JsonObject, JsonValue };
 
 export const jsonScalarRT = rt.union([rt.null, rt.boolean, rt.number, rt.string]);
 export type JsonScalar = rt.TypeOf<typeof jsonScalarRT>;
diff --git a/x-pack/plugins/infra/public/alerting/metric_threshold/components/expression.tsx b/x-pack/plugins/infra/public/alerting/metric_threshold/components/expression.tsx
index 6a5019d4683c8..4d57674c94dad 100644
--- a/x-pack/plugins/infra/public/alerting/metric_threshold/components/expression.tsx
+++ b/x-pack/plugins/infra/public/alerting/metric_threshold/components/expression.tsx
@@ -19,6 +19,7 @@ import {
   EuiFieldSearch,
   EuiAccordion,
   EuiPanel,
+  EuiLink,
 } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { i18n } from '@kbn/i18n';
@@ -58,7 +59,7 @@ export { defaultExpression };
 
 export const Expressions: React.FC<Props> = (props) => {
   const { setAlertParams, alertParams, errors, metadata } = props;
-  const { http, notifications } = useKibanaContextForPlugin().services;
+  const { http, notifications, docLinks } = useKibanaContextForPlugin().services;
   const { source, createDerivedIndexPattern } = useSourceViaHttp({
     sourceId: 'default',
     fetch: http.fetch,
@@ -260,6 +261,9 @@ export const Expressions: React.FC<Props> = (props) => {
     [alertParams.groupBy]
   );
 
+  // Test to see if any of the group fields in groupBy are already filtered down to a single
+  // group by the filterQuery. If this is the case, then a groupBy is unnecessary, as it would only
+  // ever produce one group instance
   const groupByFilterTestPatterns = useMemo(() => {
     if (!alertParams.groupBy) return null;
     const groups = !Array.isArray(alertParams.groupBy)
@@ -456,10 +460,20 @@ export const Expressions: React.FC<Props> = (props) => {
           <EuiText size="xs" color="danger">
             <FormattedMessage
               id="xpack.infra.metrics.alertFlyout.alertPerRedundantFilterError"
-              defaultMessage="This rule will only alert per one {matchedGroups} because the filter query contains an exact match for {groupCount, plural, one {this field} other {these fields}}."
+              defaultMessage="This rule may alert on {matchedGroups} less than expected, because the filter query contains a match for {groupCount, plural, one {this field} other {these fields}}. For more information, refer to {filteringAndGroupingLink}."
               values={{
                 matchedGroups: <strong>{redundantFilterGroupBy.join(', ')}</strong>,
                 groupCount: redundantFilterGroupBy.length,
+                filteringAndGroupingLink: (
+                  <EuiLink
+                    href={`${docLinks.links.observability.metricsThreshold}#filtering-and-grouping`}
+                  >
+                    {i18n.translate(
+                      'xpack.infra.metrics.alertFlyout.alertPerRedundantFilterError.docsLink',
+                      { defaultMessage: 'the docs' }
+                    )}
+                  </EuiLink>
+                ),
               }}
             />
           </EuiText>
diff --git a/x-pack/plugins/infra/public/alerting/metric_threshold/components/expression_chart.test.tsx b/x-pack/plugins/infra/public/alerting/metric_threshold/components/expression_chart.test.tsx
index ec97d01a1cd6f..c2c1fa719bb95 100644
--- a/x-pack/plugins/infra/public/alerting/metric_threshold/components/expression_chart.test.tsx
+++ b/x-pack/plugins/infra/public/alerting/metric_threshold/components/expression_chart.test.tsx
@@ -54,14 +54,6 @@ describe('ExpressionChart', () => {
         metricAlias: 'metricbeat-*',
         inventoryDefaultView: 'host',
         metricsExplorerDefaultView: 'host',
-        // @ts-ignore
-        fields: {
-          timestamp: '@timestamp',
-          container: 'container.id',
-          host: 'host.name',
-          pod: 'kubernetes.pod.uid',
-          tiebreaker: '_doc',
-        },
         anomalyThreshold: 20,
       },
     };
diff --git a/x-pack/plugins/infra/public/components/logging/log_analysis_setup/initial_configuration_step/validation.tsx b/x-pack/plugins/infra/public/components/logging/log_analysis_setup/initial_configuration_step/validation.tsx
index b78a63e61e524..67b3fa164d90c 100644
--- a/x-pack/plugins/infra/public/components/logging/log_analysis_setup/initial_configuration_step/validation.tsx
+++ b/x-pack/plugins/infra/public/components/logging/log_analysis_setup/initial_configuration_step/validation.tsx
@@ -9,7 +9,8 @@ import * as rt from 'io-ts';
 import { ValidationIndicesError, validationIndicesErrorRT } from '../../../../../common/http_api';
 import { DatasetFilter } from '../../../../../common/log_analysis';
 
-export { ValidationIndicesError, validationIndicesErrorRT };
+export type { ValidationIndicesError };
+export { validationIndicesErrorRT };
 
 export const timeRangeValidationErrorRT = rt.strict({
   error: rt.literal('INVALID_TIME_RANGE'),
diff --git a/x-pack/plugins/infra/public/components/logging/log_text_stream/index.ts b/x-pack/plugins/infra/public/components/logging/log_text_stream/index.ts
index c3716d8c97ae1..dbd5bd49d0240 100644
--- a/x-pack/plugins/infra/public/components/logging/log_text_stream/index.ts
+++ b/x-pack/plugins/infra/public/components/logging/log_text_stream/index.ts
@@ -5,12 +5,8 @@
  * 2.0.
  */
 
-export {
-  LogEntryColumn,
-  LogEntryColumnWidths,
-  useColumnWidths,
-  iconColumnId,
-} from './log_entry_column';
+export type { LogEntryColumnWidths } from './log_entry_column';
+export { LogEntryColumn, useColumnWidths, iconColumnId } from './log_entry_column';
 export { LogEntryFieldColumn } from './log_entry_field_column';
 export { LogEntryMessageColumn } from './log_entry_message_column';
 export { LogEntryRowWrapper } from './log_entry_row';
diff --git a/x-pack/plugins/infra/public/containers/logs/log_analysis/api/get_latest_categories_datasets_stats.ts b/x-pack/plugins/infra/public/containers/logs/log_analysis/api/get_latest_categories_datasets_stats.ts
index bfabcdb4af7c1..d715fb9f45194 100644
--- a/x-pack/plugins/infra/public/containers/logs/log_analysis/api/get_latest_categories_datasets_stats.ts
+++ b/x-pack/plugins/infra/public/containers/logs/log_analysis/api/get_latest_categories_datasets_stats.ts
@@ -15,7 +15,7 @@ import {
 } from '../../../../../common/http_api';
 import { decodeOrThrow } from '../../../../../common/runtime_types';
 
-export { LogEntryCategoriesDatasetStats };
+export type { LogEntryCategoriesDatasetStats };
 
 export const callGetLatestCategoriesDatasetsStatsAPI = async (
   {
diff --git a/x-pack/plugins/infra/public/containers/logs/log_analysis/index.ts b/x-pack/plugins/infra/public/containers/logs/log_analysis/index.ts
index 40ac39e3fa22a..5cccbdb78e46e 100644
--- a/x-pack/plugins/infra/public/containers/logs/log_analysis/index.ts
+++ b/x-pack/plugins/infra/public/containers/logs/log_analysis/index.ts
@@ -14,4 +14,4 @@ export * from './log_analysis_module_status';
 export * from './log_analysis_module_types';
 export * from './log_analysis_setup_state';
 
-export { JobModelSizeStats, JobSummary } from './api/ml_get_jobs_summary_api';
+export type { JobModelSizeStats, JobSummary } from './api/ml_get_jobs_summary_api';
diff --git a/x-pack/plugins/infra/public/containers/logs/log_analysis/log_analysis_module_types.ts b/x-pack/plugins/infra/public/containers/logs/log_analysis/log_analysis_module_types.ts
index 4ff8c0c3c08e0..c8ce9a7b0127b 100644
--- a/x-pack/plugins/infra/public/containers/logs/log_analysis/log_analysis_module_types.ts
+++ b/x-pack/plugins/infra/public/containers/logs/log_analysis/log_analysis_module_types.ts
@@ -17,7 +17,7 @@ import { FetchJobStatusResponsePayload } from './api/ml_get_jobs_summary_api';
 import { GetMlModuleResponsePayload } from './api/ml_get_module';
 import { SetupMlModuleResponsePayload } from './api/ml_setup_module_api';
 
-export { JobModelSizeStats, JobSummary } from './api/ml_get_jobs_summary_api';
+export type { JobModelSizeStats, JobSummary } from './api/ml_get_jobs_summary_api';
 
 export interface ModuleDescriptor<JobType extends string> {
   moduleId: string;
diff --git a/x-pack/plugins/infra/public/containers/logs/log_source/log_source.mock.ts b/x-pack/plugins/infra/public/containers/logs/log_source/log_source.mock.ts
index 6021c728d32af..204fae7dc0f2b 100644
--- a/x-pack/plugins/infra/public/containers/logs/log_source/log_source.mock.ts
+++ b/x-pack/plugins/infra/public/containers/logs/log_source/log_source.mock.ts
@@ -73,11 +73,6 @@ export const createBasicSourceConfiguration = (sourceId: string): LogSourceConfi
     },
     logColumns: [],
     fields: {
-      container: 'CONTAINER_FIELD',
-      host: 'HOST_FIELD',
-      pod: 'POD_FIELD',
-      tiebreaker: 'TIEBREAKER_FIELD',
-      timestamp: 'TIMESTAMP_FIELD',
       message: ['MESSAGE_FIELD'],
     },
     name: sourceId,
diff --git a/x-pack/plugins/infra/public/containers/logs/log_source/log_source.ts b/x-pack/plugins/infra/public/containers/logs/log_source/log_source.ts
index 8f744a1d6df6d..54f3f70b98a4b 100644
--- a/x-pack/plugins/infra/public/containers/logs/log_source/log_source.ts
+++ b/x-pack/plugins/infra/public/containers/logs/log_source/log_source.ts
@@ -26,14 +26,14 @@ import { callFetchLogSourceConfigurationAPI } from './api/fetch_log_source_confi
 import { callFetchLogSourceStatusAPI } from './api/fetch_log_source_status';
 import { callPatchLogSourceConfigurationAPI } from './api/patch_log_source_configuration';
 
-export {
+export type {
   LogIndexField,
   LogSourceConfiguration,
   LogSourceConfigurationProperties,
   LogSourceConfigurationPropertiesPatch,
   LogSourceStatus,
-  ResolveLogSourceConfigurationError,
 };
+export { ResolveLogSourceConfigurationError };
 
 export const useLogSource = ({
   sourceId,
diff --git a/x-pack/plugins/infra/public/containers/ml/infra_ml_module.tsx b/x-pack/plugins/infra/public/containers/ml/infra_ml_module.tsx
index 198a99f394850..22376648ca003 100644
--- a/x-pack/plugins/infra/public/containers/ml/infra_ml_module.tsx
+++ b/x-pack/plugins/infra/public/containers/ml/infra_ml_module.tsx
@@ -19,7 +19,7 @@ export const useInfraMLModule = <JobType extends string>({
   moduleDescriptor: ModuleDescriptor<JobType>;
 }) => {
   const { services } = useKibanaContextForPlugin();
-  const { spaceId, sourceId, timestampField } = sourceConfiguration;
+  const { spaceId, sourceId } = sourceConfiguration;
   const [moduleStatus, dispatchModuleStatus] = useModuleStatus(moduleDescriptor.jobTypes);
 
   const [, fetchJobStatus] = useTrackedPromise(
@@ -64,7 +64,6 @@ export const useInfraMLModule = <JobType extends string>({
               indices: selectedIndices,
               sourceId,
               spaceId,
-              timestampField,
             },
             partitionField,
           },
@@ -91,7 +90,7 @@ export const useInfraMLModule = <JobType extends string>({
         dispatchModuleStatus({ type: 'failedSetup' });
       },
     },
-    [moduleDescriptor.setUpModule, spaceId, sourceId, timestampField]
+    [moduleDescriptor.setUpModule, spaceId, sourceId]
   );
 
   const [cleanUpModuleRequest, cleanUpModule] = useTrackedPromise(
diff --git a/x-pack/plugins/infra/public/containers/ml/infra_ml_module_configuration.ts b/x-pack/plugins/infra/public/containers/ml/infra_ml_module_configuration.ts
index 4c876c1705364..c258debdddbca 100644
--- a/x-pack/plugins/infra/public/containers/ml/infra_ml_module_configuration.ts
+++ b/x-pack/plugins/infra/public/containers/ml/infra_ml_module_configuration.ts
@@ -45,8 +45,7 @@ export const isJobConfigurationOutdated =
       isSubset(
         new Set(jobConfiguration.indexPattern.split(',')),
         new Set(currentSourceConfiguration.indices)
-      ) &&
-      jobConfiguration.timestampField === currentSourceConfiguration.timestampField
+      )
     );
   };
 
diff --git a/x-pack/plugins/infra/public/containers/ml/infra_ml_module_types.ts b/x-pack/plugins/infra/public/containers/ml/infra_ml_module_types.ts
index 5a5272f783053..9b172a7c82a98 100644
--- a/x-pack/plugins/infra/public/containers/ml/infra_ml_module_types.ts
+++ b/x-pack/plugins/infra/public/containers/ml/infra_ml_module_types.ts
@@ -15,7 +15,7 @@ import { FetchJobStatusResponsePayload } from './api/ml_get_jobs_summary_api';
 import { GetMlModuleResponsePayload } from './api/ml_get_module';
 import { SetupMlModuleResponsePayload } from './api/ml_setup_module_api';
 
-export { JobModelSizeStats, JobSummary } from './api/ml_get_jobs_summary_api';
+export type { JobModelSizeStats, JobSummary } from './api/ml_get_jobs_summary_api';
 
 export interface SetUpModuleArgs {
   start?: number | undefined;
@@ -49,12 +49,10 @@ export interface ModuleDescriptor<JobType extends string> {
   ) => Promise<DeleteJobsResponsePayload>;
   validateSetupIndices?: (
     indices: string[],
-    timestampField: string,
     fetch: HttpHandler
   ) => Promise<ValidationIndicesResponsePayload>;
   validateSetupDatasets?: (
     indices: string[],
-    timestampField: string,
     startTime: number,
     endTime: number,
     fetch: HttpHandler
@@ -65,7 +63,6 @@ export interface ModuleSourceConfiguration {
   indices: string[];
   sourceId: string;
   spaceId: string;
-  timestampField: string;
 }
 
 interface ManyCategoriesWarningReason {
diff --git a/x-pack/plugins/infra/public/containers/ml/modules/metrics_hosts/module.tsx b/x-pack/plugins/infra/public/containers/ml/modules/metrics_hosts/module.tsx
index f892ab62ee3d8..f200ab22c043f 100644
--- a/x-pack/plugins/infra/public/containers/ml/modules/metrics_hosts/module.tsx
+++ b/x-pack/plugins/infra/public/containers/ml/modules/metrics_hosts/module.tsx
@@ -17,21 +17,18 @@ export const useMetricHostsModule = ({
   indexPattern,
   sourceId,
   spaceId,
-  timestampField,
 }: {
   indexPattern: string;
   sourceId: string;
   spaceId: string;
-  timestampField: string;
 }) => {
   const sourceConfiguration: ModuleSourceConfiguration = useMemo(
     () => ({
       indices: indexPattern.split(','),
       sourceId,
       spaceId,
-      timestampField,
     }),
-    [indexPattern, sourceId, spaceId, timestampField]
+    [indexPattern, sourceId, spaceId]
   );
 
   const infraMLModule = useInfraMLModule({
diff --git a/x-pack/plugins/infra/public/containers/ml/modules/metrics_hosts/module_descriptor.ts b/x-pack/plugins/infra/public/containers/ml/modules/metrics_hosts/module_descriptor.ts
index a7ab948d052aa..f87cd78f4ff34 100644
--- a/x-pack/plugins/infra/public/containers/ml/modules/metrics_hosts/module_descriptor.ts
+++ b/x-pack/plugins/infra/public/containers/ml/modules/metrics_hosts/module_descriptor.ts
@@ -18,6 +18,7 @@ import {
   MetricsHostsJobType,
   bucketSpan,
 } from '../../../../../common/infra_ml';
+import { TIMESTAMP_FIELD } from '../../../../../common/constants';
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import MemoryJob from '../../../../../../ml/server/models/data_recognizer/modules/metrics_ui_hosts/ml/hosts_memory_usage.json';
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
@@ -68,7 +69,7 @@ const setUpModule = async (setUpModuleArgs: SetUpModuleArgs, fetch: HttpHandler)
     start,
     end,
     filter,
-    moduleSourceConfiguration: { spaceId, sourceId, indices, timestampField },
+    moduleSourceConfiguration: { spaceId, sourceId, indices },
     partitionField,
   } = setUpModuleArgs;
 
@@ -93,13 +94,13 @@ const setUpModule = async (setUpModuleArgs: SetUpModuleArgs, fetch: HttpHandler)
     return {
       job_id: id,
       data_description: {
-        time_field: timestampField,
+        time_field: TIMESTAMP_FIELD,
       },
       analysis_config,
       custom_settings: {
         metrics_source_config: {
           indexPattern: indexNamePattern,
-          timestampField,
+          timestampField: TIMESTAMP_FIELD,
           bucketSpan,
         },
       },
diff --git a/x-pack/plugins/infra/public/containers/ml/modules/metrics_k8s/module.tsx b/x-pack/plugins/infra/public/containers/ml/modules/metrics_k8s/module.tsx
index eadc374434817..08f4f49058dbe 100644
--- a/x-pack/plugins/infra/public/containers/ml/modules/metrics_k8s/module.tsx
+++ b/x-pack/plugins/infra/public/containers/ml/modules/metrics_k8s/module.tsx
@@ -17,21 +17,18 @@ export const useMetricK8sModule = ({
   indexPattern,
   sourceId,
   spaceId,
-  timestampField,
 }: {
   indexPattern: string;
   sourceId: string;
   spaceId: string;
-  timestampField: string;
 }) => {
   const sourceConfiguration: ModuleSourceConfiguration = useMemo(
     () => ({
       indices: indexPattern.split(','),
       sourceId,
       spaceId,
-      timestampField,
     }),
-    [indexPattern, sourceId, spaceId, timestampField]
+    [indexPattern, sourceId, spaceId]
   );
 
   const infraMLModule = useInfraMLModule({
diff --git a/x-pack/plugins/infra/public/containers/ml/modules/metrics_k8s/module_descriptor.ts b/x-pack/plugins/infra/public/containers/ml/modules/metrics_k8s/module_descriptor.ts
index 4c5eb5fd4bf23..388a7dd0a5656 100644
--- a/x-pack/plugins/infra/public/containers/ml/modules/metrics_k8s/module_descriptor.ts
+++ b/x-pack/plugins/infra/public/containers/ml/modules/metrics_k8s/module_descriptor.ts
@@ -18,6 +18,7 @@ import {
   MetricK8sJobType,
   bucketSpan,
 } from '../../../../../common/infra_ml';
+import { TIMESTAMP_FIELD } from '../../../../../common/constants';
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import MemoryJob from '../../../../../../ml/server/models/data_recognizer/modules/metrics_ui_k8s/ml/k8s_memory_usage.json';
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
@@ -69,7 +70,7 @@ const setUpModule = async (setUpModuleArgs: SetUpModuleArgs, fetch: HttpHandler)
     start,
     end,
     filter,
-    moduleSourceConfiguration: { spaceId, sourceId, indices, timestampField },
+    moduleSourceConfiguration: { spaceId, sourceId, indices },
     partitionField,
   } = setUpModuleArgs;
 
@@ -93,13 +94,13 @@ const setUpModule = async (setUpModuleArgs: SetUpModuleArgs, fetch: HttpHandler)
     return {
       job_id: id,
       data_description: {
-        time_field: timestampField,
+        time_field: TIMESTAMP_FIELD,
       },
       analysis_config,
       custom_settings: {
         metrics_source_config: {
           indexPattern: indexNamePattern,
-          timestampField,
+          timestampField: TIMESTAMP_FIELD,
           bucketSpan,
         },
       },
diff --git a/x-pack/plugins/infra/public/lib/lib.ts b/x-pack/plugins/infra/public/lib/lib.ts
index 97a3f8eabbe4e..a37a9af7d9320 100644
--- a/x-pack/plugins/infra/public/lib/lib.ts
+++ b/x-pack/plugins/infra/public/lib/lib.ts
@@ -14,7 +14,6 @@ import {
   SnapshotNodeMetric,
   SnapshotNodePath,
 } from '../../common/http_api/snapshot_api';
-import { MetricsSourceConfigurationProperties } from '../../common/metrics_sources';
 import { WaffleSortOption } from '../pages/metrics/inventory_view/hooks/use_waffle_options';
 
 export interface InfraWaffleMapNode {
@@ -124,7 +123,6 @@ export enum InfraWaffleMapRuleOperator {
 }
 
 export interface InfraWaffleMapOptions {
-  fields?: Omit<MetricsSourceConfigurationProperties['fields'], 'message'> | null;
   formatter: InfraFormatterType;
   formatTemplate: string;
   metric: SnapshotMetricInput;
diff --git a/x-pack/plugins/infra/public/pages/link_to/link_to_logs.test.tsx b/x-pack/plugins/infra/public/pages/link_to/link_to_logs.test.tsx
index f9c80edd2c199..cfcf8db771b78 100644
--- a/x-pack/plugins/infra/public/pages/link_to/link_to_logs.test.tsx
+++ b/x-pack/plugins/infra/public/pages/link_to/link_to_logs.test.tsx
@@ -151,7 +151,7 @@ describe('LinkToLogsPage component', () => {
       const searchParams = new URLSearchParams(history.location.search);
       expect(searchParams.get('sourceId')).toEqual('default');
       expect(searchParams.get('logFilter')).toMatchInlineSnapshot(
-        `"(language:kuery,query:'HOST_FIELD: HOST_NAME')"`
+        `"(language:kuery,query:'host.name: HOST_NAME')"`
       );
       expect(searchParams.get('logPosition')).toEqual(null);
     });
@@ -172,7 +172,7 @@ describe('LinkToLogsPage component', () => {
       const searchParams = new URLSearchParams(history.location.search);
       expect(searchParams.get('sourceId')).toEqual('default');
       expect(searchParams.get('logFilter')).toMatchInlineSnapshot(
-        `"(language:kuery,query:'(HOST_FIELD: HOST_NAME) and (FILTER_FIELD:FILTER_VALUE)')"`
+        `"(language:kuery,query:'(host.name: HOST_NAME) and (FILTER_FIELD:FILTER_VALUE)')"`
       );
       expect(searchParams.get('logPosition')).toMatchInlineSnapshot(
         `"(end:'2019-02-20T14:58:09.404Z',position:(tiebreaker:0,time:1550671089404),start:'2019-02-20T12:58:09.404Z',streamLive:!f)"`
@@ -193,7 +193,7 @@ describe('LinkToLogsPage component', () => {
       const searchParams = new URLSearchParams(history.location.search);
       expect(searchParams.get('sourceId')).toEqual('OTHER_SOURCE');
       expect(searchParams.get('logFilter')).toMatchInlineSnapshot(
-        `"(language:kuery,query:'HOST_FIELD: HOST_NAME')"`
+        `"(language:kuery,query:'host.name: HOST_NAME')"`
       );
       expect(searchParams.get('logPosition')).toEqual(null);
     });
@@ -229,7 +229,7 @@ describe('LinkToLogsPage component', () => {
       const searchParams = new URLSearchParams(history.location.search);
       expect(searchParams.get('sourceId')).toEqual('default');
       expect(searchParams.get('logFilter')).toMatchInlineSnapshot(
-        `"(language:kuery,query:'CONTAINER_FIELD: CONTAINER_ID')"`
+        `"(language:kuery,query:'container.id: CONTAINER_ID')"`
       );
       expect(searchParams.get('logPosition')).toEqual(null);
     });
@@ -250,7 +250,7 @@ describe('LinkToLogsPage component', () => {
       const searchParams = new URLSearchParams(history.location.search);
       expect(searchParams.get('sourceId')).toEqual('default');
       expect(searchParams.get('logFilter')).toMatchInlineSnapshot(
-        `"(language:kuery,query:'(CONTAINER_FIELD: CONTAINER_ID) and (FILTER_FIELD:FILTER_VALUE)')"`
+        `"(language:kuery,query:'(container.id: CONTAINER_ID) and (FILTER_FIELD:FILTER_VALUE)')"`
       );
       expect(searchParams.get('logPosition')).toMatchInlineSnapshot(
         `"(end:'2019-02-20T14:58:09.404Z',position:(tiebreaker:0,time:1550671089404),start:'2019-02-20T12:58:09.404Z',streamLive:!f)"`
@@ -287,7 +287,7 @@ describe('LinkToLogsPage component', () => {
       const searchParams = new URLSearchParams(history.location.search);
       expect(searchParams.get('sourceId')).toEqual('default');
       expect(searchParams.get('logFilter')).toMatchInlineSnapshot(
-        `"(language:kuery,query:'POD_FIELD: POD_UID')"`
+        `"(language:kuery,query:'kubernetes.pod.uid: POD_UID')"`
       );
       expect(searchParams.get('logPosition')).toEqual(null);
     });
@@ -306,7 +306,7 @@ describe('LinkToLogsPage component', () => {
       const searchParams = new URLSearchParams(history.location.search);
       expect(searchParams.get('sourceId')).toEqual('default');
       expect(searchParams.get('logFilter')).toMatchInlineSnapshot(
-        `"(language:kuery,query:'(POD_FIELD: POD_UID) and (FILTER_FIELD:FILTER_VALUE)')"`
+        `"(language:kuery,query:'(kubernetes.pod.uid: POD_UID) and (FILTER_FIELD:FILTER_VALUE)')"`
       );
       expect(searchParams.get('logPosition')).toMatchInlineSnapshot(
         `"(end:'2019-02-20T14:58:09.404Z',position:(tiebreaker:0,time:1550671089404),start:'2019-02-20T12:58:09.404Z',streamLive:!f)"`
diff --git a/x-pack/plugins/infra/public/pages/link_to/redirect_to_node_logs.tsx b/x-pack/plugins/infra/public/pages/link_to/redirect_to_node_logs.tsx
index bc8c5699229d8..a8d339cfe979a 100644
--- a/x-pack/plugins/infra/public/pages/link_to/redirect_to_node_logs.tsx
+++ b/x-pack/plugins/infra/public/pages/link_to/redirect_to_node_logs.tsx
@@ -34,12 +34,11 @@ export const RedirectToNodeLogs = ({
   location,
 }: RedirectToNodeLogsType) => {
   const { services } = useKibanaContextForPlugin();
-  const { isLoading, loadSource, sourceConfiguration } = useLogSource({
+  const { isLoading, loadSource } = useLogSource({
     fetch: services.http.fetch,
     sourceId,
     indexPatternsService: services.data.indexPatterns,
   });
-  const fields = sourceConfiguration?.configuration.fields;
 
   useMount(() => {
     loadSource();
@@ -57,11 +56,9 @@ export const RedirectToNodeLogs = ({
         })}
       />
     );
-  } else if (fields == null) {
-    return null;
   }
 
-  const nodeFilter = `${findInventoryFields(nodeType, fields).id}: ${nodeId}`;
+  const nodeFilter = `${findInventoryFields(nodeType).id}: ${nodeId}`;
   const userFilter = getFilterFromLocation(location);
   const filter = userFilter ? `(${nodeFilter}) and (${userFilter})` : nodeFilter;
 
diff --git a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/layout.tsx b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/layout.tsx
index de0a56c5be73d..f46a379f52d50 100644
--- a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/layout.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/layout.tsx
@@ -18,7 +18,6 @@ import { PageContent } from '../../../../components/page';
 import { useWaffleTimeContext } from '../hooks/use_waffle_time';
 import { useWaffleFiltersContext } from '../hooks/use_waffle_filters';
 import { DEFAULT_LEGEND, useWaffleOptionsContext } from '../hooks/use_waffle_options';
-import { useSourceContext } from '../../../../containers/metrics_source';
 import { InfraFormatterType } from '../../../../lib/lib';
 import { euiStyled } from '../../../../../../../../src/plugins/kibana_react/common';
 import { Toolbar } from './toolbars/toolbar';
@@ -41,7 +40,6 @@ interface Props {
 export const Layout = React.memo(
   ({ shouldLoadDefault, currentView, reload, interval, nodes, loading }: Props) => {
     const [showLoading, setShowLoading] = useState(true);
-    const { source } = useSourceContext();
     const {
       metric,
       groupBy,
@@ -65,7 +63,6 @@ export const Layout = React.memo(
       legend: createLegend(legendPalette, legendSteps, legendReverseColors),
       metric,
       sort,
-      fields: source?.configuration?.fields,
       groupBy,
     };
 
diff --git a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/ml/anomaly_detection/anomaly_detection_flyout.tsx b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/ml/anomaly_detection/anomaly_detection_flyout.tsx
index 4e28fb4202bdc..1fcec291fcc29 100644
--- a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/ml/anomaly_detection/anomaly_detection_flyout.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/ml/anomaly_detection/anomaly_detection_flyout.tsx
@@ -67,13 +67,11 @@ export const AnomalyDetectionFlyout = () => {
           indexPattern={source?.configuration.metricAlias ?? ''}
           sourceId={'default'}
           spaceId={space.id}
-          timestampField={source?.configuration.fields.timestamp ?? ''}
         >
           <MetricK8sModuleProvider
             indexPattern={source?.configuration.metricAlias ?? ''}
             sourceId={'default'}
             spaceId={space.id}
-            timestampField={source?.configuration.fields.timestamp ?? ''}
           >
             <EuiFlyout onClose={closeFlyout} data-test-subj="loadMLFlyout">
               {screenName === 'home' && (
diff --git a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/node_details/tabs/logs.tsx b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/node_details/tabs/logs.tsx
index b792078c394e9..8b5224068589c 100644
--- a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/node_details/tabs/logs.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/node_details/tabs/logs.tsx
@@ -25,15 +25,13 @@ const TabComponent = (props: TabProps) => {
   const endTimestamp = props.currentTime;
   const startTimestamp = endTimestamp - 60 * 60 * 1000; // 60 minutes
   const { nodeType } = useWaffleOptionsContext();
-  const { options, node } = props;
+  const { node } = props;
 
   const throttledTextQuery = useThrottle(textQuery, textQueryThrottleInterval);
 
   const filter = useMemo(() => {
     const query = [
-      ...(options.fields != null
-        ? [`${findInventoryFields(nodeType, options.fields).id}: "${node.id}"`]
-        : []),
+      `${findInventoryFields(nodeType).id}: "${node.id}"`,
       ...(throttledTextQuery !== '' ? [throttledTextQuery] : []),
     ].join(' and ');
 
@@ -41,7 +39,7 @@ const TabComponent = (props: TabProps) => {
       language: 'kuery',
       query,
     };
-  }, [options.fields, nodeType, node.id, throttledTextQuery]);
+  }, [nodeType, node.id, throttledTextQuery]);
 
   const onQueryChange = useCallback((e: React.ChangeEvent<HTMLInputElement>) => {
     setTextQuery(e.target.value);
diff --git a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/node_details/tabs/metrics/metrics.tsx b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/node_details/tabs/metrics/metrics.tsx
index fbb8bd469c1e1..7ff4720aec01e 100644
--- a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/node_details/tabs/metrics/metrics.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/node_details/tabs/metrics/metrics.tsx
@@ -71,14 +71,12 @@ const TabComponent = (props: TabProps) => {
   ]);
   const { sourceId, createDerivedIndexPattern } = useSourceContext();
   const { nodeType, accountId, region, customMetrics } = useWaffleOptionsContext();
-  const { currentTime, options, node } = props;
+  const { currentTime, node } = props;
   const derivedIndexPattern = useMemo(
     () => createDerivedIndexPattern('metrics'),
     [createDerivedIndexPattern]
   );
-  let filter = options.fields
-    ? `${findInventoryFields(nodeType, options.fields).id}: "${node.id}"`
-    : '';
+  let filter = `${findInventoryFields(nodeType).id}: "${node.id}"`;
 
   if (filter) {
     filter = convertKueryToElasticSearchQuery(filter, derivedIndexPattern);
diff --git a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/node_details/tabs/processes/index.tsx b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/node_details/tabs/processes/index.tsx
index c227a31edc4ab..2bed7681b8d56 100644
--- a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/node_details/tabs/processes/index.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/node_details/tabs/processes/index.tsx
@@ -17,6 +17,7 @@ import {
   EuiIconTip,
   Query,
 } from '@elastic/eui';
+import { getFieldByType } from '../../../../../../../../common/inventory_models';
 import {
   useProcessList,
   SortBy,
@@ -28,7 +29,7 @@ import { SummaryTable } from './summary_table';
 import { ProcessesTable } from './processes_table';
 import { parseSearchString } from './parse_search_string';
 
-const TabComponent = ({ currentTime, node, nodeType, options }: TabProps) => {
+const TabComponent = ({ currentTime, node, nodeType }: TabProps) => {
   const [searchBarState, setSearchBarState] = useState<Query>(Query.MATCH_ALL);
   const [searchFilter, setSearchFilter] = useState<string>('');
   const [sortBy, setSortBy] = useState<SortBy>({
@@ -36,22 +37,17 @@ const TabComponent = ({ currentTime, node, nodeType, options }: TabProps) => {
     isAscending: false,
   });
 
-  const timefield = options.fields!.timestamp;
-
   const hostTerm = useMemo(() => {
-    const field =
-      options.fields && Reflect.has(options.fields, nodeType)
-        ? Reflect.get(options.fields, nodeType)
-        : nodeType;
+    const field = getFieldByType(nodeType) ?? nodeType;
     return { [field]: node.name };
-  }, [options, node, nodeType]);
+  }, [node, nodeType]);
 
   const {
     loading,
     error,
     response,
     makeRequest: reload,
-  } = useProcessList(hostTerm, timefield, currentTime, sortBy, parseSearchString(searchFilter));
+  } = useProcessList(hostTerm, currentTime, sortBy, parseSearchString(searchFilter));
 
   const debouncedSearchOnChange = useMemo(
     () => debounce<(queryText: string) => void>((queryText) => setSearchFilter(queryText), 500),
@@ -73,7 +69,7 @@ const TabComponent = ({ currentTime, node, nodeType, options }: TabProps) => {
 
   return (
     <TabContent>
-      <ProcessListContextProvider hostTerm={hostTerm} to={currentTime} timefield={timefield}>
+      <ProcessListContextProvider hostTerm={hostTerm} to={currentTime}>
         <SummaryTable
           isLoading={loading}
           processSummary={(!error ? response?.summary : null) ?? { total: 0 }}
diff --git a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/node.tsx b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/node.tsx
index 031b826265e16..489e862b74c99 100644
--- a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/node.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/node.tsx
@@ -124,11 +124,7 @@ export class Node extends React.PureComponent<Props, State> {
 
         {isAlertFlyoutVisible && (
           <AlertFlyout
-            filter={
-              options.fields
-                ? `${findInventoryFields(nodeType, options.fields).id}: "${node.id}"`
-                : ''
-            }
+            filter={`${findInventoryFields(nodeType).id}: "${node.id}"`}
             options={options}
             nodeType={nodeType}
             setVisible={this.setAlertFlyoutVisible}
diff --git a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/node_context_menu.tsx b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/node_context_menu.tsx
index 46534f278fd45..0d7741ca5477e 100644
--- a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/node_context_menu.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/waffle/node_context_menu.tsx
@@ -64,16 +64,14 @@ export const NodeContextMenu: React.FC<Props & { theme?: EuiTheme }> = withTheme
           return { label: <EuiCode>host.ip</EuiCode>, value: node.ip };
         }
       } else {
-        if (options.fields) {
-          const { id } = findInventoryFields(nodeType, options.fields);
-          return {
-            label: <EuiCode>{id}</EuiCode>,
-            value: node.id,
-          };
-        }
+        const { id } = findInventoryFields(nodeType);
+        return {
+          label: <EuiCode>{id}</EuiCode>,
+          value: node.id,
+        };
       }
       return { label: '', value: '' };
-    }, [nodeType, node.ip, node.id, options.fields]);
+    }, [nodeType, node.ip, node.id]);
 
     const nodeLogsMenuItemLinkProps = useLinkProps(
       getNodeLogsUrl({
@@ -184,11 +182,7 @@ export const NodeContextMenu: React.FC<Props & { theme?: EuiTheme }> = withTheme
 
         {flyoutVisible && (
           <AlertFlyout
-            filter={
-              options.fields
-                ? `${findInventoryFields(nodeType, options.fields).id}: "${node.id}"`
-                : ''
-            }
+            filter={`${findInventoryFields(nodeType).id}: "${node.id}"`}
             options={options}
             nodeType={nodeType}
             setVisible={setFlyoutVisible}
diff --git a/x-pack/plugins/infra/public/pages/metrics/inventory_view/hooks/use_process_list.ts b/x-pack/plugins/infra/public/pages/metrics/inventory_view/hooks/use_process_list.ts
index e74abb2ecc459..c653bb701eda0 100644
--- a/x-pack/plugins/infra/public/pages/metrics/inventory_view/hooks/use_process_list.ts
+++ b/x-pack/plugins/infra/public/pages/metrics/inventory_view/hooks/use_process_list.ts
@@ -22,7 +22,6 @@ export interface SortBy {
 
 export function useProcessList(
   hostTerm: Record<string, string>,
-  timefield: string,
   to: number,
   sortBy: SortBy,
   searchFilter: object
@@ -51,7 +50,6 @@ export function useProcessList(
     'POST',
     JSON.stringify({
       hostTerm,
-      timefield,
       indexPattern,
       to,
       sortBy: parsedSortBy,
@@ -75,15 +73,11 @@ export function useProcessList(
   };
 }
 
-function useProcessListParams(props: {
-  hostTerm: Record<string, string>;
-  timefield: string;
-  to: number;
-}) {
-  const { hostTerm, timefield, to } = props;
+function useProcessListParams(props: { hostTerm: Record<string, string>; to: number }) {
+  const { hostTerm, to } = props;
   const { createDerivedIndexPattern } = useSourceContext();
   const indexPattern = createDerivedIndexPattern('metrics').title;
-  return { hostTerm, indexPattern, timefield, to };
+  return { hostTerm, indexPattern, to };
 }
 const ProcessListContext = createContainter(useProcessListParams);
 export const [ProcessListContextProvider, useProcessListContext] = ProcessListContext;
diff --git a/x-pack/plugins/infra/public/pages/metrics/inventory_view/hooks/use_process_list_row_chart.ts b/x-pack/plugins/infra/public/pages/metrics/inventory_view/hooks/use_process_list_row_chart.ts
index 30d4e5960ba5e..0d718ffbe210c 100644
--- a/x-pack/plugins/infra/public/pages/metrics/inventory_view/hooks/use_process_list_row_chart.ts
+++ b/x-pack/plugins/infra/public/pages/metrics/inventory_view/hooks/use_process_list_row_chart.ts
@@ -25,14 +25,13 @@ export function useProcessListRowChart(command: string) {
       fold(throwErrors(createPlainError), identity)
     );
   };
-  const { hostTerm, timefield, indexPattern, to } = useProcessListContext();
+  const { hostTerm, indexPattern, to } = useProcessListContext();
 
   const { error, loading, response, makeRequest } = useHTTPRequest<ProcessListAPIChartResponse>(
     '/api/metrics/process_list/chart',
     'POST',
     JSON.stringify({
       hostTerm,
-      timefield,
       indexPattern,
       to,
       command,
diff --git a/x-pack/plugins/infra/public/pages/metrics/inventory_view/lib/create_uptime_link.test.ts b/x-pack/plugins/infra/public/pages/metrics/inventory_view/lib/create_uptime_link.test.ts
index dbe45a387891c..af93f6c0d62ce 100644
--- a/x-pack/plugins/infra/public/pages/metrics/inventory_view/lib/create_uptime_link.test.ts
+++ b/x-pack/plugins/infra/public/pages/metrics/inventory_view/lib/create_uptime_link.test.ts
@@ -10,13 +10,6 @@ import { InfraWaffleMapOptions, InfraFormatterType } from '../../../../lib/lib';
 import { SnapshotMetricType } from '../../../../../common/inventory_models/types';
 
 const options: InfraWaffleMapOptions = {
-  fields: {
-    container: 'container.id',
-    pod: 'kubernetes.pod.uid',
-    host: 'host.name',
-    timestamp: '@timestanp',
-    tiebreaker: '@timestamp',
-  },
   formatter: InfraFormatterType.percent,
   formatTemplate: '{{value}}',
   metric: { type: 'cpu' },
diff --git a/x-pack/plugins/infra/public/pages/metrics/inventory_view/lib/create_uptime_link.ts b/x-pack/plugins/infra/public/pages/metrics/inventory_view/lib/create_uptime_link.ts
index 5c02893b867de..b6fa4fe4273ab 100644
--- a/x-pack/plugins/infra/public/pages/metrics/inventory_view/lib/create_uptime_link.ts
+++ b/x-pack/plugins/infra/public/pages/metrics/inventory_view/lib/create_uptime_link.ts
@@ -5,9 +5,9 @@
  * 2.0.
  */
 
-import { get } from 'lodash';
 import { InfraWaffleMapNode, InfraWaffleMapOptions } from '../../../../lib/lib';
 import { InventoryItemType } from '../../../../../common/inventory_models/types';
+import { getFieldByType } from '../../../../../common/inventory_models';
 import { LinkDescriptor } from '../../../../hooks/use_link_props';
 
 export const createUptimeLink = (
@@ -24,7 +24,7 @@ export const createUptimeLink = (
       },
     };
   }
-  const field = get(options, ['fields', nodeType], '');
+  const field = getFieldByType(nodeType);
   return {
     app: 'uptime',
     hash: '/',
diff --git a/x-pack/plugins/infra/public/pages/metrics/metric_detail/lib/get_filtered_metrics.ts b/x-pack/plugins/infra/public/pages/metrics/metric_detail/lib/get_filtered_metrics.ts
index 2339319926da8..d1ba4502f37c3 100644
--- a/x-pack/plugins/infra/public/pages/metrics/metric_detail/lib/get_filtered_metrics.ts
+++ b/x-pack/plugins/infra/public/pages/metrics/metric_detail/lib/get_filtered_metrics.ts
@@ -8,6 +8,7 @@
 import { InfraMetadataFeature } from '../../../../../common/http_api/metadata_api';
 import { InventoryMetric } from '../../../../../common/inventory_models/types';
 import { metrics } from '../../../../../common/inventory_models/metrics';
+import { TIMESTAMP_FIELD } from '../../../../../common/constants';
 
 export const getFilteredMetrics = (
   requiredMetrics: InventoryMetric[],
@@ -20,7 +21,7 @@ export const getFilteredMetrics = (
     const metricModelCreator = metrics.tsvb[metric];
     // We just need to get a dummy version of the model so we can filter
     // using the `requires` attribute.
-    const metricModel = metricModelCreator('@timestamp', 'test', '>=1m');
+    const metricModel = metricModelCreator(TIMESTAMP_FIELD, 'test', '>=1m');
     return metricMetadata.some((m) => m && metricModel.requires.includes(m));
   });
 };
diff --git a/x-pack/plugins/infra/public/pages/metrics/metrics_explorer/components/chart_context_menu.tsx b/x-pack/plugins/infra/public/pages/metrics/metrics_explorer/components/chart_context_menu.tsx
index 005dd5cc8c078..581eec3e824ae 100644
--- a/x-pack/plugins/infra/public/pages/metrics/metrics_explorer/components/chart_context_menu.tsx
+++ b/x-pack/plugins/infra/public/pages/metrics/metrics_explorer/components/chart_context_menu.tsx
@@ -27,6 +27,7 @@ import {
 import { createTSVBLink } from './helpers/create_tsvb_link';
 import { getNodeDetailUrl } from '../../../link_to/redirect_to_node_detail';
 import { InventoryItemType } from '../../../../../common/inventory_models/types';
+import { HOST_FIELD, POD_FIELD, CONTAINER_FIELD } from '../../../../../common/constants';
 import { useLinkProps } from '../../../../hooks/use_link_props';
 
 export interface Props {
@@ -44,13 +45,13 @@ const fieldToNodeType = (
   groupBy: string | string[]
 ): InventoryItemType | undefined => {
   const fields = Array.isArray(groupBy) ? groupBy : [groupBy];
-  if (fields.includes(source.fields.host)) {
+  if (fields.includes(HOST_FIELD)) {
     return 'host';
   }
-  if (fields.includes(source.fields.pod)) {
+  if (fields.includes(POD_FIELD)) {
     return 'pod';
   }
-  if (fields.includes(source.fields.container)) {
+  if (fields.includes(CONTAINER_FIELD)) {
     return 'container';
   }
 };
diff --git a/x-pack/plugins/infra/public/pages/metrics/metrics_explorer/components/helpers/create_tsvb_link.test.ts b/x-pack/plugins/infra/public/pages/metrics/metrics_explorer/components/helpers/create_tsvb_link.test.ts
index a9e65bc30a3c6..472e86200cba3 100644
--- a/x-pack/plugins/infra/public/pages/metrics/metrics_explorer/components/helpers/create_tsvb_link.test.ts
+++ b/x-pack/plugins/infra/public/pages/metrics/metrics_explorer/components/helpers/create_tsvb_link.test.ts
@@ -79,7 +79,7 @@ describe('createTSVBLink()', () => {
       app: 'visualize',
       hash: '/create',
       search: {
-        _a: "(filters:!(),linked:!f,query:(language:kuery,query:''),uiState:(),vis:(aggs:!(),params:(axis_formatter:number,axis_min:0,axis_position:left,axis_scale:normal,default_index_pattern:'my-beats-*',filter:(language:kuery,query:'host.name : \"example-01\"'),id:test-id,index_pattern:'my-beats-*',interval:auto,series:!((axis_position:right,chart_type:line,color:#6092C0,fill:0,formatter:percent,id:test-id,label:'avg(system.cpu.user.pct)',line_width:2,metrics:!((field:system.cpu.user.pct,id:test-id,type:avg)),point_size:0,separate_axis:0,split_mode:everything,stacked:none,value_template:{{value}})),show_grid:1,show_legend:1,time_field:time,type:timeseries),title:example-01,type:metrics))",
+        _a: "(filters:!(),linked:!f,query:(language:kuery,query:''),uiState:(),vis:(aggs:!(),params:(axis_formatter:number,axis_min:0,axis_position:left,axis_scale:normal,default_index_pattern:'my-beats-*',filter:(language:kuery,query:'host.name : \"example-01\"'),id:test-id,index_pattern:'my-beats-*',interval:auto,series:!((axis_position:right,chart_type:line,color:#6092C0,fill:0,formatter:percent,id:test-id,label:'avg(system.cpu.user.pct)',line_width:2,metrics:!((field:system.cpu.user.pct,id:test-id,type:avg)),point_size:0,separate_axis:0,split_mode:everything,stacked:none,value_template:{{value}})),show_grid:1,show_legend:1,time_field:'@timestamp',type:timeseries),title:example-01,type:metrics))",
         _g: '(refreshInterval:(pause:!t,value:0),time:(from:now-1h,to:now))',
         type: 'metrics',
       },
@@ -97,7 +97,7 @@ describe('createTSVBLink()', () => {
       app: 'visualize',
       hash: '/create',
       search: {
-        _a: "(filters:!(),linked:!f,query:(language:kuery,query:''),uiState:(),vis:(aggs:!(),params:(axis_formatter:number,axis_min:0,axis_position:left,axis_scale:normal,default_index_pattern:'my-beats-*',filter:(language:kuery,query:'system.network.name:lo* and host.name : \"example-01\"'),id:test-id,index_pattern:'my-beats-*',interval:auto,series:!((axis_position:right,chart_type:line,color:#6092C0,fill:0,formatter:percent,id:test-id,label:'avg(system.cpu.user.pct)',line_width:2,metrics:!((field:system.cpu.user.pct,id:test-id,type:avg)),point_size:0,separate_axis:0,split_mode:everything,stacked:none,value_template:{{value}})),show_grid:1,show_legend:1,time_field:time,type:timeseries),title:example-01,type:metrics))",
+        _a: "(filters:!(),linked:!f,query:(language:kuery,query:''),uiState:(),vis:(aggs:!(),params:(axis_formatter:number,axis_min:0,axis_position:left,axis_scale:normal,default_index_pattern:'my-beats-*',filter:(language:kuery,query:'system.network.name:lo* and host.name : \"example-01\"'),id:test-id,index_pattern:'my-beats-*',interval:auto,series:!((axis_position:right,chart_type:line,color:#6092C0,fill:0,formatter:percent,id:test-id,label:'avg(system.cpu.user.pct)',line_width:2,metrics:!((field:system.cpu.user.pct,id:test-id,type:avg)),point_size:0,separate_axis:0,split_mode:everything,stacked:none,value_template:{{value}})),show_grid:1,show_legend:1,time_field:'@timestamp',type:timeseries),title:example-01,type:metrics))",
         _g: '(refreshInterval:(pause:!t,value:0),time:(from:now-1h,to:now))',
         type: 'metrics',
       },
@@ -161,7 +161,7 @@ describe('createTSVBLink()', () => {
       app: 'visualize',
       hash: '/create',
       search: {
-        _a: "(filters:!(),linked:!f,query:(language:kuery,query:''),uiState:(),vis:(aggs:!(),params:(axis_formatter:number,axis_min:0,axis_position:left,axis_scale:normal,default_index_pattern:'metric*',filter:(language:kuery,query:'host.name : \"example-01\"'),id:test-id,index_pattern:'metric*',interval:auto,series:!((axis_position:right,chart_type:line,color:#6092C0,fill:0,formatter:percent,id:test-id,label:'avg(system.cpu.user.pct)',line_width:2,metrics:!((field:system.cpu.user.pct,id:test-id,type:avg)),point_size:0,separate_axis:0,split_mode:everything,stacked:none,value_template:{{value}})),show_grid:1,show_legend:1,time_field:time,type:timeseries),title:example-01,type:metrics))",
+        _a: "(filters:!(),linked:!f,query:(language:kuery,query:''),uiState:(),vis:(aggs:!(),params:(axis_formatter:number,axis_min:0,axis_position:left,axis_scale:normal,default_index_pattern:'metric*',filter:(language:kuery,query:'host.name : \"example-01\"'),id:test-id,index_pattern:'metric*',interval:auto,series:!((axis_position:right,chart_type:line,color:#6092C0,fill:0,formatter:percent,id:test-id,label:'avg(system.cpu.user.pct)',line_width:2,metrics:!((field:system.cpu.user.pct,id:test-id,type:avg)),point_size:0,separate_axis:0,split_mode:everything,stacked:none,value_template:{{value}})),show_grid:1,show_legend:1,time_field:'@timestamp',type:timeseries),title:example-01,type:metrics))",
         _g: '(refreshInterval:(pause:!t,value:0),time:(from:now-1h,to:now))',
         type: 'metrics',
       },
diff --git a/x-pack/plugins/infra/public/pages/metrics/metrics_explorer/components/helpers/create_tsvb_link.ts b/x-pack/plugins/infra/public/pages/metrics/metrics_explorer/components/helpers/create_tsvb_link.ts
index 84d87ee4ad1b7..5d1f9bafdedaf 100644
--- a/x-pack/plugins/infra/public/pages/metrics/metrics_explorer/components/helpers/create_tsvb_link.ts
+++ b/x-pack/plugins/infra/public/pages/metrics/metrics_explorer/components/helpers/create_tsvb_link.ts
@@ -8,6 +8,7 @@
 import { encode } from 'rison-node';
 import uuid from 'uuid';
 import { set } from '@elastic/safer-lodash-set';
+import { TIMESTAMP_FIELD } from '../../../../../../common/constants';
 import { MetricsSourceConfigurationProperties } from '../../../../../../common/metrics_sources';
 import { colorTransformer, Color } from '../../../../../../common/color_palette';
 import { MetricsExplorerSeries } from '../../../../../../common/http_api/metrics_explorer';
@@ -169,7 +170,7 @@ export const createTSVBLink = (
         series: options.metrics.map(mapMetricToSeries(chartOptions)),
         show_grid: 1,
         show_legend: 1,
-        time_field: (source && source.fields.timestamp) || '@timestamp',
+        time_field: TIMESTAMP_FIELD,
         type: 'timeseries',
         filter: createFilterFromOptions(options, series),
       },
diff --git a/x-pack/plugins/infra/public/pages/metrics/metrics_explorer/hooks/use_metrics_explorer_data.ts b/x-pack/plugins/infra/public/pages/metrics/metrics_explorer/hooks/use_metrics_explorer_data.ts
index c0d0b15217df3..788760a0dfe1c 100644
--- a/x-pack/plugins/infra/public/pages/metrics/metrics_explorer/hooks/use_metrics_explorer_data.ts
+++ b/x-pack/plugins/infra/public/pages/metrics/metrics_explorer/hooks/use_metrics_explorer_data.ts
@@ -84,7 +84,6 @@ export function useMetricsExplorerData(
               void 0,
             timerange: {
               ...timerange,
-              field: source.fields.timestamp,
               from: from.valueOf(),
               to: to.valueOf(),
             },
diff --git a/x-pack/plugins/infra/public/utils/loading_state/index.ts b/x-pack/plugins/infra/public/utils/loading_state/index.ts
index f0f42f1afa6a4..f93d0638b3366 100644
--- a/x-pack/plugins/infra/public/utils/loading_state/index.ts
+++ b/x-pack/plugins/infra/public/utils/loading_state/index.ts
@@ -5,18 +5,21 @@
  * 2.0.
  */
 
-export { initialLoadingState, LoadingState } from './loading_state';
+export type { LoadingState } from './loading_state';
+export { initialLoadingState } from './loading_state';
 
-export { isManualLoadingPolicy, isIntervalLoadingPolicy, LoadingPolicy } from './loading_policy';
+export type { LoadingPolicy } from './loading_policy';
+export { isManualLoadingPolicy, isIntervalLoadingPolicy } from './loading_policy';
 
+export type { LoadingProgress } from './loading_progress';
 export {
   createRunningProgressReducer,
   createIdleProgressReducer,
   isIdleLoadingProgress,
   isRunningLoadingProgress,
-  LoadingProgress,
 } from './loading_progress';
 
+export type { LoadingResult } from './loading_result';
 export {
   createFailureResult,
   createFailureResultReducer,
@@ -27,5 +30,4 @@ export {
   isFailureLoadingResult,
   isSuccessLoadingResult,
   isUninitializedLoadingResult,
-  LoadingResult,
 } from './loading_result';
diff --git a/x-pack/plugins/infra/public/utils/logs_overview_fetchers.ts b/x-pack/plugins/infra/public/utils/logs_overview_fetchers.ts
index 44f65b9e8071a..6843bc631ce27 100644
--- a/x-pack/plugins/infra/public/utils/logs_overview_fetchers.ts
+++ b/x-pack/plugins/infra/public/utils/logs_overview_fetchers.ts
@@ -8,7 +8,7 @@
 import { encode } from 'rison-node';
 import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import { FetchData, FetchDataParams, LogsFetchDataResponse } from '../../../observability/public';
-import { DEFAULT_SOURCE_ID } from '../../common/constants';
+import { DEFAULT_SOURCE_ID, TIMESTAMP_FIELD } from '../../common/constants';
 import { callFetchLogSourceConfigurationAPI } from '../containers/logs/log_source/api/fetch_log_source_configuration';
 import { callFetchLogSourceStatusAPI } from '../containers/logs/log_source/api/fetch_log_source_status';
 import { InfraClientCoreSetup, InfraClientStartDeps } from '../types';
@@ -30,7 +30,6 @@ interface StatsAggregation {
 
 interface LogParams {
   index: string;
-  timestampField: string;
 }
 
 type StatsAndSeries = Pick<LogsFetchDataResponse, 'stats' | 'series'>;
@@ -63,7 +62,6 @@ export function getLogsOverviewDataFetcher(
     const { stats, series } = await fetchLogsOverview(
       {
         index: resolvedLogSourceConfiguration.indices,
-        timestampField: resolvedLogSourceConfiguration.timestampField,
       },
       params,
       data
@@ -117,7 +115,7 @@ async function fetchLogsOverview(
 function buildLogOverviewQuery(logParams: LogParams, params: FetchDataParams) {
   return {
     range: {
-      [logParams.timestampField]: {
+      [TIMESTAMP_FIELD]: {
         gt: new Date(params.absoluteTime.start).toISOString(),
         lte: new Date(params.absoluteTime.end).toISOString(),
         format: 'strict_date_optional_time',
@@ -137,7 +135,7 @@ function buildLogOverviewAggregations(logParams: LogParams, params: FetchDataPar
       aggs: {
         series: {
           date_histogram: {
-            field: logParams.timestampField,
+            field: TIMESTAMP_FIELD,
             fixed_interval: params.intervalString,
           },
         },
diff --git a/x-pack/plugins/infra/public/utils/logs_overview_fetches.test.ts b/x-pack/plugins/infra/public/utils/logs_overview_fetches.test.ts
index d0349ab20710f..8a1920f534cd6 100644
--- a/x-pack/plugins/infra/public/utils/logs_overview_fetches.test.ts
+++ b/x-pack/plugins/infra/public/utils/logs_overview_fetches.test.ts
@@ -150,7 +150,6 @@ describe('Logs UI Observability Homepage Functions', () => {
               type: 'index_pattern',
               indexPatternId: 'test-index-pattern',
             },
-            fields: { timestamp: '@timestamp', tiebreaker: '_doc' },
           },
         },
       } as GetLogSourceConfigurationSuccessResponsePayload);
diff --git a/x-pack/plugins/infra/server/deprecations.ts b/x-pack/plugins/infra/server/deprecations.ts
index 4c2f5f6a9b3d1..5e016bc094826 100644
--- a/x-pack/plugins/infra/server/deprecations.ts
+++ b/x-pack/plugins/infra/server/deprecations.ts
@@ -13,6 +13,13 @@ import {
   DeprecationsDetails,
   GetDeprecationsContext,
 } from 'src/core/server';
+import {
+  TIMESTAMP_FIELD,
+  TIEBREAKER_FIELD,
+  CONTAINER_FIELD,
+  HOST_FIELD,
+  POD_FIELD,
+} from '../common/constants';
 import { InfraSources } from './lib/sources';
 
 const deprecatedFieldMessage = (fieldName: string, defaultValue: string, configNames: string[]) =>
@@ -28,11 +35,11 @@ const deprecatedFieldMessage = (fieldName: string, defaultValue: string, configN
   });
 
 const DEFAULT_VALUES = {
-  timestamp: '@timestamp',
-  tiebreaker: '_doc',
-  container: 'container.id',
-  host: 'host.name',
-  pod: 'kubernetes.pod.uid',
+  timestamp: TIMESTAMP_FIELD,
+  tiebreaker: TIEBREAKER_FIELD,
+  container: CONTAINER_FIELD,
+  host: HOST_FIELD,
+  pod: POD_FIELD,
 };
 
 const FIELD_DEPRECATION_FACTORIES: Record<string, (configNames: string[]) => DeprecationsDetails> =
diff --git a/x-pack/plugins/infra/server/index.ts b/x-pack/plugins/infra/server/index.ts
index a25bba48d673e..93be23356dfc3 100644
--- a/x-pack/plugins/infra/server/index.ts
+++ b/x-pack/plugins/infra/server/index.ts
@@ -8,8 +8,9 @@
 import { PluginInitializerContext } from 'src/core/server';
 import { config, InfraConfig, InfraServerPlugin, InfraPluginSetup } from './plugin';
 
-export { config, InfraConfig, InfraPluginSetup };
-export { InfraRequestHandlerContext } from './types';
+export type { InfraConfig, InfraPluginSetup };
+export { config };
+export type { InfraRequestHandlerContext } from './types';
 
 export function plugin(context: PluginInitializerContext) {
   return new InfraServerPlugin(context);
diff --git a/x-pack/plugins/infra/server/lib/adapters/log_entries/kibana_log_entries_adapter.ts b/x-pack/plugins/infra/server/lib/adapters/log_entries/kibana_log_entries_adapter.ts
index 75a86ae654d6c..7e8f5ebfd5af4 100644
--- a/x-pack/plugins/infra/server/lib/adapters/log_entries/kibana_log_entries_adapter.ts
+++ b/x-pack/plugins/infra/server/lib/adapters/log_entries/kibana_log_entries_adapter.ts
@@ -24,6 +24,7 @@ import {
 import { SortedSearchHit } from '../framework';
 import { KibanaFramework } from '../framework/kibana_framework_adapter';
 import { ResolvedLogSourceConfiguration } from '../../../../common/log_sources';
+import { TIMESTAMP_FIELD, TIEBREAKER_FIELD } from '../../../../common/constants';
 
 const TIMESTAMP_FORMAT = 'epoch_millis';
 
@@ -64,8 +65,8 @@ export class InfraKibanaLogEntriesAdapter implements LogEntriesAdapter {
       : {};
 
     const sort = {
-      [resolvedLogSourceConfiguration.timestampField]: sortDirection,
-      [resolvedLogSourceConfiguration.tiebreakerField]: sortDirection,
+      [TIMESTAMP_FIELD]: sortDirection,
+      [TIEBREAKER_FIELD]: sortDirection,
     };
 
     const esQuery = {
@@ -83,7 +84,7 @@ export class InfraKibanaLogEntriesAdapter implements LogEntriesAdapter {
               ...createFilterClauses(query, highlightQuery),
               {
                 range: {
-                  [resolvedLogSourceConfiguration.timestampField]: {
+                  [TIMESTAMP_FIELD]: {
                     gte: startTimestamp,
                     lte: endTimestamp,
                     format: TIMESTAMP_FORMAT,
@@ -146,7 +147,7 @@ export class InfraKibanaLogEntriesAdapter implements LogEntriesAdapter {
         aggregations: {
           count_by_date: {
             date_range: {
-              field: resolvedLogSourceConfiguration.timestampField,
+              field: TIMESTAMP_FIELD,
               format: TIMESTAMP_FORMAT,
               ranges: bucketIntervalStarts.map((bucketIntervalStart) => ({
                 from: bucketIntervalStart.getTime(),
@@ -157,10 +158,7 @@ export class InfraKibanaLogEntriesAdapter implements LogEntriesAdapter {
               top_hits_by_key: {
                 top_hits: {
                   size: 1,
-                  sort: [
-                    { [resolvedLogSourceConfiguration.timestampField]: 'asc' },
-                    { [resolvedLogSourceConfiguration.tiebreakerField]: 'asc' },
-                  ],
+                  sort: [{ [TIMESTAMP_FIELD]: 'asc' }, { [TIEBREAKER_FIELD]: 'asc' }],
                   _source: false,
                 },
               },
@@ -173,7 +171,7 @@ export class InfraKibanaLogEntriesAdapter implements LogEntriesAdapter {
               ...createQueryFilterClauses(filterQuery),
               {
                 range: {
-                  [resolvedLogSourceConfiguration.timestampField]: {
+                  [TIMESTAMP_FIELD]: {
                     gte: startTimestamp,
                     lte: endTimestamp,
                     format: TIMESTAMP_FORMAT,
diff --git a/x-pack/plugins/infra/server/lib/adapters/metrics/kibana_metrics_adapter.ts b/x-pack/plugins/infra/server/lib/adapters/metrics/kibana_metrics_adapter.ts
index 730da9511dc38..e05a5b647ad2b 100644
--- a/x-pack/plugins/infra/server/lib/adapters/metrics/kibana_metrics_adapter.ts
+++ b/x-pack/plugins/infra/server/lib/adapters/metrics/kibana_metrics_adapter.ts
@@ -8,6 +8,7 @@
 import { i18n } from '@kbn/i18n';
 import { flatten, get } from 'lodash';
 import { KibanaRequest } from 'src/core/server';
+import { TIMESTAMP_FIELD } from '../../../../common/constants';
 import { NodeDetailsMetricData } from '../../../../common/http_api/node_details_api';
 import { KibanaFramework } from '../framework/kibana_framework_adapter';
 import { InfraMetricsAdapter, InfraMetricsRequestOptions } from './adapter_types';
@@ -36,7 +37,7 @@ export class KibanaMetricsAdapter implements InfraMetricsAdapter {
     rawRequest: KibanaRequest
   ): Promise<NodeDetailsMetricData[]> {
     const indexPattern = `${options.sourceConfiguration.metricAlias}`;
-    const fields = findInventoryFields(options.nodeType, options.sourceConfiguration.fields);
+    const fields = findInventoryFields(options.nodeType);
     const nodeField = fields.id;
 
     const search = <Aggregation>(searchOptions: object) =>
@@ -122,11 +123,7 @@ export class KibanaMetricsAdapter implements InfraMetricsAdapter {
       max: options.timerange.to,
     };
 
-    const model = createTSVBModel(
-      options.sourceConfiguration.fields.timestamp,
-      indexPattern,
-      options.timerange.interval
-    );
+    const model = createTSVBModel(TIMESTAMP_FIELD, indexPattern, options.timerange.interval);
 
     const client = <Hit = {}, Aggregation = undefined>(
       opts: CallWithRequestParams
@@ -137,7 +134,6 @@ export class KibanaMetricsAdapter implements InfraMetricsAdapter {
       client,
       {
         indexPattern: `${options.sourceConfiguration.metricAlias}`,
-        timestampField: options.sourceConfiguration.fields.timestamp,
         timerange: options.timerange,
       },
       model.requires
diff --git a/x-pack/plugins/infra/server/lib/alerting/log_threshold/mocks/index.ts b/x-pack/plugins/infra/server/lib/alerting/log_threshold/mocks/index.ts
index 296a540b4a920..f02dac2139097 100644
--- a/x-pack/plugins/infra/server/lib/alerting/log_threshold/mocks/index.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/log_threshold/mocks/index.ts
@@ -17,7 +17,6 @@ export const libsMock = {
             type: 'index_pattern',
             indexPatternId: 'some-id',
           },
-          fields: { timestamp: '@timestamp' },
         },
       });
     },
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/evaluate_alert.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/evaluate_alert.ts
index 71c18d9f7cf04..8991c884336d3 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/evaluate_alert.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/evaluate_alert.ts
@@ -74,7 +74,6 @@ export const evaluateAlert = <Params extends EvaluatedAlertParams = EvaluatedAle
         esClient,
         criterion,
         config.metricAlias,
-        config.fields.timestamp,
         groupBy,
         filterQuery,
         timeframe,
@@ -147,7 +146,6 @@ const getMetric: (
   esClient: ElasticsearchClient,
   params: MetricExpressionParams,
   index: string,
-  timefield: string,
   groupBy: string | undefined | string[],
   filterQuery: string | undefined,
   timeframe?: { start?: number; end: number },
@@ -156,7 +154,6 @@ const getMetric: (
   esClient,
   params,
   index,
-  timefield,
   groupBy,
   filterQuery,
   timeframe,
@@ -172,7 +169,6 @@ const getMetric: (
 
   const searchBody = getElasticsearchMetricQuery(
     params,
-    timefield,
     calculatedTimerange,
     hasGroupBy ? groupBy : undefined,
     filterQuery
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/metric_query.test.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/metric_query.test.ts
index 2ba8365d6b4a9..463365b6449d0 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/metric_query.test.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/metric_query.test.ts
@@ -17,7 +17,6 @@ describe("The Metric Threshold Alert's getElasticsearchMetricQuery", () => {
     timeSize: 1,
   } as MetricExpressionParams;
 
-  const timefield = '@timestamp';
   const groupBy = 'host.doggoname';
   const timeframe = {
     start: moment().subtract(5, 'minutes').valueOf(),
@@ -25,7 +24,7 @@ describe("The Metric Threshold Alert's getElasticsearchMetricQuery", () => {
   };
 
   describe('when passed no filterQuery', () => {
-    const searchBody = getElasticsearchMetricQuery(expressionParams, timefield, timeframe, groupBy);
+    const searchBody = getElasticsearchMetricQuery(expressionParams, timeframe, groupBy);
     test('includes a range filter', () => {
       expect(
         searchBody.query.bool.filter.find((filter) => filter.hasOwnProperty('range'))
@@ -47,7 +46,6 @@ describe("The Metric Threshold Alert's getElasticsearchMetricQuery", () => {
 
     const searchBody = getElasticsearchMetricQuery(
       expressionParams,
-      timefield,
       timeframe,
       groupBy,
       filterQuery
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/metric_query.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/metric_query.ts
index 59dc398973f8c..588b77250e6a6 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/metric_query.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/metric_query.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { TIMESTAMP_FIELD } from '../../../../../common/constants';
 import { networkTraffic } from '../../../../../common/inventory_models/shared/metrics/snapshot/network_traffic';
 import { MetricExpressionParams, Aggregators } from '../types';
 import { createPercentileAggregation } from './create_percentile_aggregation';
@@ -21,7 +22,6 @@ const getParsedFilterQuery: (filterQuery: string | undefined) => Record<string,
 
 export const getElasticsearchMetricQuery = (
   { metric, aggType, timeUnit, timeSize }: MetricExpressionParams,
-  timefield: string,
   timeframe: { start: number; end: number },
   groupBy?: string | string[],
   filterQuery?: string
@@ -56,9 +56,9 @@ export const getElasticsearchMetricQuery = (
       ? {
           aggregatedIntervals: {
             date_histogram: {
-              field: timefield,
+              field: TIMESTAMP_FIELD,
               fixed_interval: interval,
-              offset: calculateDateHistogramOffset({ from, to, interval, field: timefield }),
+              offset: calculateDateHistogramOffset({ from, to, interval }),
               extended_bounds: {
                 min: from,
                 max: to,
diff --git a/x-pack/plugins/infra/server/lib/host_details/process_list.ts b/x-pack/plugins/infra/server/lib/host_details/process_list.ts
index a9125c73fe5d0..6e608bfa2ddca 100644
--- a/x-pack/plugins/infra/server/lib/host_details/process_list.ts
+++ b/x-pack/plugins/infra/server/lib/host_details/process_list.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { TIMESTAMP_FIELD } from '../../../common/constants';
 import { ProcessListAPIRequest, ProcessListAPIQueryAggregation } from '../../../common/http_api';
 import { ESSearchClient } from '../metrics/types';
 import { CMDLINE_FIELD } from './common';
@@ -13,7 +14,7 @@ const TOP_N = 10;
 
 export const getProcessList = async (
   search: ESSearchClient,
-  { hostTerm, timefield, indexPattern, to, sortBy, searchFilter }: ProcessListAPIRequest
+  { hostTerm, indexPattern, to, sortBy, searchFilter }: ProcessListAPIRequest
 ) => {
   const body = {
     size: 0,
@@ -22,7 +23,7 @@ export const getProcessList = async (
         filter: [
           {
             range: {
-              [timefield]: {
+              [TIMESTAMP_FIELD]: {
                 gte: to - 60 * 1000, // 1 minute
                 lte: to,
               },
@@ -47,7 +48,7 @@ export const getProcessList = async (
               size: 1,
               sort: [
                 {
-                  [timefield]: {
+                  [TIMESTAMP_FIELD]: {
                     order: 'desc',
                   },
                 },
@@ -93,7 +94,7 @@ export const getProcessList = async (
                   size: 1,
                   sort: [
                     {
-                      [timefield]: {
+                      [TIMESTAMP_FIELD]: {
                         order: 'desc',
                       },
                     },
diff --git a/x-pack/plugins/infra/server/lib/host_details/process_list_chart.ts b/x-pack/plugins/infra/server/lib/host_details/process_list_chart.ts
index 413a97cb7a058..7ff66a80e967b 100644
--- a/x-pack/plugins/infra/server/lib/host_details/process_list_chart.ts
+++ b/x-pack/plugins/infra/server/lib/host_details/process_list_chart.ts
@@ -6,6 +6,7 @@
  */
 
 import { first } from 'lodash';
+import { TIMESTAMP_FIELD } from '../../../common/constants';
 import {
   ProcessListAPIChartRequest,
   ProcessListAPIChartQueryAggregation,
@@ -17,7 +18,7 @@ import { CMDLINE_FIELD } from './common';
 
 export const getProcessListChart = async (
   search: ESSearchClient,
-  { hostTerm, timefield, indexPattern, to, command }: ProcessListAPIChartRequest
+  { hostTerm, indexPattern, to, command }: ProcessListAPIChartRequest
 ) => {
   const body = {
     size: 0,
@@ -26,7 +27,7 @@ export const getProcessListChart = async (
         filter: [
           {
             range: {
-              [timefield]: {
+              [TIMESTAMP_FIELD]: {
                 gte: to - 60 * 1000, // 1 minute
                 lte: to,
               },
@@ -60,7 +61,7 @@ export const getProcessListChart = async (
             aggs: {
               timeseries: {
                 date_histogram: {
-                  field: timefield,
+                  field: TIMESTAMP_FIELD,
                   fixed_interval: '1m',
                   extended_bounds: {
                     min: to - 60 * 15 * 1000, // 15 minutes,
diff --git a/x-pack/plugins/infra/server/lib/infra_ml/index.ts b/x-pack/plugins/infra/server/lib/infra_ml/index.ts
index 82093b1a359d0..853ef8d0d60b2 100644
--- a/x-pack/plugins/infra/server/lib/infra_ml/index.ts
+++ b/x-pack/plugins/infra/server/lib/infra_ml/index.ts
@@ -8,4 +8,4 @@
 export * from './errors';
 export * from './metrics_hosts_anomalies';
 export * from './metrics_k8s_anomalies';
-export { MappedAnomalyHit } from './common';
+export type { MappedAnomalyHit } from './common';
diff --git a/x-pack/plugins/infra/server/lib/infra_ml/queries/metrics_hosts_anomalies.ts b/x-pack/plugins/infra/server/lib/infra_ml/queries/metrics_hosts_anomalies.ts
index ab50986c3b3d5..9c0f4313c6bdb 100644
--- a/x-pack/plugins/infra/server/lib/infra_ml/queries/metrics_hosts_anomalies.ts
+++ b/x-pack/plugins/infra/server/lib/infra_ml/queries/metrics_hosts_anomalies.ts
@@ -6,6 +6,7 @@
  */
 
 import * as rt from 'io-ts';
+import { TIEBREAKER_FIELD } from '../../../../common/constants';
 import { ANOMALY_THRESHOLD } from '../../../../common/infra_ml';
 import { commonSearchSuccessResponseFieldsRT } from '../../../utils/elasticsearch_runtime_types';
 import {
@@ -20,9 +21,6 @@ import {
 import { InfluencerFilter } from '../common';
 import { Sort, Pagination } from '../../../../common/http_api/infra_ml';
 
-// TODO: Reassess validity of this against ML docs
-const TIEBREAKER_FIELD = '_doc';
-
 const sortToMlFieldMap = {
   dataset: 'partition_field_value',
   anomalyScore: 'record_score',
diff --git a/x-pack/plugins/infra/server/lib/infra_ml/queries/metrics_k8s_anomalies.ts b/x-pack/plugins/infra/server/lib/infra_ml/queries/metrics_k8s_anomalies.ts
index 8fb8df5eef3d7..23592aad2e322 100644
--- a/x-pack/plugins/infra/server/lib/infra_ml/queries/metrics_k8s_anomalies.ts
+++ b/x-pack/plugins/infra/server/lib/infra_ml/queries/metrics_k8s_anomalies.ts
@@ -6,6 +6,7 @@
  */
 
 import * as rt from 'io-ts';
+import { TIEBREAKER_FIELD } from '../../../../common/constants';
 import { ANOMALY_THRESHOLD } from '../../../../common/infra_ml';
 import { commonSearchSuccessResponseFieldsRT } from '../../../utils/elasticsearch_runtime_types';
 import {
@@ -20,9 +21,6 @@ import {
 import { InfluencerFilter } from '../common';
 import { Sort, Pagination } from '../../../../common/http_api/infra_ml';
 
-// TODO: Reassess validity of this against ML docs
-const TIEBREAKER_FIELD = '_doc';
-
 const sortToMlFieldMap = {
   dataset: 'partition_field_value',
   anomalyScore: 'record_score',
diff --git a/x-pack/plugins/infra/server/lib/metrics/index.ts b/x-pack/plugins/infra/server/lib/metrics/index.ts
index d291dbf88b49a..c4641e265ea55 100644
--- a/x-pack/plugins/infra/server/lib/metrics/index.ts
+++ b/x-pack/plugins/infra/server/lib/metrics/index.ts
@@ -7,6 +7,7 @@
 
 import { set } from '@elastic/safer-lodash-set';
 import { ThrowReporter } from 'io-ts/lib/ThrowReporter';
+import { TIMESTAMP_FIELD } from '../../../common/constants';
 import { MetricsAPIRequest, MetricsAPIResponse, afterKeyObjectRT } from '../../../common/http_api';
 import {
   ESSearchClient,
@@ -36,7 +37,7 @@ export const query = async (
   const filter: Array<Record<string, any>> = [
     {
       range: {
-        [options.timerange.field]: {
+        [TIMESTAMP_FIELD]: {
           gte: options.timerange.from,
           lte: options.timerange.to,
           format: 'epoch_millis',
diff --git a/x-pack/plugins/infra/server/lib/metrics/lib/calculate_interval.ts b/x-pack/plugins/infra/server/lib/metrics/lib/calculate_interval.ts
index f6bdfb2de0a29..ee309ad449b2d 100644
--- a/x-pack/plugins/infra/server/lib/metrics/lib/calculate_interval.ts
+++ b/x-pack/plugins/infra/server/lib/metrics/lib/calculate_interval.ts
@@ -21,7 +21,6 @@ export const calculatedInterval = async (search: ESSearchClient, options: Metric
         search,
         {
           indexPattern: options.indexPattern,
-          timestampField: options.timerange.field,
           timerange: { from: options.timerange.from, to: options.timerange.to },
         },
         options.modules
diff --git a/x-pack/plugins/infra/server/lib/metrics/lib/convert_histogram_buckets_to_timeseries.test.ts b/x-pack/plugins/infra/server/lib/metrics/lib/convert_histogram_buckets_to_timeseries.test.ts
index b49560f8c25f6..8fe22e6f81d71 100644
--- a/x-pack/plugins/infra/server/lib/metrics/lib/convert_histogram_buckets_to_timeseries.test.ts
+++ b/x-pack/plugins/infra/server/lib/metrics/lib/convert_histogram_buckets_to_timeseries.test.ts
@@ -13,7 +13,6 @@ const keys = ['example-0'];
 
 const options: MetricsAPIRequest = {
   timerange: {
-    field: '@timestamp',
     from: moment('2020-01-01T00:00:00Z').valueOf(),
     to: moment('2020-01-01T00:00:00Z').add(5, 'minute').valueOf(),
     interval: '1m',
diff --git a/x-pack/plugins/infra/server/lib/metrics/lib/create_aggregations.test.ts b/x-pack/plugins/infra/server/lib/metrics/lib/create_aggregations.test.ts
index 91bf544b7e48f..9b92793129d44 100644
--- a/x-pack/plugins/infra/server/lib/metrics/lib/create_aggregations.test.ts
+++ b/x-pack/plugins/infra/server/lib/metrics/lib/create_aggregations.test.ts
@@ -11,7 +11,6 @@ import { MetricsAPIRequest } from '../../../../common/http_api';
 
 const options: MetricsAPIRequest = {
   timerange: {
-    field: '@timestamp',
     from: moment('2020-01-01T00:00:00Z').valueOf(),
     to: moment('2020-01-01T01:00:00Z').valueOf(),
     interval: '>=1m',
diff --git a/x-pack/plugins/infra/server/lib/metrics/lib/create_aggregations.ts b/x-pack/plugins/infra/server/lib/metrics/lib/create_aggregations.ts
index 65cd4ebe2d501..769ccce409e65 100644
--- a/x-pack/plugins/infra/server/lib/metrics/lib/create_aggregations.ts
+++ b/x-pack/plugins/infra/server/lib/metrics/lib/create_aggregations.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { TIMESTAMP_FIELD } from '../../../../common/constants';
 import { MetricsAPIRequest } from '../../../../common/http_api/metrics_api';
 import { calculateDateHistogramOffset } from './calculate_date_histogram_offset';
 import { createMetricsAggregations } from './create_metrics_aggregations';
@@ -15,7 +16,7 @@ export const createAggregations = (options: MetricsAPIRequest) => {
   const histogramAggregation = {
     histogram: {
       date_histogram: {
-        field: options.timerange.field,
+        field: TIMESTAMP_FIELD,
         fixed_interval: intervalString,
         offset: options.alignDataToEnd ? calculateDateHistogramOffset(options.timerange) : '0s',
         extended_bounds: {
diff --git a/x-pack/plugins/infra/server/lib/metrics/lib/create_metrics_aggregations.test.ts b/x-pack/plugins/infra/server/lib/metrics/lib/create_metrics_aggregations.test.ts
index 27fe491d3964b..2e2d1736e5925 100644
--- a/x-pack/plugins/infra/server/lib/metrics/lib/create_metrics_aggregations.test.ts
+++ b/x-pack/plugins/infra/server/lib/metrics/lib/create_metrics_aggregations.test.ts
@@ -11,7 +11,6 @@ import { createMetricsAggregations } from './create_metrics_aggregations';
 
 const options: MetricsAPIRequest = {
   timerange: {
-    field: '@timestamp',
     from: moment('2020-01-01T00:00:00Z').valueOf(),
     to: moment('2020-01-01T01:00:00Z').valueOf(),
     interval: '>=1m',
diff --git a/x-pack/plugins/infra/server/lib/sources/defaults.ts b/x-pack/plugins/infra/server/lib/sources/defaults.ts
index b6139613cfce3..db262a432b3fc 100644
--- a/x-pack/plugins/infra/server/lib/sources/defaults.ts
+++ b/x-pack/plugins/infra/server/lib/sources/defaults.ts
@@ -5,11 +5,7 @@
  * 2.0.
  */
 
-import {
-  METRICS_INDEX_PATTERN,
-  LOGS_INDEX_PATTERN,
-  TIMESTAMP_FIELD,
-} from '../../../common/constants';
+import { METRICS_INDEX_PATTERN, LOGS_INDEX_PATTERN } from '../../../common/constants';
 import { InfraSourceConfiguration } from '../../../common/source_configuration/source_configuration';
 
 export const defaultSourceConfiguration: InfraSourceConfiguration = {
@@ -21,12 +17,7 @@ export const defaultSourceConfiguration: InfraSourceConfiguration = {
     indexName: LOGS_INDEX_PATTERN,
   },
   fields: {
-    container: 'container.id',
-    host: 'host.name',
     message: ['message', '@message'],
-    pod: 'kubernetes.pod.uid',
-    tiebreaker: '_doc',
-    timestamp: TIMESTAMP_FIELD,
   },
   inventoryDefaultView: '0',
   metricsExplorerDefaultView: '0',
diff --git a/x-pack/plugins/infra/server/lib/sources/saved_object_references.test.ts b/x-pack/plugins/infra/server/lib/sources/saved_object_references.test.ts
index 9f6f9cd284c67..fb550390e25be 100644
--- a/x-pack/plugins/infra/server/lib/sources/saved_object_references.test.ts
+++ b/x-pack/plugins/infra/server/lib/sources/saved_object_references.test.ts
@@ -101,12 +101,7 @@ const sourceConfigurationWithIndexPatternReference: InfraSourceConfiguration = {
   name: 'NAME',
   description: 'DESCRIPTION',
   fields: {
-    container: 'CONTAINER_FIELD',
-    host: 'HOST_FIELD',
     message: ['MESSAGE_FIELD'],
-    pod: 'POD_FIELD',
-    tiebreaker: 'TIEBREAKER_FIELD',
-    timestamp: 'TIMESTAMP_FIELD',
   },
   logColumns: [],
   logIndices: {
diff --git a/x-pack/plugins/infra/server/lib/sources/sources.test.ts b/x-pack/plugins/infra/server/lib/sources/sources.test.ts
index 904f51d12673f..396d2c22a100f 100644
--- a/x-pack/plugins/infra/server/lib/sources/sources.test.ts
+++ b/x-pack/plugins/infra/server/lib/sources/sources.test.ts
@@ -24,13 +24,6 @@ describe('the InfraSources lib', () => {
         attributes: {
           metricAlias: 'METRIC_ALIAS',
           logIndices: { type: 'index_pattern', indexPatternId: 'log_index_pattern_0' },
-          fields: {
-            container: 'CONTAINER',
-            host: 'HOST',
-            pod: 'POD',
-            tiebreaker: 'TIEBREAKER',
-            timestamp: 'TIMESTAMP',
-          },
         },
         references: [
           {
@@ -50,13 +43,6 @@ describe('the InfraSources lib', () => {
         configuration: {
           metricAlias: 'METRIC_ALIAS',
           logIndices: { type: 'index_pattern', indexPatternId: 'LOG_INDEX_PATTERN' },
-          fields: {
-            container: 'CONTAINER',
-            host: 'HOST',
-            pod: 'POD',
-            tiebreaker: 'TIEBREAKER',
-            timestamp: 'TIMESTAMP',
-          },
         },
       });
     });
@@ -67,12 +53,6 @@ describe('the InfraSources lib', () => {
           default: {
             metricAlias: 'METRIC_ALIAS',
             logIndices: { type: 'index_pattern', indexPatternId: 'LOG_ALIAS' },
-            fields: {
-              host: 'HOST',
-              pod: 'POD',
-              tiebreaker: 'TIEBREAKER',
-              timestamp: 'TIMESTAMP',
-            },
           },
         }),
       });
@@ -82,11 +62,7 @@ describe('the InfraSources lib', () => {
         version: 'foo',
         type: infraSourceConfigurationSavedObjectName,
         updated_at: '2000-01-01T00:00:00.000Z',
-        attributes: {
-          fields: {
-            container: 'CONTAINER',
-          },
-        },
+        attributes: {},
         references: [],
       });
 
@@ -99,13 +75,6 @@ describe('the InfraSources lib', () => {
         configuration: {
           metricAlias: 'METRIC_ALIAS',
           logIndices: { type: 'index_pattern', indexPatternId: 'LOG_ALIAS' },
-          fields: {
-            container: 'CONTAINER',
-            host: 'HOST',
-            pod: 'POD',
-            tiebreaker: 'TIEBREAKER',
-            timestamp: 'TIMESTAMP',
-          },
         },
       });
     });
@@ -133,13 +102,6 @@ describe('the InfraSources lib', () => {
         configuration: {
           metricAlias: expect.any(String),
           logIndices: expect.any(Object),
-          fields: {
-            container: expect.any(String),
-            host: expect.any(String),
-            pod: expect.any(String),
-            tiebreaker: expect.any(String),
-            timestamp: expect.any(String),
-          },
         },
       });
     });
diff --git a/x-pack/plugins/infra/server/plugin.ts b/x-pack/plugins/infra/server/plugin.ts
index 26d9f115405a6..4e655f200d94f 100644
--- a/x-pack/plugins/infra/server/plugin.ts
+++ b/x-pack/plugins/infra/server/plugin.ts
@@ -53,12 +53,7 @@ export const config: PluginConfigDescriptor = {
           schema.object({
             fields: schema.maybe(
               schema.object({
-                timestamp: schema.maybe(schema.string()),
                 message: schema.maybe(schema.arrayOf(schema.string())),
-                tiebreaker: schema.maybe(schema.string()),
-                host: schema.maybe(schema.string()),
-                container: schema.maybe(schema.string()),
-                pod: schema.maybe(schema.string()),
               })
             ),
           })
diff --git a/x-pack/plugins/infra/server/routes/inventory_metadata/lib/get_cloud_metadata.ts b/x-pack/plugins/infra/server/routes/inventory_metadata/lib/get_cloud_metadata.ts
index c721ca75ea978..5c4ae1981c5cd 100644
--- a/x-pack/plugins/infra/server/routes/inventory_metadata/lib/get_cloud_metadata.ts
+++ b/x-pack/plugins/infra/server/routes/inventory_metadata/lib/get_cloud_metadata.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { TIMESTAMP_FIELD } from '../../../../common/constants';
 import { InventoryCloudAccount } from '../../../../common/http_api/inventory_meta_api';
 import {
   InfraMetadataAggregationResponse,
@@ -49,7 +50,7 @@ export const getCloudMetadata = async (
           must: [
             {
               range: {
-                [sourceConfiguration.fields.timestamp]: {
+                [TIMESTAMP_FIELD]: {
                   gte: currentTime - 86400000, // 24 hours ago
                   lte: currentTime,
                   format: 'epoch_millis',
diff --git a/x-pack/plugins/infra/server/routes/metadata/lib/get_cloud_metric_metadata.ts b/x-pack/plugins/infra/server/routes/metadata/lib/get_cloud_metric_metadata.ts
index d9da7bce2246f..126d1485cb702 100644
--- a/x-pack/plugins/infra/server/routes/metadata/lib/get_cloud_metric_metadata.ts
+++ b/x-pack/plugins/infra/server/routes/metadata/lib/get_cloud_metric_metadata.ts
@@ -13,6 +13,7 @@ import {
 import { KibanaFramework } from '../../../lib/adapters/framework/kibana_framework_adapter';
 import { InfraSourceConfiguration } from '../../../lib/sources';
 import { CLOUD_METRICS_MODULES } from '../../../lib/constants';
+import { TIMESTAMP_FIELD } from '../../../../common/constants';
 
 export interface InfraCloudMetricsAdapterResponse {
   buckets: InfraMetadataAggregationBucket[];
@@ -36,7 +37,7 @@ export const getCloudMetricsMetadata = async (
             { match: { 'cloud.instance.id': instanceId } },
             {
               range: {
-                [sourceConfiguration.fields.timestamp]: {
+                [TIMESTAMP_FIELD]: {
                   gte: timeRange.from,
                   lte: timeRange.to,
                   format: 'epoch_millis',
diff --git a/x-pack/plugins/infra/server/routes/metadata/lib/get_metric_metadata.ts b/x-pack/plugins/infra/server/routes/metadata/lib/get_metric_metadata.ts
index bfa0884bfe199..1962a24f7d4db 100644
--- a/x-pack/plugins/infra/server/routes/metadata/lib/get_metric_metadata.ts
+++ b/x-pack/plugins/infra/server/routes/metadata/lib/get_metric_metadata.ts
@@ -15,6 +15,7 @@ import { KibanaFramework } from '../../../lib/adapters/framework/kibana_framewor
 import { InfraSourceConfiguration } from '../../../lib/sources';
 import { findInventoryFields } from '../../../../common/inventory_models';
 import { InventoryItemType } from '../../../../common/inventory_models/types';
+import { TIMESTAMP_FIELD } from '../../../../common/constants';
 
 export interface InfraMetricsAdapterResponse {
   id: string;
@@ -30,7 +31,7 @@ export const getMetricMetadata = async (
   nodeType: InventoryItemType,
   timeRange: { from: number; to: number }
 ): Promise<InfraMetricsAdapterResponse> => {
-  const fields = findInventoryFields(nodeType, sourceConfiguration.fields);
+  const fields = findInventoryFields(nodeType);
   const metricQuery = {
     allow_no_indices: true,
     ignore_unavailable: true,
@@ -45,7 +46,7 @@ export const getMetricMetadata = async (
             },
             {
               range: {
-                [sourceConfiguration.fields.timestamp]: {
+                [TIMESTAMP_FIELD]: {
                   gte: timeRange.from,
                   lte: timeRange.to,
                   format: 'epoch_millis',
diff --git a/x-pack/plugins/infra/server/routes/metadata/lib/get_node_info.ts b/x-pack/plugins/infra/server/routes/metadata/lib/get_node_info.ts
index 94becdf6d2811..97a0707a4c215 100644
--- a/x-pack/plugins/infra/server/routes/metadata/lib/get_node_info.ts
+++ b/x-pack/plugins/infra/server/routes/metadata/lib/get_node_info.ts
@@ -15,6 +15,7 @@ import { getPodNodeName } from './get_pod_node_name';
 import { CLOUD_METRICS_MODULES } from '../../../lib/constants';
 import { findInventoryFields } from '../../../../common/inventory_models';
 import { InventoryItemType } from '../../../../common/inventory_models/types';
+import { TIMESTAMP_FIELD } from '../../../../common/constants';
 
 export const getNodeInfo = async (
   framework: KibanaFramework,
@@ -50,8 +51,7 @@ export const getNodeInfo = async (
     }
     return {};
   }
-  const fields = findInventoryFields(nodeType, sourceConfiguration.fields);
-  const timestampField = sourceConfiguration.fields.timestamp;
+  const fields = findInventoryFields(nodeType);
   const params = {
     allow_no_indices: true,
     ignore_unavailable: true,
@@ -60,14 +60,14 @@ export const getNodeInfo = async (
     body: {
       size: 1,
       _source: ['host.*', 'cloud.*', 'agent.*'],
-      sort: [{ [timestampField]: 'desc' }],
+      sort: [{ [TIMESTAMP_FIELD]: 'desc' }],
       query: {
         bool: {
           filter: [
             { match: { [fields.id]: nodeId } },
             {
               range: {
-                [timestampField]: {
+                [TIMESTAMP_FIELD]: {
                   gte: timeRange.from,
                   lte: timeRange.to,
                   format: 'epoch_millis',
diff --git a/x-pack/plugins/infra/server/routes/metadata/lib/get_pod_node_name.ts b/x-pack/plugins/infra/server/routes/metadata/lib/get_pod_node_name.ts
index 164d94d9f692f..3afb6a8abcb58 100644
--- a/x-pack/plugins/infra/server/routes/metadata/lib/get_pod_node_name.ts
+++ b/x-pack/plugins/infra/server/routes/metadata/lib/get_pod_node_name.ts
@@ -10,6 +10,7 @@ import { KibanaFramework } from '../../../lib/adapters/framework/kibana_framewor
 import { InfraSourceConfiguration } from '../../../lib/sources';
 import { findInventoryFields } from '../../../../common/inventory_models';
 import type { InfraPluginRequestHandlerContext } from '../../../types';
+import { TIMESTAMP_FIELD } from '../../../../common/constants';
 
 export const getPodNodeName = async (
   framework: KibanaFramework,
@@ -19,8 +20,7 @@ export const getPodNodeName = async (
   nodeType: 'host' | 'pod' | 'container',
   timeRange: { from: number; to: number }
 ): Promise<string | undefined> => {
-  const fields = findInventoryFields(nodeType, sourceConfiguration.fields);
-  const timestampField = sourceConfiguration.fields.timestamp;
+  const fields = findInventoryFields(nodeType);
   const params = {
     allow_no_indices: true,
     ignore_unavailable: true,
@@ -29,7 +29,7 @@ export const getPodNodeName = async (
     body: {
       size: 1,
       _source: ['kubernetes.node.name'],
-      sort: [{ [timestampField]: 'desc' }],
+      sort: [{ [TIMESTAMP_FIELD]: 'desc' }],
       query: {
         bool: {
           filter: [
@@ -37,7 +37,7 @@ export const getPodNodeName = async (
             { exists: { field: `kubernetes.node.name` } },
             {
               range: {
-                [timestampField]: {
+                [TIMESTAMP_FIELD]: {
                   gte: timeRange.from,
                   lte: timeRange.to,
                   format: 'epoch_millis',
diff --git a/x-pack/plugins/infra/server/routes/metrics_explorer/lib/convert_request_to_metrics_api_options.test.ts b/x-pack/plugins/infra/server/routes/metrics_explorer/lib/convert_request_to_metrics_api_options.test.ts
index 539e9a1fee6ef..a6848e4f7a2dd 100644
--- a/x-pack/plugins/infra/server/routes/metrics_explorer/lib/convert_request_to_metrics_api_options.test.ts
+++ b/x-pack/plugins/infra/server/routes/metrics_explorer/lib/convert_request_to_metrics_api_options.test.ts
@@ -10,7 +10,6 @@ import { convertRequestToMetricsAPIOptions } from './convert_request_to_metrics_
 
 const BASE_REQUEST: MetricsExplorerRequestBody = {
   timerange: {
-    field: '@timestamp',
     from: new Date('2020-01-01T00:00:00Z').getTime(),
     to: new Date('2020-01-01T01:00:00Z').getTime(),
     interval: '1m',
@@ -22,7 +21,6 @@ const BASE_REQUEST: MetricsExplorerRequestBody = {
 
 const BASE_METRICS_UI_OPTIONS: MetricsAPIRequest = {
   timerange: {
-    field: '@timestamp',
     from: new Date('2020-01-01T00:00:00Z').getTime(),
     to: new Date('2020-01-01T01:00:00Z').getTime(),
     interval: '1m',
diff --git a/x-pack/plugins/infra/server/routes/metrics_explorer/lib/find_interval_for_metrics.ts b/x-pack/plugins/infra/server/routes/metrics_explorer/lib/find_interval_for_metrics.ts
index 9ca8c085eac44..62e99cf8ffd32 100644
--- a/x-pack/plugins/infra/server/routes/metrics_explorer/lib/find_interval_for_metrics.ts
+++ b/x-pack/plugins/infra/server/routes/metrics_explorer/lib/find_interval_for_metrics.ts
@@ -44,7 +44,6 @@ export const findIntervalForMetrics = async (
     client,
     {
       indexPattern: options.indexPattern,
-      timestampField: options.timerange.field,
       timerange: options.timerange,
     },
     modules.filter(Boolean) as string[]
diff --git a/x-pack/plugins/infra/server/routes/metrics_explorer/lib/get_dataset_for_field.ts b/x-pack/plugins/infra/server/routes/metrics_explorer/lib/get_dataset_for_field.ts
index 640d62c366726..97154a7361c96 100644
--- a/x-pack/plugins/infra/server/routes/metrics_explorer/lib/get_dataset_for_field.ts
+++ b/x-pack/plugins/infra/server/routes/metrics_explorer/lib/get_dataset_for_field.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { TIMESTAMP_FIELD } from '../../../../common/constants';
 import { ESSearchClient } from '../../../lib/metrics/types';
 
 interface EventDatasetHit {
@@ -19,7 +20,7 @@ export const getDatasetForField = async (
   client: ESSearchClient,
   field: string,
   indexPattern: string,
-  timerange: { field: string; to: number; from: number }
+  timerange: { to: number; from: number }
 ) => {
   const params = {
     allow_no_indices: true,
@@ -33,7 +34,7 @@ export const getDatasetForField = async (
             { exists: { field } },
             {
               range: {
-                [timerange.field]: {
+                [TIMESTAMP_FIELD]: {
                   gte: timerange.from,
                   lte: timerange.to,
                   format: 'epoch_millis',
@@ -45,7 +46,7 @@ export const getDatasetForField = async (
       },
       size: 1,
       _source: ['event.dataset'],
-      sort: [{ [timerange.field]: { order: 'desc' } }],
+      sort: [{ [TIMESTAMP_FIELD]: { order: 'desc' } }],
     },
   };
 
diff --git a/x-pack/plugins/infra/server/routes/metrics_explorer/lib/query_total_groupings.ts b/x-pack/plugins/infra/server/routes/metrics_explorer/lib/query_total_groupings.ts
index a2bf778d5016d..b2e22752609c1 100644
--- a/x-pack/plugins/infra/server/routes/metrics_explorer/lib/query_total_groupings.ts
+++ b/x-pack/plugins/infra/server/routes/metrics_explorer/lib/query_total_groupings.ts
@@ -6,6 +6,7 @@
  */
 
 import { isArray } from 'lodash';
+import { TIMESTAMP_FIELD } from '../../../../common/constants';
 import { MetricsAPIRequest } from '../../../../common/http_api';
 import { ESSearchClient } from '../../../lib/metrics/types';
 
@@ -26,7 +27,7 @@ export const queryTotalGroupings = async (
   let filters: Array<Record<string, any>> = [
     {
       range: {
-        [options.timerange.field]: {
+        [TIMESTAMP_FIELD]: {
           gte: options.timerange.from,
           lte: options.timerange.to,
           format: 'epoch_millis',
diff --git a/x-pack/plugins/infra/server/routes/overview/lib/create_top_nodes_query.ts b/x-pack/plugins/infra/server/routes/overview/lib/create_top_nodes_query.ts
index 7533f2801607c..ccead528749cd 100644
--- a/x-pack/plugins/infra/server/routes/overview/lib/create_top_nodes_query.ts
+++ b/x-pack/plugins/infra/server/routes/overview/lib/create_top_nodes_query.ts
@@ -7,6 +7,7 @@
 
 import { MetricsSourceConfiguration } from '../../../../common/metrics_sources';
 import { TopNodesRequest } from '../../../../common/http_api/overview_api';
+import { TIMESTAMP_FIELD } from '../../../../common/constants';
 
 export const createTopNodesQuery = (
   options: TopNodesRequest,
@@ -22,7 +23,7 @@ export const createTopNodesQuery = (
         filter: [
           {
             range: {
-              [source.configuration.fields.timestamp]: {
+              [TIMESTAMP_FIELD]: {
                 gte: options.timerange.from,
                 lte: options.timerange.to,
               },
@@ -49,7 +50,7 @@ export const createTopNodesQuery = (
                 { field: 'host.name' },
                 { field: 'cloud.provider' },
               ],
-              sort: { '@timestamp': 'desc' },
+              sort: { [TIMESTAMP_FIELD]: 'desc' },
               size: 1,
             },
           },
diff --git a/x-pack/plugins/infra/server/routes/snapshot/lib/apply_metadata_to_last_path.ts b/x-pack/plugins/infra/server/routes/snapshot/lib/apply_metadata_to_last_path.ts
index 7de63ae59a329..2931555fc06b0 100644
--- a/x-pack/plugins/infra/server/routes/snapshot/lib/apply_metadata_to_last_path.ts
+++ b/x-pack/plugins/infra/server/routes/snapshot/lib/apply_metadata_to_last_path.ts
@@ -42,10 +42,7 @@ export const applyMetadataToLastPath = (
     if (firstMetaDoc && lastPath) {
       // We will need the inventory fields so we can use the field paths to get
       // the values from the metadata document
-      const inventoryFields = findInventoryFields(
-        snapshotRequest.nodeType,
-        source.configuration.fields
-      );
+      const inventoryFields = findInventoryFields(snapshotRequest.nodeType);
       // Set the label as the name and fallback to the id OR path.value
       lastPath.label = (firstMetaDoc[inventoryFields.name] ?? lastPath.value) as string;
       // If the inventory fields contain an ip address, we need to try and set that
diff --git a/x-pack/plugins/infra/server/routes/snapshot/lib/create_timerange_with_interval.ts b/x-pack/plugins/infra/server/routes/snapshot/lib/create_timerange_with_interval.ts
index 7473907b7410b..bf6e51b9fe94f 100644
--- a/x-pack/plugins/infra/server/routes/snapshot/lib/create_timerange_with_interval.ts
+++ b/x-pack/plugins/infra/server/routes/snapshot/lib/create_timerange_with_interval.ts
@@ -25,7 +25,6 @@ const createInterval = async (client: ESSearchClient, options: InfraSnapshotRequ
       client,
       {
         indexPattern: options.sourceConfiguration.metricAlias,
-        timestampField: options.sourceConfiguration.fields.timestamp,
         timerange: { from: timerange.from, to: timerange.to },
       },
       modules,
@@ -81,7 +80,6 @@ const aggregationsToModules = async (
       async (field) =>
         await getDatasetForField(client, field as string, options.sourceConfiguration.metricAlias, {
           ...options.timerange,
-          field: options.sourceConfiguration.fields.timestamp,
         })
     )
   );
diff --git a/x-pack/plugins/infra/server/routes/snapshot/lib/get_nodes.ts b/x-pack/plugins/infra/server/routes/snapshot/lib/get_nodes.ts
index f59756e0c5b25..a3ca2cfd683bb 100644
--- a/x-pack/plugins/infra/server/routes/snapshot/lib/get_nodes.ts
+++ b/x-pack/plugins/infra/server/routes/snapshot/lib/get_nodes.ts
@@ -16,7 +16,6 @@ import { LogQueryFields } from '../../../services/log_queries/get_log_query_fiel
 
 export interface SourceOverrides {
   indexPattern: string;
-  timestamp: string;
 }
 
 const transformAndQueryData = async ({
diff --git a/x-pack/plugins/infra/server/routes/snapshot/lib/transform_request_to_metrics_api_request.test.ts b/x-pack/plugins/infra/server/routes/snapshot/lib/transform_request_to_metrics_api_request.test.ts
index b4e6983a09900..aac5f9e145022 100644
--- a/x-pack/plugins/infra/server/routes/snapshot/lib/transform_request_to_metrics_api_request.test.ts
+++ b/x-pack/plugins/infra/server/routes/snapshot/lib/transform_request_to_metrics_api_request.test.ts
@@ -47,12 +47,7 @@ const source: InfraSource = {
       indexPatternId: 'kibana_index_pattern',
     },
     fields: {
-      container: 'container.id',
-      host: 'host.name',
       message: ['message', '@message'],
-      pod: 'kubernetes.pod.uid',
-      tiebreaker: '_doc',
-      timestamp: '@timestamp',
     },
     inventoryDefaultView: '0',
     metricsExplorerDefaultView: '0',
@@ -80,7 +75,7 @@ const snapshotRequest: SnapshotRequest = {
 
 const metricsApiRequest = {
   indexPattern: 'metrics-*,metricbeat-*',
-  timerange: { field: '@timestamp', from: 1605705900000, to: 1605706200000, interval: '60s' },
+  timerange: { from: 1605705900000, to: 1605706200000, interval: '60s' },
   metrics: [
     {
       id: 'cpu',
diff --git a/x-pack/plugins/infra/server/routes/snapshot/lib/transform_request_to_metrics_api_request.ts b/x-pack/plugins/infra/server/routes/snapshot/lib/transform_request_to_metrics_api_request.ts
index 3901c8677ae9b..b7e389cae9126 100644
--- a/x-pack/plugins/infra/server/routes/snapshot/lib/transform_request_to_metrics_api_request.ts
+++ b/x-pack/plugins/infra/server/routes/snapshot/lib/transform_request_to_metrics_api_request.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { TIMESTAMP_FIELD } from '../../../../common/constants';
 import { findInventoryFields, findInventoryModel } from '../../../../common/inventory_models';
 import { MetricsAPIRequest, SnapshotRequest } from '../../../../common/http_api';
 import { ESSearchClient } from '../../../lib/metrics/types';
@@ -37,7 +38,6 @@ export const transformRequestToMetricsAPIRequest = async ({
   const metricsApiRequest: MetricsAPIRequest = {
     indexPattern: sourceOverrides?.indexPattern ?? source.configuration.metricAlias,
     timerange: {
-      field: sourceOverrides?.timestamp ?? source.configuration.fields.timestamp,
       from: timeRangeWithIntervalApplied.from,
       to: timeRangeWithIntervalApplied.to,
       interval: timeRangeWithIntervalApplied.interval,
@@ -69,10 +69,7 @@ export const transformRequestToMetricsAPIRequest = async ({
     inventoryModel.nodeFilter?.forEach((f) => filters.push(f));
   }
 
-  const inventoryFields = findInventoryFields(
-    snapshotRequest.nodeType,
-    source.configuration.fields
-  );
+  const inventoryFields = findInventoryFields(snapshotRequest.nodeType);
   if (snapshotRequest.groupBy) {
     const groupBy = snapshotRequest.groupBy.map((g) => g.field).filter(Boolean) as string[];
     metricsApiRequest.groupBy = [...groupBy, inventoryFields.id];
@@ -86,7 +83,7 @@ export const transformRequestToMetricsAPIRequest = async ({
           size: 1,
           metrics: [{ field: inventoryFields.name }],
           sort: {
-            [source.configuration.fields.timestamp]: 'desc',
+            [TIMESTAMP_FIELD]: 'desc',
           },
         },
       },
diff --git a/x-pack/plugins/infra/server/services/log_entries/log_entries_search_strategy.test.ts b/x-pack/plugins/infra/server/services/log_entries/log_entries_search_strategy.test.ts
index b0d2eeb987861..e48c990d7822f 100644
--- a/x-pack/plugins/infra/server/services/log_entries/log_entries_search_strategy.test.ts
+++ b/x-pack/plugins/infra/server/services/log_entries/log_entries_search_strategy.test.ts
@@ -289,12 +289,7 @@ const createSourceConfigurationMock = (): InfraSource => ({
       },
     ],
     fields: {
-      pod: 'POD_FIELD',
-      host: 'HOST_FIELD',
-      container: 'CONTAINER_FIELD',
       message: ['MESSAGE_FIELD'],
-      timestamp: 'TIMESTAMP_FIELD',
-      tiebreaker: 'TIEBREAKER_FIELD',
     },
     anomalyThreshold: 20,
   },
diff --git a/x-pack/plugins/infra/server/services/log_entries/log_entry_search_strategy.test.ts b/x-pack/plugins/infra/server/services/log_entries/log_entry_search_strategy.test.ts
index 1f03878ba6feb..685f11cb00a86 100644
--- a/x-pack/plugins/infra/server/services/log_entries/log_entry_search_strategy.test.ts
+++ b/x-pack/plugins/infra/server/services/log_entries/log_entry_search_strategy.test.ts
@@ -244,12 +244,7 @@ const createSourceConfigurationMock = (): InfraSource => ({
     metricsExplorerDefaultView: 'DEFAULT_VIEW',
     logColumns: [],
     fields: {
-      pod: 'POD_FIELD',
-      host: 'HOST_FIELD',
-      container: 'CONTAINER_FIELD',
       message: ['MESSAGE_FIELD'],
-      timestamp: 'TIMESTAMP_FIELD',
-      tiebreaker: 'TIEBREAKER_FIELD',
     },
     anomalyThreshold: 20,
   },
diff --git a/x-pack/plugins/infra/server/services/log_queries/get_log_query_fields.ts b/x-pack/plugins/infra/server/services/log_queries/get_log_query_fields.ts
index 55491db97dbd6..db1696854db83 100644
--- a/x-pack/plugins/infra/server/services/log_queries/get_log_query_fields.ts
+++ b/x-pack/plugins/infra/server/services/log_queries/get_log_query_fields.ts
@@ -12,7 +12,6 @@ import { KibanaFramework } from '../../lib/adapters/framework/kibana_framework_a
 
 export interface LogQueryFields {
   indexPattern: string;
-  timestamp: string;
 }
 
 export const createGetLogQueryFields = (sources: InfraSources, framework: KibanaFramework) => {
@@ -29,7 +28,6 @@ export const createGetLogQueryFields = (sources: InfraSources, framework: Kibana
 
     return {
       indexPattern: resolvedLogSourceConfiguration.indices,
-      timestamp: resolvedLogSourceConfiguration.timestampField,
     };
   };
 };
diff --git a/x-pack/plugins/infra/server/utils/calculate_metric_interval.ts b/x-pack/plugins/infra/server/utils/calculate_metric_interval.ts
index 3357b1a842183..cb754153c6615 100644
--- a/x-pack/plugins/infra/server/utils/calculate_metric_interval.ts
+++ b/x-pack/plugins/infra/server/utils/calculate_metric_interval.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { TIMESTAMP_FIELD } from '../../common/constants';
 import { findInventoryModel } from '../../common/inventory_models';
 // import { KibanaFramework } from '../lib/adapters/framework/kibana_framework_adapter';
 import { InventoryItemType } from '../../common/inventory_models/types';
@@ -12,7 +13,6 @@ import { ESSearchClient } from '../lib/metrics/types';
 
 interface Options {
   indexPattern: string;
-  timestampField: string;
   timerange: {
     from: number;
     to: number;
@@ -44,7 +44,7 @@ export const calculateMetricInterval = async (
           filter: [
             {
               range: {
-                [options.timestampField]: {
+                [TIMESTAMP_FIELD]: {
                   gte: from,
                   lte: options.timerange.to,
                   format: 'epoch_millis',
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/index.ts b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/index.ts
index 5c59e6c0e2449..0d63e9cd2462b 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/index.ts
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/index.ts
@@ -5,9 +5,11 @@
  * 2.0.
  */
 
-export { ProcessorForm, ProcessorFormOnSubmitArg, OnSubmitHandler } from './processor_form';
+export type { ProcessorFormOnSubmitArg, OnSubmitHandler } from './processor_form';
+export { ProcessorForm } from './processor_form';
 
-export { ProcessorsTree, ProcessorInfo, OnActionHandler } from './processors_tree';
+export type { ProcessorInfo, OnActionHandler } from './processors_tree';
+export { ProcessorsTree } from './processors_tree';
 
 export { PipelineProcessorsEditor } from './pipeline_processors_editor';
 
@@ -15,11 +17,13 @@ export { PipelineProcessorsEditorItem } from './pipeline_processors_editor_item'
 
 export { ProcessorRemoveModal } from './processor_remove_modal';
 
-export { OnDoneLoadJsonHandler, LoadFromJsonButton } from './load_from_json';
+export type { OnDoneLoadJsonHandler } from './load_from_json';
+export { LoadFromJsonButton } from './load_from_json';
 
 export { TestPipelineActions } from './test_pipeline';
 
-export { PipelineProcessorsItemTooltip, Position } from './pipeline_processors_editor_item_tooltip';
+export type { Position } from './pipeline_processors_editor_item_tooltip';
+export { PipelineProcessorsItemTooltip } from './pipeline_processors_editor_item_tooltip';
 
 export { ProcessorsEmptyPrompt } from './processors_empty_prompt';
 
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/load_from_json/index.ts b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/load_from_json/index.ts
index 2e89e4b907f07..1d8fd204b4583 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/load_from_json/index.ts
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/load_from_json/index.ts
@@ -6,4 +6,4 @@
  */
 
 export { LoadFromJsonButton } from './button';
-export { OnDoneLoadJsonHandler } from './modal_provider';
+export type { OnDoneLoadJsonHandler } from './modal_provider';
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/pipeline_processors_editor_item/index.ts b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/pipeline_processors_editor_item/index.ts
index a88f51cda2ebd..8b029747c1cbf 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/pipeline_processors_editor_item/index.ts
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/pipeline_processors_editor_item/index.ts
@@ -7,4 +7,4 @@
 
 export { PipelineProcessorsEditorItem } from './pipeline_processors_editor_item.container';
 
-export { Handlers } from './types';
+export type { Handlers } from './types';
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/pipeline_processors_editor_item_tooltip/index.ts b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/pipeline_processors_editor_item_tooltip/index.ts
index e51d286a2b013..f8967a8945b2a 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/pipeline_processors_editor_item_tooltip/index.ts
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/pipeline_processors_editor_item_tooltip/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { PipelineProcessorsItemTooltip, Position } from './pipeline_processors_editor_item_tooltip';
+export type { Position } from './pipeline_processors_editor_item_tooltip';
+export { PipelineProcessorsItemTooltip } from './pipeline_processors_editor_item_tooltip';
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/processor_form/index.ts b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/processor_form/index.ts
index 75c0e4ec7cccd..1418c919cb6b1 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/processor_form/index.ts
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/processor_form/index.ts
@@ -5,8 +5,5 @@
  * 2.0.
  */
 
-export {
-  ProcessorFormContainer as ProcessorForm,
-  ProcessorFormOnSubmitArg,
-  OnSubmitHandler,
-} from './processor_form.container';
+export type { ProcessorFormOnSubmitArg, OnSubmitHandler } from './processor_form.container';
+export { ProcessorFormContainer as ProcessorForm } from './processor_form.container';
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/processor_form/processors/index.ts b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/processor_form/processors/index.ts
index 1a2422b40d0b0..e3a0fae36e577 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/processor_form/processors/index.ts
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/processor_form/processors/index.ts
@@ -45,4 +45,4 @@ export { UrlDecode } from './url_decode';
 export { UserAgent } from './user_agent';
 export { UriParts } from './uri_parts';
 
-export { FormFieldsComponent } from './shared';
+export type { FormFieldsComponent } from './shared';
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/processors_tree/index.ts b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/processors_tree/index.ts
index e8ac8bce8c4c8..3cb4f1f0f3505 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/processors_tree/index.ts
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/processors_tree/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { ProcessorsTree, OnActionHandler, ProcessorInfo } from './processors_tree';
+export type { OnActionHandler, ProcessorInfo } from './processors_tree';
+export { ProcessorsTree } from './processors_tree';
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/shared/index.ts b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/shared/index.ts
index d62ebab7c650c..8d71908bca5e4 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/shared/index.ts
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/shared/index.ts
@@ -5,10 +5,7 @@
  * 2.0.
  */
 
-export {
-  getProcessorDescriptor,
-  mapProcessorTypeToDescriptor,
-  ProcessorType,
-} from './map_processor_type_to_form';
+export type { ProcessorType } from './map_processor_type_to_form';
+export { getProcessorDescriptor, mapProcessorTypeToDescriptor } from './map_processor_type_to_form';
 
 export { ErrorIcon, ErrorIgnoredIcon, SkippedIcon } from './status_icons';
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/test_pipeline/test_pipeline_tabs/index.ts b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/test_pipeline/test_pipeline_tabs/index.ts
index 725f65f28ab91..82ba99a438522 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/test_pipeline/test_pipeline_tabs/index.ts
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/test_pipeline/test_pipeline_tabs/index.ts
@@ -5,7 +5,8 @@
  * 2.0.
  */
 
-export { Tabs, TestPipelineFlyoutTab } from './test_pipeline_tabs';
+export type { TestPipelineFlyoutTab } from './test_pipeline_tabs';
+export { Tabs } from './test_pipeline_tabs';
 
 export { DocumentsTab } from './tab_documents';
 
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/context/index.ts b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/context/index.ts
index 261393e35a2bb..6a83b29dc0d06 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/context/index.ts
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/context/index.ts
@@ -7,15 +7,11 @@
 
 export { ProcessorsEditorContextProvider } from './context';
 
-export {
-  TestPipelineContextProvider,
-  useTestPipelineContext,
-  TestPipelineData,
-  TestPipelineContext,
-} from './test_pipeline_context';
+export type { TestPipelineData, TestPipelineContext } from './test_pipeline_context';
+export { TestPipelineContextProvider, useTestPipelineContext } from './test_pipeline_context';
 
+export type { Props } from './processors_context';
 export {
   PipelineProcessorsContextProvider,
   usePipelineProcessorsContext,
-  Props,
 } from './processors_context';
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/index.ts b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/index.ts
index 3149abeb8e1e6..a3996721ed748 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/index.ts
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/index.ts
@@ -5,12 +5,13 @@
  * 2.0.
  */
 
-export { Props, ProcessorsEditorContextProvider } from './context';
+export type { Props } from './context';
+export { ProcessorsEditorContextProvider } from './context';
 
-export { OnUpdateHandlerArg, OnUpdateHandler } from './types';
+export type { OnUpdateHandlerArg, OnUpdateHandler } from './types';
 
-export { SerializeResult } from './serialize';
+export type { SerializeResult } from './serialize';
 
-export { OnDoneLoadJsonHandler } from './components';
+export type { OnDoneLoadJsonHandler } from './components';
 
 export { PipelineEditor } from './pipeline_editor';
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/processors_reducer/index.ts b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/processors_reducer/index.ts
index 664e82e81a12c..59753e5cfdbba 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/processors_reducer/index.ts
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/processors_reducer/index.ts
@@ -5,13 +5,8 @@
  * 2.0.
  */
 
-export {
-  State,
-  reducer,
-  useProcessorsState,
-  ProcessorsDispatch,
-  Action,
-} from './processors_reducer';
+export type { State, ProcessorsDispatch, Action } from './processors_reducer';
+export { reducer, useProcessorsState } from './processors_reducer';
 
 export * from './constants';
 
diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/types.ts b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/types.ts
index efb2c4a42c763..fba905d8e26bf 100644
--- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/types.ts
+++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/types.ts
@@ -31,7 +31,7 @@ export interface ProcessorInternal<CustomProcessorOptions = {}> {
   onFailure?: ProcessorInternal[];
 }
 
-export { OnFormUpdateArg };
+export type { OnFormUpdateArg };
 
 export interface FormValidityState {
   validate: OnFormUpdateArg<any>['validate'];
diff --git a/x-pack/plugins/ingest_pipelines/public/shared_imports.ts b/x-pack/plugins/ingest_pipelines/public/shared_imports.ts
index 29be11430bf64..bcc0060c1e5d4 100644
--- a/x-pack/plugins/ingest_pipelines/public/shared_imports.ts
+++ b/x-pack/plugins/ingest_pipelines/public/shared_imports.ts
@@ -10,51 +10,55 @@ import { AppServices } from './application';
 
 export { CodeEditor };
 
+export type {
+  Error,
+  SendRequestConfig,
+  SendRequestResponse,
+  UseRequestConfig,
+  OnJsonEditorUpdateHandler,
+} from '../../../../src/plugins/es_ui_shared/public/';
 export {
   AuthorizationProvider,
-  Error,
   NotAuthorizedSection,
   SectionError,
   SectionLoading,
   sendRequest,
-  SendRequestConfig,
-  SendRequestResponse,
   useAuthorizationContext,
   useRequest,
-  UseRequestConfig,
   WithPrivileges,
   XJson,
   JsonEditor,
-  OnJsonEditorUpdateHandler,
   attemptToURIDecode,
 } from '../../../../src/plugins/es_ui_shared/public/';
 
-export {
+export type {
   FormSchema,
-  FIELD_TYPES,
   FormConfig,
-  useForm,
-  Form,
-  getUseField,
   ValidationFuncArg,
   FormData,
-  UseField,
-  UseArray,
   ArrayItem,
   FormHook,
-  useFormContext,
-  UseMultiFields,
-  FormDataProvider,
   OnFormUpdateArg,
   FieldConfig,
   FieldHook,
-  getFieldValidityAndErrorMessage,
   ValidationFunc,
   ValidationConfig,
-  useFormData,
   FormOptions,
   SerializerFunc,
 } from '../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib';
+export {
+  FIELD_TYPES,
+  useForm,
+  Form,
+  getUseField,
+  UseField,
+  UseArray,
+  useFormContext,
+  UseMultiFields,
+  FormDataProvider,
+  getFieldValidityAndErrorMessage,
+  useFormData,
+} from '../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib';
 
 export {
   fieldFormatters,
diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/chart_switch.tsx b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/chart_switch.tsx
index 427306cb54fb9..250359822e068 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/chart_switch.tsx
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/chart_switch.tsx
@@ -336,6 +336,7 @@ export const ChartSwitch = memo(function ChartSwitch(props: Props) {
                         <EuiFlexGroup
                           gutterSize="xs"
                           responsive={false}
+                          alignItems="center"
                           className="lnsChartSwitch__append"
                         >
                           {v.selection.dataLoss !== 'nothing' ? (
diff --git a/x-pack/plugins/lens/public/index.ts b/x-pack/plugins/lens/public/index.ts
index 9be07a4f44dcd..fb7cefb22d175 100644
--- a/x-pack/plugins/lens/public/index.ts
+++ b/x-pack/plugins/lens/public/index.ts
@@ -58,6 +58,6 @@ export type {
 } from './indexpattern_datasource/types';
 export type { LensEmbeddableInput } from './embeddable';
 
-export { LensPublicStart } from './plugin';
+export type { LensPublicStart } from './plugin';
 
 export const plugin = () => new LensPlugin();
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/indexpattern.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/indexpattern.tsx
index d90dc83bc1fef..bdcc0e621cc36 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/indexpattern.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/indexpattern.tsx
@@ -58,7 +58,8 @@ import { GeoFieldWorkspacePanel } from '../editor_frame_service/editor_frame/wor
 import { DraggingIdentifier } from '../drag_drop';
 import { getStateTimeShiftWarningMessages } from './time_shift_utils';
 
-export { OperationType, IndexPatternColumn, deleteColumn } from './operations';
+export type { OperationType, IndexPatternColumn } from './operations';
+export { deleteColumn } from './operations';
 
 export function columnToOperation(column: IndexPatternColumn, uniqueLabel?: string): Operation {
   const { dataType, label, isBucketed, scale } = column;
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/calculations/index.ts b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/calculations/index.ts
index a7741bc60d646..1ffbdea00b775 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/calculations/index.ts
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/calculations/index.ts
@@ -5,17 +5,23 @@
  * 2.0.
  */
 
-export { counterRateOperation, CounterRateIndexPatternColumn } from './counter_rate';
-export { cumulativeSumOperation, CumulativeSumIndexPatternColumn } from './cumulative_sum';
-export { derivativeOperation, DerivativeIndexPatternColumn } from './differences';
-export { movingAverageOperation, MovingAverageIndexPatternColumn } from './moving_average';
+export type { CounterRateIndexPatternColumn } from './counter_rate';
+export { counterRateOperation } from './counter_rate';
+export type { CumulativeSumIndexPatternColumn } from './cumulative_sum';
+export { cumulativeSumOperation } from './cumulative_sum';
+export type { DerivativeIndexPatternColumn } from './differences';
+export { derivativeOperation } from './differences';
+export type { MovingAverageIndexPatternColumn } from './moving_average';
+export { movingAverageOperation } from './moving_average';
+export type {
+  OverallSumIndexPatternColumn,
+  OverallMinIndexPatternColumn,
+  OverallMaxIndexPatternColumn,
+  OverallAverageIndexPatternColumn,
+} from './overall_metric';
 export {
   overallSumOperation,
-  OverallSumIndexPatternColumn,
   overallMinOperation,
-  OverallMinIndexPatternColumn,
   overallMaxOperation,
-  OverallMaxIndexPatternColumn,
   overallAverageOperation,
-  OverallAverageIndexPatternColumn,
 } from './overall_metric';
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/formula/index.ts b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/formula/index.ts
index bafde0d37b3e9..5ff0c4e2d4bd7 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/formula/index.ts
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/formula/index.ts
@@ -5,6 +5,8 @@
  * 2.0.
  */
 
-export { formulaOperation, FormulaIndexPatternColumn } from './formula';
+export type { FormulaIndexPatternColumn } from './formula';
+export { formulaOperation } from './formula';
 export { regenerateLayerFromAst } from './parse';
-export { mathOperation, MathIndexPatternColumn } from './math';
+export type { MathIndexPatternColumn } from './math';
+export { mathOperation } from './math';
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/index.ts b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/index.ts
index 0212c73f46879..392b2b135ca22 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/index.ts
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/operations/definitions/index.ts
@@ -93,21 +93,21 @@ export type IndexPatternColumn =
 
 export type FieldBasedIndexPatternColumn = Extract<IndexPatternColumn, { sourceField: string }>;
 
-export { IncompleteColumn } from './column_types';
+export type { IncompleteColumn } from './column_types';
 
-export { TermsIndexPatternColumn } from './terms';
-export { FiltersIndexPatternColumn } from './filters';
-export { CardinalityIndexPatternColumn } from './cardinality';
-export { PercentileIndexPatternColumn } from './percentile';
-export {
+export type { TermsIndexPatternColumn } from './terms';
+export type { FiltersIndexPatternColumn } from './filters';
+export type { CardinalityIndexPatternColumn } from './cardinality';
+export type { PercentileIndexPatternColumn } from './percentile';
+export type {
   MinIndexPatternColumn,
   AvgIndexPatternColumn,
   SumIndexPatternColumn,
   MaxIndexPatternColumn,
   MedianIndexPatternColumn,
 } from './metrics';
-export { DateHistogramIndexPatternColumn } from './date_histogram';
-export {
+export type { DateHistogramIndexPatternColumn } from './date_histogram';
+export type {
   CumulativeSumIndexPatternColumn,
   CounterRateIndexPatternColumn,
   DerivativeIndexPatternColumn,
@@ -117,11 +117,11 @@ export {
   OverallMaxIndexPatternColumn,
   OverallAverageIndexPatternColumn,
 } from './calculations';
-export { CountIndexPatternColumn } from './count';
-export { LastValueIndexPatternColumn } from './last_value';
-export { RangeIndexPatternColumn } from './ranges';
-export { FormulaIndexPatternColumn, MathIndexPatternColumn } from './formula';
-export { StaticValueIndexPatternColumn } from './static_value';
+export type { CountIndexPatternColumn } from './count';
+export type { LastValueIndexPatternColumn } from './last_value';
+export type { RangeIndexPatternColumn } from './ranges';
+export type { FormulaIndexPatternColumn, MathIndexPatternColumn } from './formula';
+export type { StaticValueIndexPatternColumn } from './static_value';
 
 // List of all operation definitions registered to this data source.
 // If you want to implement a new operation, add the definition to this array and
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/operations/index.ts b/x-pack/plugins/lens/public/indexpattern_datasource/operations/index.ts
index 7899ce9efcedf..86add22b2b8ce 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/operations/index.ts
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/operations/index.ts
@@ -8,7 +8,7 @@
 export * from './operations';
 export * from './layer_helpers';
 export * from './time_scale_utils';
-export {
+export type {
   OperationType,
   IndexPatternColumn,
   FieldBasedIndexPatternColumn,
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/types.ts b/x-pack/plugins/lens/public/indexpattern_datasource/types.ts
index 588b259520272..515693b4dd5c8 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/types.ts
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/types.ts
@@ -11,7 +11,7 @@ import type { FieldSpec } from '../../../../../src/plugins/data/common';
 import type { DragDropIdentifier } from '../drag_drop/providers';
 import type { FieldFormatParams } from '../../../../../src/plugins/field_formats/common';
 
-export {
+export type {
   FieldBasedIndexPatternColumn,
   IndexPatternColumn,
   OperationType,
diff --git a/x-pack/plugins/lens/public/mocks/index.ts b/x-pack/plugins/lens/public/mocks/index.ts
index 2dd32a1679f1b..e9f03cde2642e 100644
--- a/x-pack/plugins/lens/public/mocks/index.ts
+++ b/x-pack/plugins/lens/public/mocks/index.ts
@@ -16,12 +16,12 @@ export { datasourceMap, mockDatasourceMap, createMockDatasource } from './dataso
 export type { DatasourceMock } from './datasource_mock';
 export { createExpressionRendererMock } from './expression_renderer_mock';
 export { defaultDoc, exactMatchDoc, makeDefaultServices } from './services_mock';
+export type { MountStoreProps } from './store_mocks';
 export {
   mockStoreDeps,
   mockDatasourceStates,
   defaultState,
   makeLensStore,
-  MountStoreProps,
   mountWithProvider,
 } from './store_mocks';
 export { lensPluginMock } from './lens_plugin_mock';
diff --git a/x-pack/plugins/lens/public/shared_components/index.ts b/x-pack/plugins/lens/public/shared_components/index.ts
index f268d6816910e..9ffddaa1a135b 100644
--- a/x-pack/plugins/lens/public/shared_components/index.ts
+++ b/x-pack/plugins/lens/public/shared_components/index.ts
@@ -6,7 +6,8 @@
  */
 
 export * from './empty_placeholder';
-export { ToolbarPopoverProps, ToolbarPopover } from './toolbar_popover';
+export type { ToolbarPopoverProps } from './toolbar_popover';
+export { ToolbarPopover } from './toolbar_popover';
 export { LegendSettingsPopover } from './legend_settings_popover';
 export { PalettePicker } from './palette_picker';
 export { TooltipWrapper } from './tooltip_wrapper';
diff --git a/x-pack/plugins/license_management/public/application/index.tsx b/x-pack/plugins/license_management/public/application/index.tsx
index a289a40e72da8..16b6ebb1afdf9 100644
--- a/x-pack/plugins/license_management/public/application/index.tsx
+++ b/x-pack/plugins/license_management/public/application/index.tsx
@@ -36,4 +36,4 @@ export const renderApp = (element: Element, dependencies: AppDependencies) => {
   };
 };
 
-export { AppDependencies };
+export type { AppDependencies };
diff --git a/x-pack/plugins/license_management/public/index.ts b/x-pack/plugins/license_management/public/index.ts
index d36a08a999f41..c63cab6f4ad09 100644
--- a/x-pack/plugins/license_management/public/index.ts
+++ b/x-pack/plugins/license_management/public/index.ts
@@ -9,5 +9,5 @@ import { PluginInitializerContext } from 'src/core/public';
 import { LicenseManagementUIPlugin } from './plugin';
 import './application/index.scss';
 
-export { LicenseManagementUIPluginSetup, LicenseManagementUIPluginStart } from './plugin';
+export type { LicenseManagementUIPluginSetup, LicenseManagementUIPluginStart } from './plugin';
 export const plugin = (ctx: PluginInitializerContext) => new LicenseManagementUIPlugin(ctx);
diff --git a/x-pack/plugins/lists/common/schemas/response/exception_export_details_schema.mock.ts b/x-pack/plugins/lists/common/schemas/response/exception_export_details_schema.mock.ts
new file mode 100644
index 0000000000000..91b20a49213d6
--- /dev/null
+++ b/x-pack/plugins/lists/common/schemas/response/exception_export_details_schema.mock.ts
@@ -0,0 +1,28 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ExportExceptionDetails } from '@kbn/securitysolution-io-ts-list-types';
+
+export interface ExportExceptionDetailsMock {
+  listCount?: number;
+  missingListsCount?: number;
+  missingLists?: Array<Record<'list_id', string>>;
+  itemCount?: number;
+  missingItemCount?: number;
+  missingItems?: Array<Record<'item_id', string>>;
+}
+
+export const getExceptionExportDetailsMock = (
+  details?: ExportExceptionDetailsMock
+): ExportExceptionDetails => ({
+  exported_exception_list_count: details?.listCount ?? 0,
+  exported_exception_list_item_count: details?.itemCount ?? 0,
+  missing_exception_list_item_count: details?.missingItemCount ?? 0,
+  missing_exception_list_items: details?.missingItems ?? [],
+  missing_exception_lists: details?.missingLists ?? [],
+  missing_exception_lists_count: details?.missingListsCount ?? 0,
+});
diff --git a/x-pack/plugins/lists/server/index.ts b/x-pack/plugins/lists/server/index.ts
index 9f395cb0d94bc..d8e13e86329c1 100644
--- a/x-pack/plugins/lists/server/index.ts
+++ b/x-pack/plugins/lists/server/index.ts
@@ -12,7 +12,7 @@ import { ListPlugin } from './plugin';
 
 // exporting these since its required at top level in siem plugin
 export { ListClient } from './services/lists/list_client';
-export {
+export type {
   CreateExceptionListItemOptions,
   UpdateExceptionListItemOptions,
 } from './services/exception_lists/exception_list_client_types';
diff --git a/x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts b/x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts
index 14de474974c11..d6edf83428587 100644
--- a/x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts
+++ b/x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts
@@ -15,6 +15,7 @@ import type {
   ExceptionListItemTypeOrUndefined,
   ExceptionListType,
   ExceptionListTypeOrUndefined,
+  ExportExceptionDetails,
   FilterOrUndefined,
   Id,
   IdOrUndefined,
@@ -229,12 +230,5 @@ export interface ExportExceptionListAndItemsOptions {
 
 export interface ExportExceptionListAndItemsReturn {
   exportData: string;
-  exportDetails: {
-    exported_exception_list_count: number;
-    exported_exception_list_item_count: number;
-    missing_exception_list_item_count: number;
-    missing_exception_list_items: string[];
-    missing_exception_lists: string[];
-    missing_exception_lists_count: number;
-  };
+  exportDetails: ExportExceptionDetails;
 }
diff --git a/x-pack/plugins/lists/server/services/exception_lists/export_exception_list_and_items.ts b/x-pack/plugins/lists/server/services/exception_lists/export_exception_list_and_items.ts
index 46b3df4e5ac44..b071c72a9b122 100644
--- a/x-pack/plugins/lists/server/services/exception_lists/export_exception_list_and_items.ts
+++ b/x-pack/plugins/lists/server/services/exception_lists/export_exception_list_and_items.ts
@@ -6,6 +6,7 @@
  */
 
 import type {
+  ExportExceptionDetails,
   IdOrUndefined,
   ListIdOrUndefined,
   NamespaceType,
@@ -25,14 +26,7 @@ interface ExportExceptionListAndItemsOptions {
 
 export interface ExportExceptionListAndItemsReturn {
   exportData: string;
-  exportDetails: {
-    exported_exception_list_count: number;
-    exported_exception_list_item_count: number;
-    missing_exception_list_item_count: number;
-    missing_exception_list_items: string[];
-    missing_exception_lists: string[];
-    missing_exception_lists_count: number;
-  };
+  exportDetails: ExportExceptionDetails;
 }
 
 export const exportExceptionListAndItems = async ({
diff --git a/x-pack/plugins/maps/common/elasticsearch_util/index.ts b/x-pack/plugins/maps/common/elasticsearch_util/index.ts
index 6febb237cdda7..b5b20d70a7c76 100644
--- a/x-pack/plugins/maps/common/elasticsearch_util/index.ts
+++ b/x-pack/plugins/maps/common/elasticsearch_util/index.ts
@@ -9,4 +9,5 @@ export * from './es_agg_utils';
 export * from './elasticsearch_geo_utils';
 export * from './spatial_filter_utils';
 export * from './types';
-export { isTotalHitsGreaterThan, TotalHits } from './total_hits';
+export type { TotalHits } from './total_hits';
+export { isTotalHitsGreaterThan } from './total_hits';
diff --git a/x-pack/plugins/maps/common/index.ts b/x-pack/plugins/maps/common/index.ts
index 8374a4d0dbaa3..517ed0bceff10 100644
--- a/x-pack/plugins/maps/common/index.ts
+++ b/x-pack/plugins/maps/common/index.ts
@@ -19,7 +19,7 @@ export {
   SYMBOLIZE_AS_TYPES,
 } from './constants';
 
-export {
+export type {
   EMSFileSourceDescriptor,
   ESTermSourceDescriptor,
   LayerDescriptor,
diff --git a/x-pack/plugins/maps/public/actions/index.ts b/x-pack/plugins/maps/public/actions/index.ts
index 4c869698d5ac1..f4d6997333c6c 100644
--- a/x-pack/plugins/maps/public/actions/index.ts
+++ b/x-pack/plugins/maps/public/actions/index.ts
@@ -10,9 +10,9 @@ export * from './ui_actions';
 export * from './map_actions';
 export * from './map_action_constants';
 export * from './layer_actions';
+export type { DataRequestContext } from './data_request_actions';
 export {
   cancelAllInFlightRequests,
-  DataRequestContext,
   fitToLayerExtent,
   fitToDataBounds,
 } from './data_request_actions';
diff --git a/x-pack/plugins/maps/public/api/index.ts b/x-pack/plugins/maps/public/api/index.ts
index 9cf7577f448be..0bbeca6f8160d 100644
--- a/x-pack/plugins/maps/public/api/index.ts
+++ b/x-pack/plugins/maps/public/api/index.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-export { MapsStartApi } from './start_api';
-export { MapsSetupApi } from './setup_api';
+export type { MapsStartApi } from './start_api';
+export type { MapsSetupApi } from './setup_api';
 export { createLayerDescriptors } from './create_layer_descriptors';
 export { suggestEMSTermJoinConfig } from './ems';
diff --git a/x-pack/plugins/maps/public/classes/fields/agg/index.ts b/x-pack/plugins/maps/public/classes/fields/agg/index.ts
index f8de2db85db91..bd0b5184fe157 100644
--- a/x-pack/plugins/maps/public/classes/fields/agg/index.ts
+++ b/x-pack/plugins/maps/public/classes/fields/agg/index.ts
@@ -6,4 +6,4 @@
  */
 
 export { esAggFieldsFactory } from './es_agg_factory';
-export { IESAggField } from './agg_field_types';
+export type { IESAggField } from './agg_field_types';
diff --git a/x-pack/plugins/maps/public/classes/layers/vector_layer/index.ts b/x-pack/plugins/maps/public/classes/layers/vector_layer/index.ts
index cb964f77613da..2b14b78f92946 100644
--- a/x-pack/plugins/maps/public/classes/layers/vector_layer/index.ts
+++ b/x-pack/plugins/maps/public/classes/layers/vector_layer/index.ts
@@ -6,10 +6,5 @@
  */
 
 export { addGeoJsonMbSource, getVectorSourceBounds, syncVectorSource } from './utils';
-export {
-  isVectorLayer,
-  IVectorLayer,
-  VectorLayer,
-  VectorLayerArguments,
-  NO_RESULTS_ICON_AND_TOOLTIPCONTENT,
-} from './vector_layer';
+export type { IVectorLayer, VectorLayerArguments } from './vector_layer';
+export { isVectorLayer, VectorLayer, NO_RESULTS_ICON_AND_TOOLTIPCONTENT } from './vector_layer';
diff --git a/x-pack/plugins/maps/public/classes/sources/ems_file_source/index.ts b/x-pack/plugins/maps/public/classes/sources/ems_file_source/index.ts
index 2d4d59c5c4159..6c9d7060e9a4b 100644
--- a/x-pack/plugins/maps/public/classes/sources/ems_file_source/index.ts
+++ b/x-pack/plugins/maps/public/classes/sources/ems_file_source/index.ts
@@ -6,4 +6,5 @@
  */
 
 export { emsBoundariesLayerWizardConfig } from './ems_boundaries_layer_wizard';
-export { EMSFileSource, IEmsFileSource } from './ems_file_source';
+export type { IEmsFileSource } from './ems_file_source';
+export { EMSFileSource } from './ems_file_source';
diff --git a/x-pack/plugins/maps/public/classes/sources/es_search_source/index.ts b/x-pack/plugins/maps/public/classes/sources/es_search_source/index.ts
index 75217c0a29c08..54686f91c133d 100644
--- a/x-pack/plugins/maps/public/classes/sources/es_search_source/index.ts
+++ b/x-pack/plugins/maps/public/classes/sources/es_search_source/index.ts
@@ -5,7 +5,8 @@
  * 2.0.
  */
 
-export { createLayerDescriptor, CreateLayerDescriptorParams } from './create_layer_descriptor';
+export type { CreateLayerDescriptorParams } from './create_layer_descriptor';
+export { createLayerDescriptor } from './create_layer_descriptor';
 export { ESSearchSource } from './es_search_source';
 export {
   createDefaultLayerDescriptor,
diff --git a/x-pack/plugins/maps/public/classes/sources/term_join_source/index.ts b/x-pack/plugins/maps/public/classes/sources/term_join_source/index.ts
index a40533d98be87..78f7705104f73 100644
--- a/x-pack/plugins/maps/public/classes/sources/term_join_source/index.ts
+++ b/x-pack/plugins/maps/public/classes/sources/term_join_source/index.ts
@@ -5,4 +5,4 @@
  * 2.0.
  */
 
-export { ITermJoinSource } from './term_join_source';
+export type { ITermJoinSource } from './term_join_source';
diff --git a/x-pack/plugins/maps/public/classes/sources/tiled_single_layer_vector_source/index.ts b/x-pack/plugins/maps/public/classes/sources/tiled_single_layer_vector_source/index.ts
index 30177751a8d55..c60cedba61c83 100644
--- a/x-pack/plugins/maps/public/classes/sources/tiled_single_layer_vector_source/index.ts
+++ b/x-pack/plugins/maps/public/classes/sources/tiled_single_layer_vector_source/index.ts
@@ -5,4 +5,4 @@
  * 2.0.
  */
 
-export { ITiledSingleLayerVectorSource } from './tiled_single_layer_vector_source';
+export type { ITiledSingleLayerVectorSource } from './tiled_single_layer_vector_source';
diff --git a/x-pack/plugins/maps/public/connected_components/edit_layer_panel/join_editor/index.ts b/x-pack/plugins/maps/public/connected_components/edit_layer_panel/join_editor/index.ts
index 7971017a3d52b..570c1ba8fb896 100644
--- a/x-pack/plugins/maps/public/connected_components/edit_layer_panel/join_editor/index.ts
+++ b/x-pack/plugins/maps/public/connected_components/edit_layer_panel/join_editor/index.ts
@@ -31,4 +31,4 @@ function mapDispatchToProps(dispatch: ThunkDispatch<MapStoreState, void, AnyActi
 
 const connectedJoinEditor = connect(mapStateToProps, mapDispatchToProps)(JoinEditor);
 export { connectedJoinEditor as JoinEditor };
-export { JoinField } from './join_editor';
+export type { JoinField } from './join_editor';
diff --git a/x-pack/plugins/maps/public/routes/map_page/url_state/index.ts b/x-pack/plugins/maps/public/routes/map_page/url_state/index.ts
index 7b8ccbecf5636..6fa6514ac08df 100644
--- a/x-pack/plugins/maps/public/routes/map_page/url_state/index.ts
+++ b/x-pack/plugins/maps/public/routes/map_page/url_state/index.ts
@@ -5,11 +5,8 @@
  * 2.0.
  */
 
-export {
-  getGlobalState,
-  updateGlobalState,
-  startGlobalStateSyncing,
-  MapsGlobalState,
-} from './global_sync';
-export { AppStateManager, MapsAppState } from './app_state_manager';
+export type { MapsGlobalState } from './global_sync';
+export { getGlobalState, updateGlobalState, startGlobalStateSyncing } from './global_sync';
+export type { MapsAppState } from './app_state_manager';
+export { AppStateManager } from './app_state_manager';
 export { startAppStateSyncing } from './app_sync';
diff --git a/x-pack/plugins/metrics_entities/server/index.ts b/x-pack/plugins/metrics_entities/server/index.ts
index bb80ac8e8be73..15b0d110dd178 100644
--- a/x-pack/plugins/metrics_entities/server/index.ts
+++ b/x-pack/plugins/metrics_entities/server/index.ts
@@ -18,7 +18,7 @@ export const plugin = (initializerContext: PluginInitializerContext): MetricsEnt
   return new MetricsEntitiesPlugin(initializerContext);
 };
 
-export { MetricsEntitiesPluginSetup, MetricsEntitiesPluginStart } from './types';
+export type { MetricsEntitiesPluginSetup, MetricsEntitiesPluginStart } from './types';
 
 export const config = {
   schema: schema.object({
diff --git a/x-pack/plugins/ml/common/index.ts b/x-pack/plugins/ml/common/index.ts
index a64a0c0ae09fe..ad9927a533a60 100644
--- a/x-pack/plugins/ml/common/index.ts
+++ b/x-pack/plugins/ml/common/index.ts
@@ -6,7 +6,7 @@
  */
 
 export { ES_CLIENT_TOTAL_HITS_RELATION } from './types/es_client';
-export { ChartData } from './types/field_histograms';
+export type { ChartData } from './types/field_histograms';
 export { ANOMALY_SEVERITY, ANOMALY_THRESHOLD, SEVERITY_COLORS } from './constants/anomalies';
 export { getSeverityColor, getSeverityType } from './util/anomaly_utils';
 export { isPopulatedObject } from './util/object_utils';
diff --git a/x-pack/plugins/ml/common/license/index.ts b/x-pack/plugins/ml/common/license/index.ts
index 5db5bce43c747..9fb14766ba9ed 100644
--- a/x-pack/plugins/ml/common/license/index.ts
+++ b/x-pack/plugins/ml/common/license/index.ts
@@ -5,9 +5,9 @@
  * 2.0.
  */
 
+export type { LicenseStatus } from './ml_license';
 export {
   MlLicense,
-  LicenseStatus,
   MINIMUM_FULL_LICENSE,
   MINIMUM_LICENSE,
   isFullLicense,
diff --git a/x-pack/plugins/ml/common/util/errors/index.ts b/x-pack/plugins/ml/common/util/errors/index.ts
index cdc0e59d84976..f6566c98490da 100644
--- a/x-pack/plugins/ml/common/util/errors/index.ts
+++ b/x-pack/plugins/ml/common/util/errors/index.ts
@@ -7,7 +7,7 @@
 
 export { MLRequestFailure } from './request_error';
 export { extractErrorMessage, extractErrorProperties } from './process_errors';
-export {
+export type {
   ErrorType,
   ErrorMessage,
   EsErrorBody,
@@ -15,8 +15,5 @@ export {
   MLErrorObject,
   MLHttpFetchError,
   MLResponseError,
-  isBoomError,
-  isErrorString,
-  isEsErrorBody,
-  isMLResponseError,
 } from './types';
+export { isBoomError, isErrorString, isEsErrorBody, isMLResponseError } from './types';
diff --git a/x-pack/plugins/ml/public/application/components/anomalies_table/influencers_cell.js b/x-pack/plugins/ml/public/application/components/anomalies_table/influencers_cell.js
index 1f2236ad3e6a7..0059bec2929d0 100644
--- a/x-pack/plugins/ml/public/application/components/anomalies_table/influencers_cell.js
+++ b/x-pack/plugins/ml/public/application/components/anomalies_table/influencers_cell.js
@@ -12,6 +12,7 @@ import React, { Component } from 'react';
 import { EuiLink, EuiButtonIcon, EuiToolTip } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { i18n } from '@kbn/i18n';
+import { blurButtonOnClick } from '../../util/component_utils';
 
 /*
  * Component for rendering a list of record influencers inside a cell in the anomalies table.
@@ -59,13 +60,13 @@ export class InfluencersCell extends Component {
               <EuiButtonIcon
                 size="s"
                 className="filter-button"
-                onClick={() =>
+                onClick={blurButtonOnClick(() => {
                   influencerFilter(
                     influencer.influencerFieldName,
                     influencer.influencerFieldValue,
                     '+'
-                  )
-                }
+                  );
+                })}
                 iconType="plusInCircle"
                 aria-label={i18n.translate(
                   'xpack.ml.anomaliesTable.influencersCell.addFilterAriaLabel',
@@ -86,13 +87,13 @@ export class InfluencersCell extends Component {
               <EuiButtonIcon
                 size="s"
                 className="filter-button"
-                onClick={() =>
+                onClick={blurButtonOnClick(() => {
                   influencerFilter(
                     influencer.influencerFieldName,
                     influencer.influencerFieldValue,
                     '-'
-                  )
-                }
+                  );
+                })}
                 iconType="minusInCircle"
                 aria-label={i18n.translate(
                   'xpack.ml.anomaliesTable.influencersCell.removeFilterAriaLabel',
diff --git a/x-pack/plugins/ml/public/application/components/color_range_legend/index.ts b/x-pack/plugins/ml/public/application/components/color_range_legend/index.ts
index 37495d0ef739e..e72a835cb1f63 100644
--- a/x-pack/plugins/ml/public/application/components/color_range_legend/index.ts
+++ b/x-pack/plugins/ml/public/application/components/color_range_legend/index.ts
@@ -6,6 +6,7 @@
  */
 
 export { ColorRangeLegend } from './color_range_legend';
+export type { EuiThemeType } from './use_color_range';
 export {
   colorRangeOptions,
   colorRangeScaleOptions,
@@ -13,5 +14,4 @@ export {
   COLOR_RANGE,
   COLOR_RANGE_SCALE,
   useCurrentEuiTheme,
-  EuiThemeType,
 } from './use_color_range';
diff --git a/x-pack/plugins/ml/public/application/components/data_grid/index.ts b/x-pack/plugins/ml/public/application/components/data_grid/index.ts
index 481ff432e0156..b2bd1ff228923 100644
--- a/x-pack/plugins/ml/public/application/components/data_grid/index.ts
+++ b/x-pack/plugins/ml/public/application/components/data_grid/index.ts
@@ -19,7 +19,7 @@ export {
 export { getFieldType } from './use_column_chart';
 export { useDataGrid } from './use_data_grid';
 export { DataGrid } from './data_grid';
-export {
+export type {
   DataGridItem,
   EsSorting,
   RenderCellValue,
diff --git a/x-pack/plugins/ml/public/application/components/entity_cell/entity_cell.tsx b/x-pack/plugins/ml/public/application/components/entity_cell/entity_cell.tsx
index a79c8a63b3bc6..f4a3b6dbf69c4 100644
--- a/x-pack/plugins/ml/public/application/components/entity_cell/entity_cell.tsx
+++ b/x-pack/plugins/ml/public/application/components/entity_cell/entity_cell.tsx
@@ -13,6 +13,7 @@ import { i18n } from '@kbn/i18n';
 import { EMPTY_FIELD_VALUE_LABEL } from '../../timeseriesexplorer/components/entity_control/entity_control';
 import { MLCATEGORY } from '../../../../common/constants/field_types';
 import { ENTITY_FIELD_OPERATIONS } from '../../../../common/util/anomaly_utils';
+import { blurButtonOnClick } from '../../util/component_utils';
 
 export type EntityCellFilter = (
   entityName: string,
@@ -41,7 +42,9 @@ function getAddFilter({ entityName, entityValue, filter }: EntityCellProps) {
         <EuiButtonIcon
           size="s"
           className="filter-button"
-          onClick={() => filter(entityName, entityValue, ENTITY_FIELD_OPERATIONS.ADD)}
+          onClick={blurButtonOnClick(() => {
+            filter(entityName, entityValue, ENTITY_FIELD_OPERATIONS.ADD);
+          })}
           iconType="plusInCircle"
           aria-label={i18n.translate('xpack.ml.anomaliesTable.entityCell.addFilterAriaLabel', {
             defaultMessage: 'Add filter',
@@ -66,7 +69,9 @@ function getRemoveFilter({ entityName, entityValue, filter }: EntityCellProps) {
         <EuiButtonIcon
           size="s"
           className="filter-button"
-          onClick={() => filter(entityName, entityValue, ENTITY_FIELD_OPERATIONS.REMOVE)}
+          onClick={blurButtonOnClick(() => {
+            filter(entityName, entityValue, ENTITY_FIELD_OPERATIONS.REMOVE);
+          })}
           iconType="minusInCircle"
           aria-label={i18n.translate('xpack.ml.anomaliesTable.entityCell.removeFilterAriaLabel', {
             defaultMessage: 'Remove filter',
diff --git a/x-pack/plugins/ml/public/application/components/entity_cell/index.ts b/x-pack/plugins/ml/public/application/components/entity_cell/index.ts
index d29e2adf66bfe..e0d57bce48514 100644
--- a/x-pack/plugins/ml/public/application/components/entity_cell/index.ts
+++ b/x-pack/plugins/ml/public/application/components/entity_cell/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { EntityCell, EntityCellFilter } from './entity_cell';
+export type { EntityCellFilter } from './entity_cell';
+export { EntityCell } from './entity_cell';
diff --git a/x-pack/plugins/ml/public/application/components/full_time_range_selector/index.tsx b/x-pack/plugins/ml/public/application/components/full_time_range_selector/index.tsx
index c79df59ee3f69..14ad77e2adc3a 100644
--- a/x-pack/plugins/ml/public/application/components/full_time_range_selector/index.tsx
+++ b/x-pack/plugins/ml/public/application/components/full_time_range_selector/index.tsx
@@ -6,4 +6,5 @@
  */
 
 export { FullTimeRangeSelector } from './full_time_range_selector';
-export { getTimeFilterRange, TimeRange } from './full_time_range_selector_service';
+export type { TimeRange } from './full_time_range_selector_service';
+export { getTimeFilterRange } from './full_time_range_selector_service';
diff --git a/x-pack/plugins/ml/public/application/components/multi_select_picker/index.ts b/x-pack/plugins/ml/public/application/components/multi_select_picker/index.ts
index 9d32228e1c4bc..a42ce68d9aa10 100644
--- a/x-pack/plugins/ml/public/application/components/multi_select_picker/index.ts
+++ b/x-pack/plugins/ml/public/application/components/multi_select_picker/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { MultiSelectPicker, Option } from './multi_select_picker';
+export type { Option } from './multi_select_picker';
+export { MultiSelectPicker } from './multi_select_picker';
diff --git a/x-pack/plugins/ml/public/application/components/scatterplot_matrix/index.ts b/x-pack/plugins/ml/public/application/components/scatterplot_matrix/index.ts
index 216b0d8d5e992..7f7642732b2e2 100644
--- a/x-pack/plugins/ml/public/application/components/scatterplot_matrix/index.ts
+++ b/x-pack/plugins/ml/public/application/components/scatterplot_matrix/index.ts
@@ -6,4 +6,5 @@
  */
 
 export { useScatterplotFieldOptions } from './use_scatterplot_field_options';
-export { ScatterplotMatrix, ScatterplotMatrixProps } from './scatterplot_matrix';
+export type { ScatterplotMatrixProps } from './scatterplot_matrix';
+export { ScatterplotMatrix } from './scatterplot_matrix';
diff --git a/x-pack/plugins/ml/public/application/components/stats_bar/index.ts b/x-pack/plugins/ml/public/application/components/stats_bar/index.ts
index c3c44477e7f91..e1638c90c9e49 100644
--- a/x-pack/plugins/ml/public/application/components/stats_bar/index.ts
+++ b/x-pack/plugins/ml/public/application/components/stats_bar/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { StatsBar, AnalyticStatsBarStats, JobStatsBarStats, ModelsBarStats } from './stats_bar';
+export type { AnalyticStatsBarStats, JobStatsBarStats, ModelsBarStats } from './stats_bar';
+export { StatsBar } from './stats_bar';
diff --git a/x-pack/plugins/ml/public/application/contexts/kibana/index.ts b/x-pack/plugins/ml/public/application/contexts/kibana/index.ts
index 7331ebe34e915..0873d395f0b79 100644
--- a/x-pack/plugins/ml/public/application/contexts/kibana/index.ts
+++ b/x-pack/plugins/ml/public/application/contexts/kibana/index.ts
@@ -5,8 +5,10 @@
  * 2.0.
  */
 
-export { useMlKibana, StartServices, MlKibanaReactContextValue } from './kibana_context';
-export { useNavigateToPath, NavigateToPath } from './use_navigate_to_path';
+export type { StartServices, MlKibanaReactContextValue } from './kibana_context';
+export { useMlKibana } from './kibana_context';
+export type { NavigateToPath } from './use_navigate_to_path';
+export { useNavigateToPath } from './use_navigate_to_path';
 export { useUiSettings } from './use_ui_settings_context';
 export { useTimefilter } from './use_timefilter';
 export { useNotifications } from './use_notifications_context';
diff --git a/x-pack/plugins/ml/public/application/contexts/ml/index.ts b/x-pack/plugins/ml/public/application/contexts/ml/index.ts
index 20d5dca4e6c18..a5ca1ded4f1ae 100644
--- a/x-pack/plugins/ml/public/application/contexts/ml/index.ts
+++ b/x-pack/plugins/ml/public/application/contexts/ml/index.ts
@@ -5,5 +5,6 @@
  * 2.0.
  */
 
-export { MlContext, MlContextValue, SavedSearchQuery } from './ml_context';
+export type { MlContextValue, SavedSearchQuery } from './ml_context';
+export { MlContext } from './ml_context';
 export { useMlContext } from './use_ml_context';
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/common/index.ts b/x-pack/plugins/ml/public/application/data_frame_analytics/common/index.ts
index 54372b5f6afc7..2fb0daa1ed45e 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/common/index.ts
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/common/index.ts
@@ -5,6 +5,13 @@
  * 2.0.
  */
 
+export type {
+  UpdateDataFrameAnalyticsConfig,
+  IndexPattern,
+  RegressionEvaluateResponse,
+  Eval,
+  SearchQuery,
+} from './analytics';
 export {
   getAnalysisType,
   getDependentVar,
@@ -13,38 +20,26 @@ export {
   isOutlierAnalysis,
   refreshAnalyticsList$,
   useRefreshAnalyticsList,
-  UpdateDataFrameAnalyticsConfig,
-  IndexPattern,
   REFRESH_ANALYTICS_LIST_STATE,
   OUTLIER_ANALYSIS_METHOD,
-  RegressionEvaluateResponse,
   getValuesFromResponse,
   loadEvalData,
   loadDocsCount,
-  Eval,
   getPredictedFieldName,
   INDEX_STATUS,
   SEARCH_SIZE,
   defaultSearchQuery,
-  SearchQuery,
   ANALYSIS_CONFIG_TYPE,
 } from './analytics';
 
-export {
-  getDefaultFieldsFromJobCaps,
-  sortExplorationResultsFields,
-  EsId,
-  EsDoc,
-  EsDocSource,
-  EsFieldName,
-  MAX_COLUMNS,
-} from './fields';
+export type { EsId, EsDoc, EsDocSource, EsFieldName } from './fields';
+export { getDefaultFieldsFromJobCaps, sortExplorationResultsFields, MAX_COLUMNS } from './fields';
 
 export { getIndexData } from './get_index_data';
 export { getIndexFields } from './get_index_fields';
 export { getScatterplotMatrixLegendType } from './get_scatterplot_matrix_legend_type';
 
 export { useResultsViewConfig } from './use_results_view_config';
-export { DataFrameAnalyticsConfig } from '../../../../common/types/data_frame_analytics';
-export { DataFrameAnalyticsId } from '../../../../common/types/data_frame_analytics';
-export { IndexName } from '../../../../common/types/data_frame_analytics';
+export type { DataFrameAnalyticsConfig } from '../../../../common/types/data_frame_analytics';
+export type { DataFrameAnalyticsId } from '../../../../common/types/data_frame_analytics';
+export type { IndexName } from '../../../../common/types/data_frame_analytics';
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/expandable_section/index.ts b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/expandable_section/index.ts
index c8ea83aa489ce..8979a350294a5 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/expandable_section/index.ts
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/expandable_section/index.ts
@@ -5,11 +5,8 @@
  * 2.0.
  */
 
-export {
-  ExpandableSection,
-  ExpandableSectionProps,
-  HEADER_ITEMS_LOADING,
-} from './expandable_section';
+export type { ExpandableSectionProps } from './expandable_section';
+export { ExpandableSection, HEADER_ITEMS_LOADING } from './expandable_section';
 export { ExpandableSectionAnalytics } from './expandable_section_analytics';
 export { ExpandableSectionResults } from './expandable_section_results';
 export { ExpandableSectionSplom } from './expandable_section_splom';
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_page_wrapper/index.ts b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_page_wrapper/index.ts
index c91301942daa8..75d9c1e89affc 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_page_wrapper/index.ts
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_page_wrapper/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { EvaluatePanelProps, ExplorationPageWrapper } from './exploration_page_wrapper';
+export type { EvaluatePanelProps } from './exploration_page_wrapper';
+export { ExplorationPageWrapper } from './exploration_page_wrapper';
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_clone/index.ts b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_clone/index.ts
index 12d5b4be9ac6c..ba26d84d6a475 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_clone/index.ts
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_clone/index.ts
@@ -5,9 +5,6 @@
  * 2.0.
  */
 
-export {
-  extractCloningConfig,
-  isAdvancedConfig,
-  CloneDataFrameAnalyticsConfig,
-} from './clone_action_name';
+export type { CloneDataFrameAnalyticsConfig } from './clone_action_name';
+export { extractCloningConfig, isAdvancedConfig } from './clone_action_name';
 export { useCloneAction } from './use_clone_action';
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/common.ts b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/common.ts
index 1be9186a8468c..78e5a80b4cc4c 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/common.ts
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/common.ts
@@ -10,7 +10,7 @@ import { EuiTableActionsColumnType, Query, Ast } from '@elastic/eui';
 import { DATA_FRAME_TASK_STATE } from '../../../../../../../common/constants/data_frame_analytics';
 import { DataFrameTaskStateType } from '../../../../../../../common/types/data_frame_analytics';
 export { DATA_FRAME_TASK_STATE };
-export { DataFrameTaskStateType };
+export type { DataFrameTaskStateType };
 
 import { DataFrameAnalyticsId, DataFrameAnalyticsConfig } from '../../../../common';
 import {
@@ -18,7 +18,7 @@ import {
   DataFrameAnalyticsStats,
 } from '../../../../../../../common/types/data_frame_analytics';
 
-export { DataFrameAnalyticsStats } from '../../../../../../../common/types/data_frame_analytics';
+export type { DataFrameAnalyticsStats } from '../../../../../../../common/types/data_frame_analytics';
 
 export enum DATA_FRAME_MODE {
   BATCH = 'batch',
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/hooks/use_create_analytics_form/index.ts b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/hooks/use_create_analytics_form/index.ts
index f07b06ada93cf..848b8f76ab14c 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/hooks/use_create_analytics_form/index.ts
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/hooks/use_create_analytics_form/index.ts
@@ -6,9 +6,9 @@
  */
 
 export { DEFAULT_NUM_TOP_FEATURE_IMPORTANCE_VALUES } from './state';
-export {
+export type {
   AnalyticsCreationStep,
-  useCreateAnalyticsForm,
   CreateAnalyticsFormProps,
   CreateAnalyticsStepProps,
 } from './use_create_analytics_form';
+export { useCreateAnalyticsForm } from './use_create_analytics_form';
diff --git a/x-pack/plugins/ml/public/application/datavisualizer/file_based/file_datavisualizer.tsx b/x-pack/plugins/ml/public/application/datavisualizer/file_based/file_datavisualizer.tsx
index 93c0291d4f9d4..90b152453cecb 100644
--- a/x-pack/plugins/ml/public/application/datavisualizer/file_based/file_datavisualizer.tsx
+++ b/x-pack/plugins/ml/public/application/datavisualizer/file_based/file_datavisualizer.tsx
@@ -89,7 +89,7 @@ export const FileDataVisualizerPage: FC = () => {
             },
           });
         },
-        canDisplay: async () => true,
+        canDisplay: async ({ indexPatternId }) => indexPatternId !== '',
       },
     ],
     []
diff --git a/x-pack/plugins/ml/public/application/explorer/explorer_charts/components/explorer_chart_label/entity_filter/entity_filter.tsx b/x-pack/plugins/ml/public/application/explorer/explorer_charts/components/explorer_chart_label/entity_filter/entity_filter.tsx
index 2ede9d380f3bf..66f4052a6952f 100644
--- a/x-pack/plugins/ml/public/application/explorer/explorer_charts/components/explorer_chart_label/entity_filter/entity_filter.tsx
+++ b/x-pack/plugins/ml/public/application/explorer/explorer_charts/components/explorer_chart_label/entity_filter/entity_filter.tsx
@@ -12,6 +12,7 @@ import {
   ENTITY_FIELD_OPERATIONS,
   EntityFieldOperation,
 } from '../../../../../../../common/util/anomaly_utils';
+import { blurButtonOnClick } from '../../../../../util/component_utils';
 import './_entity_filter.scss';
 
 interface EntityFilterProps {
@@ -41,13 +42,13 @@ export const EntityFilter: FC<EntityFilterProps> = ({
         <EuiButtonIcon
           size="s"
           className="filter-button"
-          onClick={() =>
+          onClick={blurButtonOnClick(() => {
             onFilter({
               influencerFieldName,
               influencerFieldValue,
               action: ENTITY_FIELD_OPERATIONS.ADD,
-            })
-          }
+            });
+          })}
           iconType="plusInCircle"
           aria-label={i18n.translate('xpack.ml.entityFilter.addFilterAriaLabel', {
             defaultMessage: 'Add filter for {influencerFieldName} {influencerFieldValue}',
@@ -66,13 +67,13 @@ export const EntityFilter: FC<EntityFilterProps> = ({
         <EuiButtonIcon
           size="s"
           className="filter-button"
-          onClick={() =>
+          onClick={blurButtonOnClick(() => {
             onFilter({
               influencerFieldName,
               influencerFieldValue,
               action: ENTITY_FIELD_OPERATIONS.REMOVE,
-            })
-          }
+            });
+          })}
           iconType="minusInCircle"
           aria-label={i18n.translate('xpack.ml.entityFilter.removeFilterAriaLabel', {
             defaultMessage: 'Remove filter for {influencerFieldName} {influencerFieldValue}',
diff --git a/x-pack/plugins/ml/public/application/explorer/reducers/explorer_reducer/index.ts b/x-pack/plugins/ml/public/application/explorer/reducers/explorer_reducer/index.ts
index 91ae73628fd77..74b6c88fba8d4 100644
--- a/x-pack/plugins/ml/public/application/explorer/reducers/explorer_reducer/index.ts
+++ b/x-pack/plugins/ml/public/application/explorer/reducers/explorer_reducer/index.ts
@@ -7,4 +7,5 @@
 
 export { getIndexPattern } from './get_index_pattern';
 export { explorerReducer } from './reducer';
-export { getExplorerDefaultState, ExplorerState } from './state';
+export type { ExplorerState } from './state';
+export { getExplorerDefaultState } from './state';
diff --git a/x-pack/plugins/ml/public/application/explorer/reducers/index.ts b/x-pack/plugins/ml/public/application/explorer/reducers/index.ts
index 6652bbf132d4e..db44d1864daa1 100644
--- a/x-pack/plugins/ml/public/application/explorer/reducers/index.ts
+++ b/x-pack/plugins/ml/public/application/explorer/reducers/index.ts
@@ -5,9 +5,5 @@
  * 2.0.
  */
 
-export {
-  explorerReducer,
-  getExplorerDefaultState,
-  getIndexPattern,
-  ExplorerState,
-} from './explorer_reducer';
+export type { ExplorerState } from './explorer_reducer';
+export { explorerReducer, getExplorerDefaultState, getIndexPattern } from './explorer_reducer';
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/common/chart_loader/index.ts b/x-pack/plugins/ml/public/application/jobs/new_job/common/chart_loader/index.ts
index ee05f3777a515..f4932f4536add 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/common/chart_loader/index.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/common/chart_loader/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { ChartLoader, LineChartData, LineChartPoint } from './chart_loader';
+export type { LineChartData, LineChartPoint } from './chart_loader';
+export { ChartLoader } from './chart_loader';
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/common/components/index.ts b/x-pack/plugins/ml/public/application/jobs/new_job/common/components/index.ts
index f8de9af407285..cabbdf302f87f 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/common/components/index.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/common/components/index.ts
@@ -6,4 +6,5 @@
  */
 
 export { JobGroupsInput } from './job_groups_input';
-export { TimeRangePicker, TimeRange } from './time_range_picker';
+export type { TimeRange } from './time_range_picker';
+export { TimeRangePicker } from './time_range_picker';
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/index.ts b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/index.ts
index ec4e4c0e0c7ec..ccc26a3e0b6ae 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/index.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/index.ts
@@ -12,8 +12,8 @@ export { PopulationJobCreator } from './population_job_creator';
 export { AdvancedJobCreator } from './advanced_job_creator';
 export { CategorizationJobCreator } from './categorization_job_creator';
 export { RareJobCreator } from './rare_job_creator';
+export type { JobCreatorType } from './type_guards';
 export {
-  JobCreatorType,
   isSingleMetricJobCreator,
   isMultiMetricJobCreator,
   isPopulationJobCreator,
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_runner/index.ts b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_runner/index.ts
index 72460af14623d..2178086de5b91 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_runner/index.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_runner/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { JobRunner, ProgressSubscriber } from './job_runner';
+export type { ProgressSubscriber } from './job_runner';
+export { JobRunner } from './job_runner';
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_validator/index.ts b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_validator/index.ts
index 054fcbab0c7a8..71de7aa3724f1 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_validator/index.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_validator/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { JobValidator, Validation, BasicValidations, ValidationSummary } from './job_validator';
+export type { Validation, BasicValidations, ValidationSummary } from './job_validator';
+export { JobValidator } from './job_validator';
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/common/results_loader/index.ts b/x-pack/plugins/ml/public/application/jobs/new_job/common/results_loader/index.ts
index 19c950439fdda..e13a74e76f5ba 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/common/results_loader/index.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/common/results_loader/index.ts
@@ -5,5 +5,6 @@
  * 2.0.
  */
 
-export { ResultsLoader, Results, ModelItem, Anomaly } from './results_loader';
+export type { Results, ModelItem, Anomaly } from './results_loader';
+export { ResultsLoader } from './results_loader';
 export { CategorizationExamplesLoader } from './categorization_examples_loader';
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/advanced_detector_modal/index.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/advanced_detector_modal/index.tsx
index 7758ec28f4bbf..75a331ce5d0eb 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/advanced_detector_modal/index.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/advanced_detector_modal/index.tsx
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { AdvancedDetectorModal, ModalPayload } from './advanced_detector_modal';
+export type { ModalPayload } from './advanced_detector_modal';
+export { AdvancedDetectorModal } from './advanced_detector_modal';
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/agg_select/index.ts b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/agg_select/index.ts
index eefa14d903242..eecbacfaecccc 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/agg_select/index.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/agg_select/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { AggSelect, DropDownLabel, DropDownOption, DropDownProps, createLabel } from './agg_select';
+export type { DropDownLabel, DropDownOption, DropDownProps } from './agg_select';
+export { AggSelect, createLabel } from './agg_select';
diff --git a/x-pack/plugins/ml/public/application/routing/index.ts b/x-pack/plugins/ml/public/application/routing/index.ts
index f4b076db7ab37..1aac673b5411c 100644
--- a/x-pack/plugins/ml/public/application/routing/index.ts
+++ b/x-pack/plugins/ml/public/application/routing/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { MlRouter, MlRoute } from './router';
+export type { MlRoute } from './router';
+export { MlRouter } from './router';
diff --git a/x-pack/plugins/ml/public/application/services/toast_notification_service/index.ts b/x-pack/plugins/ml/public/application/services/toast_notification_service/index.ts
index d303cef3203b6..d2f946777284d 100644
--- a/x-pack/plugins/ml/public/application/services/toast_notification_service/index.ts
+++ b/x-pack/plugins/ml/public/application/services/toast_notification_service/index.ts
@@ -5,8 +5,8 @@
  * 2.0.
  */
 
+export type { ToastNotificationService } from './toast_notification_service';
 export {
-  ToastNotificationService,
   toastNotificationServiceProvider,
   useToastNotificationService,
   getToastNotificationService,
diff --git a/x-pack/plugins/ml/public/application/util/component_utils.ts b/x-pack/plugins/ml/public/application/util/component_utils.ts
new file mode 100644
index 0000000000000..764e4f0edd83b
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/util/component_utils.ts
@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { MouseEvent } from 'react';
+
+/**
+ * Removes focus from a button element when clicked, for example to
+ * ensure a wrapping tooltip is hidden on click.
+ */
+export const blurButtonOnClick = (callback: Function) => (event: MouseEvent<HTMLButtonElement>) => {
+  (event.target as HTMLButtonElement).blur();
+  callback();
+};
diff --git a/x-pack/plugins/ml/public/index.ts b/x-pack/plugins/ml/public/index.ts
index 6af8b8a6c876d..4913969bf5483 100755
--- a/x-pack/plugins/ml/public/index.ts
+++ b/x-pack/plugins/ml/public/index.ts
@@ -54,7 +54,8 @@ export {
 export { ES_CLIENT_TOTAL_HITS_RELATION } from '../common/types/es_client';
 
 export { ANOMALY_SEVERITY } from '../common';
-export { useMlHref, ML_PAGES, MlLocator, MlLocatorDefinition } from './locator';
+export type { MlLocator } from './locator';
+export { useMlHref, ML_PAGES, MlLocatorDefinition } from './locator';
 
 // Bundled shared exports
 // Exported this way so the code doesn't end up in ML's page load bundle
diff --git a/x-pack/plugins/ml/public/locator/ml_locator.ts b/x-pack/plugins/ml/public/locator/ml_locator.ts
index f1bcd84e77d7d..7fa573c3e653d 100644
--- a/x-pack/plugins/ml/public/locator/ml_locator.ts
+++ b/x-pack/plugins/ml/public/locator/ml_locator.ts
@@ -28,7 +28,7 @@ import {
 } from './formatters';
 import { formatTrainedModelsManagementUrl } from './formatters/trained_models';
 
-export { MlLocatorParams, MlLocator };
+export type { MlLocatorParams, MlLocator };
 
 export class MlLocatorDefinition implements LocatorDefinition<MlLocatorParams> {
   public readonly id = ML_APP_LOCATOR;
diff --git a/x-pack/plugins/ml/server/lib/capabilities/index.ts b/x-pack/plugins/ml/server/lib/capabilities/index.ts
index 623ebe56085ff..7c27aee6bf4af 100644
--- a/x-pack/plugins/ml/server/lib/capabilities/index.ts
+++ b/x-pack/plugins/ml/server/lib/capabilities/index.ts
@@ -5,9 +5,6 @@
  * 2.0.
  */
 
-export {
-  capabilitiesProvider,
-  hasMlCapabilitiesProvider,
-  HasMlCapabilities,
-} from './check_capabilities';
+export type { HasMlCapabilities } from './check_capabilities';
+export { capabilitiesProvider, hasMlCapabilitiesProvider } from './check_capabilities';
 export { setupCapabilitiesSwitcher } from './capabilities_switcher';
diff --git a/x-pack/plugins/ml/server/lib/ml_client/index.ts b/x-pack/plugins/ml/server/lib/ml_client/index.ts
index 509b83ef1edf7..b5329ba2cfbca 100644
--- a/x-pack/plugins/ml/server/lib/ml_client/index.ts
+++ b/x-pack/plugins/ml/server/lib/ml_client/index.ts
@@ -7,4 +7,4 @@
 
 export { getMlClient } from './ml_client';
 export { MLJobNotFound } from './errors';
-export { MlClient } from './types';
+export type { MlClient } from './types';
diff --git a/x-pack/plugins/ml/server/models/calendar/index.ts b/x-pack/plugins/ml/server/models/calendar/index.ts
index c5177dd675ca1..ca05246dff010 100644
--- a/x-pack/plugins/ml/server/models/calendar/index.ts
+++ b/x-pack/plugins/ml/server/models/calendar/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { CalendarManager, Calendar, FormCalendar } from './calendar_manager';
+export type { Calendar, FormCalendar } from './calendar_manager';
+export { CalendarManager } from './calendar_manager';
diff --git a/x-pack/plugins/ml/server/models/data_frame_analytics/models_provider.ts b/x-pack/plugins/ml/server/models/data_frame_analytics/models_provider.ts
index fb8480d621d55..2f40081f1458d 100644
--- a/x-pack/plugins/ml/server/models/data_frame_analytics/models_provider.ts
+++ b/x-pack/plugins/ml/server/models/data_frame_analytics/models_provider.ts
@@ -49,26 +49,31 @@ export function modelsProvider(
         modelIds.map((id: string) => [id, null])
       );
 
-      const { body, statusCode } = await client.asCurrentUser.ingest.getPipeline();
-
-      if (statusCode !== 200) {
-        return modelIdsMap;
-      }
-
-      for (const [pipelineName, pipelineDefinition] of Object.entries(body)) {
-        const { processors } = pipelineDefinition as { processors: Array<Record<string, any>> };
-
-        for (const processor of processors) {
-          const id = processor.inference?.model_id;
-          if (modelIdsMap.has(id)) {
-            const obj = modelIdsMap.get(id);
-            if (obj === null) {
-              modelIdsMap.set(id, { [pipelineName]: pipelineDefinition });
-            } else {
-              obj![pipelineName] = pipelineDefinition;
+      try {
+        const { body } = await client.asCurrentUser.ingest.getPipeline();
+
+        for (const [pipelineName, pipelineDefinition] of Object.entries(body)) {
+          const { processors } = pipelineDefinition as { processors: Array<Record<string, any>> };
+
+          for (const processor of processors) {
+            const id = processor.inference?.model_id;
+            if (modelIdsMap.has(id)) {
+              const obj = modelIdsMap.get(id);
+              if (obj === null) {
+                modelIdsMap.set(id, { [pipelineName]: pipelineDefinition });
+              } else {
+                obj![pipelineName] = pipelineDefinition;
+              }
             }
           }
         }
+      } catch (error) {
+        if (error.statusCode === 404) {
+          // ES returns 404 when there are no pipelines
+          // Instead, we should return the modelIdsMap and a 200
+          return modelIdsMap;
+        }
+        throw error;
       }
 
       return modelIdsMap;
diff --git a/x-pack/plugins/ml/server/models/data_frame_analytics/types.ts b/x-pack/plugins/ml/server/models/data_frame_analytics/types.ts
index c9cca5756ada6..216cfe50cc539 100644
--- a/x-pack/plugins/ml/server/models/data_frame_analytics/types.ts
+++ b/x-pack/plugins/ml/server/models/data_frame_analytics/types.ts
@@ -11,7 +11,7 @@ import {
   AnalyticsMapNodeElement,
   AnalyticsMapEdgeElement,
 } from '../../../common/types/data_frame_analytics';
-export {
+export type {
   MapElements,
   AnalyticsMapReturnType,
   AnalyticsMapNodeElement,
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts b/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts
index 1cd9aae79777b..9e02a93a3c0f1 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts
+++ b/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts
@@ -293,6 +293,8 @@ export class DataRecognizer {
       index,
       size,
       body: searchBody,
+      // Ignored indices that are frozen
+      ignore_throttled: true,
     });
 
     // @ts-expect-error incorrect search response type
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/index.ts b/x-pack/plugins/ml/server/models/data_recognizer/index.ts
index fbddf17a50ede..55595c3a12bde 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/index.ts
+++ b/x-pack/plugins/ml/server/models/data_recognizer/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { DataRecognizer, RecognizeResult, dataRecognizerFactory } from './data_recognizer';
+export type { RecognizeResult } from './data_recognizer';
+export { DataRecognizer, dataRecognizerFactory } from './data_recognizer';
diff --git a/x-pack/plugins/ml/server/models/filter/index.ts b/x-pack/plugins/ml/server/models/filter/index.ts
index d5663478b4812..678fe73007ea2 100644
--- a/x-pack/plugins/ml/server/models/filter/index.ts
+++ b/x-pack/plugins/ml/server/models/filter/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { FilterManager, FormFilter, UpdateFilter } from './filter_manager';
+export type { FormFilter, UpdateFilter } from './filter_manager';
+export { FilterManager } from './filter_manager';
diff --git a/x-pack/plugins/ml/server/saved_objects/index.ts b/x-pack/plugins/ml/server/saved_objects/index.ts
index cbd31c9261130..652f47122ae2f 100644
--- a/x-pack/plugins/ml/server/saved_objects/index.ts
+++ b/x-pack/plugins/ml/server/saved_objects/index.ts
@@ -6,7 +6,8 @@
  */
 
 export { setupSavedObjects } from './saved_objects';
-export { JobObject, JobSavedObjectService, jobSavedObjectServiceFactory } from './service';
+export type { JobObject, JobSavedObjectService } from './service';
+export { jobSavedObjectServiceFactory } from './service';
 export { checksFactory } from './checks';
 export { syncSavedObjectsFactory } from './sync';
 export { jobSavedObjectsInitializationFactory } from './initialization';
diff --git a/x-pack/plugins/ml/server/shared_services/index.ts b/x-pack/plugins/ml/server/shared_services/index.ts
index 4126850918f6d..3a38b0b76bac6 100644
--- a/x-pack/plugins/ml/server/shared_services/index.ts
+++ b/x-pack/plugins/ml/server/shared_services/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { SharedServices, createSharedServices } from './shared_services';
+export type { SharedServices } from './shared_services';
+export { createSharedServices } from './shared_services';
diff --git a/x-pack/plugins/ml/server/shared_services/license_checks/index.ts b/x-pack/plugins/ml/server/shared_services/license_checks/index.ts
index 5939ff18a9376..9810084488cae 100644
--- a/x-pack/plugins/ml/server/shared_services/license_checks/index.ts
+++ b/x-pack/plugins/ml/server/shared_services/license_checks/index.ts
@@ -5,5 +5,6 @@
  * 2.0.
  */
 
-export { LicenseCheck, licenseChecks } from './license_checks';
+export type { LicenseCheck } from './license_checks';
+export { licenseChecks } from './license_checks';
 export { InsufficientBasicLicenseError, InsufficientFullLicenseError } from './errors';
diff --git a/x-pack/plugins/monitoring/public/types.ts b/x-pack/plugins/monitoring/public/types.ts
index 4817ac235e2bd..fa92cfacafdcc 100644
--- a/x-pack/plugins/monitoring/public/types.ts
+++ b/x-pack/plugins/monitoring/public/types.ts
@@ -12,9 +12,9 @@ import { TriggersAndActionsUIPublicPluginStart } from '../../triggers_actions_ui
 import { UsageCollectionSetup } from '../../../../src/plugins/usage_collection/public';
 
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
-export { MonitoringConfig } from '../server';
+export type { MonitoringConfig } from '../server';
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
-export { MLJobs } from '../server/lib/elasticsearch/get_ml_jobs';
+export type { MLJobs } from '../server/lib/elasticsearch/get_ml_jobs';
 
 export interface MonitoringStartPluginDependencies {
   navigation: NavigationStart;
diff --git a/x-pack/plugins/monitoring/server/index.ts b/x-pack/plugins/monitoring/server/index.ts
index 63cc61e503917..44aaff7d51c4a 100644
--- a/x-pack/plugins/monitoring/server/index.ts
+++ b/x-pack/plugins/monitoring/server/index.ts
@@ -11,9 +11,9 @@ import { MonitoringPlugin } from './plugin';
 import { configSchema } from './config';
 import { deprecations } from './deprecations';
 
-export { KibanaSettingsCollector } from './kibana_monitoring/collectors';
-export { MonitoringConfig } from './config';
-export { MonitoringPluginSetup, IBulkUploader } from './types';
+export type { KibanaSettingsCollector } from './kibana_monitoring/collectors';
+export type { MonitoringConfig } from './config';
+export type { MonitoringPluginSetup, IBulkUploader } from './types';
 
 export const plugin = (initContext: PluginInitializerContext) => new MonitoringPlugin(initContext);
 export const config: PluginConfigDescriptor<TypeOf<typeof configSchema>> = {
diff --git a/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/index.ts b/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/index.ts
index 06d47f0044728..9fa7ea8fdaf6a 100644
--- a/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/index.ts
+++ b/x-pack/plugins/monitoring/server/kibana_monitoring/collectors/index.ts
@@ -11,7 +11,8 @@ import { getSettingsCollector } from './get_settings_collector';
 import { getMonitoringUsageCollector } from './get_usage_collector';
 import { MonitoringConfig } from '../../config';
 
-export { KibanaSettingsCollector, getKibanaSettings } from './get_settings_collector';
+export type { KibanaSettingsCollector } from './get_settings_collector';
+export { getKibanaSettings } from './get_settings_collector';
 
 export function registerCollectors(
   usageCollection: UsageCollectionSetup,
diff --git a/x-pack/plugins/monitoring/server/lib/elasticsearch/nodes/index.ts b/x-pack/plugins/monitoring/server/lib/elasticsearch/nodes/index.ts
index 8f474c0284844..00f3370dfde51 100644
--- a/x-pack/plugins/monitoring/server/lib/elasticsearch/nodes/index.ts
+++ b/x-pack/plugins/monitoring/server/lib/elasticsearch/nodes/index.ts
@@ -7,6 +7,7 @@
 
 export { getNodes } from './get_nodes';
 export { getNodeSummary } from './get_node_summary';
-export { calculateNodeType, Node } from './calculate_node_type';
+export type { Node } from './calculate_node_type';
+export { calculateNodeType } from './calculate_node_type';
 export { getNodeTypeClassLabel } from './get_node_type_class_label';
 export { getDefaultNodeFromId } from './get_default_node_from_id';
diff --git a/x-pack/plugins/monitoring/server/lib/metrics/index.ts b/x-pack/plugins/monitoring/server/lib/metrics/index.ts
index ba43a8c316d3b..2fdaeb81ee620 100644
--- a/x-pack/plugins/monitoring/server/lib/metrics/index.ts
+++ b/x-pack/plugins/monitoring/server/lib/metrics/index.ts
@@ -9,9 +9,11 @@
 export { ElasticsearchMetric } from './elasticsearch/classes';
 // @ts-ignore
 export { KibanaClusterMetric, KibanaMetric } from './kibana/classes';
-export { ApmMetric, ApmClusterMetric, ApmMetricFields } from './apm/classes';
+export type { ApmMetricFields } from './apm/classes';
+export { ApmMetric, ApmClusterMetric } from './apm/classes';
 // @ts-ignore
 export { LogstashClusterMetric, LogstashMetric } from './logstash/classes';
-export { BeatsClusterMetric, BeatsMetric, BeatsMetricFields } from './beats/classes';
+export type { BeatsMetricFields } from './beats/classes';
+export { BeatsClusterMetric, BeatsMetric } from './beats/classes';
 // @ts-ignore
 export { metrics } from './metrics';
diff --git a/x-pack/plugins/observability/public/context/has_data_context.test.tsx b/x-pack/plugins/observability/public/context/has_data_context.test.tsx
index a586a8bf0bcce..1eb4108b12181 100644
--- a/x-pack/plugins/observability/public/context/has_data_context.test.tsx
+++ b/x-pack/plugins/observability/public/context/has_data_context.test.tsx
@@ -556,7 +556,7 @@ describe('HasDataContextProvider', () => {
             status: 'success',
           },
         },
-        hasAnyData: false,
+        hasAnyData: true,
         isAllRequestsComplete: true,
         forceUpdate: expect.any(String),
         onRefreshTimeRange: expect.any(Function),
diff --git a/x-pack/plugins/observability/public/context/has_data_context.tsx b/x-pack/plugins/observability/public/context/has_data_context.tsx
index caed130543acc..b6a45784a53b4 100644
--- a/x-pack/plugins/observability/public/context/has_data_context.tsx
+++ b/x-pack/plugins/observability/public/context/has_data_context.tsx
@@ -146,9 +146,12 @@ export function HasDataContextProvider({ children }: { children: React.ReactNode
     return appStatus !== undefined && appStatus !== FETCH_STATUS.LOADING;
   });
 
-  const hasAnyData = (Object.keys(hasDataMap) as ObservabilityFetchDataPlugins[]).some(
-    (app) => hasDataMap[app]?.hasData === true
-  );
+  const hasAnyData = (Object.keys(hasDataMap) as ObservabilityFetchDataPlugins[]).some((app) => {
+    const appHasData = hasDataMap[app]?.hasData;
+    return (
+      appHasData === true || (Array.isArray(appHasData) && (appHasData as Alert[])?.length > 0)
+    );
+  });
 
   return (
     <HasDataContext.Provider
diff --git a/x-pack/plugins/observability/public/index.ts b/x-pack/plugins/observability/public/index.ts
index 2dd380c3b7683..3eebf8a84db19 100644
--- a/x-pack/plugins/observability/public/index.ts
+++ b/x-pack/plugins/observability/public/index.ts
@@ -51,12 +51,11 @@ export {
 
 export type { LazyObservabilityPageTemplateProps } from './components/shared';
 
+export type { UiTracker, TrackMetricOptions } from './hooks/use_track_metric';
 export {
   useTrackPageview,
   useUiTracker,
   useTrackMetric,
-  UiTracker,
-  TrackMetricOptions,
   METRIC_TYPE,
 } from './hooks/use_track_metric';
 
@@ -83,8 +82,6 @@ export type {
 export { createObservabilityRuleTypeRegistryMock } from './rules/observability_rule_type_registry_mock';
 export type { ExploratoryEmbeddableProps } from './components/shared/exploratory_view/embeddable/embeddable';
 
-export {
-  InspectorContextProvider,
-  AddInspectorRequest,
-} from './context/inspector/inspector_context';
+export type { AddInspectorRequest } from './context/inspector/inspector_context';
+export { InspectorContextProvider } from './context/inspector/inspector_context';
 export { useInspectorContext } from './context/inspector/use_inspector_context';
diff --git a/x-pack/plugins/observability/public/pages/alerts/alerts_table_t_grid.tsx b/x-pack/plugins/observability/public/pages/alerts/alerts_table_t_grid.tsx
index ace01aa851ce8..13ef1c7725a3d 100644
--- a/x-pack/plugins/observability/public/pages/alerts/alerts_table_t_grid.tsx
+++ b/x-pack/plugins/observability/public/pages/alerts/alerts_table_t_grid.tsx
@@ -412,6 +412,8 @@ export function AlertsTableTGrid(props: AlertsTableTGridProps) {
       },
       renderCellValue: getRenderCellValue({ setFlyoutAlert }),
       rowRenderers: NO_ROW_RENDER,
+      // TODO: implement Kibana data view runtime fields in observability
+      runtimeMappings: {},
       start: rangeFrom,
       setRefetch,
       sort: [
diff --git a/x-pack/plugins/observability/public/services/call_observability_api/types.ts b/x-pack/plugins/observability/public/services/call_observability_api/types.ts
index 8722aecd90800..f517772821f42 100644
--- a/x-pack/plugins/observability/public/services/call_observability_api/types.ts
+++ b/x-pack/plugins/observability/public/services/call_observability_api/types.ts
@@ -31,4 +31,4 @@ export type ObservabilityClient = RouteRepositoryClient<
   ObservabilityClientOptions
 >;
 
-export { ObservabilityAPIReturnType };
+export type { ObservabilityAPIReturnType };
diff --git a/x-pack/plugins/observability/server/index.ts b/x-pack/plugins/observability/server/index.ts
index 22a469dbedbdd..d4d7127d8baee 100644
--- a/x-pack/plugins/observability/server/index.ts
+++ b/x-pack/plugins/observability/server/index.ts
@@ -43,11 +43,5 @@ export type ObservabilityConfig = TypeOf<typeof config.schema>;
 export const plugin = (initContext: PluginInitializerContext) =>
   new ObservabilityPlugin(initContext);
 
-export {
-  createOrUpdateIndex,
-  Mappings,
-  ObservabilityPluginSetup,
-  ScopedAnnotationsClient,
-  unwrapEsResponse,
-  WrappedElasticsearchClientError,
-};
+export type { Mappings, ObservabilityPluginSetup, ScopedAnnotationsClient };
+export { createOrUpdateIndex, unwrapEsResponse, WrappedElasticsearchClientError };
diff --git a/x-pack/plugins/observability/server/routes/types.ts b/x-pack/plugins/observability/server/routes/types.ts
index 5075b21fdf1fa..b316b1fffc770 100644
--- a/x-pack/plugins/observability/server/routes/types.ts
+++ b/x-pack/plugins/observability/server/routes/types.ts
@@ -17,7 +17,7 @@ import { RuleDataPluginService } from '../../../rule_registry/server';
 import { ObservabilityServerRouteRepository } from './get_global_observability_server_route_repository';
 import { ObservabilityRequestHandlerContext } from '../types';
 
-export { ObservabilityServerRouteRepository };
+export type { ObservabilityServerRouteRepository };
 
 export interface ObservabilityRouteHandlerResources {
   core: {
diff --git a/x-pack/plugins/observability/typings/common.ts b/x-pack/plugins/observability/typings/common.ts
index 2bc95447d9203..368dd33f1f13f 100644
--- a/x-pack/plugins/observability/typings/common.ts
+++ b/x-pack/plugins/observability/typings/common.ts
@@ -23,6 +23,6 @@ export type PromiseReturnType<Func> = Func extends (...args: any[]) => Promise<i
   ? Value
   : Func;
 
-export { Coordinates } from '../public/typings/fetch_overview_data/';
+export type { Coordinates } from '../public/typings/fetch_overview_data/';
 
 export type InspectResponse = Request[];
diff --git a/x-pack/plugins/osquery/common/shared_imports.ts b/x-pack/plugins/osquery/common/shared_imports.ts
index 1461fb31bb9ff..298cf92c4eeb2 100644
--- a/x-pack/plugins/osquery/common/shared_imports.ts
+++ b/x-pack/plugins/osquery/common/shared_imports.ts
@@ -5,4 +5,4 @@
  * 2.0.
  */
 
-export { Agent } from '../../fleet/common';
+export type { Agent } from '../../fleet/common';
diff --git a/x-pack/plugins/osquery/public/components/layouts/index.tsx b/x-pack/plugins/osquery/public/components/layouts/index.tsx
index e9d1987592eb9..116291e543129 100644
--- a/x-pack/plugins/osquery/public/components/layouts/index.tsx
+++ b/x-pack/plugins/osquery/public/components/layouts/index.tsx
@@ -8,5 +8,6 @@
 // copied from x-pack/plugins/fleet/public/applications/fleet/layouts/index.tsx
 
 export { Container, Nav, Wrapper } from './default';
-export { WithHeaderLayout, WithHeaderLayoutProps } from './with_header';
+export type { WithHeaderLayoutProps } from './with_header';
+export { WithHeaderLayout } from './with_header';
 export { WithoutHeaderLayout } from './without_header';
diff --git a/x-pack/plugins/osquery/public/shared_imports.ts b/x-pack/plugins/osquery/public/shared_imports.ts
index 8ffdc387bf76e..227a276c41f18 100644
--- a/x-pack/plugins/osquery/public/shared_imports.ts
+++ b/x-pack/plugins/osquery/public/shared_imports.ts
@@ -5,27 +5,29 @@
  * 2.0.
  */
 
-export {
-  getUseField,
-  getFieldValidityAndErrorMessage,
+export type {
   FieldHook,
   FieldValidateResponse,
-  FIELD_TYPES,
-  Form,
   FormConfig,
   FormData,
-  FormDataProvider,
   FormHook,
   FormSchema,
+  ValidationError,
+  ValidationFunc,
+  ValidationFuncArg,
+} from '../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib';
+export {
+  getUseField,
+  getFieldValidityAndErrorMessage,
+  FIELD_TYPES,
+  Form,
+  FormDataProvider,
   UseArray,
   UseField,
   UseMultiFields,
   useForm,
   useFormContext,
   useFormData,
-  ValidationError,
-  ValidationFunc,
-  ValidationFuncArg,
   VALIDATION_TYPES,
 } from '../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib';
 
@@ -37,4 +39,4 @@ export {
   JsonEditorField,
 } from '../../../../src/plugins/es_ui_shared/static/forms/components';
 export { fieldValidators } from '../../../../src/plugins/es_ui_shared/static/forms/helpers';
-export { ERROR_CODE } from '../../../../src/plugins/es_ui_shared/static/forms/helpers/field_validators/types';
+export type { ERROR_CODE } from '../../../../src/plugins/es_ui_shared/static/forms/helpers/field_validators/types';
diff --git a/x-pack/plugins/osquery/server/index.ts b/x-pack/plugins/osquery/server/index.ts
index 5deec805cc282..03da89d72d7b9 100644
--- a/x-pack/plugins/osquery/server/index.ts
+++ b/x-pack/plugins/osquery/server/index.ts
@@ -21,4 +21,4 @@ export function plugin(initializerContext: PluginInitializerContext) {
   return new OsqueryPlugin(initializerContext);
 }
 
-export { OsqueryPluginSetup, OsqueryPluginStart } from './types';
+export type { OsqueryPluginSetup, OsqueryPluginStart } from './types';
diff --git a/x-pack/plugins/remote_clusters/__jest__/client_integration/helpers/index.ts b/x-pack/plugins/remote_clusters/__jest__/client_integration/helpers/index.ts
index cf859ff6913f5..4cfe1fb41a835 100644
--- a/x-pack/plugins/remote_clusters/__jest__/client_integration/helpers/index.ts
+++ b/x-pack/plugins/remote_clusters/__jest__/client_integration/helpers/index.ts
@@ -7,4 +7,5 @@
 
 export { nextTick, getRandomString, findTestSubject } from '@kbn/test/jest';
 export { setupEnvironment } from './setup_environment';
-export { createRemoteClustersActions, RemoteClustersActions } from './remote_clusters_actions';
+export type { RemoteClustersActions } from './remote_clusters_actions';
+export { createRemoteClustersActions } from './remote_clusters_actions';
diff --git a/x-pack/plugins/remote_clusters/common/lib/index.ts b/x-pack/plugins/remote_clusters/common/lib/index.ts
index b17283511b8b7..fb1a4d33e7f7f 100644
--- a/x-pack/plugins/remote_clusters/common/lib/index.ts
+++ b/x-pack/plugins/remote_clusters/common/lib/index.ts
@@ -5,10 +5,5 @@
  * 2.0.
  */
 
-export {
-  deserializeCluster,
-  serializeCluster,
-  Cluster,
-  ClusterInfoEs,
-  ClusterPayloadEs,
-} from './cluster_serialization';
+export type { Cluster, ClusterInfoEs, ClusterPayloadEs } from './cluster_serialization';
+export { deserializeCluster, serializeCluster } from './cluster_serialization';
diff --git a/x-pack/plugins/remote_clusters/public/application/sections/components/remote_cluster_form/validators/index.ts b/x-pack/plugins/remote_clusters/public/application/sections/components/remote_cluster_form/validators/index.ts
index 6f3956a19f6a0..a695b95b8de85 100644
--- a/x-pack/plugins/remote_clusters/public/application/sections/components/remote_cluster_form/validators/index.ts
+++ b/x-pack/plugins/remote_clusters/public/application/sections/components/remote_cluster_form/validators/index.ts
@@ -10,7 +10,8 @@ export { validateProxy } from './validate_proxy';
 export { validateSeeds } from './validate_seeds';
 export { validateSeed } from './validate_seed';
 export { validateServerName } from './validate_server_name';
-export { validateCluster, ClusterErrors } from './validate_cluster';
+export type { ClusterErrors } from './validate_cluster';
+export { validateCluster } from './validate_cluster';
 export {
   isCloudUrlEnabled,
   validateCloudUrl,
diff --git a/x-pack/plugins/remote_clusters/public/application/services/index.ts b/x-pack/plugins/remote_clusters/public/application/services/index.ts
index 471abaf32736e..832d0af810301 100644
--- a/x-pack/plugins/remote_clusters/public/application/services/index.ts
+++ b/x-pack/plugins/remote_clusters/public/application/services/index.ts
@@ -13,12 +13,7 @@ export { setBreadcrumbs } from './breadcrumb';
 
 export { redirect } from './redirect';
 
-export {
-  setUserHasLeftApp,
-  getUserHasLeftApp,
-  registerRouter,
-  getRouter,
-  AppRouter,
-} from './routing';
+export type { AppRouter } from './routing';
+export { setUserHasLeftApp, getUserHasLeftApp, registerRouter, getRouter } from './routing';
 
 export { trackUiMetric, METRIC_TYPE } from './ui_metric';
diff --git a/x-pack/plugins/remote_clusters/public/index.ts b/x-pack/plugins/remote_clusters/public/index.ts
index 18e718fabfc5d..f2f50a8825e11 100644
--- a/x-pack/plugins/remote_clusters/public/index.ts
+++ b/x-pack/plugins/remote_clusters/public/index.ts
@@ -8,7 +8,7 @@
 import { PluginInitializerContext } from 'kibana/public';
 import { RemoteClustersUIPlugin } from './plugin';
 
-export { RemoteClustersPluginSetup } from './plugin';
+export type { RemoteClustersPluginSetup } from './plugin';
 
 export const plugin = (initializerContext: PluginInitializerContext) =>
   new RemoteClustersUIPlugin(initializerContext);
diff --git a/x-pack/plugins/remote_clusters/public/types.ts b/x-pack/plugins/remote_clusters/public/types.ts
index 15a34c84bb30c..bcd162599ab77 100644
--- a/x-pack/plugins/remote_clusters/public/types.ts
+++ b/x-pack/plugins/remote_clusters/public/types.ts
@@ -23,6 +23,6 @@ export interface ClientConfigType {
   };
 }
 
-export { RegisterManagementAppArgs };
+export type { RegisterManagementAppArgs };
 
-export { I18nStart };
+export type { I18nStart };
diff --git a/x-pack/plugins/remote_clusters/server/index.ts b/x-pack/plugins/remote_clusters/server/index.ts
index 33be5d88a3e4b..9447f9d9209e3 100644
--- a/x-pack/plugins/remote_clusters/server/index.ts
+++ b/x-pack/plugins/remote_clusters/server/index.ts
@@ -9,6 +9,6 @@ import { PluginInitializerContext } from 'kibana/server';
 import { RemoteClustersServerPlugin } from './plugin';
 
 export { config } from './config';
-export { RemoteClustersPluginSetup } from './plugin';
+export type { RemoteClustersPluginSetup } from './plugin';
 
 export const plugin = (ctx: PluginInitializerContext) => new RemoteClustersServerPlugin(ctx);
diff --git a/x-pack/plugins/reporting/common/types/base.ts b/x-pack/plugins/reporting/common/types/base.ts
new file mode 100644
index 0000000000000..44960c57f61c1
--- /dev/null
+++ b/x-pack/plugins/reporting/common/types/base.ts
@@ -0,0 +1,29 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { Ensure, SerializableRecord } from '@kbn/utility-types';
+import type { LayoutParams } from './layout';
+
+export type JobId = string;
+
+export type BaseParams = Ensure<
+  {
+    layout?: LayoutParams;
+    objectType: string;
+    title: string;
+    browserTimezone: string; // to format dates in the user's time zone
+    version: string; // to handle any state migrations
+  },
+  SerializableRecord
+>;
+
+// base params decorated with encrypted headers that come into runJob functions
+export interface BasePayload extends BaseParams {
+  headers: string;
+  spaceId?: string;
+  isDeprecated?: boolean;
+}
diff --git a/x-pack/plugins/reporting/server/export_types/csv/types.d.ts b/x-pack/plugins/reporting/common/types/export_types/csv.ts
similarity index 86%
rename from x-pack/plugins/reporting/server/export_types/csv/types.d.ts
rename to x-pack/plugins/reporting/common/types/export_types/csv.ts
index fff6f0bcf9538..8249c129052d7 100644
--- a/x-pack/plugins/reporting/server/export_types/csv/types.d.ts
+++ b/x-pack/plugins/reporting/common/types/export_types/csv.ts
@@ -5,8 +5,7 @@
  * 2.0.
  */
 
-import type { FieldSpec } from 'src/plugins/data/common';
-import { BaseParams, BasePayload } from '../../types';
+import { BaseParams, BasePayload } from '../base';
 
 export type RawValue = string | object | null | undefined;
 
@@ -57,16 +56,6 @@ export interface SearchRequestDeprecatedCSV {
     | any;
 }
 
-type FormatsMapDeprecatedCSV = Map<
-  string,
-  {
-    id: string;
-    params: {
-      pattern: string;
-    };
-  }
->;
-
 export interface SavedSearchGeneratorResultDeprecatedCSV {
   maxSizeReached: boolean;
   csvContainsFormulas?: boolean;
diff --git a/x-pack/plugins/reporting/server/export_types/csv_searchsource/types.d.ts b/x-pack/plugins/reporting/common/types/export_types/csv_searchsource.ts
similarity index 81%
rename from x-pack/plugins/reporting/server/export_types/csv_searchsource/types.d.ts
rename to x-pack/plugins/reporting/common/types/export_types/csv_searchsource.ts
index 170b03c2dfbff..2ba88426e8786 100644
--- a/x-pack/plugins/reporting/server/export_types/csv_searchsource/types.d.ts
+++ b/x-pack/plugins/reporting/common/types/export_types/csv_searchsource.ts
@@ -6,9 +6,7 @@
  */
 
 import type { SearchSourceFields } from 'src/plugins/data/common';
-import type { BaseParams, BasePayload } from '../../types';
-
-export type RawValue = string | object | null | undefined;
+import type { BaseParams, BasePayload } from '../base';
 
 interface BaseParamsCSV {
   searchSource: SearchSourceFields;
diff --git a/x-pack/plugins/reporting/server/export_types/csv_searchsource_immediate/types.d.ts b/x-pack/plugins/reporting/common/types/export_types/csv_searchsource_immediate.ts
similarity index 100%
rename from x-pack/plugins/reporting/server/export_types/csv_searchsource_immediate/types.d.ts
rename to x-pack/plugins/reporting/common/types/export_types/csv_searchsource_immediate.ts
diff --git a/x-pack/plugins/reporting/common/types/export_types/index.ts b/x-pack/plugins/reporting/common/types/export_types/index.ts
new file mode 100644
index 0000000000000..0ad47e7414031
--- /dev/null
+++ b/x-pack/plugins/reporting/common/types/export_types/index.ts
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export * from './csv';
+export * from './csv_searchsource';
+export * from './csv_searchsource_immediate';
+export * from './png';
+export * from './png_v2';
+export * from './printable_pdf';
+export * from './printable_pdf_v2';
diff --git a/x-pack/plugins/reporting/server/export_types/png/types.d.ts b/x-pack/plugins/reporting/common/types/export_types/png.ts
similarity index 84%
rename from x-pack/plugins/reporting/server/export_types/png/types.d.ts
rename to x-pack/plugins/reporting/common/types/export_types/png.ts
index d266b5c849185..3b850b5bd8b33 100644
--- a/x-pack/plugins/reporting/server/export_types/png/types.d.ts
+++ b/x-pack/plugins/reporting/common/types/export_types/png.ts
@@ -5,8 +5,8 @@
  * 2.0.
  */
 
-import { LayoutParams } from '../../lib/layouts';
-import { BaseParams, BasePayload } from '../../types';
+import type { LayoutParams } from '../layout';
+import type { BaseParams, BasePayload } from '../base';
 
 interface BaseParamsPNG {
   layout: LayoutParams;
diff --git a/x-pack/plugins/reporting/server/export_types/png_v2/types.d.ts b/x-pack/plugins/reporting/common/types/export_types/png_v2.ts
similarity index 83%
rename from x-pack/plugins/reporting/server/export_types/png_v2/types.d.ts
rename to x-pack/plugins/reporting/common/types/export_types/png_v2.ts
index 50c857b66934b..c937d01ce0be1 100644
--- a/x-pack/plugins/reporting/server/export_types/png_v2/types.d.ts
+++ b/x-pack/plugins/reporting/common/types/export_types/png_v2.ts
@@ -5,9 +5,9 @@
  * 2.0.
  */
 
-import type { LocatorParams } from '../../../common/types';
-import type { LayoutParams } from '../../lib/layouts';
-import type { BaseParams, BasePayload } from '../../types';
+import type { LocatorParams } from '../url';
+import type { LayoutParams } from '../layout';
+import type { BaseParams, BasePayload } from '../base';
 
 // Job params: structure of incoming user request data
 export interface JobParamsPNGV2 extends BaseParams {
diff --git a/x-pack/plugins/reporting/server/export_types/printable_pdf/types.d.ts b/x-pack/plugins/reporting/common/types/export_types/printable_pdf.ts
similarity index 74%
rename from x-pack/plugins/reporting/server/export_types/printable_pdf/types.d.ts
rename to x-pack/plugins/reporting/common/types/export_types/printable_pdf.ts
index 8e4c45ad79506..a424706430f2c 100644
--- a/x-pack/plugins/reporting/server/export_types/printable_pdf/types.d.ts
+++ b/x-pack/plugins/reporting/common/types/export_types/printable_pdf.ts
@@ -5,8 +5,8 @@
  * 2.0.
  */
 
-import { LayoutParams } from '../../lib/layouts';
-import { BaseParams, BasePayload } from '../../types';
+import type { LayoutParams } from '../layout';
+import type { BaseParams, BasePayload } from '../base';
 
 interface BaseParamsPDF {
   layout: LayoutParams;
@@ -17,6 +17,8 @@ interface BaseParamsPDF {
 // Job params: structure of incoming user request data, after being parsed from RISON
 export type JobParamsPDF = BaseParamsPDF & BaseParams;
 
+export type JobAppParamsPDF = Omit<JobParamsPDF, 'browserTimezone' | 'version'>;
+
 // Job payload: structure of stored job data provided by create_job
 export interface TaskPayloadPDF extends BasePayload {
   layout: LayoutParams;
@@ -24,8 +26,7 @@ export interface TaskPayloadPDF extends BasePayload {
   objects: Array<{ relativeUrl: string }>;
 }
 
-type Legacy = Omit<JobParamsPDF, 'relativeUrls'>;
-export interface JobParamsPDFLegacy extends Legacy {
+export interface JobParamsPDFLegacy extends Omit<JobParamsPDF, 'relativeUrls'> {
   savedObjectId: string;
   queryString: string;
 }
diff --git a/x-pack/plugins/reporting/common/types/export_types/printable_pdf_v2.ts b/x-pack/plugins/reporting/common/types/export_types/printable_pdf_v2.ts
new file mode 100644
index 0000000000000..c9a7a2ce2331a
--- /dev/null
+++ b/x-pack/plugins/reporting/common/types/export_types/printable_pdf_v2.ts
@@ -0,0 +1,33 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { LocatorParams } from '../url';
+import type { LayoutParams } from '../layout';
+import type { BaseParams, BasePayload } from '../base';
+
+interface BaseParamsPDFV2 {
+  layout: LayoutParams;
+
+  /**
+   * This value is used to re-create the same visual state as when the report was requested as well as navigate to the correct page.
+   */
+  locatorParams: LocatorParams[];
+}
+
+// Job params: structure of incoming user request data, after being parsed from RISON
+export type JobParamsPDFV2 = BaseParamsPDFV2 & BaseParams;
+
+export type JobAppParamsPDFV2 = Omit<JobParamsPDFV2, 'browserTimezone' | 'version'>;
+
+// Job payload: structure of stored job data provided by create_job
+export interface TaskPayloadPDFV2 extends BasePayload, BaseParamsPDFV2 {
+  layout: LayoutParams;
+  /**
+   * The value of forceNow is injected server-side every time a given report is generated.
+   */
+  forceNow: string;
+}
diff --git a/x-pack/plugins/reporting/common/types.ts b/x-pack/plugins/reporting/common/types/index.ts
similarity index 75%
rename from x-pack/plugins/reporting/common/types.ts
rename to x-pack/plugins/reporting/common/types/index.ts
index fe018feab0f8b..75e8cb0af9698 100644
--- a/x-pack/plugins/reporting/common/types.ts
+++ b/x-pack/plugins/reporting/common/types/index.ts
@@ -5,7 +5,20 @@
  * 2.0.
  */
 
-import type { Ensure, SerializableRecord } from '@kbn/utility-types';
+import type { Size, LayoutParams } from './layout';
+import type { JobId, BaseParams, BasePayload } from './base';
+
+export type { JobId, BaseParams, BasePayload };
+export type { Size, LayoutParams };
+export type {
+  DownloadReportFn,
+  IlmPolicyMigrationStatus,
+  IlmPolicyStatusResponse,
+  LocatorParams,
+  ManagementLinkFn,
+  UrlOrUrlLocatorTuple,
+} from './url';
+export * from './export_types';
 
 export interface PageSizeParams {
   pageMarginTop: number;
@@ -21,22 +34,6 @@ export interface PdfImageSize {
   height?: number;
 }
 
-export type Size = Ensure<
-  {
-    width: number;
-    height: number;
-  },
-  SerializableRecord
->;
-
-export type LayoutParams = Ensure<
-  {
-    id: string;
-    dimensions?: Size;
-  },
-  SerializableRecord
->;
-
 export interface ReportDocumentHead {
   _id: string;
   _index: string;
@@ -56,24 +53,6 @@ export interface TaskRunResult {
   warnings?: string[];
 }
 
-export type BaseParams = Ensure<
-  {
-    layout?: LayoutParams;
-    objectType: string;
-    title: string;
-    browserTimezone: string; // to format dates in the user's time zone
-    version: string; // to handle any state migrations
-  },
-  SerializableRecord
->;
-
-// base params decorated with encrypted headers that come into runJob functions
-export interface BasePayload extends BaseParams {
-  headers: string;
-  spaceId?: string;
-  isDeprecated?: boolean;
-}
-
 export interface ReportSource {
   /*
    * Required fields: populated in RequestHandler.enqueueJob when the request comes in to
@@ -119,8 +98,6 @@ export interface ReportDocument extends ReportDocumentHead {
   _source: ReportSource;
 }
 
-export type JobId = string;
-
 /*
  * JobStatus:
  *  - Begins as 'pending'
@@ -173,28 +150,3 @@ export interface JobSummarySet {
   completed: JobSummary[];
   failed: JobSummary[];
 }
-
-type DownloadLink = string;
-export type DownloadReportFn = (jobId: JobId) => DownloadLink;
-
-type ManagementLink = string;
-export type ManagementLinkFn = () => ManagementLink;
-
-export interface LocatorParams<
-  P extends SerializableRecord = SerializableRecord & { forceNow?: string }
-> {
-  id: string;
-  version: string;
-  params: P;
-}
-
-export type IlmPolicyMigrationStatus = 'policy-not-found' | 'indices-not-managed-by-policy' | 'ok';
-
-export interface IlmPolicyStatusResponse {
-  status: IlmPolicyMigrationStatus;
-}
-
-type Url = string;
-type UrlLocatorTuple = [url: Url, locatorParams: LocatorParams];
-
-export type UrlOrUrlLocatorTuple = Url | UrlLocatorTuple;
diff --git a/x-pack/plugins/reporting/common/types/layout.ts b/x-pack/plugins/reporting/common/types/layout.ts
new file mode 100644
index 0000000000000..b22d6b59d0873
--- /dev/null
+++ b/x-pack/plugins/reporting/common/types/layout.ts
@@ -0,0 +1,24 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { Ensure, SerializableRecord } from '@kbn/utility-types';
+
+export type Size = Ensure<
+  {
+    width: number;
+    height: number;
+  },
+  SerializableRecord
+>;
+
+export type LayoutParams = Ensure<
+  {
+    id: string;
+    dimensions?: Size;
+  },
+  SerializableRecord
+>;
diff --git a/x-pack/plugins/reporting/common/types/url.ts b/x-pack/plugins/reporting/common/types/url.ts
new file mode 100644
index 0000000000000..dfb8ee9f908e3
--- /dev/null
+++ b/x-pack/plugins/reporting/common/types/url.ts
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { SerializableRecord } from '@kbn/utility-types';
+import type { JobId } from './base';
+
+type DownloadLink = string;
+export type DownloadReportFn = (jobId: JobId) => DownloadLink;
+
+type ManagementLink = string;
+export type ManagementLinkFn = () => ManagementLink;
+
+export interface LocatorParams<
+  P extends SerializableRecord = SerializableRecord & { forceNow?: string }
+> {
+  id: string;
+  version: string;
+  params: P;
+}
+
+export type IlmPolicyMigrationStatus = 'policy-not-found' | 'indices-not-managed-by-policy' | 'ok';
+
+export interface IlmPolicyStatusResponse {
+  status: IlmPolicyMigrationStatus;
+}
+
+type Url = string;
+type UrlLocatorTuple = [url: Url, locatorParams: LocatorParams];
+
+export type UrlOrUrlLocatorTuple = Url | UrlLocatorTuple;
diff --git a/x-pack/plugins/reporting/public/index.ts b/x-pack/plugins/reporting/public/index.ts
index 2df236e6e3079..a634f87140e73 100644
--- a/x-pack/plugins/reporting/public/index.ts
+++ b/x-pack/plugins/reporting/public/index.ts
@@ -18,6 +18,17 @@ export interface ReportingSetup {
 export type ReportingStart = ReportingSetup;
 
 export { constants } from '../common';
+export type {
+  JobParamsCSV,
+  JobParamsDownloadCSV,
+  JobParamsPNG,
+  JobParamsPNGV2,
+  JobAppParamsPDFV2,
+  JobParamsPDF,
+  JobParamsPDFV2,
+  JobAppParamsPDF,
+} from '../common/types';
+
 export { ReportingAPIClient, ReportingPublicPlugin as Plugin };
 
 export function plugin(initializerContext: PluginInitializerContext) {
diff --git a/x-pack/plugins/reporting/public/share_context_menu/reporting_panel_content/index.ts b/x-pack/plugins/reporting/public/share_context_menu/reporting_panel_content/index.ts
index 843a0b6747e4c..94ee7f940b917 100644
--- a/x-pack/plugins/reporting/public/share_context_menu/reporting_panel_content/index.ts
+++ b/x-pack/plugins/reporting/public/share_context_menu/reporting_panel_content/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { ReportingPanelContent, Props, ReportingPanelProps } from './reporting_panel_content';
+export type { Props, ReportingPanelProps } from './reporting_panel_content';
+export { ReportingPanelContent } from './reporting_panel_content';
diff --git a/x-pack/plugins/reporting/public/shared_imports.ts b/x-pack/plugins/reporting/public/shared_imports.ts
index e719d720a7895..30e6cd12e3ed9 100644
--- a/x-pack/plugins/reporting/public/shared_imports.ts
+++ b/x-pack/plugins/reporting/public/shared_imports.ts
@@ -7,7 +7,8 @@
 
 export type { SharePluginSetup, SharePluginStart, LocatorPublic } from 'src/plugins/share/public';
 
-export { useRequest, UseRequestResponse } from '../../../../src/plugins/es_ui_shared/public';
+export type { UseRequestResponse } from '../../../../src/plugins/es_ui_shared/public';
+export { useRequest } from '../../../../src/plugins/es_ui_shared/public';
 
 export { KibanaContextProvider } from '../../../../src/plugins/kibana_react/public';
 
diff --git a/x-pack/plugins/reporting/server/config/__snapshots__/schema.test.ts.snap b/x-pack/plugins/reporting/server/config/__snapshots__/schema.test.ts.snap
new file mode 100644
index 0000000000000..a384550f18462
--- /dev/null
+++ b/x-pack/plugins/reporting/server/config/__snapshots__/schema.test.ts.snap
@@ -0,0 +1,197 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`Reporting Config Schema context {"dev":false,"dist":false} produces correct config 1`] = `
+Object {
+  "capture": Object {
+    "browser": Object {
+      "autoDownload": true,
+      "chromium": Object {
+        "proxy": Object {
+          "enabled": false,
+        },
+      },
+      "type": "chromium",
+    },
+    "loadDelay": "PT3S",
+    "maxAttempts": 1,
+    "networkPolicy": Object {
+      "enabled": true,
+      "rules": Array [
+        Object {
+          "allow": true,
+          "host": undefined,
+          "protocol": "http:",
+        },
+        Object {
+          "allow": true,
+          "host": undefined,
+          "protocol": "https:",
+        },
+        Object {
+          "allow": true,
+          "host": undefined,
+          "protocol": "ws:",
+        },
+        Object {
+          "allow": true,
+          "host": undefined,
+          "protocol": "wss:",
+        },
+        Object {
+          "allow": true,
+          "host": undefined,
+          "protocol": "data:",
+        },
+        Object {
+          "allow": false,
+          "host": undefined,
+          "protocol": undefined,
+        },
+      ],
+    },
+    "timeouts": Object {
+      "openUrl": "PT1M",
+      "renderComplete": "PT30S",
+      "waitForElements": "PT30S",
+    },
+    "zoom": 2,
+  },
+  "csv": Object {
+    "checkForFormulas": true,
+    "enablePanelActionDownload": true,
+    "escapeFormulaValues": false,
+    "maxSizeBytes": ByteSizeValue {
+      "valueInBytes": 10485760,
+    },
+    "scroll": Object {
+      "duration": "30s",
+      "size": 500,
+    },
+    "useByteOrderMarkEncoding": false,
+  },
+  "enabled": true,
+  "encryptionKey": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "kibanaServer": Object {},
+  "poll": Object {
+    "jobCompletionNotifier": Object {
+      "interval": 10000,
+      "intervalErrorMultiplier": 5,
+    },
+    "jobsRefresh": Object {
+      "interval": 5000,
+      "intervalErrorMultiplier": 5,
+    },
+  },
+  "queue": Object {
+    "indexInterval": "week",
+    "pollEnabled": true,
+    "pollInterval": "PT3S",
+    "pollIntervalErrorMultiplier": 10,
+    "timeout": "PT2M",
+  },
+  "roles": Object {
+    "allow": Array [
+      "reporting_user",
+    ],
+    "enabled": true,
+  },
+}
+`;
+
+exports[`Reporting Config Schema context {"dev":false,"dist":true} produces correct config 1`] = `
+Object {
+  "capture": Object {
+    "browser": Object {
+      "autoDownload": false,
+      "chromium": Object {
+        "inspect": false,
+        "proxy": Object {
+          "enabled": false,
+        },
+      },
+      "type": "chromium",
+    },
+    "loadDelay": "PT3S",
+    "maxAttempts": 3,
+    "networkPolicy": Object {
+      "enabled": true,
+      "rules": Array [
+        Object {
+          "allow": true,
+          "host": undefined,
+          "protocol": "http:",
+        },
+        Object {
+          "allow": true,
+          "host": undefined,
+          "protocol": "https:",
+        },
+        Object {
+          "allow": true,
+          "host": undefined,
+          "protocol": "ws:",
+        },
+        Object {
+          "allow": true,
+          "host": undefined,
+          "protocol": "wss:",
+        },
+        Object {
+          "allow": true,
+          "host": undefined,
+          "protocol": "data:",
+        },
+        Object {
+          "allow": false,
+          "host": undefined,
+          "protocol": undefined,
+        },
+      ],
+    },
+    "timeouts": Object {
+      "openUrl": "PT1M",
+      "renderComplete": "PT30S",
+      "waitForElements": "PT30S",
+    },
+    "zoom": 2,
+  },
+  "csv": Object {
+    "checkForFormulas": true,
+    "enablePanelActionDownload": true,
+    "escapeFormulaValues": false,
+    "maxSizeBytes": ByteSizeValue {
+      "valueInBytes": 10485760,
+    },
+    "scroll": Object {
+      "duration": "30s",
+      "size": 500,
+    },
+    "useByteOrderMarkEncoding": false,
+  },
+  "enabled": true,
+  "kibanaServer": Object {},
+  "poll": Object {
+    "jobCompletionNotifier": Object {
+      "interval": 10000,
+      "intervalErrorMultiplier": 5,
+    },
+    "jobsRefresh": Object {
+      "interval": 5000,
+      "intervalErrorMultiplier": 5,
+    },
+  },
+  "queue": Object {
+    "indexInterval": "week",
+    "pollEnabled": true,
+    "pollInterval": "PT3S",
+    "pollIntervalErrorMultiplier": 10,
+    "timeout": "PT2M",
+  },
+  "roles": Object {
+    "allow": Array [
+      "reporting_user",
+    ],
+    "enabled": true,
+  },
+}
+`;
diff --git a/x-pack/plugins/reporting/server/config/create_config.test.ts b/x-pack/plugins/reporting/server/config/create_config.test.ts
index 718638e1ba62b..3c5ecdc1dab0b 100644
--- a/x-pack/plugins/reporting/server/config/create_config.test.ts
+++ b/x-pack/plugins/reporting/server/config/create_config.test.ts
@@ -43,10 +43,10 @@ describe('Reporting server createConfig$', () => {
     const result = await createConfig$(mockCoreSetup, mockConfig$, mockLogger).toPromise();
 
     expect(result.encryptionKey).toMatch(/\S{32,}/); // random 32 characters
-    expect(mockLogger.warn.mock.calls.length).toBe(1);
-    expect(mockLogger.warn.mock.calls[0]).toMatchObject([
-      'Generating a random key for xpack.reporting.encryptionKey. To prevent sessions from being invalidated on restart, please set xpack.reporting.encryptionKey in the kibana.yml or use the bin/kibana-encryption-keys command.',
-    ]);
+    expect(mockLogger.warn).toHaveBeenCalledTimes(1);
+    expect(mockLogger.warn).toHaveBeenCalledWith(
+      'Generating a random key for xpack.reporting.encryptionKey. To prevent sessions from being invalidated on restart, please set xpack.reporting.encryptionKey in the kibana.yml or use the bin/kibana-encryption-keys command.'
+    );
   });
 
   it('uses the user-provided encryption key', async () => {
@@ -58,7 +58,7 @@ describe('Reporting server createConfig$', () => {
     const mockConfig$ = createMockConfig(mockInitContext);
     const result = await createConfig$(mockCoreSetup, mockConfig$, mockLogger).toPromise();
     expect(result.encryptionKey).toMatch('iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii');
-    expect(mockLogger.warn.mock.calls.length).toBe(0);
+    expect(mockLogger.warn).not.toHaveBeenCalled();
   });
 
   it('uses the user-provided encryption key, reporting kibanaServer settings to override server info', async () => {
@@ -103,7 +103,7 @@ describe('Reporting server createConfig$', () => {
         },
       }
     `);
-    expect(mockLogger.warn.mock.calls.length).toBe(0);
+    expect(mockLogger.warn).not.toHaveBeenCalled();
   });
 
   it('uses user-provided disableSandbox: false', async () => {
@@ -117,7 +117,7 @@ describe('Reporting server createConfig$', () => {
     const result = await createConfig$(mockCoreSetup, mockConfig$, mockLogger).toPromise();
 
     expect(result.capture.browser.chromium).toMatchObject({ disableSandbox: false });
-    expect(mockLogger.warn.mock.calls.length).toBe(0);
+    expect(mockLogger.warn).not.toHaveBeenCalled();
   });
 
   it('uses user-provided disableSandbox: true', async () => {
@@ -131,7 +131,7 @@ describe('Reporting server createConfig$', () => {
     const result = await createConfig$(mockCoreSetup, mockConfig$, mockLogger).toPromise();
 
     expect(result.capture.browser.chromium).toMatchObject({ disableSandbox: true });
-    expect(mockLogger.warn.mock.calls.length).toBe(0);
+    expect(mockLogger.warn).not.toHaveBeenCalled();
   });
 
   it('provides a default for disableSandbox', async () => {
@@ -144,18 +144,12 @@ describe('Reporting server createConfig$', () => {
     const result = await createConfig$(mockCoreSetup, mockConfig$, mockLogger).toPromise();
 
     expect(result.capture.browser.chromium).toMatchObject({ disableSandbox: expect.any(Boolean) });
-    expect(mockLogger.warn.mock.calls.length).toBe(0);
+    expect(mockLogger.warn).not.toHaveBeenCalled();
   });
 
-  for (const hostname of [
-    '0',
-    '0.0',
-    '0.0.0',
-    '0.0.0.0',
-    '0000:0000:0000:0000:0000:0000:0000:0000',
-    '::',
-  ]) {
-    it(`apply failover logic when hostname is given as ${hostname}`, async () => {
+  it.each(['0', '0.0', '0.0.0', '0.0.0.0', '0000:0000:0000:0000:0000:0000:0000:0000', '::'])(
+    `apply failover logic when hostname is given as "%s"`,
+    async (hostname) => {
       mockInitContext = coreMock.createPluginInitializerContext(
         createMockConfigSchema({
           encryptionKey: 'aaaaaaaaaaaaabbbbbbbbbbbbaaaaaaaaa',
@@ -167,7 +161,7 @@ describe('Reporting server createConfig$', () => {
           },
         })
       );
-      mockCoreSetup.http.getServerInfo = jest.fn().mockImplementation(
+      mockCoreSetup.http.getServerInfo = jest.fn(
         (): HttpServerInfo => ({
           name: 'cool server',
           hostname,
@@ -177,12 +171,16 @@ describe('Reporting server createConfig$', () => {
       );
 
       const mockConfig$ = createMockConfig(mockInitContext);
-      const result = await createConfig$(mockCoreSetup, mockConfig$, mockLogger).toPromise();
-      expect(result.kibanaServer).toMatchObject({
-        hostname: 'localhost',
-        port: 5601,
-        protocol: 'http',
-      });
-    });
-  }
+      await expect(
+        createConfig$(mockCoreSetup, mockConfig$, mockLogger).toPromise()
+      ).resolves.toHaveProperty(
+        'kibanaServer',
+        expect.objectContaining({
+          hostname: 'localhost',
+          port: 5601,
+          protocol: 'http',
+        })
+      );
+    }
+  );
 });
diff --git a/x-pack/plugins/reporting/server/config/index.ts b/x-pack/plugins/reporting/server/config/index.ts
index c20b5e16c7f04..fa836fd47cde3 100644
--- a/x-pack/plugins/reporting/server/config/index.ts
+++ b/x-pack/plugins/reporting/server/config/index.ts
@@ -11,7 +11,8 @@ import { get } from 'lodash';
 import { ConfigSchema, ReportingConfigType } from './schema';
 export { buildConfig } from './config';
 export { registerUiSettings } from './ui_settings';
-export { ConfigSchema, ReportingConfigType };
+export type { ReportingConfigType };
+export { ConfigSchema };
 
 export const config: PluginConfigDescriptor<ReportingConfigType> = {
   exposeToBrowser: { poll: true, roles: true },
diff --git a/x-pack/plugins/reporting/server/config/schema.test.ts b/x-pack/plugins/reporting/server/config/schema.test.ts
index 7f1da5b55ccb6..c49490be87a15 100644
--- a/x-pack/plugins/reporting/server/config/schema.test.ts
+++ b/x-pack/plugins/reporting/server/config/schema.test.ts
@@ -9,203 +9,11 @@ import { ConfigSchema } from './schema';
 
 describe('Reporting Config Schema', () => {
   it(`context {"dev":false,"dist":false} produces correct config`, () => {
-    expect(ConfigSchema.validate({}, { dev: false, dist: false })).toMatchInlineSnapshot(`
-      Object {
-        "capture": Object {
-          "browser": Object {
-            "autoDownload": true,
-            "chromium": Object {
-              "proxy": Object {
-                "enabled": false,
-              },
-            },
-            "type": "chromium",
-          },
-          "loadDelay": "PT3S",
-          "maxAttempts": 1,
-          "networkPolicy": Object {
-            "enabled": true,
-            "rules": Array [
-              Object {
-                "allow": true,
-                "host": undefined,
-                "protocol": "http:",
-              },
-              Object {
-                "allow": true,
-                "host": undefined,
-                "protocol": "https:",
-              },
-              Object {
-                "allow": true,
-                "host": undefined,
-                "protocol": "ws:",
-              },
-              Object {
-                "allow": true,
-                "host": undefined,
-                "protocol": "wss:",
-              },
-              Object {
-                "allow": true,
-                "host": undefined,
-                "protocol": "data:",
-              },
-              Object {
-                "allow": false,
-                "host": undefined,
-                "protocol": undefined,
-              },
-            ],
-          },
-          "timeouts": Object {
-            "openUrl": "PT1M",
-            "renderComplete": "PT30S",
-            "waitForElements": "PT30S",
-          },
-          "zoom": 2,
-        },
-        "csv": Object {
-          "checkForFormulas": true,
-          "enablePanelActionDownload": true,
-          "escapeFormulaValues": false,
-          "maxSizeBytes": ByteSizeValue {
-            "valueInBytes": 10485760,
-          },
-          "scroll": Object {
-            "duration": "30s",
-            "size": 500,
-          },
-          "useByteOrderMarkEncoding": false,
-        },
-        "enabled": true,
-        "encryptionKey": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-        "kibanaServer": Object {},
-        "poll": Object {
-          "jobCompletionNotifier": Object {
-            "interval": 10000,
-            "intervalErrorMultiplier": 5,
-          },
-          "jobsRefresh": Object {
-            "interval": 5000,
-            "intervalErrorMultiplier": 5,
-          },
-        },
-        "queue": Object {
-          "indexInterval": "week",
-          "pollEnabled": true,
-          "pollInterval": "PT3S",
-          "pollIntervalErrorMultiplier": 10,
-          "timeout": "PT2M",
-        },
-        "roles": Object {
-          "allow": Array [
-            "reporting_user",
-          ],
-          "enabled": true,
-        },
-      }
-    `);
+    expect(ConfigSchema.validate({}, { dev: false, dist: false })).toMatchSnapshot();
   });
 
   it(`context {"dev":false,"dist":true} produces correct config`, () => {
-    expect(ConfigSchema.validate({}, { dev: false, dist: true })).toMatchInlineSnapshot(`
-      Object {
-        "capture": Object {
-          "browser": Object {
-            "autoDownload": false,
-            "chromium": Object {
-              "inspect": false,
-              "proxy": Object {
-                "enabled": false,
-              },
-            },
-            "type": "chromium",
-          },
-          "loadDelay": "PT3S",
-          "maxAttempts": 3,
-          "networkPolicy": Object {
-            "enabled": true,
-            "rules": Array [
-              Object {
-                "allow": true,
-                "host": undefined,
-                "protocol": "http:",
-              },
-              Object {
-                "allow": true,
-                "host": undefined,
-                "protocol": "https:",
-              },
-              Object {
-                "allow": true,
-                "host": undefined,
-                "protocol": "ws:",
-              },
-              Object {
-                "allow": true,
-                "host": undefined,
-                "protocol": "wss:",
-              },
-              Object {
-                "allow": true,
-                "host": undefined,
-                "protocol": "data:",
-              },
-              Object {
-                "allow": false,
-                "host": undefined,
-                "protocol": undefined,
-              },
-            ],
-          },
-          "timeouts": Object {
-            "openUrl": "PT1M",
-            "renderComplete": "PT30S",
-            "waitForElements": "PT30S",
-          },
-          "zoom": 2,
-        },
-        "csv": Object {
-          "checkForFormulas": true,
-          "enablePanelActionDownload": true,
-          "escapeFormulaValues": false,
-          "maxSizeBytes": ByteSizeValue {
-            "valueInBytes": 10485760,
-          },
-          "scroll": Object {
-            "duration": "30s",
-            "size": 500,
-          },
-          "useByteOrderMarkEncoding": false,
-        },
-        "enabled": true,
-        "kibanaServer": Object {},
-        "poll": Object {
-          "jobCompletionNotifier": Object {
-            "interval": 10000,
-            "intervalErrorMultiplier": 5,
-          },
-          "jobsRefresh": Object {
-            "interval": 5000,
-            "intervalErrorMultiplier": 5,
-          },
-        },
-        "queue": Object {
-          "indexInterval": "week",
-          "pollEnabled": true,
-          "pollInterval": "PT3S",
-          "pollIntervalErrorMultiplier": 10,
-          "timeout": "PT2M",
-        },
-        "roles": Object {
-          "allow": Array [
-            "reporting_user",
-          ],
-          "enabled": true,
-        },
-      }
-    `);
+    expect(ConfigSchema.validate({}, { dev: false, dist: true })).toMatchSnapshot();
   });
 
   it('allows Duration values for certain keys', () => {
@@ -288,18 +96,20 @@ describe('Reporting Config Schema', () => {
     `);
   });
 
-  for (const address of ['0', '0.0', '0.0.0']) {
-    it(`fails to validate "kibanaServer.hostname" with an invalid hostname: "${address}"`, () => {
+  it.each(['0', '0.0', '0.0.0'])(
+    `fails to validate "kibanaServer.hostname" with an invalid hostname: "%s"`,
+    (address) => {
       expect(() =>
         ConfigSchema.validate({
           kibanaServer: { hostname: address },
         })
       ).toThrowError(`[kibanaServer.hostname]: value must be a valid hostname (see RFC 1123).`);
-    });
-  }
+    }
+  );
 
-  for (const address of ['0.0.0.0', '0000:0000:0000:0000:0000:0000:0000:0000', '::']) {
-    it(`fails to validate "kibanaServer.hostname" hostname as zero: "${address}"`, () => {
+  it.each(['0.0.0.0', '0000:0000:0000:0000:0000:0000:0000:0000', '::'])(
+    `fails to validate "kibanaServer.hostname" hostname as zero: "%s"`,
+    (address) => {
       expect(() =>
         ConfigSchema.validate({
           kibanaServer: { hostname: address },
@@ -307,6 +117,6 @@ describe('Reporting Config Schema', () => {
       ).toThrowError(
         `[kibanaServer.hostname]: cannot use '0.0.0.0' as Kibana host name, consider using the default (localhost) instead`
       );
-    });
-  }
+    }
+  );
 });
diff --git a/x-pack/plugins/reporting/server/export_types/csv/types.ts b/x-pack/plugins/reporting/server/export_types/csv/types.ts
new file mode 100644
index 0000000000000..5531f2d670128
--- /dev/null
+++ b/x-pack/plugins/reporting/server/export_types/csv/types.ts
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export type {
+  RawValue,
+  JobParamsDeprecatedCSV,
+  TaskPayloadDeprecatedCSV,
+  SearchRequestDeprecatedCSV,
+  SavedSearchGeneratorResultDeprecatedCSV,
+} from '../../../common/types';
diff --git a/x-pack/plugins/reporting/server/export_types/csv_searchsource/types.ts b/x-pack/plugins/reporting/server/export_types/csv_searchsource/types.ts
new file mode 100644
index 0000000000000..57e154eb2b26f
--- /dev/null
+++ b/x-pack/plugins/reporting/server/export_types/csv_searchsource/types.ts
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export type { RawValue, JobParamsCSV, TaskPayloadCSV } from '../../../common/types';
diff --git a/x-pack/plugins/reporting/server/export_types/csv_searchsource_immediate/types.ts b/x-pack/plugins/reporting/server/export_types/csv_searchsource_immediate/types.ts
new file mode 100644
index 0000000000000..1475c0cc2cf63
--- /dev/null
+++ b/x-pack/plugins/reporting/server/export_types/csv_searchsource_immediate/types.ts
@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export type {
+  FakeRequest,
+  JobParamsDownloadCSV,
+  SavedObjectServiceError,
+} from '../../../common/types';
diff --git a/x-pack/plugins/reporting/server/export_types/png/types.ts b/x-pack/plugins/reporting/server/export_types/png/types.ts
new file mode 100644
index 0000000000000..ccfca04b02499
--- /dev/null
+++ b/x-pack/plugins/reporting/server/export_types/png/types.ts
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export type { JobParamsPNG, TaskPayloadPNG } from '../../../common/types';
diff --git a/x-pack/plugins/reporting/server/export_types/png_v2/types.ts b/x-pack/plugins/reporting/server/export_types/png_v2/types.ts
new file mode 100644
index 0000000000000..3773bfae2b3ff
--- /dev/null
+++ b/x-pack/plugins/reporting/server/export_types/png_v2/types.ts
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export type { JobParamsPNGV2, TaskPayloadPNGV2 } from '../../../common/types';
diff --git a/x-pack/plugins/reporting/server/export_types/printable_pdf/types.ts b/x-pack/plugins/reporting/server/export_types/printable_pdf/types.ts
new file mode 100644
index 0000000000000..763fb8942b470
--- /dev/null
+++ b/x-pack/plugins/reporting/server/export_types/printable_pdf/types.ts
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export type { JobParamsPDF, TaskPayloadPDF, JobParamsPDFLegacy } from '../../../common/types';
diff --git a/x-pack/plugins/reporting/server/export_types/printable_pdf_v2/types.ts b/x-pack/plugins/reporting/server/export_types/printable_pdf_v2/types.ts
index a629eea9f21f7..ba8427feda914 100644
--- a/x-pack/plugins/reporting/server/export_types/printable_pdf_v2/types.ts
+++ b/x-pack/plugins/reporting/server/export_types/printable_pdf_v2/types.ts
@@ -5,27 +5,4 @@
  * 2.0.
  */
 
-import { LocatorParams } from '../../../common/types';
-import { LayoutParams } from '../../lib/layouts';
-import { BaseParams, BasePayload } from '../../types';
-
-interface BaseParamsPDFV2 {
-  layout: LayoutParams;
-
-  /**
-   * This value is used to re-create the same visual state as when the report was requested as well as navigate to the correct page.
-   */
-  locatorParams: LocatorParams[];
-}
-
-// Job params: structure of incoming user request data, after being parsed from RISON
-export type JobParamsPDFV2 = BaseParamsPDFV2 & BaseParams;
-
-// Job payload: structure of stored job data provided by create_job
-export interface TaskPayloadPDFV2 extends BasePayload, BaseParamsPDFV2 {
-  layout: LayoutParams;
-  /**
-   * The value of forceNow is injected server-side every time a given report is generated.
-   */
-  forceNow: string;
-}
+export type { JobParamsPDFV2, TaskPayloadPDFV2 } from '../../../common/types';
diff --git a/x-pack/plugins/reporting/server/index.ts b/x-pack/plugins/reporting/server/index.ts
index bc6529eb90782..2c851a9dffc1b 100644
--- a/x-pack/plugins/reporting/server/index.ts
+++ b/x-pack/plugins/reporting/server/index.ts
@@ -13,10 +13,20 @@ export const plugin = (initContext: PluginInitializerContext<ReportingConfigType
   new ReportingPlugin(initContext);
 
 export { config } from './config';
-export { ReportingConfig } from './config/config';
+export type { ReportingConfig } from './config/config';
+
+export type {
+  JobParamsCSV,
+  JobParamsDownloadCSV,
+  JobParamsPNG,
+  JobParamsPNGV2,
+  JobParamsPDF,
+  JobParamsPDFV2,
+} from '../common/types';
+
 // internal imports
 export { ReportingCore } from './core';
-export {
+export type {
   ReportingSetup,
   ReportingSetupDeps as PluginSetup,
   ReportingStartDeps as PluginStart,
diff --git a/x-pack/plugins/reporting/server/lib/layouts/index.ts b/x-pack/plugins/reporting/server/lib/layouts/index.ts
index b721565b1d771..daff568ab0067 100644
--- a/x-pack/plugins/reporting/server/lib/layouts/index.ts
+++ b/x-pack/plugins/reporting/server/lib/layouts/index.ts
@@ -19,7 +19,7 @@ export interface LayoutSelectorDictionary {
   timefilterDurationAttribute: string;
 }
 
-export { LayoutParams, PageSizeParams, PdfImageSize, Size } from '../../../common/types';
+export type { LayoutParams, PageSizeParams, PdfImageSize, Size } from '../../../common/types';
 export { CanvasLayout } from './canvas_layout';
 export { createLayout } from './create_layout';
 export type { Layout } from './layout';
diff --git a/x-pack/plugins/reporting/server/lib/screenshots/observable.ts b/x-pack/plugins/reporting/server/lib/screenshots/observable.ts
index 173dbaaf99557..48802eb5e5fbe 100644
--- a/x-pack/plugins/reporting/server/lib/screenshots/observable.ts
+++ b/x-pack/plugins/reporting/server/lib/screenshots/observable.ts
@@ -20,7 +20,7 @@ import {
 } from './';
 import { ScreenshotObservableHandler } from './observable_handler';
 
-export { ElementPosition, ElementsPositionAndAttribute, ScreenshotResults };
+export type { ElementPosition, ElementsPositionAndAttribute, ScreenshotResults };
 
 const getTimeouts = (captureConfig: CaptureConfig) => ({
   openUrl: {
diff --git a/x-pack/plugins/reporting/server/lib/store/index.ts b/x-pack/plugins/reporting/server/lib/store/index.ts
index 9ba8d44f19e65..e5f1c65e47948 100644
--- a/x-pack/plugins/reporting/server/lib/store/index.ts
+++ b/x-pack/plugins/reporting/server/lib/store/index.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-export { ReportDocument } from '../../../common/types';
+export type { ReportDocument } from '../../../common/types';
 export { Report } from './report';
 export { SavedReport } from './saved_report';
 export { ReportingStore } from './store';
diff --git a/x-pack/plugins/reporting/server/lib/store/report.ts b/x-pack/plugins/reporting/server/lib/store/report.ts
index 2feb162fbf37e..2f802334eb6ff 100644
--- a/x-pack/plugins/reporting/server/lib/store/report.ts
+++ b/x-pack/plugins/reporting/server/lib/store/report.ts
@@ -17,8 +17,8 @@ import {
 } from '../../../common/types';
 import type { ReportTaskParams } from '../tasks';
 
-export { ReportDocument };
-export { ReportApiJSON, ReportSource };
+export type { ReportDocument };
+export type { ReportApiJSON, ReportSource };
 
 const puid = new Puid();
 export const MIGRATION_VERSION = '7.14.0';
diff --git a/x-pack/plugins/reporting/server/lib/tasks/index.ts b/x-pack/plugins/reporting/server/lib/tasks/index.ts
index f464383c0b533..6be8299d1d26a 100644
--- a/x-pack/plugins/reporting/server/lib/tasks/index.ts
+++ b/x-pack/plugins/reporting/server/lib/tasks/index.ts
@@ -14,7 +14,7 @@ export const REPORTING_MONITOR_TYPE = 'reports:monitor';
 
 export { ExecuteReportTask } from './execute_report';
 export { MonitorReportsTask } from './monitor_reports';
-export { TaskRunResult };
+export type { TaskRunResult };
 
 export interface ReportTaskParams<JobPayloadType = BasePayload> {
   id: string;
diff --git a/x-pack/plugins/reporting/server/types.ts b/x-pack/plugins/reporting/server/types.ts
index 84fa6fb5b10d6..af9a973b0bb45 100644
--- a/x-pack/plugins/reporting/server/types.ts
+++ b/x-pack/plugins/reporting/server/types.ts
@@ -57,7 +57,7 @@ export type ReportingUser = { username: AuthenticatedUser['username'] } | false;
 export type CaptureConfig = ReportingConfigType['capture'];
 export type ScrollConfig = ReportingConfigType['csv']['scroll'];
 
-export { BaseParams, BasePayload };
+export type { BaseParams, BasePayload };
 
 // default fn type for CreateJobFnFactory
 export type CreateJobFn<JobParamsType = BaseParams, JobPayloadType = BasePayload> = (
diff --git a/x-pack/plugins/rule_registry/server/index.ts b/x-pack/plugins/rule_registry/server/index.ts
index d6c5b61706415..d52cd0ebf608c 100644
--- a/x-pack/plugins/rule_registry/server/index.ts
+++ b/x-pack/plugins/rule_registry/server/index.ts
@@ -12,9 +12,9 @@ import { PluginInitializerContext } from 'src/core/server';
 import { RuleRegistryPlugin } from './plugin';
 
 export type { RuleRegistryPluginSetupContract, RuleRegistryPluginStartContract } from './plugin';
-export { IRuleDataService, RuleDataPluginService } from './rule_data_plugin_service';
+export type { IRuleDataService, RuleDataPluginService } from './rule_data_plugin_service';
 export { RuleDataClient } from './rule_data_client';
-export { IRuleDataClient } from './rule_data_client/types';
+export type { IRuleDataClient } from './rule_data_client/types';
 export type {
   RacRequestHandlerContext,
   RacApiRequestHandlerContext,
@@ -24,14 +24,15 @@ export type {
 export * from './config';
 export * from './rule_data_plugin_service';
 export * from './rule_data_client';
+export * from './alert_data_client/audit_events';
 
 export { createLifecycleRuleTypeFactory } from './utils/create_lifecycle_rule_type_factory';
-export {
+export type {
   LifecycleRuleExecutor,
   LifecycleAlertService,
   LifecycleAlertServices,
-  createLifecycleExecutor,
 } from './utils/create_lifecycle_executor';
+export { createLifecycleExecutor } from './utils/create_lifecycle_executor';
 export { createPersistenceRuleTypeWrapper } from './utils/create_persistence_rule_type_wrapper';
 export * from './utils/persistence_types';
 export type { AlertsClient } from './alert_data_client/alerts_client';
diff --git a/x-pack/plugins/runtime_fields/public/components/index.ts b/x-pack/plugins/runtime_fields/public/components/index.ts
index 8fbec39b4abfb..47db4087dab6e 100644
--- a/x-pack/plugins/runtime_fields/public/components/index.ts
+++ b/x-pack/plugins/runtime_fields/public/components/index.ts
@@ -5,11 +5,10 @@
  * 2.0.
  */
 
-export { RuntimeFieldForm, FormState as RuntimeFieldFormState } from './runtime_field_form';
+export type { FormState as RuntimeFieldFormState } from './runtime_field_form';
+export { RuntimeFieldForm } from './runtime_field_form';
 
 export { RuntimeFieldEditor } from './runtime_field_editor';
 
-export {
-  RuntimeFieldEditorFlyoutContent,
-  RuntimeFieldEditorFlyoutContentProps,
-} from './runtime_field_editor_flyout_content';
+export type { RuntimeFieldEditorFlyoutContentProps } from './runtime_field_editor_flyout_content';
+export { RuntimeFieldEditorFlyoutContent } from './runtime_field_editor_flyout_content';
diff --git a/x-pack/plugins/runtime_fields/public/components/runtime_field_editor_flyout_content/index.ts b/x-pack/plugins/runtime_fields/public/components/runtime_field_editor_flyout_content/index.ts
index 7ac0165fc9d41..e626cdb5b2312 100644
--- a/x-pack/plugins/runtime_fields/public/components/runtime_field_editor_flyout_content/index.ts
+++ b/x-pack/plugins/runtime_fields/public/components/runtime_field_editor_flyout_content/index.ts
@@ -5,7 +5,5 @@
  * 2.0.
  */
 
-export {
-  RuntimeFieldEditorFlyoutContent,
-  Props as RuntimeFieldEditorFlyoutContentProps,
-} from './runtime_field_editor_flyout_content';
+export type { Props as RuntimeFieldEditorFlyoutContentProps } from './runtime_field_editor_flyout_content';
+export { RuntimeFieldEditorFlyoutContent } from './runtime_field_editor_flyout_content';
diff --git a/x-pack/plugins/runtime_fields/public/components/runtime_field_form/index.ts b/x-pack/plugins/runtime_fields/public/components/runtime_field_form/index.ts
index bc8d6d8bdc1b3..a8f29539c4f2c 100644
--- a/x-pack/plugins/runtime_fields/public/components/runtime_field_form/index.ts
+++ b/x-pack/plugins/runtime_fields/public/components/runtime_field_form/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { RuntimeFieldForm, FormState } from './runtime_field_form';
+export type { FormState } from './runtime_field_form';
+export { RuntimeFieldForm } from './runtime_field_form';
diff --git a/x-pack/plugins/runtime_fields/public/index.ts b/x-pack/plugins/runtime_fields/public/index.ts
index 1a3c6943c3a5c..ece935d0d5571 100644
--- a/x-pack/plugins/runtime_fields/public/index.ts
+++ b/x-pack/plugins/runtime_fields/public/index.ts
@@ -7,14 +7,10 @@
 
 import { RuntimeFieldsPlugin } from './plugin';
 
-export {
-  RuntimeFieldEditorFlyoutContent,
-  RuntimeFieldEditorFlyoutContentProps,
-  RuntimeFieldEditor,
-  RuntimeFieldFormState,
-} from './components';
+export type { RuntimeFieldEditorFlyoutContentProps, RuntimeFieldFormState } from './components';
+export { RuntimeFieldEditorFlyoutContent, RuntimeFieldEditor } from './components';
 export { RUNTIME_FIELD_OPTIONS } from './constants';
-export { RuntimeField, RuntimeType, PluginSetup as RuntimeFieldsSetup } from './types';
+export type { RuntimeField, RuntimeType, PluginSetup as RuntimeFieldsSetup } from './types';
 
 export function plugin() {
   return new RuntimeFieldsPlugin();
diff --git a/x-pack/plugins/runtime_fields/public/shared_imports.ts b/x-pack/plugins/runtime_fields/public/shared_imports.ts
index a6dd23440176a..61b517a4e1117 100644
--- a/x-pack/plugins/runtime_fields/public/shared_imports.ts
+++ b/x-pack/plugins/runtime_fields/public/shared_imports.ts
@@ -5,15 +5,17 @@
  * 2.0.
  */
 
+export type {
+  FormSchema,
+  FormHook,
+  ValidationFunc,
+  FieldConfig,
+} from '../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib';
 export {
   useForm,
   useFormData,
   Form,
-  FormSchema,
   UseField,
-  FormHook,
-  ValidationFunc,
-  FieldConfig,
 } from '../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib';
 
 export { fieldValidators } from '../../../../src/plugins/es_ui_shared/static/forms/helpers';
diff --git a/x-pack/plugins/runtime_fields/public/test_utils.ts b/x-pack/plugins/runtime_fields/public/test_utils.ts
index d3b02257c2ff2..1c052cd666e56 100644
--- a/x-pack/plugins/runtime_fields/public/test_utils.ts
+++ b/x-pack/plugins/runtime_fields/public/test_utils.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { registerTestBed, TestBed } from '@kbn/test/jest';
+export type { TestBed } from '@kbn/test/jest';
+export { registerTestBed } from '@kbn/test/jest';
diff --git a/x-pack/plugins/saved_objects_tagging/common/index.ts b/x-pack/plugins/saved_objects_tagging/common/index.ts
index 500e656014e9a..a513822adb5e0 100644
--- a/x-pack/plugins/saved_objects_tagging/common/index.ts
+++ b/x-pack/plugins/saved_objects_tagging/common/index.ts
@@ -5,11 +5,12 @@
  * 2.0.
  */
 
-export { TagsCapabilities, getTagsCapabilities } from './capabilities';
+export type { TagsCapabilities } from './capabilities';
+export { getTagsCapabilities } from './capabilities';
 export { tagFeatureId, tagSavedObjectTypeName, tagManagementSectionId } from './constants';
-export { TagWithRelations, TagAttributes, Tag, ITagsClient, TagSavedObject } from './types';
+export type { TagWithRelations, TagAttributes, Tag, ITagsClient, TagSavedObject } from './types';
+export type { TagValidation } from './validation';
 export {
-  TagValidation,
   validateTagColor,
   validateTagName,
   validateTagDescription,
diff --git a/x-pack/plugins/saved_objects_tagging/public/components/assign_flyout/index.ts b/x-pack/plugins/saved_objects_tagging/public/components/assign_flyout/index.ts
index 2dc3449199cf6..d785d241edb6c 100644
--- a/x-pack/plugins/saved_objects_tagging/public/components/assign_flyout/index.ts
+++ b/x-pack/plugins/saved_objects_tagging/public/components/assign_flyout/index.ts
@@ -5,9 +5,9 @@
  * 2.0.
  */
 
-export {
-  getAssignFlyoutOpener,
+export type {
   AssignFlyoutOpener,
   GetAssignFlyoutOpenerOptions,
   OpenAssignFlyoutOptions,
 } from './open_assign_flyout';
+export { getAssignFlyoutOpener } from './open_assign_flyout';
diff --git a/x-pack/plugins/saved_objects_tagging/public/components/base/index.ts b/x-pack/plugins/saved_objects_tagging/public/components/base/index.ts
index 34500b978df00..29c75be50a392 100644
--- a/x-pack/plugins/saved_objects_tagging/public/components/base/index.ts
+++ b/x-pack/plugins/saved_objects_tagging/public/components/base/index.ts
@@ -5,7 +5,11 @@
  * 2.0.
  */
 
-export { TagBadge, TagBadgeProps } from './tag_badge';
-export { TagList, TagListProps } from './tag_list';
-export { TagSelector, TagSelectorProps } from './tag_selector';
-export { TagSearchBarOption, TagSearchBarOptionProps } from './tag_searchbar_option';
+export type { TagBadgeProps } from './tag_badge';
+export { TagBadge } from './tag_badge';
+export type { TagListProps } from './tag_list';
+export { TagList } from './tag_list';
+export type { TagSelectorProps } from './tag_selector';
+export { TagSelector } from './tag_selector';
+export type { TagSearchBarOptionProps } from './tag_searchbar_option';
+export { TagSearchBarOption } from './tag_searchbar_option';
diff --git a/x-pack/plugins/saved_objects_tagging/public/components/edition_modal/index.ts b/x-pack/plugins/saved_objects_tagging/public/components/edition_modal/index.ts
index 0436e8c57e59b..ac6994453443e 100644
--- a/x-pack/plugins/saved_objects_tagging/public/components/edition_modal/index.ts
+++ b/x-pack/plugins/saved_objects_tagging/public/components/edition_modal/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { getCreateModalOpener, getEditModalOpener, CreateModalOpener } from './open_modal';
+export type { CreateModalOpener } from './open_modal';
+export { getCreateModalOpener, getEditModalOpener } from './open_modal';
diff --git a/x-pack/plugins/saved_objects_tagging/public/components/index.ts b/x-pack/plugins/saved_objects_tagging/public/components/index.ts
index c6142d8552bcc..5c7c491df9bd4 100644
--- a/x-pack/plugins/saved_objects_tagging/public/components/index.ts
+++ b/x-pack/plugins/saved_objects_tagging/public/components/index.ts
@@ -5,13 +5,10 @@
  * 2.0.
  */
 
-export {
-  TagSelector,
+export type {
   TagSelectorProps,
-  TagList,
   TagListProps,
-  TagBadge,
   TagBadgeProps,
-  TagSearchBarOption,
   TagSearchBarOptionProps,
 } from './base';
+export { TagSelector, TagList, TagBadge, TagSearchBarOption } from './base';
diff --git a/x-pack/plugins/saved_objects_tagging/public/index.ts b/x-pack/plugins/saved_objects_tagging/public/index.ts
index c110e629f0ca3..1da147f4f168a 100644
--- a/x-pack/plugins/saved_objects_tagging/public/index.ts
+++ b/x-pack/plugins/saved_objects_tagging/public/index.ts
@@ -8,8 +8,8 @@
 import { PluginInitializerContext } from '../../../../src/core/public';
 import { SavedObjectTaggingPlugin } from './plugin';
 
-export { SavedObjectTaggingPluginStart } from './types';
-export { Tag } from '../common';
+export type { SavedObjectTaggingPluginStart } from './types';
+export type { Tag } from '../common';
 
 export const plugin = (initializerContext: PluginInitializerContext) =>
   new SavedObjectTaggingPlugin(initializerContext);
diff --git a/x-pack/plugins/saved_objects_tagging/public/management/actions/index.ts b/x-pack/plugins/saved_objects_tagging/public/management/actions/index.ts
index a18ef5afd445f..5503cec4af9dc 100644
--- a/x-pack/plugins/saved_objects_tagging/public/management/actions/index.ts
+++ b/x-pack/plugins/saved_objects_tagging/public/management/actions/index.ts
@@ -14,7 +14,7 @@ import { getDeleteAction } from './delete';
 import { getEditAction } from './edit';
 import { getAssignAction } from './assign';
 
-export { TagAction } from './types';
+export type { TagAction } from './types';
 
 interface GetActionsOptions {
   core: CoreStart;
diff --git a/x-pack/plugins/saved_objects_tagging/public/services/assignments/index.ts b/x-pack/plugins/saved_objects_tagging/public/services/assignments/index.ts
index 8b26da9cc5674..763c70a93ab41 100644
--- a/x-pack/plugins/saved_objects_tagging/public/services/assignments/index.ts
+++ b/x-pack/plugins/saved_objects_tagging/public/services/assignments/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { ITagAssignmentService, TagAssignmentService } from './assignment_service';
+export type { ITagAssignmentService } from './assignment_service';
+export { TagAssignmentService } from './assignment_service';
diff --git a/x-pack/plugins/saved_objects_tagging/public/services/index.ts b/x-pack/plugins/saved_objects_tagging/public/services/index.ts
index 1909aaea5c4ee..29d5ad7a7e027 100644
--- a/x-pack/plugins/saved_objects_tagging/public/services/index.ts
+++ b/x-pack/plugins/saved_objects_tagging/public/services/index.ts
@@ -5,13 +5,12 @@
  * 2.0.
  */
 
-export {
+export type {
   ITagInternalClient,
-  TagsCache,
   ITagsCache,
-  TagsClient,
   ITagsChangeListener,
-  isServerValidationError,
   TagServerValidationError,
 } from './tags';
-export { TagAssignmentService, ITagAssignmentService } from './assignments';
+export { TagsCache, TagsClient, isServerValidationError } from './tags';
+export type { ITagAssignmentService } from './assignments';
+export { TagAssignmentService } from './assignments';
diff --git a/x-pack/plugins/saved_objects_tagging/public/services/tags/index.ts b/x-pack/plugins/saved_objects_tagging/public/services/tags/index.ts
index 4b4e6d6c84123..b69f7124b0c8f 100644
--- a/x-pack/plugins/saved_objects_tagging/public/services/tags/index.ts
+++ b/x-pack/plugins/saved_objects_tagging/public/services/tags/index.ts
@@ -5,6 +5,9 @@
  * 2.0.
  */
 
-export { TagsClient, ITagInternalClient } from './tags_client';
-export { TagsCache, ITagsChangeListener, ITagsCache } from './tags_cache';
-export { isServerValidationError, TagServerValidationError } from './errors';
+export type { ITagInternalClient } from './tags_client';
+export { TagsClient } from './tags_client';
+export type { ITagsChangeListener, ITagsCache } from './tags_cache';
+export { TagsCache } from './tags_cache';
+export type { TagServerValidationError } from './errors';
+export { isServerValidationError } from './errors';
diff --git a/x-pack/plugins/saved_objects_tagging/public/services/tags/tags_cache.ts b/x-pack/plugins/saved_objects_tagging/public/services/tags/tags_cache.ts
index 1d8fda1e5912d..15d207aca47c0 100644
--- a/x-pack/plugins/saved_objects_tagging/public/services/tags/tags_cache.ts
+++ b/x-pack/plugins/saved_objects_tagging/public/services/tags/tags_cache.ts
@@ -11,7 +11,7 @@ import { takeUntil } from 'rxjs/operators';
 import { ITagsCache } from '../../../../../../src/plugins/saved_objects_tagging_oss/public';
 import { Tag, TagAttributes } from '../../../common/types';
 
-export { ITagsCache };
+export type { ITagsCache };
 
 export interface ITagsChangeListener {
   onDelete: (id: string) => void;
diff --git a/x-pack/plugins/saved_objects_tagging/server/services/assignments/index.ts b/x-pack/plugins/saved_objects_tagging/server/services/assignments/index.ts
index c465f89369a1e..7bf69b6c02304 100644
--- a/x-pack/plugins/saved_objects_tagging/server/services/assignments/index.ts
+++ b/x-pack/plugins/saved_objects_tagging/server/services/assignments/index.ts
@@ -5,5 +5,6 @@
  * 2.0.
  */
 
-export { AssignmentService, IAssignmentService } from './assignment_service';
+export type { IAssignmentService } from './assignment_service';
+export { AssignmentService } from './assignment_service';
 export { AssignmentError } from './errors';
diff --git a/x-pack/plugins/saved_objects_tagging/server/services/index.ts b/x-pack/plugins/saved_objects_tagging/server/services/index.ts
index 695d90e496f60..36c5e32b816c6 100644
--- a/x-pack/plugins/saved_objects_tagging/server/services/index.ts
+++ b/x-pack/plugins/saved_objects_tagging/server/services/index.ts
@@ -6,4 +6,5 @@
  */
 
 export { TagsClient, savedObjectToTag, TagValidationError } from './tags';
-export { IAssignmentService, AssignmentService, AssignmentError } from './assignments';
+export type { IAssignmentService } from './assignments';
+export { AssignmentService, AssignmentError } from './assignments';
diff --git a/x-pack/plugins/searchprofiler/common/index.ts b/x-pack/plugins/searchprofiler/common/index.ts
index 5b4f922231af3..154846bb3daa6 100644
--- a/x-pack/plugins/searchprofiler/common/index.ts
+++ b/x-pack/plugins/searchprofiler/common/index.ts
@@ -7,4 +7,4 @@
 
 export { PLUGIN } from './constants';
 
-export { LicenseStatus } from './types';
+export type { LicenseStatus } from './types';
diff --git a/x-pack/plugins/searchprofiler/public/application/components/highlight_details_flyout/index.ts b/x-pack/plugins/searchprofiler/public/application/components/highlight_details_flyout/index.ts
index a48ee9be0c0d1..3e1b4c208f157 100644
--- a/x-pack/plugins/searchprofiler/public/application/components/highlight_details_flyout/index.ts
+++ b/x-pack/plugins/searchprofiler/public/application/components/highlight_details_flyout/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { HighlightDetailsFlyout, Props } from './highlight_details_flyout';
+export type { Props } from './highlight_details_flyout';
+export { HighlightDetailsFlyout } from './highlight_details_flyout';
diff --git a/x-pack/plugins/searchprofiler/public/application/components/index.ts b/x-pack/plugins/searchprofiler/public/application/components/index.ts
index 86f7e2b6af557..ea5ba226fc5f6 100644
--- a/x-pack/plugins/searchprofiler/public/application/components/index.ts
+++ b/x-pack/plugins/searchprofiler/public/application/components/index.ts
@@ -7,7 +7,8 @@
 
 export { SearchProfilerTabs } from './searchprofiler_tabs';
 export { LicenseWarningNotice } from './license_warning_notice';
-export { ProfileTree, OnHighlightChangeArgs } from './profile_tree';
+export type { OnHighlightChangeArgs } from './profile_tree';
+export { ProfileTree } from './profile_tree';
 export { HighlightDetailsFlyout } from './highlight_details_flyout';
 export { ProfileLoadingPlaceholder } from './profile_loading_placeholder';
 export { EmptyTreePlaceHolder } from './empty_tree_placeholder';
diff --git a/x-pack/plugins/searchprofiler/public/application/components/profile_query_editor/editor/index.ts b/x-pack/plugins/searchprofiler/public/application/components/profile_query_editor/editor/index.ts
index 3d90bf2670525..5d8be48041176 100644
--- a/x-pack/plugins/searchprofiler/public/application/components/profile_query_editor/editor/index.ts
+++ b/x-pack/plugins/searchprofiler/public/application/components/profile_query_editor/editor/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { Editor, EditorInstance } from './editor';
+export type { EditorInstance } from './editor';
+export { Editor } from './editor';
diff --git a/x-pack/plugins/searchprofiler/public/application/components/profile_tree/index.ts b/x-pack/plugins/searchprofiler/public/application/components/profile_tree/index.ts
index eb1eb29d7d09b..8768c5b8b85f0 100644
--- a/x-pack/plugins/searchprofiler/public/application/components/profile_tree/index.ts
+++ b/x-pack/plugins/searchprofiler/public/application/components/profile_tree/index.ts
@@ -6,4 +6,4 @@
  */
 
 export { ProfileTree } from './profile_tree';
-export { OnHighlightChangeArgs } from './highlight_context';
+export type { OnHighlightChangeArgs } from './highlight_context';
diff --git a/x-pack/plugins/searchprofiler/public/application/store/index.ts b/x-pack/plugins/searchprofiler/public/application/store/index.ts
index ce5a6fe832b8c..ed350a47181d0 100644
--- a/x-pack/plugins/searchprofiler/public/application/store/index.ts
+++ b/x-pack/plugins/searchprofiler/public/application/store/index.ts
@@ -5,5 +5,6 @@
  * 2.0.
  */
 
-export { useStore, State } from './store';
-export { Action } from './reducer';
+export type { State } from './store';
+export { useStore } from './store';
+export type { Action } from './reducer';
diff --git a/x-pack/plugins/security/common/licensing/index.ts b/x-pack/plugins/security/common/licensing/index.ts
index ec82007524fa4..48329aeb99925 100644
--- a/x-pack/plugins/security/common/licensing/index.ts
+++ b/x-pack/plugins/security/common/licensing/index.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
-export { SecurityLicenseService, SecurityLicense } from './license_service';
+export type { SecurityLicense } from './license_service';
+export { SecurityLicenseService } from './license_service';
 
-export { LoginLayout, SecurityLicenseFeatures } from './license_features';
+export type { LoginLayout, SecurityLicenseFeatures } from './license_features';
diff --git a/x-pack/plugins/security/common/model/index.ts b/x-pack/plugins/security/common/model/index.ts
index 082e6bdc12cd0..bc1666af3200c 100644
--- a/x-pack/plugins/security/common/model/index.ts
+++ b/x-pack/plugins/security/common/model/index.ts
@@ -5,17 +5,18 @@
  * 2.0.
  */
 
-export { ApiKey, ApiKeyToInvalidate, ApiKeyRoleDescriptors } from './api_key';
-export { User, EditUser, getUserDisplayName } from './user';
-export { AuthenticatedUser, canUserChangePassword } from './authenticated_user';
-export { AuthenticationProvider, shouldProviderUseLoginForm } from './authentication_provider';
-export { BuiltinESPrivileges } from './builtin_es_privileges';
-export { RawKibanaPrivileges, RawKibanaFeaturePrivileges } from './raw_kibana_privileges';
-export { FeaturesPrivileges } from './features_privileges';
+export type { ApiKey, ApiKeyToInvalidate, ApiKeyRoleDescriptors } from './api_key';
+export type { User, EditUser } from './user';
+export { getUserDisplayName } from './user';
+export type { AuthenticatedUser } from './authenticated_user';
+export { canUserChangePassword } from './authenticated_user';
+export type { AuthenticationProvider } from './authentication_provider';
+export { shouldProviderUseLoginForm } from './authentication_provider';
+export type { BuiltinESPrivileges } from './builtin_es_privileges';
+export type { RawKibanaPrivileges, RawKibanaFeaturePrivileges } from './raw_kibana_privileges';
+export type { FeaturesPrivileges } from './features_privileges';
+export type { Role, RoleIndexPrivilege, RoleKibanaPrivilege } from './role';
 export {
-  Role,
-  RoleIndexPrivilege,
-  RoleKibanaPrivilege,
   copyRole,
   isRoleDeprecated,
   isRoleReadOnly,
@@ -26,14 +27,14 @@ export {
   prepareRoleClone,
   getExtendedRoleDeprecationNotice,
 } from './role';
-export {
+export type {
   InlineRoleTemplate,
   StoredRoleTemplate,
   InvalidRoleTemplate,
   RoleTemplate,
   RoleMapping,
 } from './role_mapping';
-export {
+export type {
   PrivilegeDeprecationsRolesByFeatureIdRequest,
   PrivilegeDeprecationsRolesByFeatureIdResponse,
   PrivilegeDeprecationsService,
diff --git a/x-pack/plugins/security/public/authentication/index.ts b/x-pack/plugins/security/public/authentication/index.ts
index 50d6b0c74376e..dd7cb006d879e 100644
--- a/x-pack/plugins/security/public/authentication/index.ts
+++ b/x-pack/plugins/security/public/authentication/index.ts
@@ -5,8 +5,8 @@
  * 2.0.
  */
 
-export {
-  AuthenticationService,
+export type {
   AuthenticationServiceSetup,
   AuthenticationServiceStart,
 } from './authentication_service';
+export { AuthenticationService } from './authentication_service';
diff --git a/x-pack/plugins/security/public/index.ts b/x-pack/plugins/security/public/index.ts
index e8d5f739821ed..55925e142ff24 100644
--- a/x-pack/plugins/security/public/index.ts
+++ b/x-pack/plugins/security/public/index.ts
@@ -7,15 +7,20 @@
 
 import type { PluginInitializer, PluginInitializerContext } from 'src/core/public';
 
-import type { PluginSetupDependencies, PluginStartDependencies } from './plugin';
-import { SecurityPlugin, SecurityPluginSetup, SecurityPluginStart } from './plugin';
+import type {
+  PluginSetupDependencies,
+  PluginStartDependencies,
+  SecurityPluginSetup,
+  SecurityPluginStart,
+} from './plugin';
+import { SecurityPlugin } from './plugin';
 
-export { SecurityPluginSetup, SecurityPluginStart };
-export { AuthenticatedUser } from '../common/model';
-export { SecurityLicense, SecurityLicenseFeatures } from '../common/licensing';
-export { UserMenuLink, SecurityNavControlServiceStart } from '../public/nav_control';
+export type { SecurityPluginSetup, SecurityPluginStart };
+export type { AuthenticatedUser } from '../common/model';
+export type { SecurityLicense, SecurityLicenseFeatures } from '../common/licensing';
+export type { UserMenuLink, SecurityNavControlServiceStart } from '../public/nav_control';
 
-export { AuthenticationServiceStart, AuthenticationServiceSetup } from './authentication';
+export type { AuthenticationServiceStart, AuthenticationServiceSetup } from './authentication';
 
 export const plugin: PluginInitializer<
   SecurityPluginSetup,
diff --git a/x-pack/plugins/security/public/management/api_keys/api_keys_grid/api_keys_grid_page.test.tsx b/x-pack/plugins/security/public/management/api_keys/api_keys_grid/api_keys_grid_page.test.tsx
index 72fd79805f970..6e3de061fd191 100644
--- a/x-pack/plugins/security/public/management/api_keys/api_keys_grid/api_keys_grid_page.test.tsx
+++ b/x-pack/plugins/security/public/management/api_keys/api_keys_grid/api_keys_grid_page.test.tsx
@@ -5,13 +5,7 @@
  * 2.0.
  */
 
-import {
-  fireEvent,
-  render,
-  waitFor,
-  waitForElementToBeRemoved,
-  within,
-} from '@testing-library/react';
+import { render } from '@testing-library/react';
 import { createMemoryHistory } from 'history';
 import React from 'react';
 
@@ -22,60 +16,75 @@ import { Providers } from '../api_keys_management_app';
 import { apiKeysAPIClientMock } from '../index.mock';
 import { APIKeysGridPage } from './api_keys_grid_page';
 
-jest.mock('@elastic/eui/lib/services/accessibility/html_id_generator', () => ({
-  htmlIdGenerator: () => () => `id-${Math.random()}`,
-}));
+/*
+ * Note to engineers
+ * we moved these 4 tests below to "x-pack/test/functional/apps/api_keys/home_page.ts":
+ * 1-"creates API key when submitting form, redirects back and displays base64"
+ * 2-"creates API key with optional expiration, redirects back and displays base64"
+ * 3-"deletes multiple api keys using bulk select"
+ * 4-"deletes api key using cta button"
+ * to functional tests to avoid flakyness
+ */
 
-jest.setTimeout(15000);
+describe('APIKeysGridPage', () => {
+  // We are spying on the console.error to avoid react to throw error
+  // in our test "displays error when fetching API keys fails"
+  // since we are using EuiErrorBoundary and react will console.error any errors
+  const consoleWarnMock = jest.spyOn(console, 'error').mockImplementation();
 
-const coreStart = coreMock.createStart();
+  const coreStart = coreMock.createStart();
+  const apiClientMock = apiKeysAPIClientMock.create();
+  const { authc } = securityMock.createSetup();
 
-const apiClientMock = apiKeysAPIClientMock.create();
-apiClientMock.checkPrivileges.mockResolvedValue({
-  areApiKeysEnabled: true,
-  canManage: true,
-  isAdmin: true,
-});
-apiClientMock.getApiKeys.mockResolvedValue({
-  apiKeys: [
-    {
-      creation: 1571322182082,
-      expiration: 1571408582082,
-      id: '0QQZ2m0BO2XZwgJFuWTT',
-      invalidated: false,
-      name: 'first-api-key',
-      realm: 'reserved',
-      username: 'elastic',
-    },
-    {
-      creation: 1571322182082,
-      expiration: 1571408582082,
-      id: 'BO2XZwgJFuWTT0QQZ2m0',
-      invalidated: false,
-      name: 'second-api-key',
-      realm: 'reserved',
-      username: 'elastic',
-    },
-  ],
-});
+  beforeEach(() => {
+    apiClientMock.checkPrivileges.mockClear();
+    apiClientMock.getApiKeys.mockClear();
+    coreStart.http.get.mockClear();
+    coreStart.http.post.mockClear();
+    authc.getCurrentUser.mockClear();
 
-const authc = securityMock.createSetup().authc;
-authc.getCurrentUser.mockResolvedValue(
-  mockAuthenticatedUser({
-    username: 'jdoe',
-    full_name: '',
-    email: '',
-    enabled: true,
-    roles: ['superuser'],
-  })
-);
+    apiClientMock.checkPrivileges.mockResolvedValue({
+      areApiKeysEnabled: true,
+      canManage: true,
+      isAdmin: true,
+    });
+    apiClientMock.getApiKeys.mockResolvedValue({
+      apiKeys: [
+        {
+          creation: 1571322182082,
+          expiration: 1571408582082,
+          id: '0QQZ2m0BO2XZwgJFuWTT',
+          invalidated: false,
+          name: 'first-api-key',
+          realm: 'reserved',
+          username: 'elastic',
+        },
+        {
+          creation: 1571322182082,
+          expiration: 1571408582082,
+          id: 'BO2XZwgJFuWTT0QQZ2m0',
+          invalidated: false,
+          name: 'second-api-key',
+          realm: 'reserved',
+          username: 'elastic',
+        },
+      ],
+    });
 
-// FLAKY: https://github.com/elastic/kibana/issues/97085
-describe.skip('APIKeysGridPage', () => {
+    authc.getCurrentUser.mockResolvedValue(
+      mockAuthenticatedUser({
+        username: 'jdoe',
+        full_name: '',
+        email: '',
+        enabled: true,
+        roles: ['superuser'],
+      })
+    );
+  });
   it('loads and displays API keys', async () => {
     const history = createMemoryHistory({ initialEntries: ['/'] });
 
-    const { getByText } = render(
+    const { findByText } = render(
       <Providers services={coreStart} authc={authc} history={history}>
         <APIKeysGridPage
           apiKeysAPIClient={apiClientMock}
@@ -85,9 +94,14 @@ describe.skip('APIKeysGridPage', () => {
       </Providers>
     );
 
-    await waitForElementToBeRemoved(() => getByText(/Loading API keys/));
-    getByText(/first-api-key/);
-    getByText(/second-api-key/);
+    expect(await findByText(/Loading API keys/)).not.toBeInTheDocument();
+    await findByText(/first-api-key/);
+    await findByText(/second-api-key/);
+  });
+
+  afterAll(() => {
+    // Let's make sure we restore everything just in case
+    consoleWarnMock.mockRestore();
   });
 
   it('displays callout when API keys are disabled', async () => {
@@ -98,7 +112,7 @@ describe.skip('APIKeysGridPage', () => {
       isAdmin: true,
     });
 
-    const { getByText } = render(
+    const { findByText } = render(
       <Providers services={coreStart} authc={authc} history={history}>
         <APIKeysGridPage
           apiKeysAPIClient={apiClientMock}
@@ -108,8 +122,8 @@ describe.skip('APIKeysGridPage', () => {
       </Providers>
     );
 
-    await waitForElementToBeRemoved(() => getByText(/Loading API keys/));
-    getByText(/API keys not enabled/);
+    expect(await findByText(/Loading API keys/)).not.toBeInTheDocument();
+    await findByText(/API keys not enabled/);
   });
 
   it('displays error when user does not have required permissions', async () => {
@@ -120,7 +134,7 @@ describe.skip('APIKeysGridPage', () => {
       isAdmin: false,
     });
 
-    const { getByText } = render(
+    const { findByText } = render(
       <Providers services={coreStart} authc={authc} history={history}>
         <APIKeysGridPage
           apiKeysAPIClient={apiClientMock}
@@ -130,145 +144,21 @@ describe.skip('APIKeysGridPage', () => {
       </Providers>
     );
 
-    await waitForElementToBeRemoved(() => getByText(/Loading API keys/));
-    getByText(/You need permission to manage API keys/);
+    expect(await findByText(/Loading API keys/)).not.toBeInTheDocument();
+    await findByText(/You need permission to manage API keys/);
   });
 
   it('displays error when fetching API keys fails', async () => {
     apiClientMock.getApiKeys.mockRejectedValueOnce({
-      body: { error: 'Internal Server Error', message: '', statusCode: 500 },
-    });
-    const history = createMemoryHistory({ initialEntries: ['/'] });
-
-    const { getByText } = render(
-      <Providers services={coreStart} authc={authc} history={history}>
-        <APIKeysGridPage
-          apiKeysAPIClient={apiClientMock}
-          notifications={coreStart.notifications}
-          history={history}
-        />
-      </Providers>
-    );
-
-    await waitForElementToBeRemoved(() => getByText(/Loading API keys/));
-    getByText(/Could not load API keys/);
-  });
-
-  it('creates API key when submitting form, redirects back and displays base64', async () => {
-    const history = createMemoryHistory({ initialEntries: ['/create'] });
-    coreStart.http.get.mockResolvedValue([{ name: 'superuser' }]);
-    coreStart.http.post.mockResolvedValue({ id: '1D', api_key: 'AP1_K3Y' });
-
-    const { findByRole, findByDisplayValue } = render(
-      <Providers services={coreStart} authc={authc} history={history}>
-        <APIKeysGridPage
-          apiKeysAPIClient={apiClientMock}
-          notifications={coreStart.notifications}
-          history={history}
-        />
-      </Providers>
-    );
-    expect(coreStart.http.get).toHaveBeenCalledWith('/api/security/role');
-
-    const dialog = await findByRole('dialog');
-
-    fireEvent.click(await findByRole('button', { name: 'Create API key' }));
-
-    const alert = await findByRole('alert');
-    within(alert).getByText(/Enter a name/i);
-
-    fireEvent.change(await within(dialog).findByLabelText('Name'), {
-      target: { value: 'Test' },
-    });
-
-    fireEvent.click(await findByRole('button', { name: 'Create API key' }));
-
-    await waitFor(() => {
-      expect(coreStart.http.post).toHaveBeenLastCalledWith('/internal/security/api_key', {
-        body: JSON.stringify({ name: 'Test' }),
-      });
-      expect(history.location.pathname).toBe('/');
-    });
-
-    await findByDisplayValue(btoa('1D:AP1_K3Y'));
-  });
-
-  it('creates API key with optional expiration, redirects back and displays base64', async () => {
-    const history = createMemoryHistory({ initialEntries: ['/create'] });
-    coreStart.http.get.mockResolvedValue([{ name: 'superuser' }]);
-    coreStart.http.post.mockResolvedValue({ id: '1D', api_key: 'AP1_K3Y' });
-
-    const { findByRole, findByDisplayValue } = render(
-      <Providers services={coreStart} authc={authc} history={history}>
-        <APIKeysGridPage
-          apiKeysAPIClient={apiClientMock}
-          notifications={coreStart.notifications}
-          history={history}
-        />
-      </Providers>
-    );
-    expect(coreStart.http.get).toHaveBeenCalledWith('/api/security/role');
-
-    const dialog = await findByRole('dialog');
-
-    fireEvent.change(await within(dialog).findByLabelText('Name'), {
-      target: { value: 'Test' },
-    });
-
-    fireEvent.click(await within(dialog).findByLabelText('Expire after time'));
-
-    fireEvent.click(await findByRole('button', { name: 'Create API key' }));
-
-    const alert = await findByRole('alert');
-    within(alert).getByText(/Enter a valid duration or disable this option\./i);
-
-    fireEvent.change(await within(dialog).findByLabelText('Lifetime (days)'), {
-      target: { value: '12' },
-    });
-
-    fireEvent.click(await findByRole('button', { name: 'Create API key' }));
-
-    await waitFor(() => {
-      expect(coreStart.http.post).toHaveBeenLastCalledWith('/internal/security/api_key', {
-        body: JSON.stringify({ name: 'Test', expiration: '12d' }),
-      });
-      expect(history.location.pathname).toBe('/');
+      body: {
+        error: 'Internal Server Error',
+        message: 'Internal Server Error',
+        statusCode: 500,
+      },
     });
-
-    await findByDisplayValue(btoa('1D:AP1_K3Y'));
-  });
-
-  it('deletes api key using cta button', async () => {
-    const history = createMemoryHistory({ initialEntries: ['/'] });
-
-    const { findByRole, findAllByLabelText } = render(
-      <Providers services={coreStart} authc={authc} history={history}>
-        <APIKeysGridPage
-          apiKeysAPIClient={apiClientMock}
-          notifications={coreStart.notifications}
-          history={history}
-        />
-      </Providers>
-    );
-
-    const [deleteButton] = await findAllByLabelText(/Delete/i);
-    fireEvent.click(deleteButton);
-
-    const dialog = await findByRole('dialog');
-    fireEvent.click(await within(dialog).findByRole('button', { name: 'Delete API key' }));
-
-    await waitFor(() => {
-      expect(apiClientMock.invalidateApiKeys).toHaveBeenLastCalledWith(
-        [{ id: '0QQZ2m0BO2XZwgJFuWTT', name: 'first-api-key' }],
-        true
-      );
-    });
-  });
-
-  it('deletes multiple api keys using bulk select', async () => {
     const history = createMemoryHistory({ initialEntries: ['/'] });
 
-    const { findByRole, findAllByRole } = render(
+    const { findByText } = render(
       <Providers services={coreStart} authc={authc} history={history}>
         <APIKeysGridPage
           apiKeysAPIClient={apiClientMock}
@@ -278,21 +168,7 @@ describe.skip('APIKeysGridPage', () => {
       </Providers>
     );
 
-    const deleteCheckboxes = await findAllByRole('checkbox', { name: 'Select this row' });
-    deleteCheckboxes.forEach((checkbox) => fireEvent.click(checkbox));
-    fireEvent.click(await findByRole('button', { name: 'Delete API keys' }));
-
-    const dialog = await findByRole('dialog');
-    fireEvent.click(await within(dialog).findByRole('button', { name: 'Delete API keys' }));
-
-    await waitFor(() => {
-      expect(apiClientMock.invalidateApiKeys).toHaveBeenLastCalledWith(
-        [
-          { id: '0QQZ2m0BO2XZwgJFuWTT', name: 'first-api-key' },
-          { id: 'BO2XZwgJFuWTT0QQZ2m0', name: 'second-api-key' },
-        ],
-        true
-      );
-    });
+    expect(await findByText(/Loading API keys/)).not.toBeInTheDocument();
+    await findByText(/Could not load API keys/);
   });
 });
diff --git a/x-pack/plugins/security/public/management/api_keys/api_keys_grid/api_keys_grid_page.tsx b/x-pack/plugins/security/public/management/api_keys/api_keys_grid/api_keys_grid_page.tsx
index dcf2a7bfe5165..a4843e4637d8b 100644
--- a/x-pack/plugins/security/public/management/api_keys/api_keys_grid/api_keys_grid_page.tsx
+++ b/x-pack/plugins/security/public/management/api_keys/api_keys_grid/api_keys_grid_page.tsx
@@ -164,6 +164,7 @@ export class APIKeysGridPage extends Component<Props, State> {
               {...reactRouterNavigate(this.props.history, '/create')}
               fill
               iconType="plusInCircleFilled"
+              data-test-subj="apiKeysCreatePromptButton"
             >
               <FormattedMessage
                 id="xpack.security.management.apiKeys.table.createButton"
@@ -207,6 +208,7 @@ export class APIKeysGridPage extends Component<Props, State> {
               {...reactRouterNavigate(this.props.history, '/create')}
               fill
               iconType="plusInCircleFilled"
+              data-test-subj="apiKeysCreateTableButton"
             >
               <FormattedMessage
                 id="xpack.security.management.apiKeys.table.createButton"
@@ -597,6 +599,7 @@ export class APIKeysGridPage extends Component<Props, State> {
             color: 'danger',
             onClick: (item) =>
               invalidateApiKeyPrompt([{ id: item.id, name: item.name }], this.onApiKeysInvalidated),
+            'data-test-subj': 'apiKeysTableDeleteAction',
           },
         ],
       },
diff --git a/x-pack/plugins/security/public/management/api_keys/api_keys_grid/create_api_key_flyout.tsx b/x-pack/plugins/security/public/management/api_keys/api_keys_grid/create_api_key_flyout.tsx
index e1ffc3b4b3515..f2fa6f7de468e 100644
--- a/x-pack/plugins/security/public/management/api_keys/api_keys_grid/create_api_key_flyout.tsx
+++ b/x-pack/plugins/security/public/management/api_keys/api_keys_grid/create_api_key_flyout.tsx
@@ -202,6 +202,7 @@ export const CreateApiKeyFlyout: FunctionComponent<CreateApiKeyFlyoutProps> = ({
               isInvalid={form.touched.name && !!form.errors.name}
               inputRef={firstFieldRef}
               fullWidth
+              data-test-subj="apiKeyNameInput"
             />
           </EuiFormRow>
 
@@ -258,6 +259,7 @@ export const CreateApiKeyFlyout: FunctionComponent<CreateApiKeyFlyoutProps> = ({
               )}
               checked={!!form.values.customExpiration}
               onChange={(e) => form.setValue('customExpiration', e.target.checked)}
+              data-test-subj="apiKeyCustomExpirationSwitch"
             />
             {form.values.customExpiration && (
               <>
@@ -284,6 +286,7 @@ export const CreateApiKeyFlyout: FunctionComponent<CreateApiKeyFlyoutProps> = ({
                     defaultValue={form.values.expiration}
                     isInvalid={form.touched.expiration && !!form.errors.expiration}
                     fullWidth
+                    data-test-subj="apiKeyCustomExpirationInput"
                   />
                 </EuiFormRow>
                 <EuiSpacer size="s" />
diff --git a/x-pack/plugins/security/public/management/api_keys/api_keys_grid/invalidate_provider/index.ts b/x-pack/plugins/security/public/management/api_keys/api_keys_grid/invalidate_provider/index.ts
index dc99861ce0a8d..3af1e9d37c17d 100644
--- a/x-pack/plugins/security/public/management/api_keys/api_keys_grid/invalidate_provider/index.ts
+++ b/x-pack/plugins/security/public/management/api_keys/api_keys_grid/invalidate_provider/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { InvalidateProvider, InvalidateApiKeys } from './invalidate_provider';
+export type { InvalidateApiKeys } from './invalidate_provider';
+export { InvalidateProvider } from './invalidate_provider';
diff --git a/x-pack/plugins/security/public/management/role_mappings/model/index.ts b/x-pack/plugins/security/public/management/role_mappings/model/index.ts
index 25e66bda35034..d80eb4d7d6943 100644
--- a/x-pack/plugins/security/public/management/role_mappings/model/index.ts
+++ b/x-pack/plugins/security/public/management/role_mappings/model/index.ts
@@ -11,6 +11,7 @@ export { Rule } from './rule';
 export { RuleGroup } from './rule_group';
 export { ExceptAllRule } from './except_all_rule';
 export { ExceptAnyRule } from './except_any_rule';
-export { FieldRule, FieldRuleValue } from './field_rule';
+export type { FieldRuleValue } from './field_rule';
+export { FieldRule } from './field_rule';
 export { generateRulesFromRaw } from './rule_builder';
 export { RuleBuilderError } from './rule_builder_error';
diff --git a/x-pack/plugins/security/public/nav_control/index.ts b/x-pack/plugins/security/public/nav_control/index.ts
index 5ec306fa97170..95331b7504070 100644
--- a/x-pack/plugins/security/public/nav_control/index.ts
+++ b/x-pack/plugins/security/public/nav_control/index.ts
@@ -5,5 +5,6 @@
  * 2.0.
  */
 
-export { SecurityNavControlService, SecurityNavControlServiceStart } from './nav_control_service';
+export type { SecurityNavControlServiceStart } from './nav_control_service';
+export { SecurityNavControlService } from './nav_control_service';
 export type { UserMenuLink } from './nav_control_component';
diff --git a/x-pack/plugins/security/server/anonymous_access/index.ts b/x-pack/plugins/security/server/anonymous_access/index.ts
index 2d86cb3a3e3b4..6e41ab1bae780 100644
--- a/x-pack/plugins/security/server/anonymous_access/index.ts
+++ b/x-pack/plugins/security/server/anonymous_access/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { AnonymousAccessService, AnonymousAccessServiceStart } from './anonymous_access_service';
+export type { AnonymousAccessServiceStart } from './anonymous_access_service';
+export { AnonymousAccessService } from './anonymous_access_service';
diff --git a/x-pack/plugins/security/server/audit/index.ts b/x-pack/plugins/security/server/audit/index.ts
index 5cae122c94cc3..b859e773552a3 100644
--- a/x-pack/plugins/security/server/audit/index.ts
+++ b/x-pack/plugins/security/server/audit/index.ts
@@ -5,9 +5,10 @@
  * 2.0.
  */
 
-export { AuditService, AuditServiceSetup, AuditLogger } from './audit_service';
+export type { AuditServiceSetup, AuditLogger } from './audit_service';
+export { AuditService } from './audit_service';
+export type { AuditEvent } from './audit_events';
 export {
-  AuditEvent,
   userLoginEvent,
   accessAgreementAcknowledgedEvent,
   httpRequestEvent,
diff --git a/x-pack/plugins/security/server/authentication/api_keys/index.ts b/x-pack/plugins/security/server/authentication/api_keys/index.ts
index b14d09d559700..44fe48f04debb 100644
--- a/x-pack/plugins/security/server/authentication/api_keys/index.ts
+++ b/x-pack/plugins/security/server/authentication/api_keys/index.ts
@@ -5,11 +5,11 @@
  * 2.0.
  */
 
-export {
-  APIKeys,
+export type {
   CreateAPIKeyResult,
   InvalidateAPIKeyResult,
   CreateAPIKeyParams,
   InvalidateAPIKeysParams,
   GrantAPIKeyResult,
 } from './api_keys';
+export { APIKeys } from './api_keys';
diff --git a/x-pack/plugins/security/server/authentication/index.ts b/x-pack/plugins/security/server/authentication/index.ts
index 1e46d2aaf560e..f6f6f1da36952 100644
--- a/x-pack/plugins/security/server/authentication/index.ts
+++ b/x-pack/plugins/security/server/authentication/index.ts
@@ -6,11 +6,11 @@
  */
 
 export { canRedirectRequest } from './can_redirect_request';
-export {
-  AuthenticationService,
+export type {
   AuthenticationServiceStart,
   InternalAuthenticationServiceStart,
 } from './authentication_service';
+export { AuthenticationService } from './authentication_service';
 export { AuthenticationResult } from './authentication_result';
 export { DeauthenticationResult } from './deauthentication_result';
 export {
diff --git a/x-pack/plugins/security/server/authentication/providers/index.ts b/x-pack/plugins/security/server/authentication/providers/index.ts
index c589371331eaf..31f89889b3892 100644
--- a/x-pack/plugins/security/server/authentication/providers/index.ts
+++ b/x-pack/plugins/security/server/authentication/providers/index.ts
@@ -5,11 +5,8 @@
  * 2.0.
  */
 
-export {
-  BaseAuthenticationProvider,
-  AuthenticationProviderOptions,
-  AuthenticationProviderSpecificOptions,
-} from './base';
+export type { AuthenticationProviderOptions, AuthenticationProviderSpecificOptions } from './base';
+export { BaseAuthenticationProvider } from './base';
 export { AnonymousAuthenticationProvider } from './anonymous';
 export { BasicAuthenticationProvider } from './basic';
 export { KerberosAuthenticationProvider } from './kerberos';
diff --git a/x-pack/plugins/security/server/authorization/authorization_service.tsx b/x-pack/plugins/security/server/authorization/authorization_service.tsx
index 72f2c9843daec..004c82d2c3f3f 100644
--- a/x-pack/plugins/security/server/authorization/authorization_service.tsx
+++ b/x-pack/plugins/security/server/authorization/authorization_service.tsx
@@ -50,7 +50,7 @@ import { validateFeaturePrivileges } from './validate_feature_privileges';
 import { validateReservedPrivileges } from './validate_reserved_privileges';
 
 export { Actions } from './actions';
-export { CheckSavedObjectsPrivileges } from './check_saved_objects_privileges';
+export type { CheckSavedObjectsPrivileges } from './check_saved_objects_privileges';
 
 interface AuthorizationServiceSetupParams {
   packageVersion: string;
diff --git a/x-pack/plugins/security/server/authorization/index.ts b/x-pack/plugins/security/server/authorization/index.ts
index 221baa85a65f6..265ec2dce5a31 100644
--- a/x-pack/plugins/security/server/authorization/index.ts
+++ b/x-pack/plugins/security/server/authorization/index.ts
@@ -6,11 +6,12 @@
  */
 
 export { Actions } from './actions';
-export {
-  AuthorizationService,
+export type {
   AuthorizationServiceSetup,
   AuthorizationServiceSetupInternal,
 } from './authorization_service';
-export { CheckSavedObjectsPrivileges } from './check_saved_objects_privileges';
-export { CheckPrivilegesPayload } from './types';
-export { transformElasticsearchRoleToRole, ElasticsearchRole } from './roles';
+export { AuthorizationService } from './authorization_service';
+export type { CheckSavedObjectsPrivileges } from './check_saved_objects_privileges';
+export type { CheckPrivilegesPayload } from './types';
+export type { ElasticsearchRole } from './roles';
+export { transformElasticsearchRoleToRole } from './roles';
diff --git a/x-pack/plugins/security/server/authorization/privileges/feature_privilege_builder/index.ts b/x-pack/plugins/security/server/authorization/privileges/feature_privilege_builder/index.ts
index 81d1339052301..d46f30ef53ab4 100644
--- a/x-pack/plugins/security/server/authorization/privileges/feature_privilege_builder/index.ts
+++ b/x-pack/plugins/security/server/authorization/privileges/feature_privilege_builder/index.ts
@@ -14,13 +14,13 @@ import { FeaturePrivilegeApiBuilder } from './api';
 import { FeaturePrivilegeAppBuilder } from './app';
 import { FeaturePrivilegeCasesBuilder } from './cases';
 import { FeaturePrivilegeCatalogueBuilder } from './catalogue';
-import { FeaturePrivilegeBuilder } from './feature_privilege_builder';
+import type { FeaturePrivilegeBuilder } from './feature_privilege_builder';
 import { FeaturePrivilegeManagementBuilder } from './management';
 import { FeaturePrivilegeNavlinkBuilder } from './navlink';
 import { FeaturePrivilegeSavedObjectBuilder } from './saved_object';
 import { FeaturePrivilegeUIBuilder } from './ui';
 
-export { FeaturePrivilegeBuilder };
+export type { FeaturePrivilegeBuilder };
 
 export const featurePrivilegeBuilderFactory = (actions: Actions): FeaturePrivilegeBuilder => {
   const builders = [
diff --git a/x-pack/plugins/security/server/authorization/privileges/index.ts b/x-pack/plugins/security/server/authorization/privileges/index.ts
index 31c9cf2713c9d..7e98730abd71e 100644
--- a/x-pack/plugins/security/server/authorization/privileges/index.ts
+++ b/x-pack/plugins/security/server/authorization/privileges/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { privilegesFactory, PrivilegesService } from './privileges';
+export type { PrivilegesService } from './privileges';
+export { privilegesFactory } from './privileges';
diff --git a/x-pack/plugins/security/server/authorization/roles/index.ts b/x-pack/plugins/security/server/authorization/roles/index.ts
index a5047a1872c09..205c339b45fbc 100644
--- a/x-pack/plugins/security/server/authorization/roles/index.ts
+++ b/x-pack/plugins/security/server/authorization/roles/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { transformElasticsearchRoleToRole, ElasticsearchRole } from './elasticsearch_role';
+export type { ElasticsearchRole } from './elasticsearch_role';
+export { transformElasticsearchRoleToRole } from './elasticsearch_role';
diff --git a/x-pack/plugins/security/server/elasticsearch/index.ts b/x-pack/plugins/security/server/elasticsearch/index.ts
index 1c3bdd3054dd7..46acb874f7fc2 100644
--- a/x-pack/plugins/security/server/elasticsearch/index.ts
+++ b/x-pack/plugins/security/server/elasticsearch/index.ts
@@ -8,8 +8,8 @@
 import type { AuthenticatedUser } from '../../common/model';
 
 export type AuthenticationInfo = Omit<AuthenticatedUser, 'authentication_provider'>;
-export {
-  ElasticsearchService,
+export type {
   ElasticsearchServiceStart,
   OnlineStatusRetryScheduler,
 } from './elasticsearch_service';
+export { ElasticsearchService } from './elasticsearch_service';
diff --git a/x-pack/plugins/security/server/feature_usage/index.ts b/x-pack/plugins/security/server/feature_usage/index.ts
index 81d4336ef7bbb..b58dacfa97d3a 100644
--- a/x-pack/plugins/security/server/feature_usage/index.ts
+++ b/x-pack/plugins/security/server/feature_usage/index.ts
@@ -5,7 +5,5 @@
  * 2.0.
  */
 
-export {
-  SecurityFeatureUsageService,
-  SecurityFeatureUsageServiceStart,
-} from './feature_usage_service';
+export type { SecurityFeatureUsageServiceStart } from './feature_usage_service';
+export { SecurityFeatureUsageService } from './feature_usage_service';
diff --git a/x-pack/plugins/security/server/index.ts b/x-pack/plugins/security/server/index.ts
index d1600b52df0ad..10b1e8167c14a 100644
--- a/x-pack/plugins/security/server/index.ts
+++ b/x-pack/plugins/security/server/index.ts
@@ -29,11 +29,11 @@ export type {
 } from './authentication';
 export type { CheckPrivilegesPayload } from './authorization';
 export type AuthorizationServiceSetup = SecurityPluginStart['authz'];
-export { AuditLogger, AuditEvent } from './audit';
+export type { AuditLogger, AuditEvent } from './audit';
 export type { SecurityPluginSetup, SecurityPluginStart };
 export type { AuthenticatedUser } from '../common/model';
 export { ROUTE_TAG_CAN_REDIRECT } from './routes/tags';
-export { AuditServiceSetup } from './audit';
+export type { AuditServiceSetup } from './audit';
 
 export const config: PluginConfigDescriptor<TypeOf<typeof ConfigSchema>> = {
   schema: ConfigSchema,
diff --git a/x-pack/plugins/security/server/routes/authorization/roles/model/index.ts b/x-pack/plugins/security/server/routes/authorization/roles/model/index.ts
index e090cd26dc39f..cb5bb8a91152c 100644
--- a/x-pack/plugins/security/server/routes/authorization/roles/model/index.ts
+++ b/x-pack/plugins/security/server/routes/authorization/roles/model/index.ts
@@ -5,5 +5,6 @@
  * 2.0.
  */
 
-export { ElasticsearchRole, transformElasticsearchRoleToRole } from '../../../../authorization';
+export type { ElasticsearchRole } from '../../../../authorization';
+export { transformElasticsearchRoleToRole } from '../../../../authorization';
 export { getPutPayloadSchema, transformPutPayloadToElasticsearchRole } from './put_payload';
diff --git a/x-pack/plugins/security/server/session_management/index.ts b/x-pack/plugins/security/server/session_management/index.ts
index a9ac23ad6354b..09787ed419854 100644
--- a/x-pack/plugins/security/server/session_management/index.ts
+++ b/x-pack/plugins/security/server/session_management/index.ts
@@ -5,8 +5,7 @@
  * 2.0.
  */
 
-export { Session, SessionValue } from './session';
-export {
-  SessionManagementServiceStart,
-  SessionManagementService,
-} from './session_management_service';
+export type { SessionValue } from './session';
+export { Session } from './session';
+export type { SessionManagementServiceStart } from './session_management_service';
+export { SessionManagementService } from './session_management_service';
diff --git a/x-pack/plugins/security_solution/common/constants.ts b/x-pack/plugins/security_solution/common/constants.ts
index 2772c3de51065..584f3ed334d89 100644
--- a/x-pack/plugins/security_solution/common/constants.ts
+++ b/x-pack/plugins/security_solution/common/constants.ts
@@ -11,8 +11,16 @@ import type { TransformConfigSchema } from './transforms/types';
 import { ENABLE_CASE_CONNECTOR } from '../../cases/common';
 import { METADATA_TRANSFORMS_PATTERN } from './endpoint/constants';
 
+/**
+ * as const
+ *
+ * The const assertion ensures that type widening does not occur
+ * https://mariusschulz.com/blog/literal-type-widening-in-typescript
+ * Please follow this convention when adding to this file
+ */
+
 export const APP_ID = 'securitySolution' as const;
-export const APP_UI_ID = 'securitySolutionUI';
+export const APP_UI_ID = 'securitySolutionUI' as const;
 export const CASES_FEATURE_ID = 'securitySolutionCases' as const;
 export const SERVER_APP_ID = 'siem' as const;
 export const APP_NAME = 'Security' as const;
@@ -26,6 +34,8 @@ export const DEFAULT_DATE_FORMAT_TZ = 'dateFormat:tz' as const;
 export const DEFAULT_DARK_MODE = 'theme:darkMode' as const;
 export const DEFAULT_INDEX_KEY = 'securitySolution:defaultIndex' as const;
 export const DEFAULT_NUMBER_FORMAT = 'format:number:defaultPattern' as const;
+export const DEFAULT_DATA_VIEW_ID = 'security-solution' as const;
+export const DEFAULT_TIME_FIELD = '@timestamp' as const;
 export const DEFAULT_TIME_RANGE = 'timepicker:timeDefaults' as const;
 export const DEFAULT_REFRESH_RATE_INTERVAL = 'timepicker:refreshIntervalDefaults' as const;
 export const DEFAULT_APP_TIME_RANGE = 'securitySolution:timeDefaults' as const;
@@ -51,7 +61,6 @@ export const DEFAULT_TIMEPICKER_QUICK_RANGES = 'timepicker:quickRanges' as const
 export const DEFAULT_TRANSFORMS = 'securitySolution:transforms' as const;
 export const SCROLLING_DISABLED_CLASS_NAME = 'scrolling-disabled' as const;
 export const GLOBAL_HEADER_HEIGHT = 96 as const; // px
-export const GLOBAL_HEADER_HEIGHT_WITH_GLOBAL_BANNER = 128 as const; // px
 export const FILTERS_GLOBAL_HEIGHT = 109 as const; // px
 export const FULL_SCREEN_TOGGLED_CLASS_NAME = 'fullScreenToggled' as const;
 export const NO_ALERT_INDEX = 'no-alert-index-049FC71A-4C2C-446F-9901-37XMC5024C51' as const;
@@ -268,6 +277,7 @@ export const TIMELINE_PREPACKAGED_URL = `${TIMELINE_URL}/_prepackaged` as const;
 
 export const NOTE_URL = '/api/note' as const;
 export const PINNED_EVENT_URL = '/api/pinned_event' as const;
+export const SOURCERER_API_URL = '/api/sourcerer' as const;
 
 /**
  * Default signals index key for kibana.dev.yml
@@ -355,7 +365,7 @@ export const ELASTIC_NAME = 'estc' as const;
 
 export const METADATA_TRANSFORM_STATS_URL = `/api/transform/transforms/${METADATA_TRANSFORMS_PATTERN}/_stats`;
 
-export const RISKY_HOSTS_INDEX_PREFIX = 'ml_host_risk_score_latest_';
+export const RISKY_HOSTS_INDEX_PREFIX = 'ml_host_risk_score_latest_' as const;
 
 export const TRANSFORM_STATES = {
   ABORTING: 'aborting',
diff --git a/x-pack/plugins/security_solution/common/detection_engine/get_query_filter.ts b/x-pack/plugins/security_solution/common/detection_engine/get_query_filter.ts
index 033e979d2814c..42c10614975eb 100644
--- a/x-pack/plugins/security_solution/common/detection_engine/get_query_filter.ts
+++ b/x-pack/plugins/security_solution/common/detection_engine/get_query_filter.ts
@@ -11,7 +11,7 @@ import type {
   CreateExceptionListItemSchema,
 } from '@kbn/securitysolution-io-ts-list-types';
 import { buildExceptionFilter } from '@kbn/securitysolution-list-utils';
-import { Filter, EsQueryConfig, IndexPatternBase, buildEsQuery } from '@kbn/es-query';
+import { Filter, EsQueryConfig, DataViewBase, buildEsQuery } from '@kbn/es-query';
 
 import { ESBoolQuery } from '../typed_json';
 import { Query, Index, TimestampOverrideOrUndefined } from './schemas/common/schemas';
@@ -24,7 +24,7 @@ export const getQueryFilter = (
   lists: Array<ExceptionListItemSchema | CreateExceptionListItemSchema>,
   excludeExceptions: boolean = true
 ): ESBoolQuery => {
-  const indexPattern: IndexPatternBase = {
+  const indexPattern: DataViewBase = {
     fields: [],
     title: index.join(),
   };
diff --git a/x-pack/plugins/security_solution/common/detection_engine/schemas/response/export_rules_details_schema.mock.ts b/x-pack/plugins/security_solution/common/detection_engine/schemas/response/export_rules_details_schema.mock.ts
new file mode 100644
index 0000000000000..a47d57c299117
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/detection_engine/schemas/response/export_rules_details_schema.mock.ts
@@ -0,0 +1,38 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ExportRulesDetails } from './export_rules_details_schema';
+import {
+  ExportExceptionDetailsMock,
+  getExceptionExportDetailsMock,
+} from '../../../../../lists/common/schemas/response/exception_export_details_schema.mock';
+
+interface RuleDetailsMock {
+  totalCount?: number;
+  rulesCount?: number;
+  missingCount?: number;
+  missingRules?: Array<Record<'rule_id', string>>;
+}
+
+export const getOutputDetailsSample = (ruleDetails?: RuleDetailsMock): ExportRulesDetails => ({
+  exported_count: ruleDetails?.totalCount ?? 0,
+  exported_rules_count: ruleDetails?.rulesCount ?? 0,
+  missing_rules: ruleDetails?.missingRules ?? [],
+  missing_rules_count: ruleDetails?.missingCount ?? 0,
+});
+
+export const getOutputDetailsSampleWithExceptions = (
+  ruleDetails?: RuleDetailsMock,
+  exceptionDetails?: ExportExceptionDetailsMock
+): ExportRulesDetails => ({
+  ...getOutputDetailsSample(ruleDetails),
+  ...getExceptionExportDetailsMock(exceptionDetails),
+});
+
+export const getSampleDetailsAsNdjson = (sample: ExportRulesDetails): string => {
+  return `${JSON.stringify(sample)}\n`;
+};
diff --git a/x-pack/plugins/security_solution/common/detection_engine/schemas/response/export_rules_details_schema.test.ts b/x-pack/plugins/security_solution/common/detection_engine/schemas/response/export_rules_details_schema.test.ts
new file mode 100644
index 0000000000000..af0295ee46046
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/detection_engine/schemas/response/export_rules_details_schema.test.ts
@@ -0,0 +1,60 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { pipe } from 'fp-ts/lib/pipeable';
+import { left } from 'fp-ts/lib/Either';
+import { exactCheck, foldLeftRight, getPaths } from '@kbn/securitysolution-io-ts-utils';
+
+import {
+  getOutputDetailsSample,
+  getOutputDetailsSampleWithExceptions,
+} from './export_rules_details_schema.mock';
+import {
+  ExportRulesDetails,
+  exportRulesDetailsWithExceptionsSchema,
+} from './export_rules_details_schema';
+
+describe('exportRulesDetailsWithExceptionsSchema', () => {
+  test('it should validate export details response', () => {
+    const payload = getOutputDetailsSample();
+    const decoded = exportRulesDetailsWithExceptionsSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should validate export details with exceptions details response', () => {
+    const payload = getOutputDetailsSampleWithExceptions();
+    const decoded = exportRulesDetailsWithExceptionsSchema.decode(payload);
+    const checked = exactCheck(payload, decoded);
+    const message = pipe(checked, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should strip out extra keys', () => {
+    const payload: ExportRulesDetails & {
+      extraKey?: string;
+    } = getOutputDetailsSample();
+    payload.extraKey = 'some extra key';
+    const decoded = exportRulesDetailsWithExceptionsSchema.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(getOutputDetailsSample());
+  });
+});
diff --git a/x-pack/plugins/security_solution/common/detection_engine/schemas/response/export_rules_details_schema.ts b/x-pack/plugins/security_solution/common/detection_engine/schemas/response/export_rules_details_schema.ts
new file mode 100644
index 0000000000000..00e34ca9d7326
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/detection_engine/schemas/response/export_rules_details_schema.ts
@@ -0,0 +1,41 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as t from 'io-ts';
+import { exportExceptionDetails } from '@kbn/securitysolution-io-ts-list-types';
+import { NonEmptyString } from '@kbn/securitysolution-io-ts-types';
+
+const createSchema = <Required extends t.Props, Optional extends t.Props>(
+  requiredFields: Required,
+  optionalFields: Optional
+) => {
+  return t.intersection([t.exact(t.type(requiredFields)), t.exact(t.partial(optionalFields))]);
+};
+
+export const exportRulesDetails = {
+  exported_count: t.number,
+  exported_rules_count: t.number,
+  missing_rules: t.array(
+    t.exact(
+      t.type({
+        rule_id: NonEmptyString,
+      })
+    )
+  ),
+  missing_rules_count: t.number,
+};
+
+const exportRulesDetailsSchema = t.exact(t.type(exportRulesDetails));
+export type ExportRulesDetailsSchema = t.TypeOf<typeof exportRulesDetailsSchema>;
+
+// With exceptions
+export const exportRulesDetailsWithExceptionsSchema = createSchema(
+  exportRulesDetails,
+  exportExceptionDetails
+);
+
+export type ExportRulesDetails = t.TypeOf<typeof exportRulesDetailsWithExceptionsSchema>;
diff --git a/x-pack/plugins/security_solution/common/experimental_features.ts b/x-pack/plugins/security_solution/common/experimental_features.ts
index b6a0724faebed..4fd1b00ae3bee 100644
--- a/x-pack/plugins/security_solution/common/experimental_features.ts
+++ b/x-pack/plugins/security_solution/common/experimental_features.ts
@@ -21,6 +21,7 @@ export const allowedExperimentalValues = Object.freeze({
   uebaEnabled: false,
   disableIsolationUIPendingStatuses: false,
   riskyHostsEnabled: false,
+  pendingActionResponsesWithAck: true,
 });
 
 type ExperimentalConfigKeys = Array<keyof ExperimentalFeatures>;
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/field_maps/alerts.ts b/x-pack/plugins/security_solution/common/field_maps/alerts.ts
similarity index 98%
rename from x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/field_maps/alerts.ts
rename to x-pack/plugins/security_solution/common/field_maps/alerts.ts
index 5a7ceb83baf8c..08ce8f098f6fd 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/field_maps/alerts.ts
+++ b/x-pack/plugins/security_solution/common/field_maps/alerts.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { FieldMap } from '../../../../../../rule_registry/common/field_map';
+import { FieldMap } from '../../../rule_registry/common/field_map';
 
 export const alertsFieldMap: FieldMap = {
   'kibana.alert.ancestors': {
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/field_maps/field_names.ts b/x-pack/plugins/security_solution/common/field_maps/field_names.ts
similarity index 90%
rename from x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/field_maps/field_names.ts
rename to x-pack/plugins/security_solution/common/field_maps/field_names.ts
index 62c20217d23f0..1cb40063202d0 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/field_maps/field_names.ts
+++ b/x-pack/plugins/security_solution/common/field_maps/field_names.ts
@@ -13,6 +13,7 @@ export const ALERT_DEPTH = `${ALERT_NAMESPACE}.depth` as const;
 export const ALERT_GROUP_ID = `${ALERT_NAMESPACE}.group.id` as const;
 export const ALERT_GROUP_INDEX = `${ALERT_NAMESPACE}.group.index` as const;
 export const ALERT_ORIGINAL_TIME = `${ALERT_NAMESPACE}.original_time` as const;
+export const ALERT_THRESHOLD_RESULT = `${ALERT_NAMESPACE}.threshold_result` as const;
 
 export const ALERT_ORIGINAL_EVENT = `${ALERT_NAMESPACE}.original_event` as const;
 export const ALERT_ORIGINAL_EVENT_ACTION = `${ALERT_ORIGINAL_EVENT}.action` as const;
@@ -24,3 +25,4 @@ export const ALERT_ORIGINAL_EVENT_TYPE = `${ALERT_ORIGINAL_EVENT}.type` as const
 
 export const ALERT_RULE_THRESHOLD = `${ALERT_RULE_NAMESPACE}.threshold` as const;
 export const ALERT_RULE_THRESHOLD_FIELD = `${ALERT_RULE_THRESHOLD}.field` as const;
+export const ALERT_RULE_TIMELINE_ID = `${ALERT_RULE_NAMESPACE}.timeline_id` as const;
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/field_maps/index.ts b/x-pack/plugins/security_solution/common/field_maps/index.ts
similarity index 80%
rename from x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/field_maps/index.ts
rename to x-pack/plugins/security_solution/common/field_maps/index.ts
index 0f19e2b3d3a91..e293dac663816 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/field_maps/index.ts
+++ b/x-pack/plugins/security_solution/common/field_maps/index.ts
@@ -7,4 +7,5 @@
 
 import { AlertsFieldMap, alertsFieldMap } from './alerts';
 import { RulesFieldMap, rulesFieldMap } from './rules';
-export { AlertsFieldMap, RulesFieldMap, alertsFieldMap, rulesFieldMap };
+export type { AlertsFieldMap, RulesFieldMap };
+export { alertsFieldMap, rulesFieldMap };
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/field_maps/rules.ts b/x-pack/plugins/security_solution/common/field_maps/rules.ts
similarity index 100%
rename from x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/field_maps/rules.ts
rename to x-pack/plugins/security_solution/common/field_maps/rules.ts
diff --git a/x-pack/plugins/security_solution/common/search_strategy/index_fields/index.ts b/x-pack/plugins/security_solution/common/search_strategy/index_fields/index.ts
index be5fd3b5c4dc5..86bc11f7a596d 100644
--- a/x-pack/plugins/security_solution/common/search_strategy/index_fields/index.ts
+++ b/x-pack/plugins/security_solution/common/search_strategy/index_fields/index.ts
@@ -5,79 +5,17 @@
  * 2.0.
  */
 
-import type { IFieldSubType } from '@kbn/es-query';
-
-import type {
-  IEsSearchRequest,
-  IEsSearchResponse,
-  IIndexPattern,
-} from '../../../../../../src/plugins/data/common';
-import type { DocValueFields, Maybe } from '../common';
-
-interface FieldInfo {
-  category: string;
-  description?: string;
-  example?: string | number;
-  format?: string;
-  name: string;
-  type?: string;
-}
-
-export interface IndexField {
-  /** Where the field belong */
-  category: string;
-  /** Example of field's value */
-  example?: Maybe<string | number>;
-  /** whether the field's belong to an alias index */
-  indexes: Array<Maybe<string>>;
-  /** The name of the field */
-  name: string;
-  /** The type of the field's values as recognized by Kibana */
-  type: string;
-  /** Whether the field's values can be efficiently searched for */
-  searchable: boolean;
-  /** Whether the field's values can be aggregated */
-  aggregatable: boolean;
-  /** Description of the field */
-  description?: Maybe<string>;
-  format?: Maybe<string>;
-  /** the elastic type as mapped in the index */
-  esTypes?: string[];
-  subType?: IFieldSubType;
-  readFromDocValues: boolean;
-}
-
-export type BeatFields = Record<string, FieldInfo>;
-
-export interface IndexFieldsStrategyRequest extends IEsSearchRequest {
-  indices: string[];
-  onlyCheckIfIndicesExist: boolean;
-}
-
-export interface IndexFieldsStrategyResponse extends IEsSearchResponse {
-  indexFields: IndexField[];
-  indicesExist: string[];
-}
-
-export interface BrowserField {
-  aggregatable: boolean;
-  category: string;
-  description: string | null;
-  example: string | number | null;
-  fields: Readonly<Record<string, Partial<BrowserField>>>;
-  format: string;
-  indexes: string[];
-  name: string;
-  searchable: boolean;
-  type: string;
-  subType?: IFieldSubType;
-}
-
-export type BrowserFields = Readonly<Record<string, Partial<BrowserField>>>;
-
-export const EMPTY_BROWSER_FIELDS = {};
-export const EMPTY_DOCVALUE_FIELD: DocValueFields[] = [];
-export const EMPTY_INDEX_PATTERN: IIndexPattern = {
-  fields: [],
-  title: '',
-};
+export type {
+  FieldInfo,
+  IndexField,
+  BeatFields,
+  IndexFieldsStrategyRequest,
+  IndexFieldsStrategyResponse,
+  BrowserField,
+  BrowserFields,
+} from '../../../../timelines/common';
+export {
+  EMPTY_BROWSER_FIELDS,
+  EMPTY_DOCVALUE_FIELD,
+  EMPTY_INDEX_FIELDS,
+} from '../../../../timelines/common';
diff --git a/x-pack/plugins/security_solution/common/search_strategy/timeline/events/last_event_time/index.ts b/x-pack/plugins/security_solution/common/search_strategy/timeline/events/last_event_time/index.ts
index 39f23a63c8afe..d6735b59c229d 100644
--- a/x-pack/plugins/security_solution/common/search_strategy/timeline/events/last_event_time/index.ts
+++ b/x-pack/plugins/security_solution/common/search_strategy/timeline/events/last_event_time/index.ts
@@ -10,6 +10,7 @@ export { LastEventIndexKey } from '../../../../../../timelines/common';
 export type {
   LastTimeDetails,
   TimelineEventsLastEventTimeStrategyResponse,
+  TimelineKpiStrategyRequest,
   TimelineKpiStrategyResponse,
   TimelineEventsLastEventTimeRequestOptions,
 } from '../../../../../../timelines/common';
diff --git a/x-pack/plugins/security_solution/common/search_strategy/timeline/index.ts b/x-pack/plugins/security_solution/common/search_strategy/timeline/index.ts
index 548560ac5cb8c..2d94a36a937d5 100644
--- a/x-pack/plugins/security_solution/common/search_strategy/timeline/index.ts
+++ b/x-pack/plugins/security_solution/common/search_strategy/timeline/index.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { MappingRuntimeFields } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import { IEsSearchRequest } from '../../../../../../src/plugins/data/common';
 import { ESQuery } from '../../typed_json';
 import {
@@ -41,6 +42,7 @@ export interface TimelineRequestBasicOptions extends IEsSearchRequest {
   defaultIndex: string[];
   docValueFields?: DocValueFields[];
   factoryQueryType?: TimelineFactoryQueryTypes;
+  runtimeMappings: MappingRuntimeFields;
 }
 
 export interface TimelineRequestSortField<Field = string> extends SortField<Field> {
@@ -171,6 +173,7 @@ export interface SortTimelineInput {
 export interface TimelineInput {
   columns?: Maybe<ColumnHeaderInput[]>;
   dataProviders?: Maybe<DataProviderInput[]>;
+  dataViewId?: Maybe<string>;
   description?: Maybe<string>;
   eqlOptions?: Maybe<EqlOptionsInput>;
   eventType?: Maybe<string>;
diff --git a/x-pack/plugins/security_solution/common/test/index.ts b/x-pack/plugins/security_solution/common/test/index.ts
index 6d5df76b306a3..53261d54e84b0 100644
--- a/x-pack/plugins/security_solution/common/test/index.ts
+++ b/x-pack/plugins/security_solution/common/test/index.ts
@@ -7,12 +7,12 @@
 
 // For the source of these roles please consult the PR these were introduced https://github.com/elastic/kibana/pull/81866#issue-511165754
 export enum ROLES {
+  soc_manager = 'soc_manager',
   reader = 'reader',
   t1_analyst = 't1_analyst',
   t2_analyst = 't2_analyst',
   hunter = 'hunter',
   rule_author = 'rule_author',
-  soc_manager = 'soc_manager',
   platform_engineer = 'platform_engineer',
   detections_admin = 'detections_admin',
 }
diff --git a/x-pack/plugins/security_solution/common/types/timeline/index.ts b/x-pack/plugins/security_solution/common/types/timeline/index.ts
index c0046f7535db8..60fd126e6fd85 100644
--- a/x-pack/plugins/security_solution/common/types/timeline/index.ts
+++ b/x-pack/plugins/security_solution/common/types/timeline/index.ts
@@ -272,6 +272,7 @@ export type TimelineTypeLiteralWithNull = runtimeTypes.TypeOf<typeof TimelineTyp
 export const SavedTimelineRuntimeType = runtimeTypes.partial({
   columns: unionWithNullType(runtimeTypes.array(SavedColumnHeaderRuntimeType)),
   dataProviders: unionWithNullType(runtimeTypes.array(SavedDataProviderRuntimeType)),
+  dataViewId: unionWithNullType(runtimeTypes.string),
   description: unionWithNullType(runtimeTypes.string),
   eqlOptions: unionWithNullType(EqlOptionsRuntimeType),
   eventType: unionWithNullType(runtimeTypes.string),
@@ -305,7 +306,7 @@ export type SavedTimelineNote = runtimeTypes.TypeOf<typeof SavedTimelineRuntimeT
  * This type represents a timeline type stored in a saved object that does not include any fields that reference
  * other saved objects.
  */
-export type TimelineWithoutExternalRefs = Omit<SavedTimeline, 'savedQueryId'>;
+export type TimelineWithoutExternalRefs = Omit<SavedTimeline, 'dataViewId' | 'savedQueryId'>;
 
 /*
  *  Timeline IDs
@@ -719,6 +720,7 @@ export interface TimelineResult {
   created?: Maybe<number>;
   createdBy?: Maybe<string>;
   dataProviders?: Maybe<DataProviderResult[]>;
+  dataViewId?: Maybe<string>;
   dateRange?: Maybe<DateRangePickerResult>;
   description?: Maybe<string>;
   eqlOptions?: Maybe<EqlOptionsResult>;
diff --git a/x-pack/plugins/security_solution/common/types/timeline/store.ts b/x-pack/plugins/security_solution/common/types/timeline/store.ts
index 03cf0c39378e5..75cd44ba2b7d7 100644
--- a/x-pack/plugins/security_solution/common/types/timeline/store.ts
+++ b/x-pack/plugins/security_solution/common/types/timeline/store.ts
@@ -38,19 +38,20 @@ export interface SortColumnTimeline {
 }
 
 export interface TimelinePersistInput {
-  id: string;
+  columns: ColumnHeaderOptions[];
   dataProviders?: DataProvider[];
+  dataViewId: string;
   dateRange?: {
     start: string;
     end: string;
   };
+  defaultColumns?: ColumnHeaderOptions[];
   excludedRowRendererIds?: RowRendererId[];
   expandedDetail?: TimelineExpandedDetail;
   filters?: Filter[];
-  columns: ColumnHeaderOptions[];
-  defaultColumns?: ColumnHeaderOptions[];
-  itemsPerPage?: number;
+  id: string;
   indexNames: string[];
+  itemsPerPage?: number;
   kqlQuery?: {
     filterQuery: SerializedFilterQuery | null;
   };
diff --git a/x-pack/plugins/security_solution/cypress/cypress.json b/x-pack/plugins/security_solution/cypress/cypress.json
index 6a9a240af5873..8c27309becf08 100644
--- a/x-pack/plugins/security_solution/cypress/cypress.json
+++ b/x-pack/plugins/security_solution/cypress/cypress.json
@@ -12,5 +12,10 @@
   "video": false,
   "videosFolder": "../../../target/kibana-security-solution/cypress/videos",
   "viewportHeight": 900,
-  "viewportWidth": 1440
+  "viewportWidth": 1440,
+  "env": {
+    "protocol": "http",
+    "hostname": "localhost",
+    "configport": "5601"
+  }
 }
diff --git a/x-pack/plugins/security_solution/cypress/downloads/timelines_export.ndjson b/x-pack/plugins/security_solution/cypress/downloads/timelines_export.ndjson
new file mode 100644
index 0000000000000..8cf76734ad876
--- /dev/null
+++ b/x-pack/plugins/security_solution/cypress/downloads/timelines_export.ndjson
@@ -0,0 +1 @@
+{"savedObjectId":"46cca0e0-2580-11ec-8e56-9dafa0b0343b","version":"WzIyNjIzNCwxXQ==","columns":[{"id":"@timestamp"},{"id":"user.name"},{"id":"event.category"},{"id":"event.action"},{"id":"host.name"}],"kqlMode":"filter","kqlQuery":{"filterQuery":{"kuery":{"expression":"host.name: *","kind":"kuery"}}},"dateRange":{"start":"1514809376000","end":"1577881376000"},"description":"This is the best timeline","title":"Security Timeline","created":1633399341550,"createdBy":"elastic","updated":1633399341550,"updatedBy":"elastic","savedQueryId":null,"dataViewId":null,"timelineType":"default","sort":[],"eventNotes":[],"globalNotes":[],"pinnedEventIds":[]}
diff --git a/x-pack/plugins/security_solution/cypress/integration/cases/privileges.spec.ts b/x-pack/plugins/security_solution/cypress/integration/cases/privileges.spec.ts
index 23016ecc512b1..0337cd3bd6e17 100644
--- a/x-pack/plugins/security_solution/cypress/integration/cases/privileges.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/cases/privileges.spec.ts
@@ -18,184 +18,28 @@ import {
   filterStatusOpen,
 } from '../../tasks/create_new_case';
 import {
-  constructUrlWithUser,
-  getEnvAuth,
+  loginAndWaitForHostDetailsPage,
   loginWithUserAndWaitForPageWithoutDateRange,
+  logout,
 } from '../../tasks/login';
+import {
+  createUsersAndRoles,
+  deleteUsersAndRoles,
+  secAll,
+  secAllUser,
+  secReadCasesAllUser,
+  secReadCasesAll,
+} from '../../tasks/privileges';
 
 import { CASES_URL } from '../../urls/navigation';
-
-interface User {
-  username: string;
-  password: string;
-  description?: string;
-  roles: string[];
-}
-
-interface UserInfo {
-  username: string;
-  full_name: string;
-  email: string;
-}
-
-interface FeaturesPrivileges {
-  [featureId: string]: string[];
-}
-
-interface ElasticsearchIndices {
-  names: string[];
-  privileges: string[];
-}
-
-interface ElasticSearchPrivilege {
-  cluster?: string[];
-  indices?: ElasticsearchIndices[];
-}
-
-interface KibanaPrivilege {
-  spaces: string[];
-  base?: string[];
-  feature?: FeaturesPrivileges;
-}
-
-interface Role {
-  name: string;
-  privileges: {
-    elasticsearch?: ElasticSearchPrivilege;
-    kibana?: KibanaPrivilege[];
-  };
-}
-
-const secAll: Role = {
-  name: 'sec_all_role',
-  privileges: {
-    elasticsearch: {
-      indices: [
-        {
-          names: ['*'],
-          privileges: ['all'],
-        },
-      ],
-    },
-    kibana: [
-      {
-        feature: {
-          siem: ['all'],
-          securitySolutionCases: ['all'],
-          actions: ['all'],
-          actionsSimulators: ['all'],
-        },
-        spaces: ['*'],
-      },
-    ],
-  },
-};
-
-const secAllUser: User = {
-  username: 'sec_all_user',
-  password: 'password',
-  roles: [secAll.name],
-};
-
-const secReadCasesAll: Role = {
-  name: 'sec_read_cases_all_role',
-  privileges: {
-    elasticsearch: {
-      indices: [
-        {
-          names: ['*'],
-          privileges: ['all'],
-        },
-      ],
-    },
-    kibana: [
-      {
-        feature: {
-          siem: ['read'],
-          securitySolutionCases: ['all'],
-          actions: ['all'],
-          actionsSimulators: ['all'],
-        },
-        spaces: ['*'],
-      },
-    ],
-  },
-};
-
-const secReadCasesAllUser: User = {
-  username: 'sec_read_cases_all_user',
-  password: 'password',
-  roles: [secReadCasesAll.name],
-};
-
+import { openSourcerer } from '../../tasks/sourcerer';
 const usersToCreate = [secAllUser, secReadCasesAllUser];
 const rolesToCreate = [secAll, secReadCasesAll];
-
-const getUserInfo = (user: User): UserInfo => ({
-  username: user.username,
-  full_name: user.username.replace('_', ' '),
-  email: `${user.username}@elastic.co`,
-});
-
-const createUsersAndRoles = (users: User[], roles: Role[]) => {
-  const envUser = getEnvAuth();
-  for (const role of roles) {
-    cy.log(`Creating role: ${JSON.stringify(role)}`);
-    cy.request({
-      body: role.privileges,
-      headers: { 'kbn-xsrf': 'cypress-creds-via-config' },
-      method: 'PUT',
-      url: constructUrlWithUser(envUser, `/api/security/role/${role.name}`),
-    })
-      .its('status')
-      .should('eql', 204);
-  }
-
-  for (const user of users) {
-    const userInfo = getUserInfo(user);
-    cy.log(`Creating user: ${JSON.stringify(user)}`);
-    cy.request({
-      body: {
-        username: user.username,
-        password: user.password,
-        roles: user.roles,
-        full_name: userInfo.full_name,
-        email: userInfo.email,
-      },
-      headers: { 'kbn-xsrf': 'cypress-creds-via-config' },
-      method: 'POST',
-      url: constructUrlWithUser(envUser, `/internal/security/users/${user.username}`),
-    })
-      .its('status')
-      .should('eql', 200);
-  }
-};
-
-const deleteUsersAndRoles = (users: User[], roles: Role[]) => {
-  const envUser = getEnvAuth();
-  for (const user of users) {
-    cy.log(`Deleting user: ${JSON.stringify(user)}`);
-    cy.request({
-      headers: { 'kbn-xsrf': 'cypress-creds-via-config' },
-      method: 'DELETE',
-      url: constructUrlWithUser(envUser, `/internal/security/users/${user.username}`),
-      failOnStatusCode: false,
-    })
-      .its('status')
-      .should('oneOf', [204, 404]);
-  }
-
-  for (const role of roles) {
-    cy.log(`Deleting role: ${JSON.stringify(role)}`);
-    cy.request({
-      headers: { 'kbn-xsrf': 'cypress-creds-via-config' },
-      method: 'DELETE',
-      url: constructUrlWithUser(envUser, `/api/security/role/${role.name}`),
-      failOnStatusCode: false,
-    })
-      .its('status')
-      .should('oneOf', [204, 404]);
-  }
+// needed to generate index pattern
+const visitSecuritySolution = () => {
+  loginAndWaitForHostDetailsPage();
+  openSourcerer();
+  logout();
 };
 
 const testCase: TestCaseWithoutTimeline = {
@@ -205,11 +49,11 @@ const testCase: TestCaseWithoutTimeline = {
   reporter: 'elastic',
   owner: 'securitySolution',
 };
-
 describe('Cases privileges', () => {
   before(() => {
     cleanKibana();
     createUsersAndRoles(usersToCreate, rolesToCreate);
+    visitSecuritySolution();
   });
 
   after(() => {
diff --git a/x-pack/plugins/security_solution/cypress/integration/data_sources/sourcerer.spec.ts b/x-pack/plugins/security_solution/cypress/integration/data_sources/sourcerer.spec.ts
index 26c366e981d44..bd7acc38c1021 100644
--- a/x-pack/plugins/security_solution/cypress/integration/data_sources/sourcerer.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/data_sources/sourcerer.spec.ts
@@ -5,7 +5,10 @@
  * 2.0.
  */
 
-import { loginAndWaitForPage } from '../../tasks/login';
+import {
+  loginAndWaitForPage,
+  loginWithUserAndWaitForPageWithoutDateRange,
+} from '../../tasks/login';
 
 import { HOSTS_URL } from '../../urls/navigation';
 import { waitForAllHostsToBeLoaded } from '../../tasks/hosts/all_hosts';
@@ -28,20 +31,34 @@ import { openTimelineUsingToggle } from '../../tasks/security_main';
 import { populateTimeline } from '../../tasks/timeline';
 import { SERVER_SIDE_EVENT_COUNT } from '../../screens/timeline';
 import { cleanKibana } from '../../tasks/common';
+import { createUsersAndRoles, secReadCasesAll, secReadCasesAllUser } from '../../tasks/privileges';
+import { TOASTER } from '../../screens/configure_cases';
 
+const usersToCreate = [secReadCasesAllUser];
+const rolesToCreate = [secReadCasesAll];
 // Skipped at the moment as this has flake due to click handler issues. This has been raised with team members
 // and the code is being re-worked and then these tests will be unskipped
-describe.skip('Sourcerer', () => {
-  before(() => {
+describe('Sourcerer', () => {
+  beforeEach(() => {
     cleanKibana();
   });
-
-  beforeEach(() => {
-    cy.clearLocalStorage();
-    loginAndWaitForPage(HOSTS_URL);
+  describe('permissions', () => {
+    before(() => {
+      createUsersAndRoles(usersToCreate, rolesToCreate);
+    });
+    it(`role(s) ${secReadCasesAllUser.roles.join()} shows error when user does not have permissions`, () => {
+      loginWithUserAndWaitForPageWithoutDateRange(HOSTS_URL, secReadCasesAllUser);
+      cy.get(TOASTER).should('have.text', 'Write role required to generate data');
+    });
   });
+  // Originially written in December 2020, flakey from day1
+  // has always been skipped with intentions to fix, see note at top of file
+  describe.skip('Default scope', () => {
+    beforeEach(() => {
+      cy.clearLocalStorage();
+      loginAndWaitForPage(HOSTS_URL);
+    });
 
-  describe('Default scope', () => {
     it('has SIEM index patterns selected on initial load', () => {
       openSourcerer();
       isSourcererSelection(`auditbeat-*`);
@@ -52,7 +69,7 @@ describe.skip('Sourcerer', () => {
       isSourcererOptions([`metrics-*`, `logs-*`]);
     });
 
-    it('selected KIP gets added to sourcerer', () => {
+    it('selected DATA_VIEW gets added to sourcerer', () => {
       setSourcererOption(`metrics-*`);
       openSourcerer();
       isSourcererSelection(`metrics-*`);
@@ -75,8 +92,14 @@ describe.skip('Sourcerer', () => {
       isNotSourcererSelection(`metrics-*`);
     });
   });
+  // Originially written in December 2020, flakey from day1
+  // has always been skipped with intentions to fix
+  describe.skip('Timeline scope', () => {
+    beforeEach(() => {
+      cy.clearLocalStorage();
+      loginAndWaitForPage(HOSTS_URL);
+    });
 
-  describe('Timeline scope', () => {
     const alertPatterns = ['.siem-signals-default'];
     const rawPatterns = ['auditbeat-*'];
     const allPatterns = [...alertPatterns, ...rawPatterns];
diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/alerts_details.spec.ts b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/alerts_details.spec.ts
index 803ff4b4d0d80..033a12dd9de3e 100644
--- a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/alerts_details.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/alerts_details.spec.ts
@@ -9,6 +9,7 @@ import { ALERT_FLYOUT, CELL_TEXT, JSON_TEXT, TABLE_ROWS } from '../../screens/al
 
 import {
   expandFirstAlert,
+  refreshAlerts,
   waitForAlertsIndexToBeCreated,
   waitForAlertsPanelToBeLoaded,
 } from '../../tasks/alerts';
@@ -32,6 +33,7 @@ describe('Alert details with unmapped fields', () => {
     createCustomRuleActivated(getUnmappedRule());
     loginAndWaitForPageWithoutDateRange(ALERTS_URL);
     waitForAlertsPanelToBeLoaded();
+    refreshAlerts();
     expandFirstAlert();
   });
 
diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/attach_to_case.spec.ts b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/attach_to_case.spec.ts
index 49c2dd4b41717..e5b2c4eed3b00 100644
--- a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/attach_to_case.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/attach_to_case.spec.ts
@@ -54,6 +54,7 @@ describe('Alerts timeline', () => {
       loadDetectionsPage(ROLES.platform_engineer);
     });
 
+    // Skipping due to alerts not refreshing for platform_engineer despite being returned from API?
     it.skip('should allow a user with crud privileges to attach alerts to cases', () => {
       cy.get(TIMELINE_CONTEXT_MENU_BTN).first().click({ force: true });
       cy.get(ATTACH_ALERT_TO_CASE_BUTTON).first().should('not.be.disabled');
diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_rules/event_correlation_rule.spec.ts b/x-pack/plugins/security_solution/cypress/integration/detection_rules/event_correlation_rule.spec.ts
index 10f556a11bf60..171d224cc32d3 100644
--- a/x-pack/plugins/security_solution/cypress/integration/detection_rules/event_correlation_rule.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/detection_rules/event_correlation_rule.spec.ts
@@ -70,7 +70,7 @@ import { loginAndWaitForPageWithoutDateRange } from '../../tasks/login';
 
 import { ALERTS_URL } from '../../urls/navigation';
 
-describe.skip('Detection rules, EQL', () => {
+describe('Detection rules, EQL', () => {
   const expectedUrls = getEqlRule().referenceUrls.join('');
   const expectedFalsePositives = getEqlRule().falsePositivesExamples.join('');
   const expectedTags = getEqlRule().tags.join('');
@@ -169,7 +169,7 @@ describe.skip('Detection rules, EQL', () => {
   });
 });
 
-describe.skip('Detection rules, sequence EQL', () => {
+describe('Detection rules, sequence EQL', () => {
   const expectedNumberOfRules = 1;
   const expectedNumberOfSequenceAlerts = '1 alert';
 
diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_rules/indicator_match_rule.spec.ts b/x-pack/plugins/security_solution/cypress/integration/detection_rules/indicator_match_rule.spec.ts
index 02621ea49e906..378de8f0bc593 100644
--- a/x-pack/plugins/security_solution/cypress/integration/detection_rules/indicator_match_rule.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/detection_rules/indicator_match_rule.spec.ts
@@ -114,7 +114,7 @@ import { loginAndWaitForPageWithoutDateRange } from '../../tasks/login';
 import { goBackToAllRulesTable } from '../../tasks/rule_details';
 
 import { ALERTS_URL, RULE_CREATION } from '../../urls/navigation';
-import { DEFAULT_THREAT_MATCH_QUERY } from '../../../common/constants';
+const DEFAULT_THREAT_MATCH_QUERY = '@timestamp >= "now-30d"';
 
 describe('indicator match', () => {
   describe('Detection rules, Indicator Match', () => {
diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_rules/sorting.spec.ts b/x-pack/plugins/security_solution/cypress/integration/detection_rules/sorting.spec.ts
index ef3d3a82d40bd..92f9e8180d50c 100644
--- a/x-pack/plugins/security_solution/cypress/integration/detection_rules/sorting.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/detection_rules/sorting.spec.ts
@@ -34,7 +34,6 @@ import {
   waitForRuleToChangeStatus,
 } from '../../tasks/alerts_detection_rules';
 import { loginAndWaitForPageWithoutDateRange } from '../../tasks/login';
-import { DEFAULT_RULE_REFRESH_INTERVAL_VALUE } from '../../../common/constants';
 
 import { ALERTS_URL } from '../../urls/navigation';
 import { createCustomRule } from '../../tasks/api_calls/rules';
@@ -46,6 +45,8 @@ import {
   getNewThresholdRule,
 } from '../../objects/rule';
 
+const DEFAULT_RULE_REFRESH_INTERVAL_VALUE = 60000;
+
 describe('Alerts detection rules', () => {
   beforeEach(() => {
     cleanKibana();
diff --git a/x-pack/plugins/security_solution/cypress/integration/ml/ml_conditional_links.spec.ts b/x-pack/plugins/security_solution/cypress/integration/ml/ml_conditional_links.spec.ts
index 89a0d5a660b97..f9d78ba12a5ea 100644
--- a/x-pack/plugins/security_solution/cypress/integration/ml/ml_conditional_links.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/ml/ml_conditional_links.spec.ts
@@ -98,7 +98,7 @@ describe('ml conditional links', () => {
     loginAndWaitForPageWithoutDateRange(mlNetworkSingleIpNullKqlQuery);
     cy.url().should(
       'include',
-      'app/security/network/ip/127.0.0.1/source?timerange=(global:(linkTo:!(timeline),timerange:(from:%272019-08-28T11:00:00.000Z%27,kind:absolute,to:%272019-08-28T13:59:59.999Z%27)),timeline:(linkTo:!(global),timerange:(from:%272019-08-28T11:00:00.000Z%27,kind:absolute,to:%272019-08-28T13:59:59.999Z%27)))&sourcerer=(default:!(%27auditbeat-*%27))'
+      'app/security/network/ip/127.0.0.1/source?timerange=(global:(linkTo:!(timeline),timerange:(from:%272019-08-28T11:00:00.000Z%27,kind:absolute,to:%272019-08-28T13:59:59.999Z%27)),timeline:(linkTo:!(global),timerange:(from:%272019-08-28T11:00:00.000Z%27,kind:absolute,to:%272019-08-28T13:59:59.999Z%27)))&sourcerer=(default:(id:security-solution-default,selectedPatterns:!(%27auditbeat-*%27)))'
     );
   });
 
@@ -106,7 +106,7 @@ describe('ml conditional links', () => {
     loginAndWaitForPageWithoutDateRange(mlNetworkSingleIpKqlQuery);
     cy.url().should(
       'include',
-      '/app/security/network/ip/127.0.0.1/source?query=(language:kuery,query:%27(process.name:%20%22conhost.exe%22%20or%20process.name:%20%22sc.exe%22)%27)&timerange=(global:(linkTo:!(timeline),timerange:(from:%272019-08-28T11:00:00.000Z%27,kind:absolute,to:%272019-08-28T13:59:59.999Z%27)),timeline:(linkTo:!(global),timerange:(from:%272019-08-28T11:00:00.000Z%27,kind:absolute,to:%272019-08-28T13:59:59.999Z%27)))&sourcerer=(default:!(%27auditbeat-*%27))'
+      '/app/security/network/ip/127.0.0.1/source?query=(language:kuery,query:%27(process.name:%20%22conhost.exe%22%20or%20process.name:%20%22sc.exe%22)%27)&timerange=(global:(linkTo:!(timeline),timerange:(from:%272019-08-28T11:00:00.000Z%27,kind:absolute,to:%272019-08-28T13:59:59.999Z%27)),timeline:(linkTo:!(global),timerange:(from:%272019-08-28T11:00:00.000Z%27,kind:absolute,to:%272019-08-28T13:59:59.999Z%27)))&sourcerer=(default:(id:security-solution-default,selectedPatterns:!(%27auditbeat-*%27)))'
     );
   });
 
@@ -114,7 +114,7 @@ describe('ml conditional links', () => {
     loginAndWaitForPageWithoutDateRange(mlNetworkMultipleIpNullKqlQuery);
     cy.url().should(
       'include',
-      'app/security/network/flows?query=(language:kuery,query:%27((source.ip:%20%22127.0.0.1%22%20or%20destination.ip:%20%22127.0.0.1%22)%20or%20(source.ip:%20%22127.0.0.2%22%20or%20destination.ip:%20%22127.0.0.2%22))%27)&timerange=(global:(linkTo:!(timeline),timerange:(from:%272019-08-28T11:00:00.000Z%27,kind:absolute,to:%272019-08-28T13:59:59.999Z%27)),timeline:(linkTo:!(global),timerange:(from:%272019-08-28T11:00:00.000Z%27,kind:absolute,to:%272019-08-28T13:59:59.999Z%27)))&sourcerer=(default:!(%27auditbeat-*%27))'
+      'app/security/network/flows?query=(language:kuery,query:%27((source.ip:%20%22127.0.0.1%22%20or%20destination.ip:%20%22127.0.0.1%22)%20or%20(source.ip:%20%22127.0.0.2%22%20or%20destination.ip:%20%22127.0.0.2%22))%27)&timerange=(global:(linkTo:!(timeline),timerange:(from:%272019-08-28T11:00:00.000Z%27,kind:absolute,to:%272019-08-28T13:59:59.999Z%27)),timeline:(linkTo:!(global),timerange:(from:%272019-08-28T11:00:00.000Z%27,kind:absolute,to:%272019-08-28T13:59:59.999Z%27)))&sourcerer=(default:(id:security-solution-default,selectedPatterns:!(%27auditbeat-*%27)))'
     );
   });
 
@@ -122,7 +122,7 @@ describe('ml conditional links', () => {
     loginAndWaitForPageWithoutDateRange(mlNetworkMultipleIpKqlQuery);
     cy.url().should(
       'include',
-      '/app/security/network/flows?query=(language:kuery,query:%27((source.ip:%20%22127.0.0.1%22%20or%20destination.ip:%20%22127.0.0.1%22)%20or%20(source.ip:%20%22127.0.0.2%22%20or%20destination.ip:%20%22127.0.0.2%22))%20and%20((process.name:%20%22conhost.exe%22%20or%20process.name:%20%22sc.exe%22))%27)&timerange=(global:(linkTo:!(timeline),timerange:(from:%272019-08-28T11:00:00.000Z%27,kind:absolute,to:%272019-08-28T13:59:59.999Z%27)),timeline:(linkTo:!(global),timerange:(from:%272019-08-28T11:00:00.000Z%27,kind:absolute,to:%272019-08-28T13:59:59.999Z%27)))&sourcerer=(default:!(%27auditbeat-*%27))'
+      '/app/security/network/flows?query=(language:kuery,query:%27((source.ip:%20%22127.0.0.1%22%20or%20destination.ip:%20%22127.0.0.1%22)%20or%20(source.ip:%20%22127.0.0.2%22%20or%20destination.ip:%20%22127.0.0.2%22))%20and%20((process.name:%20%22conhost.exe%22%20or%20process.name:%20%22sc.exe%22))%27)&timerange=(global:(linkTo:!(timeline),timerange:(from:%272019-08-28T11:00:00.000Z%27,kind:absolute,to:%272019-08-28T13:59:59.999Z%27)),timeline:(linkTo:!(global),timerange:(from:%272019-08-28T11:00:00.000Z%27,kind:absolute,to:%272019-08-28T13:59:59.999Z%27)))&sourcerer=(default:(id:security-solution-default,selectedPatterns:!(%27auditbeat-*%27)))'
     );
   });
 
@@ -130,15 +130,16 @@ describe('ml conditional links', () => {
     loginAndWaitForPageWithoutDateRange(mlNetworkNullKqlQuery);
     cy.url().should(
       'include',
-      '/app/security/network/flows?timerange=(global:(linkTo:!(timeline),timerange:(from:%272019-08-28T11:00:00.000Z%27,kind:absolute,to:%272019-08-28T13:59:59.999Z%27)),timeline:(linkTo:!(global),timerange:(from:%272019-08-28T11:00:00.000Z%27,kind:absolute,to:%272019-08-28T13:59:59.999Z%27)))&sourcerer=(default:!(%27auditbeat-*%27))'
+      '/app/security/network/flows?timerange=(global:(linkTo:!(timeline),timerange:(from:%272019-08-28T11:00:00.000Z%27,kind:absolute,to:%272019-08-28T13:59:59.999Z%27)),timeline:(linkTo:!(global),timerange:(from:%272019-08-28T11:00:00.000Z%27,kind:absolute,to:%272019-08-28T13:59:59.999Z%27)))&sourcerer=(default:(id:security-solution-default,selectedPatterns:!(%27auditbeat-*%27)))'
     );
   });
 
   it('redirects from a $ip$ with a value for the query', () => {
     loginAndWaitForPageWithoutDateRange(mlNetworkKqlQuery);
+
     cy.url().should(
       'include',
-      '/app/security/network/flows?query=(language:kuery,query:%27(process.name:%20%22conhost.exe%22%20or%20process.name:%20%22sc.exe%22)%27)&timerange=(global:(linkTo:!(timeline),timerange:(from:%272019-08-28T11:00:00.000Z%27,kind:absolute,to:%272019-08-28T13:59:59.999Z%27)),timeline:(linkTo:!(global),timerange:(from:%272019-08-28T11:00:00.000Z%27,kind:absolute,to:%272019-08-28T13:59:59.999Z%27)))&sourcerer=(default:!(%27auditbeat-*%27))'
+      `/app/security/network/flows?query=(language:kuery,query:%27(process.name:%20%22conhost.exe%22%20or%20process.name:%20%22sc.exe%22)%27)&timerange=(global:(linkTo:!(timeline),timerange:(from:%272019-08-28T11:00:00.000Z%27,kind:absolute,to:%272019-08-28T13:59:59.999Z%27)),timeline:(linkTo:!(global),timerange:(from:%272019-08-28T11:00:00.000Z%27,kind:absolute,to:%272019-08-28T13:59:59.999Z%27)))&sourcerer=(default:(id:security-solution-default,selectedPatterns:!(%27auditbeat-*%27)))`
     );
   });
 
@@ -146,7 +147,7 @@ describe('ml conditional links', () => {
     loginAndWaitForPageWithoutDateRange(mlHostSingleHostNullKqlQuery);
     cy.url().should(
       'include',
-      '/app/security/hosts/siem-windows/anomalies?timerange=(global:(linkTo:!(timeline),timerange:(from:%272019-06-06T06:00:00.000Z%27,kind:absolute,to:%272019-06-07T05:59:59.999Z%27)),timeline:(linkTo:!(global),timerange:(from:%272019-06-06T06:00:00.000Z%27,kind:absolute,to:%272019-06-07T05:59:59.999Z%27)))&sourcerer=(default:!(%27auditbeat-*%27))'
+      '/app/security/hosts/siem-windows/anomalies?timerange=(global:(linkTo:!(timeline),timerange:(from:%272019-06-06T06:00:00.000Z%27,kind:absolute,to:%272019-06-07T05:59:59.999Z%27)),timeline:(linkTo:!(global),timerange:(from:%272019-06-06T06:00:00.000Z%27,kind:absolute,to:%272019-06-07T05:59:59.999Z%27)))&sourcerer=(default:(id:security-solution-default,selectedPatterns:!(%27auditbeat-*%27)))'
     );
   });
 
@@ -154,7 +155,7 @@ describe('ml conditional links', () => {
     loginAndWaitForPageWithoutDateRange(mlHostSingleHostKqlQueryVariable);
     cy.url().should(
       'include',
-      '/app/security/hosts/siem-windows/anomalies?timerange=(global:(linkTo:!(timeline),timerange:(from:%272019-06-06T06:00:00.000Z%27,kind:absolute,to:%272019-06-07T05:59:59.999Z%27)),timeline:(linkTo:!(global),timerange:(from:%272019-06-06T06:00:00.000Z%27,kind:absolute,to:%272019-06-07T05:59:59.999Z%27)))&sourcerer=(default:!(%27auditbeat-*%27))'
+      '/app/security/hosts/siem-windows/anomalies?timerange=(global:(linkTo:!(timeline),timerange:(from:%272019-06-06T06:00:00.000Z%27,kind:absolute,to:%272019-06-07T05:59:59.999Z%27)),timeline:(linkTo:!(global),timerange:(from:%272019-06-06T06:00:00.000Z%27,kind:absolute,to:%272019-06-07T05:59:59.999Z%27)))&sourcerer=(default:(id:security-solution-default,selectedPatterns:!(%27auditbeat-*%27)))'
     );
   });
 
@@ -162,7 +163,7 @@ describe('ml conditional links', () => {
     loginAndWaitForPageWithoutDateRange(mlHostSingleHostKqlQuery);
     cy.url().should(
       'include',
-      '/app/security/hosts/siem-windows/anomalies?query=(language:kuery,query:%27(process.name:%20%22conhost.exe%22%20or%20process.name:%20%22sc.exe%22)%27)&timerange=(global:(linkTo:!(timeline),timerange:(from:%272019-06-06T06:00:00.000Z%27,kind:absolute,to:%272019-06-07T05:59:59.999Z%27)),timeline:(linkTo:!(global),timerange:(from:%272019-06-06T06:00:00.000Z%27,kind:absolute,to:%272019-06-07T05:59:59.999Z%27)))&sourcerer=(default:!(%27auditbeat-*%27))'
+      '/app/security/hosts/siem-windows/anomalies?query=(language:kuery,query:%27(process.name:%20%22conhost.exe%22%20or%20process.name:%20%22sc.exe%22)%27)&timerange=(global:(linkTo:!(timeline),timerange:(from:%272019-06-06T06:00:00.000Z%27,kind:absolute,to:%272019-06-07T05:59:59.999Z%27)),timeline:(linkTo:!(global),timerange:(from:%272019-06-06T06:00:00.000Z%27,kind:absolute,to:%272019-06-07T05:59:59.999Z%27)))&sourcerer=(default:(id:security-solution-default,selectedPatterns:!(%27auditbeat-*%27)))'
     );
   });
 
@@ -170,7 +171,7 @@ describe('ml conditional links', () => {
     loginAndWaitForPageWithoutDateRange(mlHostMultiHostNullKqlQuery);
     cy.url().should(
       'include',
-      '/app/security/hosts/anomalies?query=(language:kuery,query:%27(host.name:%20%22siem-windows%22%20or%20host.name:%20%22siem-suricata%22)%27)&timerange=(global:(linkTo:!(timeline),timerange:(from:%272019-06-06T06:00:00.000Z%27,kind:absolute,to:%272019-06-07T05:59:59.999Z%27)),timeline:(linkTo:!(global),timerange:(from:%272019-06-06T06:00:00.000Z%27,kind:absolute,to:%272019-06-07T05:59:59.999Z%27)))&sourcerer=(default:!(%27auditbeat-*%27))'
+      '/app/security/hosts/anomalies?query=(language:kuery,query:%27(host.name:%20%22siem-windows%22%20or%20host.name:%20%22siem-suricata%22)%27)&timerange=(global:(linkTo:!(timeline),timerange:(from:%272019-06-06T06:00:00.000Z%27,kind:absolute,to:%272019-06-07T05:59:59.999Z%27)),timeline:(linkTo:!(global),timerange:(from:%272019-06-06T06:00:00.000Z%27,kind:absolute,to:%272019-06-07T05:59:59.999Z%27)))&sourcerer=(default:(id:security-solution-default,selectedPatterns:!(%27auditbeat-*%27)))'
     );
   });
 
@@ -178,7 +179,7 @@ describe('ml conditional links', () => {
     loginAndWaitForPageWithoutDateRange(mlHostMultiHostKqlQuery);
     cy.url().should(
       'include',
-      '/app/security/hosts/anomalies?query=(language:kuery,query:%27(host.name:%20%22siem-windows%22%20or%20host.name:%20%22siem-suricata%22)%20and%20((process.name:%20%22conhost.exe%22%20or%20process.name:%20%22sc.exe%22))%27)&timerange=(global:(linkTo:!(timeline),timerange:(from:%272019-06-06T06:00:00.000Z%27,kind:absolute,to:%272019-06-07T05:59:59.999Z%27)),timeline:(linkTo:!(global),timerange:(from:%272019-06-06T06:00:00.000Z%27,kind:absolute,to:%272019-06-07T05:59:59.999Z%27)))&sourcerer=(default:!(%27auditbeat-*%27))'
+      '/app/security/hosts/anomalies?query=(language:kuery,query:%27(host.name:%20%22siem-windows%22%20or%20host.name:%20%22siem-suricata%22)%20and%20((process.name:%20%22conhost.exe%22%20or%20process.name:%20%22sc.exe%22))%27)&timerange=(global:(linkTo:!(timeline),timerange:(from:%272019-06-06T06:00:00.000Z%27,kind:absolute,to:%272019-06-07T05:59:59.999Z%27)),timeline:(linkTo:!(global),timerange:(from:%272019-06-06T06:00:00.000Z%27,kind:absolute,to:%272019-06-07T05:59:59.999Z%27)))&sourcerer=(default:(id:security-solution-default,selectedPatterns:!(%27auditbeat-*%27)))'
     );
   });
 
@@ -186,7 +187,7 @@ describe('ml conditional links', () => {
     loginAndWaitForPageWithoutDateRange(mlHostVariableHostNullKqlQuery);
     cy.url().should(
       'include',
-      '/app/security/hosts/anomalies?timerange=(global:(linkTo:!(timeline),timerange:(from:%272019-06-06T06:00:00.000Z%27,kind:absolute,to:%272019-06-07T05:59:59.999Z%27)),timeline:(linkTo:!(global),timerange:(from:%272019-06-06T06:00:00.000Z%27,kind:absolute,to:%272019-06-07T05:59:59.999Z%27)))&sourcerer=(default:!(%27auditbeat-*%27))'
+      '/app/security/hosts/anomalies?timerange=(global:(linkTo:!(timeline),timerange:(from:%272019-06-06T06:00:00.000Z%27,kind:absolute,to:%272019-06-07T05:59:59.999Z%27)),timeline:(linkTo:!(global),timerange:(from:%272019-06-06T06:00:00.000Z%27,kind:absolute,to:%272019-06-07T05:59:59.999Z%27)))&sourcerer=(default:(id:security-solution-default,selectedPatterns:!(%27auditbeat-*%27)))'
     );
   });
 
@@ -194,7 +195,7 @@ describe('ml conditional links', () => {
     loginAndWaitForPageWithoutDateRange(mlHostVariableHostKqlQuery);
     cy.url().should(
       'include',
-      '/app/security/hosts/anomalies?query=(language:kuery,query:%27(process.name:%20%22conhost.exe%22%20or%20process.name:%20%22sc.exe%22)%27)&timerange=(global:(linkTo:!(timeline),timerange:(from:%272019-06-06T06:00:00.000Z%27,kind:absolute,to:%272019-06-07T05:59:59.999Z%27)),timeline:(linkTo:!(global),timerange:(from:%272019-06-06T06:00:00.000Z%27,kind:absolute,to:%272019-06-07T05:59:59.999Z%27)))&sourcerer=(default:!(%27auditbeat-*%27))'
+      '/app/security/hosts/anomalies?query=(language:kuery,query:%27(process.name:%20%22conhost.exe%22%20or%20process.name:%20%22sc.exe%22)%27)&timerange=(global:(linkTo:!(timeline),timerange:(from:%272019-06-06T06:00:00.000Z%27,kind:absolute,to:%272019-06-07T05:59:59.999Z%27)),timeline:(linkTo:!(global),timerange:(from:%272019-06-06T06:00:00.000Z%27,kind:absolute,to:%272019-06-07T05:59:59.999Z%27)))&sourcerer=(default:(id:security-solution-default,selectedPatterns:!(%27auditbeat-*%27)))'
     );
   });
 });
diff --git a/x-pack/plugins/security_solution/cypress/integration/timelines/creation.spec.ts b/x-pack/plugins/security_solution/cypress/integration/timelines/creation.spec.ts
index fb41aec91b6c4..cbff911e5d982 100644
--- a/x-pack/plugins/security_solution/cypress/integration/timelines/creation.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/timelines/creation.spec.ts
@@ -121,7 +121,6 @@ describe('Create a timeline from a template', () => {
     loginAndWaitForPageWithoutDateRange(TIMELINE_TEMPLATES_URL);
     waitForTimelinesPanelToBeLoaded();
   });
-
   it('Should have the same query and open the timeline modal', () => {
     selectCustomTemplates();
     cy.wait('@timeline', { timeout: 100000 });
@@ -132,5 +131,6 @@ describe('Create a timeline from a template', () => {
     cy.get(TIMELINE_FLYOUT_WRAPPER).should('have.css', 'visibility', 'visible');
     cy.get(TIMELINE_DESCRIPTION).should('have.text', getTimeline().description);
     cy.get(TIMELINE_QUERY).should('have.text', getTimeline().query);
+    closeTimeline();
   });
 });
diff --git a/x-pack/plugins/security_solution/cypress/integration/urls/state.spec.ts b/x-pack/plugins/security_solution/cypress/integration/urls/state.spec.ts
index 73eb141f1ce3d..28fe1294e6f01 100644
--- a/x-pack/plugins/security_solution/cypress/integration/urls/state.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/urls/state.spec.ts
@@ -182,11 +182,10 @@ describe('url state', () => {
     loginAndWaitForPageWithoutDateRange(ABSOLUTE_DATE_RANGE.url);
     kqlSearch('source.ip: "10.142.0.9" {enter}');
     navigateFromHeaderTo(HOSTS);
-
     cy.get(NETWORK).should(
       'have.attr',
       'href',
-      `/app/security/network?query=(language:kuery,query:'source.ip:%20%2210.142.0.9%22%20')&sourcerer=(default:!(\'auditbeat-*\'))&timerange=(global:(linkTo:!(timeline),timerange:(from:'2019-08-01T20:03:29.186Z',kind:absolute,to:'2019-08-01T20:33:29.186Z')),timeline:(linkTo:!(global),timerange:(from:'2019-08-01T20:03:29.186Z',kind:absolute,to:'2019-08-01T20:33:29.186Z')))`
+      `/app/security/network?query=(language:kuery,query:'source.ip:%20%2210.142.0.9%22%20')&sourcerer=(default:(id:security-solution-default,selectedPatterns:!('auditbeat-*')))&timerange=(global:(linkTo:!(timeline),timerange:(from:'2019-08-01T20:03:29.186Z',kind:absolute,to:'2019-08-01T20:33:29.186Z')),timeline:(linkTo:!(global),timerange:(from:'2019-08-01T20:03:29.186Z',kind:absolute,to:'2019-08-01T20:33:29.186Z')))`
     );
   });
 
@@ -199,12 +198,12 @@ describe('url state', () => {
     cy.get(HOSTS).should(
       'have.attr',
       'href',
-      `/app/security/hosts?query=(language:kuery,query:'host.name:%20%22siem-kibana%22%20')&sourcerer=(default:!(\'auditbeat-*\'))&timerange=(global:(linkTo:!(timeline),timerange:(from:'2019-08-01T20:03:29.186Z',kind:absolute,to:'2020-01-01T21:33:29.186Z')),timeline:(linkTo:!(global),timerange:(from:'2019-08-01T20:03:29.186Z',kind:absolute,to:'2020-01-01T21:33:29.186Z')))`
+      `/app/security/hosts?query=(language:kuery,query:'host.name:%20%22siem-kibana%22%20')&sourcerer=(default:(id:security-solution-default,selectedPatterns:!('auditbeat-*')))&timerange=(global:(linkTo:!(timeline),timerange:(from:'2019-08-01T20:03:29.186Z',kind:absolute,to:'2020-01-01T21:33:29.186Z')),timeline:(linkTo:!(global),timerange:(from:'2019-08-01T20:03:29.186Z',kind:absolute,to:'2020-01-01T21:33:29.186Z')))`
     );
     cy.get(NETWORK).should(
       'have.attr',
       'href',
-      `/app/security/network?query=(language:kuery,query:'host.name:%20%22siem-kibana%22%20')&sourcerer=(default:!(\'auditbeat-*\'))&timerange=(global:(linkTo:!(timeline),timerange:(from:'2019-08-01T20:03:29.186Z',kind:absolute,to:'2020-01-01T21:33:29.186Z')),timeline:(linkTo:!(global),timerange:(from:'2019-08-01T20:03:29.186Z',kind:absolute,to:'2020-01-01T21:33:29.186Z')))`
+      `/app/security/network?query=(language:kuery,query:'host.name:%20%22siem-kibana%22%20')&sourcerer=(default:(id:security-solution-default,selectedPatterns:!('auditbeat-*')))&timerange=(global:(linkTo:!(timeline),timerange:(from:'2019-08-01T20:03:29.186Z',kind:absolute,to:'2020-01-01T21:33:29.186Z')),timeline:(linkTo:!(global),timerange:(from:'2019-08-01T20:03:29.186Z',kind:absolute,to:'2020-01-01T21:33:29.186Z')))`
     );
     cy.get(HOSTS_NAMES).first().should('have.text', 'siem-kibana');
 
@@ -215,21 +214,21 @@ describe('url state', () => {
     cy.get(ANOMALIES_TAB).should(
       'have.attr',
       'href',
-      "/app/security/hosts/siem-kibana/anomalies?sourcerer=(default:!('auditbeat-*'))&timerange=(global:(linkTo:!(timeline),timerange:(from:'2019-08-01T20:03:29.186Z',kind:absolute,to:'2020-01-01T21:33:29.186Z')),timeline:(linkTo:!(global),timerange:(from:'2019-08-01T20:03:29.186Z',kind:absolute,to:'2020-01-01T21:33:29.186Z')))&query=(language:kuery,query:'agent.type:%20%22auditbeat%22%20')"
+      "/app/security/hosts/siem-kibana/anomalies?sourcerer=(default:(id:security-solution-default,selectedPatterns:!('auditbeat-*')))&timerange=(global:(linkTo:!(timeline),timerange:(from:'2019-08-01T20:03:29.186Z',kind:absolute,to:'2020-01-01T21:33:29.186Z')),timeline:(linkTo:!(global),timerange:(from:'2019-08-01T20:03:29.186Z',kind:absolute,to:'2020-01-01T21:33:29.186Z')))&query=(language:kuery,query:'agent.type:%20%22auditbeat%22%20')"
     );
     cy.get(BREADCRUMBS)
       .eq(1)
       .should(
         'have.attr',
         'href',
-        `/app/security/hosts?query=(language:kuery,query:'agent.type:%20%22auditbeat%22%20')&sourcerer=(default:!(\'auditbeat-*\'))&timerange=(global:(linkTo:!(timeline),timerange:(from:'2019-08-01T20:03:29.186Z',kind:absolute,to:'2020-01-01T21:33:29.186Z')),timeline:(linkTo:!(global),timerange:(from:'2019-08-01T20:03:29.186Z',kind:absolute,to:'2020-01-01T21:33:29.186Z')))`
+        `/app/security/hosts?query=(language:kuery,query:'agent.type:%20%22auditbeat%22%20')&sourcerer=(default:(id:security-solution-default,selectedPatterns:!('auditbeat-*')))&timerange=(global:(linkTo:!(timeline),timerange:(from:'2019-08-01T20:03:29.186Z',kind:absolute,to:'2020-01-01T21:33:29.186Z')),timeline:(linkTo:!(global),timerange:(from:'2019-08-01T20:03:29.186Z',kind:absolute,to:'2020-01-01T21:33:29.186Z')))`
       );
     cy.get(BREADCRUMBS)
       .eq(2)
       .should(
         'have.attr',
         'href',
-        `/app/security/hosts/siem-kibana?query=(language:kuery,query:'agent.type:%20%22auditbeat%22%20')&sourcerer=(default:!(\'auditbeat-*\'))&timerange=(global:(linkTo:!(timeline),timerange:(from:'2019-08-01T20:03:29.186Z',kind:absolute,to:'2020-01-01T21:33:29.186Z')),timeline:(linkTo:!(global),timerange:(from:'2019-08-01T20:03:29.186Z',kind:absolute,to:'2020-01-01T21:33:29.186Z')))`
+        `/app/security/hosts/siem-kibana?query=(language:kuery,query:'agent.type:%20%22auditbeat%22%20')&sourcerer=(default:(id:security-solution-default,selectedPatterns:!('auditbeat-*')))&timerange=(global:(linkTo:!(timeline),timerange:(from:'2019-08-01T20:03:29.186Z',kind:absolute,to:'2020-01-01T21:33:29.186Z')),timeline:(linkTo:!(global),timerange:(from:'2019-08-01T20:03:29.186Z',kind:absolute,to:'2020-01-01T21:33:29.186Z')))`
       );
   });
 
diff --git a/x-pack/plugins/security_solution/cypress/objects/rule.ts b/x-pack/plugins/security_solution/cypress/objects/rule.ts
index ae04e20dfe86e..0a9eecf83c7fc 100644
--- a/x-pack/plugins/security_solution/cypress/objects/rule.ts
+++ b/x-pack/plugins/security_solution/cypress/objects/rule.ts
@@ -419,7 +419,63 @@ export const getEditedRule = (): CustomRule => ({
 });
 
 export const expectedExportedRule = (ruleResponse: Cypress.Response<RulesSchema>): string => {
-  const jsonrule = ruleResponse.body;
-
-  return `{"id":"${jsonrule.id}","updated_at":"${jsonrule.updated_at}","updated_by":"elastic","created_at":"${jsonrule.created_at}","created_by":"elastic","name":"${jsonrule.name}","tags":[],"interval":"100m","enabled":false,"description":"${jsonrule.description}","risk_score":${jsonrule.risk_score},"severity":"${jsonrule.severity}","output_index":".siem-signals-default","author":[],"false_positives":[],"from":"now-50000h","rule_id":"rule_testing","max_signals":100,"risk_score_mapping":[],"severity_mapping":[],"threat":[],"to":"now","references":[],"version":1,"exceptions_list":[],"immutable":false,"type":"query","language":"kuery","index":["exceptions-*"],"query":"${jsonrule.query}","throttle":"no_actions","actions":[]}\n{"exported_rules_count":1,"missing_rules":[],"missing_rules_count":0,"exported_exception_list_count":0,"exported_exception_list_item_count":0,"missing_exception_list_item_count":0,"missing_exception_list_items":[],"missing_exception_lists":[],"missing_exception_lists_count":0}\n`;
+  const {
+    id,
+    updated_at: updatedAt,
+    updated_by: updatedBy,
+    created_at: createdAt,
+    description,
+    name,
+    risk_score: riskScore,
+    severity,
+    query,
+  } = ruleResponse.body;
+  const rule = {
+    id,
+    updated_at: updatedAt,
+    updated_by: updatedBy,
+    created_at: createdAt,
+    created_by: 'elastic',
+    name,
+    tags: [],
+    interval: '100m',
+    enabled: false,
+    description,
+    risk_score: riskScore,
+    severity,
+    output_index: '.siem-signals-default',
+    author: [],
+    false_positives: [],
+    from: 'now-50000h',
+    rule_id: 'rule_testing',
+    max_signals: 100,
+    risk_score_mapping: [],
+    severity_mapping: [],
+    threat: [],
+    to: 'now',
+    references: [],
+    version: 1,
+    exceptions_list: [],
+    immutable: false,
+    type: 'query',
+    language: 'kuery',
+    index: ['exceptions-*'],
+    query,
+    throttle: 'no_actions',
+    actions: [],
+  };
+  const details = {
+    exported_count: 1,
+    exported_rules_count: 1,
+    missing_rules: [],
+    missing_rules_count: 0,
+    exported_exception_list_count: 0,
+    exported_exception_list_item_count: 0,
+    missing_exception_list_item_count: 0,
+    missing_exception_list_items: [],
+    missing_exception_lists: [],
+    missing_exception_lists_count: 0,
+  };
+
+  return `${JSON.stringify(rule)}\n${JSON.stringify(details)}\n`;
 };
diff --git a/x-pack/plugins/security_solution/cypress/objects/timeline.ts b/x-pack/plugins/security_solution/cypress/objects/timeline.ts
index f3d9bc1b9ef1a..70b8c1b400d51 100644
--- a/x-pack/plugins/security_solution/cypress/objects/timeline.ts
+++ b/x-pack/plugins/security_solution/cypress/objects/timeline.ts
@@ -87,6 +87,7 @@ export const expectedExportedTimelineTemplate = (
         },
       },
     },
+    dataViewId: timelineTemplateBody.dataViewId,
     dateRange: {
       start: timelineTemplateBody.dateRange?.start,
       end: timelineTemplateBody.dateRange?.end,
@@ -127,6 +128,7 @@ export const expectedExportedTimeline = (timelineResponse: Cypress.Response<Time
       },
     },
     dateRange: { start: timelineBody.dateRange?.start, end: timelineBody.dateRange?.end },
+    dataViewId: timelineBody.dataViewId,
     description: timelineBody.description,
     title: timelineBody.title,
     created: timelineBody.created,
diff --git a/x-pack/plugins/security_solution/cypress/screens/sourcerer.ts b/x-pack/plugins/security_solution/cypress/screens/sourcerer.ts
index 874fc7352e908..185e06f99951c 100644
--- a/x-pack/plugins/security_solution/cypress/screens/sourcerer.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/sourcerer.ts
@@ -7,10 +7,10 @@
 
 export const SOURCERER_TRIGGER = '[data-test-subj="sourcerer-trigger"]';
 export const SOURCERER_INPUT =
-  '[data-test-subj="indexPattern-switcher"] [data-test-subj="comboBoxInput"]';
+  '[data-test-subj="sourcerer-combo-box"] [data-test-subj="comboBoxInput"]';
 export const SOURCERER_OPTIONS =
-  '[data-test-subj="comboBoxOptionsList indexPattern-switcher-optionsList"]';
-export const SOURCERER_SAVE_BUTTON = 'button[data-test-subj="add-index"]';
+  '[data-test-subj="comboBoxOptionsList sourcerer-combo-box-optionsList"]';
+export const SOURCERER_SAVE_BUTTON = 'button[data-test-subj="sourcerer-save"]';
 export const SOURCERER_RESET_BUTTON = 'button[data-test-subj="sourcerer-reset"]';
 export const SOURCERER_POPOVER_TITLE = '.euiPopoverTitle';
 export const HOSTS_STAT = '[data-test-subj="stat-hosts"] [data-test-subj="stat-title"]';
diff --git a/x-pack/plugins/security_solution/cypress/tasks/alerts.ts b/x-pack/plugins/security_solution/cypress/tasks/alerts.ts
index 220c0fbdaa4cf..f4b84b83284db 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/alerts.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/alerts.ts
@@ -102,6 +102,12 @@ export const goToOpenedAlerts = () => {
   cy.get(LOADING_INDICATOR).should('not.exist');
 };
 
+export const refreshAlerts = () => {
+  // ensure we've refetched fields the first time index is defined
+  cy.get(REFRESH_BUTTON).should('have.text', 'Refresh');
+  cy.get(REFRESH_BUTTON).first().click({ force: true });
+};
+
 export const openFirstAlert = () => {
   cy.get(TIMELINE_CONTEXT_MENU_BTN).first().click({ force: true });
   cy.get(OPEN_ALERT_BTN).click();
diff --git a/x-pack/plugins/security_solution/cypress/tasks/login.ts b/x-pack/plugins/security_solution/cypress/tasks/login.ts
index 96d37d2d9214a..f0137f4baf099 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/login.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/login.ts
@@ -10,7 +10,7 @@ import Url, { UrlObject } from 'url';
 
 import { ROLES } from '../../common/test';
 import { TIMELINE_FLYOUT_BODY } from '../screens/timeline';
-import { hostDetailsUrl } from '../urls/navigation';
+import { hostDetailsUrl, LOGOUT_URL } from '../urls/navigation';
 
 /**
  * Credentials in the `kibana.dev.yml` config file will be used to authenticate
@@ -326,3 +326,7 @@ export const waitForPageWithoutDateRange = (url: string, role?: ROLES) => {
   cy.visit(role ? getUrlWithRoute(role, url) : url);
   cy.get('[data-test-subj="headerGlobalNav"]', { timeout: 120000 });
 };
+
+export const logout = () => {
+  cy.visit(LOGOUT_URL);
+};
diff --git a/x-pack/plugins/security_solution/cypress/tasks/privileges.ts b/x-pack/plugins/security_solution/cypress/tasks/privileges.ts
new file mode 100644
index 0000000000000..3550aff767d38
--- /dev/null
+++ b/x-pack/plugins/security_solution/cypress/tasks/privileges.ts
@@ -0,0 +1,186 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { constructUrlWithUser, getEnvAuth } from './login';
+
+interface User {
+  username: string;
+  password: string;
+  description?: string;
+  roles: string[];
+}
+
+interface UserInfo {
+  username: string;
+  full_name: string;
+  email: string;
+}
+
+interface FeaturesPrivileges {
+  [featureId: string]: string[];
+}
+
+interface ElasticsearchIndices {
+  names: string[];
+  privileges: string[];
+}
+
+interface ElasticSearchPrivilege {
+  cluster?: string[];
+  indices?: ElasticsearchIndices[];
+}
+
+interface KibanaPrivilege {
+  spaces: string[];
+  base?: string[];
+  feature?: FeaturesPrivileges;
+}
+
+interface Role {
+  name: string;
+  privileges: {
+    elasticsearch?: ElasticSearchPrivilege;
+    kibana?: KibanaPrivilege[];
+  };
+}
+
+export const secAll: Role = {
+  name: 'sec_all_role',
+  privileges: {
+    elasticsearch: {
+      indices: [
+        {
+          names: ['*'],
+          privileges: ['all'],
+        },
+      ],
+    },
+    kibana: [
+      {
+        feature: {
+          siem: ['all'],
+          securitySolutionCases: ['all'],
+          actions: ['all'],
+          actionsSimulators: ['all'],
+          // TODO: Steph/sourcerer remove once we have our internal saved object client
+          // https://github.com/elastic/security-team/issues/1978
+          indexPatterns: ['read'],
+          savedObjectsManagement: ['read'],
+        },
+        spaces: ['*'],
+      },
+    ],
+  },
+};
+
+export const secAllUser: User = {
+  username: 'sec_all_user',
+  password: 'password',
+  roles: [secAll.name],
+};
+
+export const secReadCasesAll: Role = {
+  name: 'sec_read_cases_all_role',
+  privileges: {
+    elasticsearch: {
+      indices: [
+        {
+          names: ['*'],
+          privileges: ['all'],
+        },
+      ],
+    },
+    kibana: [
+      {
+        feature: {
+          siem: ['read'],
+          securitySolutionCases: ['all'],
+          actions: ['all'],
+          actionsSimulators: ['all'],
+          // TODO: Steph/sourcerer remove once we have our internal saved object client
+          // https://github.com/elastic/security-team/issues/1978
+          indexPatterns: ['read'],
+          savedObjectsManagement: ['read'],
+        },
+        spaces: ['*'],
+      },
+    ],
+  },
+};
+
+export const secReadCasesAllUser: User = {
+  username: 'sec_read_cases_all_user',
+  password: 'password',
+  roles: [secReadCasesAll.name],
+};
+
+const getUserInfo = (user: User): UserInfo => ({
+  username: user.username,
+  full_name: user.username.replace('_', ' '),
+  email: `${user.username}@elastic.co`,
+});
+
+export const createUsersAndRoles = (users: User[], roles: Role[]) => {
+  const envUser = getEnvAuth();
+  for (const role of roles) {
+    cy.log(`Creating role: ${JSON.stringify(role)}`);
+    cy.request({
+      body: role.privileges,
+      headers: { 'kbn-xsrf': 'cypress-creds-via-config' },
+      method: 'PUT',
+      url: constructUrlWithUser(envUser, `/api/security/role/${role.name}`),
+    })
+      .its('status')
+      .should('eql', 204);
+  }
+
+  for (const user of users) {
+    const userInfo = getUserInfo(user);
+    cy.log(`Creating user: ${JSON.stringify(user)}`);
+    cy.request({
+      body: {
+        username: user.username,
+        password: user.password,
+        roles: user.roles,
+        full_name: userInfo.full_name,
+        email: userInfo.email,
+      },
+      headers: { 'kbn-xsrf': 'cypress-creds-via-config' },
+      method: 'POST',
+      url: constructUrlWithUser(envUser, `/internal/security/users/${user.username}`),
+    })
+      .its('status')
+      .should('eql', 200);
+  }
+};
+
+export const deleteUsersAndRoles = (users: User[], roles: Role[]) => {
+  const envUser = getEnvAuth();
+  for (const user of users) {
+    cy.log(`Deleting user: ${JSON.stringify(user)}`);
+    cy.request({
+      headers: { 'kbn-xsrf': 'cypress-creds-via-config' },
+      method: 'DELETE',
+      url: constructUrlWithUser(envUser, `/internal/security/users/${user.username}`),
+      failOnStatusCode: false,
+    })
+      .its('status')
+      .should('oneOf', [204, 404]);
+  }
+
+  for (const role of roles) {
+    cy.log(`Deleting role: ${JSON.stringify(role)}`);
+    cy.request({
+      headers: { 'kbn-xsrf': 'cypress-creds-via-config' },
+      method: 'DELETE',
+      url: constructUrlWithUser(envUser, `/api/security/role/${role.name}`),
+      failOnStatusCode: false,
+    })
+      .its('status')
+      .should('oneOf', [204, 404]);
+  }
+};
diff --git a/x-pack/plugins/security_solution/cypress/urls/navigation.ts b/x-pack/plugins/security_solution/cypress/urls/navigation.ts
index a9fad865f506c..901c06193d73c 100644
--- a/x-pack/plugins/security_solution/cypress/urls/navigation.ts
+++ b/x-pack/plugins/security_solution/cypress/urls/navigation.ts
@@ -41,3 +41,4 @@ export const OVERVIEW_URL = '/app/security/overview';
 export const RULE_CREATION = 'app/security/rules/create';
 export const TIMELINES_URL = '/app/security/timelines';
 export const TIMELINE_TEMPLATES_URL = '/app/security/timelines/template';
+export const LOGOUT_URL = '/logout';
diff --git a/x-pack/plugins/security_solution/public/app/home/index.tsx b/x-pack/plugins/security_solution/public/app/home/index.tsx
index e7f825691c58d..3a02adc155e6e 100644
--- a/x-pack/plugins/security_solution/public/app/home/index.tsx
+++ b/x-pack/plugins/security_solution/public/app/home/index.tsx
@@ -16,8 +16,8 @@ import { UseUrlState } from '../../common/components/url_state';
 import { navTabs } from './home_navigations';
 import {
   useInitSourcerer,
-  useSourcererScope,
   getScopeFromPath,
+  useSourcererDataView,
 } from '../../common/containers/sourcerer';
 import { useUpgradeSecurityPackages } from '../../common/hooks/use_upgrade_security_packages';
 import { GlobalHeader } from './global_header';
@@ -38,8 +38,7 @@ const HomePageComponent: React.FC<HomePageProps> = ({
 
   useInitSourcerer(getScopeFromPath(pathname));
 
-  const { browserFields, indexPattern } = useSourcererScope(getScopeFromPath(pathname));
-
+  const { browserFields, indexPattern } = useSourcererDataView(getScopeFromPath(pathname));
   // side effect: this will attempt to upgrade the endpoint package if it is not up to date
   // this will run when a user navigates to the Security Solution app and when they navigate between
   // tabs in the app. This is useful for keeping the endpoint package as up to date as possible until
diff --git a/x-pack/plugins/security_solution/public/app/home/template_wrapper/bottom_bar/index.tsx b/x-pack/plugins/security_solution/public/app/home/template_wrapper/bottom_bar/index.tsx
index 8e972b92c2fa1..c283bb10c7928 100644
--- a/x-pack/plugins/security_solution/public/app/home/template_wrapper/bottom_bar/index.tsx
+++ b/x-pack/plugins/security_solution/public/app/home/template_wrapper/bottom_bar/index.tsx
@@ -8,25 +8,23 @@
 /* eslint-disable react/display-name */
 
 import React from 'react';
-import { useLocation } from 'react-router-dom';
 import { KibanaPageTemplateProps } from '../../../../../../../../src/plugins/kibana_react/public';
 import { AppLeaveHandler } from '../../../../../../../../src/core/public';
 import { useShowTimeline } from '../../../../common/utils/timeline/use_show_timeline';
-import { useSourcererScope, getScopeFromPath } from '../../../../common/containers/sourcerer';
+import { useSourcererDataView } from '../../../../common/containers/sourcerer';
 import { TimelineId } from '../../../../../common/types/timeline';
 import { AutoSaveWarningMsg } from '../../../../timelines/components/timeline/auto_save_warning';
 import { Flyout } from '../../../../timelines/components/flyout';
 import { useResolveRedirect } from '../../../../common/hooks/use_resolve_redirect';
+import { SourcererScopeName } from '../../../../common/store/sourcerer/model';
 
 export const BOTTOM_BAR_CLASSNAME = 'timeline-bottom-bar';
 
 export const SecuritySolutionBottomBar = React.memo(
   ({ onAppLeave }: { onAppLeave: (handler: AppLeaveHandler) => void }) => {
-    const { pathname } = useLocation();
-
     const [showTimeline] = useShowTimeline();
 
-    const { indicesExist } = useSourcererScope(getScopeFromPath(pathname));
+    const { indicesExist } = useSourcererDataView(SourcererScopeName.timeline);
     useResolveRedirect();
 
     return indicesExist && showTimeline ? (
diff --git a/x-pack/plugins/security_solution/public/cases/components/case_view/helpers.ts b/x-pack/plugins/security_solution/public/cases/components/case_view/helpers.ts
index 94813862a983a..bfaa5fb7652d4 100644
--- a/x-pack/plugins/security_solution/public/cases/components/case_view/helpers.ts
+++ b/x-pack/plugins/security_solution/public/cases/components/case_view/helpers.ts
@@ -7,7 +7,7 @@
 
 import { isObject, get, isString, isNumber } from 'lodash';
 import { useMemo } from 'react';
-import { useSourcererScope } from '../../../common/containers/sourcerer';
+import { useSourcererDataView } from '../../../common/containers/sourcerer';
 import { SourcererScopeName } from '../../../common/store/sourcerer/model';
 import { useQueryAlerts } from '../../../detections/containers/detection_engine/alerts/use_query';
 import { Ecs } from '../../../../../cases/common';
@@ -102,7 +102,7 @@ export interface Alert {
   [key: string]: unknown;
 }
 export const useFetchAlertData = (alertIds: string[]): [boolean, Record<string, Ecs>] => {
-  const { selectedPatterns } = useSourcererScope(SourcererScopeName.detections);
+  const { selectedPatterns } = useSourcererDataView(SourcererScopeName.detections);
   const alertsQuery = useMemo(() => buildAlertsQuery(alertIds), [alertIds]);
 
   const { loading: isLoadingAlerts, data: alertsData } = useQueryAlerts<SignalHit, unknown>({
diff --git a/x-pack/plugins/security_solution/public/cases/components/case_view/index.tsx b/x-pack/plugins/security_solution/public/cases/components/case_view/index.tsx
index bdf4a1dbc1579..fc65d5c370bae 100644
--- a/x-pack/plugins/security_solution/public/cases/components/case_view/index.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/case_view/index.tsx
@@ -21,7 +21,7 @@ import { SecurityPageName } from '../../../app/types';
 import { useKibana } from '../../../common/lib/kibana';
 import { APP_UI_ID } from '../../../../common/constants';
 import { timelineActions } from '../../../timelines/store/timeline';
-import { useSourcererScope } from '../../../common/containers/sourcerer';
+import { useSourcererDataView } from '../../../common/containers/sourcerer';
 import { SourcererScopeName } from '../../../common/store/sourcerer/model';
 import { DetailsPanel } from '../../../timelines/components/side_panel';
 import { InvestigateInTimelineAction } from '../../../detections/components/alerts_table/timeline_actions/investigate_in_timeline_action';
@@ -53,14 +53,16 @@ export interface CaseProps extends Props {
 }
 
 const TimelineDetailsPanel = () => {
-  const { browserFields, docValueFields } = useSourcererScope(SourcererScopeName.detections);
-
+  const { browserFields, docValueFields, runtimeMappings } = useSourcererDataView(
+    SourcererScopeName.detections
+  );
   return (
     <DetailsPanel
       browserFields={browserFields}
       docValueFields={docValueFields}
       entityType="events"
       isFlyoutView
+      runtimeMappings={runtimeMappings}
       timelineId={TimelineId.casePage}
     />
   );
@@ -134,6 +136,7 @@ export const CaseView = React.memo(
         timelineActions.createTimeline({
           id: TimelineId.casePage,
           columns: [],
+          dataViewId: '',
           indexNames: [],
           expandedDetail: {},
           show: false,
diff --git a/x-pack/plugins/security_solution/public/common/components/drag_and_drop/__snapshots__/drag_drop_context_wrapper.test.tsx.snap b/x-pack/plugins/security_solution/public/common/components/drag_and_drop/__snapshots__/drag_drop_context_wrapper.test.tsx.snap
index 6ef797580be9b..93c083eafbdf3 100644
--- a/x-pack/plugins/security_solution/public/common/components/drag_and_drop/__snapshots__/drag_drop_context_wrapper.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/common/components/drag_and_drop/__snapshots__/drag_drop_context_wrapper.test.tsx.snap
@@ -125,6 +125,7 @@ exports[`DragDropContextWrapper rendering it renders against the snapshot 1`] =
               "packetbeat",
             ],
             "name": "@timestamp",
+            "readFromDocValues": true,
             "searchable": true,
             "type": "date",
           },
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/alert_summary_view.test.tsx.snap b/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/alert_summary_view.test.tsx.snap
index a907b64d00cac..40784270e6c60 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/alert_summary_view.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/alert_summary_view.test.tsx.snap
@@ -676,7 +676,7 @@ exports[`AlertSummaryView Behavior event code renders additional summary rows 1`
                   <div
                     data-test-subj="more-actions-source.ip"
                     field="source.ip"
-                    items="[object Object]"
+                    items="[object Object],[object Object]"
                     value="185.156.74.3"
                   >
                     Overflow button
@@ -1368,7 +1368,7 @@ exports[`AlertSummaryView Memory event code renders additional summary rows 1`]
                   <div
                     data-test-subj="more-actions-source.ip"
                     field="source.ip"
-                    items="[object Object]"
+                    items="[object Object],[object Object]"
                     value="185.156.74.3"
                   >
                     Overflow button
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/table/field_name_cell.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/table/field_name_cell.tsx
index 327d8d963c75e..74b366ffc1b3e 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/table/field_name_cell.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/table/field_name_cell.tsx
@@ -10,7 +10,7 @@ import { EuiFlexGroup, EuiFlexItem, EuiBadge, EuiText, EuiToolTip } from '@elast
 import { isEmpty } from 'lodash';
 import * as i18n from '../translations';
 import { FieldIcon } from '../../../../../../../../src/plugins/kibana_react/public';
-import { IndexPatternField } from '../../../../../../../../src/plugins/data/public';
+import { DataViewField } from '../../../../../../../../src/plugins/data_views/common';
 import { getExampleText } from '../helpers';
 import { BrowserField } from '../../../containers/source';
 import { EventFieldsData } from '../types';
@@ -20,7 +20,7 @@ export interface FieldNameCellProps {
   data: EventFieldsData;
   field: string;
   fieldFromBrowserField: BrowserField;
-  fieldMapping?: IndexPatternField;
+  fieldMapping?: DataViewField;
   scripted?: boolean;
 }
 export const FieldNameCell = React.memo(
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/table/field_value_cell.test.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/table/field_value_cell.test.tsx
index d703e736d8b61..710cf5fceeb21 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/table/field_value_cell.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/table/field_value_cell.test.tsx
@@ -30,6 +30,7 @@ const hostIpData: EventFieldsData = {
   isObjectArray: false,
   name: 'host.ip',
   originalValue: ['127.0.0.1', '::1', '10.1.2.3', '2001:0DB8:AC10:FE01::'],
+  readFromDocValues: false,
   searchable: true,
   type: 'ip',
   values: ['127.0.0.1', '::1', '10.1.2.3', '2001:0DB8:AC10:FE01::'],
@@ -101,6 +102,7 @@ describe('FieldValueCell', () => {
       isObjectArray: false,
       name: 'message',
       originalValue: ['Endpoint network event'],
+      readFromDocValues: false,
       searchable: true,
       type: 'string',
       values: ['Endpoint network event'],
@@ -117,6 +119,7 @@ describe('FieldValueCell', () => {
       format: '',
       indexes: ['auditbeat-*', 'filebeat-*', 'logs-*', 'winlogbeat-*'],
       name: 'message',
+      readFromDocValues: false,
       searchable: true,
       type: 'string',
     };
@@ -156,6 +159,7 @@ describe('FieldValueCell', () => {
       format: '',
       indexes: ['auditbeat-*', 'filebeat-*', 'logs-*', 'winlogbeat-*'],
       name: 'host.ip',
+      readFromDocValues: false,
       searchable: true,
       type: 'ip',
     };
diff --git a/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.test.tsx b/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.test.tsx
index 7b7a1ead5d702..a611d140f61d1 100644
--- a/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.test.tsx
@@ -16,8 +16,12 @@ import { mockEventViewerResponse, mockEventViewerResponseWithEvents } from './mo
 import { StatefulEventsViewer } from '.';
 import { EventsViewer } from './events_viewer';
 import { defaultHeaders } from './default_headers';
-import { useSourcererScope } from '../../containers/sourcerer';
-import { mockBrowserFields, mockDocValueFields } from '../../containers/source/mock';
+import { useSourcererDataView } from '../../containers/sourcerer';
+import {
+  mockBrowserFields,
+  mockDocValueFields,
+  mockRuntimeMappings,
+} from '../../containers/source/mock';
 import { eventsDefaultModel } from './default_model';
 import { useMountAppended } from '../../utils/use_mount_appended';
 import { inputsModel } from '../../store/inputs';
@@ -91,7 +95,7 @@ jest.mock('../../../timelines/containers', () => ({
 
 jest.mock('../../components/url_state/normalize_time_range.ts');
 
-const mockUseSourcererScope: jest.Mock = useSourcererScope as jest.Mock;
+const mockUseSourcererDataView: jest.Mock = useSourcererDataView as jest.Mock;
 jest.mock('../../containers/sourcerer');
 
 const mockUseResizeObserver: jest.Mock = useResizeObserver as jest.Mock;
@@ -107,6 +111,7 @@ const to = '2019-08-27T22:10:56.794Z';
 const defaultMocks = {
   browserFields: mockBrowserFields,
   docValueFields: mockDocValueFields,
+  runtimeMappings: mockRuntimeMappings,
   indexPattern: mockIndexPattern,
   loading: false,
   selectedPatterns: mockIndexNames,
@@ -139,6 +144,7 @@ const eventsViewerDefaultProps = {
   },
   renderCellValue: DefaultCellRenderer,
   rowRenderers: defaultRowRenderers,
+  runtimeMappings: {},
   start: from,
   sort: [
     {
@@ -169,7 +175,7 @@ describe('EventsViewer', () => {
     mockUseTimelineEvents.mockReset();
   });
   beforeAll(() => {
-    mockUseSourcererScope.mockImplementation(() => defaultMocks);
+    mockUseSourcererDataView.mockImplementation(() => defaultMocks);
   });
 
   describe('event details', () => {
@@ -278,7 +284,7 @@ describe('EventsViewer', () => {
 
   describe('loading', () => {
     beforeAll(() => {
-      mockUseSourcererScope.mockImplementation(() => ({ ...defaultMocks, loading: true }));
+      mockUseSourcererDataView.mockImplementation(() => ({ ...defaultMocks, loading: true }));
     });
     beforeEach(() => {
       mockUseTimelineEvents.mockReturnValue([false, mockEventViewerResponse]);
diff --git a/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.tsx b/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.tsx
index fd644d1380ddb..5a3aa2e6dc38a 100644
--- a/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/events_viewer/events_viewer.tsx
@@ -11,6 +11,8 @@ import styled from 'styled-components';
 import deepEqual from 'fast-deep-equal';
 
 import { useDispatch } from 'react-redux';
+import { DataViewBase, Filter, Query } from '@kbn/es-query';
+import { MappingRuntimeFields } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import { Direction } from '../../../../common/search_strategy';
 import { BrowserFields, DocValueFields } from '../../containers/source';
 import { useTimelineEvents } from '../../../timelines/containers';
@@ -30,12 +32,7 @@ import {
 import { TimelineRefetch } from '../../../timelines/components/timeline/refetch_timeline';
 import { EventDetailsWidthProvider } from './event_details_width_context';
 import * as i18n from './translations';
-import {
-  Filter,
-  esQuery,
-  IIndexPattern,
-  Query,
-} from '../../../../../../../src/plugins/data/public';
+import { esQuery } from '../../../../../../../src/plugins/data/public';
 import { inputsModel } from '../../store';
 import { ExitFullScreen } from '../exit_full_screen';
 import { useGlobalFullScreen } from '../../containers/use_full_screen';
@@ -123,7 +120,7 @@ interface Props {
   headerFilterGroup?: React.ReactNode;
   id: TimelineId;
   indexNames: string[];
-  indexPattern: IIndexPattern;
+  indexPattern: DataViewBase;
   isLive: boolean;
   isLoadingIndexPattern: boolean;
   itemsPerPage: number;
@@ -133,6 +130,7 @@ interface Props {
   onRuleChange?: () => void;
   renderCellValue: (props: CellValueElementProps) => React.ReactNode;
   rowRenderers: RowRenderer[];
+  runtimeMappings: MappingRuntimeFields;
   start: string;
   sort: Sort[];
   showTotalCount?: boolean;
@@ -162,6 +160,7 @@ const EventsViewerComponent: React.FC<Props> = ({
   query,
   renderCellValue,
   rowRenderers,
+  runtimeMappings,
   start,
   sort,
   showTotalCount = true,
@@ -240,6 +239,7 @@ const EventsViewerComponent: React.FC<Props> = ({
       id,
       indexNames,
       limit: itemsPerPage,
+      runtimeMappings,
       sort: sortField,
       startDate: start,
       endDate: end,
diff --git a/x-pack/plugins/security_solution/public/common/components/events_viewer/index.tsx b/x-pack/plugins/security_solution/public/common/components/events_viewer/index.tsx
index 1e61e69180f91..5be966ab64980 100644
--- a/x-pack/plugins/security_solution/public/common/components/events_viewer/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/events_viewer/index.tsx
@@ -22,7 +22,7 @@ import { InspectButtonContainer } from '../inspect';
 import { useGlobalFullScreen } from '../../containers/use_full_screen';
 import { useIsExperimentalFeatureEnabled } from '../../hooks/use_experimental_features';
 import { SourcererScopeName } from '../../store/sourcerer/model';
-import { useSourcererScope } from '../../containers/sourcerer';
+import { useSourcererDataView } from '../../containers/sourcerer';
 import type { EntityType } from '../../../../../timelines/common';
 import { TGridCellAction } from '../../../../../timelines/common/types';
 import { DetailsPanel } from '../../../timelines/components/side_panel';
@@ -117,9 +117,12 @@ const StatefulEventsViewerComponent: React.FC<Props> = ({
     browserFields,
     docValueFields,
     indexPattern,
+    runtimeMappings,
     selectedPatterns,
+    dataViewId: selectedDataViewId,
     loading: isLoadingIndexPattern,
-  } = useSourcererScope(scopeId);
+  } = useSourcererDataView(scopeId);
+
   const { globalFullScreen } = useGlobalFullScreen();
   // TODO: Once we are past experimental phase this code should be removed
   const tGridEnabled = useIsExperimentalFeatureEnabled('tGridEnabled');
@@ -129,14 +132,15 @@ const StatefulEventsViewerComponent: React.FC<Props> = ({
   useEffect(() => {
     if (createTimeline != null) {
       createTimeline({
-        id,
         columns,
+        dataViewId: selectedDataViewId,
         defaultColumns,
         excludedRowRendererIds,
+        id,
         indexNames: selectedPatterns,
-        sort,
         itemsPerPage,
         showCheckboxes,
+        sort,
       });
     }
     return () => {
@@ -206,6 +210,7 @@ const StatefulEventsViewerComponent: React.FC<Props> = ({
               query,
               renderCellValue,
               rowRenderers,
+              runtimeMappings,
               setQuery,
               sort,
               start,
@@ -235,6 +240,7 @@ const StatefulEventsViewerComponent: React.FC<Props> = ({
               onRuleChange={onRuleChange}
               renderCellValue={renderCellValue}
               rowRenderers={rowRenderers}
+              runtimeMappings={runtimeMappings}
               start={start}
               sort={sort}
               showTotalCount={isEmpty(graphEventId) ? true : false}
@@ -249,6 +255,7 @@ const StatefulEventsViewerComponent: React.FC<Props> = ({
         entityType={entityType}
         docValueFields={docValueFields}
         isFlyoutView
+        runtimeMappings={runtimeMappings}
         timelineId={id}
       />
     </>
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx
index a90ec21f992f8..37f250ffd2d4d 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.test.tsx
@@ -42,13 +42,13 @@ import { getCommentsArrayMock } from '../../../../../lists/common/schemas/types/
 import { fields } from '../../../../../../../src/plugins/data/common/mocks';
 import { ENTRIES, OLD_DATE_RELATIVE_TO_DATE_NOW } from '../../../../../lists/common/constants.mock';
 import { CodeSignature } from '../../../../common/ecs/file';
-import { IndexPatternBase } from '@kbn/es-query';
+import { DataViewBase } from '@kbn/es-query';
 
 jest.mock('uuid', () => ({
   v4: jest.fn().mockReturnValue('123'),
 }));
 
-const getMockIndexPattern = (): IndexPatternBase => ({
+const getMockIndexPattern = (): DataViewBase => ({
   fields,
   id: '1234',
   title: 'logstash-*',
@@ -364,7 +364,7 @@ describe('Exception helpers', () => {
           name: 'nested.field',
         },
       ],
-    } as IndexPatternBase;
+    } as DataViewBase;
 
     test('it should return false with an empty array', () => {
       const payload: ExceptionListItemSchema[] = [];
diff --git a/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx b/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx
index 58da977fcb8f0..e14c151ed367c 100644
--- a/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/exceptions/helpers.tsx
@@ -33,7 +33,7 @@ import {
   addIdToEntries,
   ExceptionsBuilderExceptionItem,
 } from '@kbn/securitysolution-list-utils';
-import { IndexPatternBase } from '@kbn/es-query';
+import { DataViewBase } from '@kbn/es-query';
 import * as i18n from './translations';
 import { AlertData, Flattened } from './types';
 
@@ -46,10 +46,10 @@ import exceptionableEndpointFields from './exceptionable_endpoint_fields.json';
 import exceptionableEndpointEventFields from './exceptionable_endpoint_event_fields.json';
 
 export const filterIndexPatterns = (
-  patterns: IndexPatternBase,
+  patterns: DataViewBase,
   type: ExceptionListType,
   osTypes?: OsTypeArray
-): IndexPatternBase => {
+): DataViewBase => {
   switch (type) {
     case 'endpoint':
       const osFilterForEndpoint: (name: string) => boolean = osTypes?.includes('linux')
@@ -752,7 +752,7 @@ export const getPrepopulatedBehaviorException = ({
  */
 export const entryHasNonEcsType = (
   exceptionItems: Array<ExceptionListItemSchema | CreateExceptionListItemSchema>,
-  indexPatterns: IndexPatternBase
+  indexPatterns: DataViewBase
 ): boolean => {
   const doesFieldNameExist = (exceptionEntry: Entry): boolean => {
     return indexPatterns.fields.some(({ name }) => name === exceptionEntry.field);
diff --git a/x-pack/plugins/security_solution/public/common/components/hover_actions/actions/show_top_n.tsx b/x-pack/plugins/security_solution/public/common/components/hover_actions/actions/show_top_n.tsx
index 738103f02dcdf..40b978cfe20fb 100644
--- a/x-pack/plugins/security_solution/public/common/components/hover_actions/actions/show_top_n.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/hover_actions/actions/show_top_n.tsx
@@ -17,7 +17,7 @@ import { i18n } from '@kbn/i18n';
 import { StatefulTopN } from '../../top_n';
 import { TimelineId } from '../../../../../common/types/timeline';
 import { SourcererScopeName } from '../../../store/sourcerer/model';
-import { useSourcererScope } from '../../../containers/sourcerer';
+import { useSourcererDataView } from '../../../containers/sourcerer';
 import { TooltipWithKeyboardShortcut } from '../../accessibility';
 import { getAdditionalScreenReaderOnlyContext } from '../utils';
 import { SHOW_TOP_N_KEYBOARD_SHORTCUT } from '../keyboard_shortcut_constants';
@@ -85,7 +85,8 @@ export const ShowTopNButton: React.FC<Props> = React.memo(
           )
         ? SourcererScopeName.detections
         : SourcererScopeName.default;
-    const { browserFields, indexPattern } = useSourcererScope(activeScope);
+    const { browserFields, indexPattern } = useSourcererDataView(activeScope);
+
     const icon = iconType ?? 'visBarVertical';
     const side = iconSide ?? 'left';
     const buttonTitle = title ?? SHOW_TOP(field);
diff --git a/x-pack/plugins/security_solution/public/common/components/hover_actions/use_hover_action_items.test.tsx b/x-pack/plugins/security_solution/public/common/components/hover_actions/use_hover_action_items.test.tsx
index 0abcbefc71954..1f6436f59602c 100644
--- a/x-pack/plugins/security_solution/public/common/components/hover_actions/use_hover_action_items.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/hover_actions/use_hover_action_items.test.tsx
@@ -13,7 +13,7 @@ import { DataProvider } from '../../../../common/types/timeline';
 jest.mock('../../lib/kibana');
 jest.mock('../../hooks/use_selector');
 jest.mock('../../containers/sourcerer', () => ({
-  useSourcererScope: jest.fn().mockReturnValue({ browserFields: {} }),
+  useSourcererDataView: jest.fn().mockReturnValue({ browserFields: {} }),
 }));
 
 describe('useHoverActionItems', () => {
diff --git a/x-pack/plugins/security_solution/public/common/components/hover_actions/use_hover_action_items.tsx b/x-pack/plugins/security_solution/public/common/components/hover_actions/use_hover_action_items.tsx
index 61cef7930a3a5..44321d6846769 100644
--- a/x-pack/plugins/security_solution/public/common/components/hover_actions/use_hover_action_items.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/hover_actions/use_hover_action_items.tsx
@@ -17,7 +17,7 @@ import { allowTopN } from '../drag_and_drop/helpers';
 import { useDeepEqualSelector } from '../../hooks/use_selector';
 import { ColumnHeaderOptions, DataProvider, TimelineId } from '../../../../common/types/timeline';
 import { SourcererScopeName } from '../../store/sourcerer/model';
-import { useSourcererScope } from '../../containers/sourcerer';
+import { useSourcererDataView } from '../../containers/sourcerer';
 import { timelineSelectors } from '../../../timelines/store/timeline';
 import { ShowTopNButton } from './actions/show_top_n';
 import { FilterManager } from '../../../../../../../src/plugins/data/public';
@@ -116,7 +116,7 @@ export const useHoverActionItems = ({
         )
       ? SourcererScopeName.detections
       : SourcererScopeName.default;
-  const { browserFields } = useSourcererScope(activeScope);
+  const { browserFields } = useSourcererDataView(activeScope);
 
   /*
    * In the case of `DisableOverflowButton`, we show filters only when topN is NOT opened. As after topN button is clicked, the chart panel replace current hover actions in the hover actions' popover, so we have to hide all the actions.
diff --git a/x-pack/plugins/security_solution/public/common/components/links/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/links/index.test.tsx
index 965167f2c945e..0c077aaea81a8 100644
--- a/x-pack/plugins/security_solution/public/common/components/links/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/links/index.test.tsx
@@ -46,6 +46,7 @@ jest.mock('../../lib/kibana', () => {
 describe('Custom Links', () => {
   const hostName = 'Host Name';
   const ipv4 = '192.0.2.255';
+  const ipv4a = '192.0.2.266';
   const ipv6 = '2001:db8:ffff:ffff:ffff:ffff:ffff:ffff';
   const ipv6Encoded = encodeIpv6(ipv6);
 
@@ -64,6 +65,16 @@ describe('Custom Links', () => {
   });
 
   describe('NetworkDetailsLink', () => {
+    test('can handle array of ips', () => {
+      const wrapper = mount(<NetworkDetailsLink ip={[ipv4, ipv4a]} />);
+      expect(wrapper.find('EuiLink').first().prop('href')).toEqual(
+        `/ip/${encodeURIComponent(ipv4)}/source`
+      );
+      expect(wrapper.text()).toEqual(`${ipv4}${ipv4a}`);
+      expect(wrapper.find('EuiLink').last().prop('href')).toEqual(
+        `/ip/${encodeURIComponent(ipv4a)}/source`
+      );
+    });
     test('should render valid link to IP Details with ipv4 as the display text', () => {
       const wrapper = mount(<NetworkDetailsLink ip={ipv4} />);
       expect(wrapper.find('EuiLink').prop('href')).toEqual(
diff --git a/x-pack/plugins/security_solution/public/common/components/links/index.tsx b/x-pack/plugins/security_solution/public/common/components/links/index.tsx
index 8b9188af7725c..c5f6f09676749 100644
--- a/x-pack/plugins/security_solution/public/common/components/links/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/links/index.tsx
@@ -14,7 +14,7 @@ import {
   EuiToolTip,
 } from '@elastic/eui';
 import React, { useMemo, useCallback, SyntheticEvent } from 'react';
-import { isNil } from 'lodash/fp';
+import { isArray, isNil } from 'lodash/fp';
 
 import { IP_REPUTATION_LINKS_SETTING, APP_UI_ID } from '../../../../common/constants';
 import {
@@ -172,7 +172,7 @@ const NetworkDetailsLinkComponent: React.FC<{
   children?: React.ReactNode;
   /** `Component` is only used with `EuiDataGrid`; the grid keeps a reference to `Component` for show / hide functionality */
   Component?: typeof EuiButtonEmpty | typeof EuiButtonIcon;
-  ip: string;
+  ip: string | string[];
   flowTarget?: FlowTarget | FlowTargetSourceDest;
   isButton?: boolean;
   onClick?: (e: SyntheticEvent) => void | undefined;
@@ -181,39 +181,46 @@ const NetworkDetailsLinkComponent: React.FC<{
   const { formatUrl, search } = useFormatUrl(SecurityPageName.network);
   const { navigateToApp } = useKibana().services.application;
   const goToNetworkDetails = useCallback(
-    (ev) => {
+    (ev, cIp: string) => {
       ev.preventDefault();
       navigateToApp(APP_UI_ID, {
         deepLinkId: SecurityPageName.network,
-        path: getNetworkDetailsUrl(encodeURIComponent(encodeIpv6(ip)), flowTarget, search),
+        path: getNetworkDetailsUrl(encodeURIComponent(encodeIpv6(cIp)), flowTarget, search),
       });
     },
-    [flowTarget, ip, navigateToApp, search]
+    [flowTarget, navigateToApp, search]
   );
-  const href = useMemo(
-    () => formatUrl(getNetworkDetailsUrl(encodeURIComponent(encodeIpv6(ip)))),
-    [formatUrl, ip]
+  const getHref = useCallback(
+    (cIp: string) => formatUrl(getNetworkDetailsUrl(encodeURIComponent(encodeIpv6(cIp)))),
+    [formatUrl]
   );
 
-  return isButton ? (
-    <GenericLinkButton
-      Component={Component}
-      dataTestSubj="data-grid-network-details"
-      onClick={onClick ?? goToNetworkDetails}
-      href={href}
-      title={title ?? ip}
-    >
-      {children}
-    </GenericLinkButton>
-  ) : (
-    <LinkAnchor
-      onClick={onClick ?? goToNetworkDetails}
-      href={href}
-      data-test-subj="network-details"
-    >
-      {children ? children : ip}
-    </LinkAnchor>
+  const getLink = useCallback(
+    (cIp: string, i: number) =>
+      isButton ? (
+        <GenericLinkButton
+          Component={Component}
+          key={`${cIp}-${i}`}
+          dataTestSubj="data-grid-network-details"
+          onClick={onClick ?? ((e: SyntheticEvent) => goToNetworkDetails(e, cIp))}
+          href={getHref(cIp)}
+          title={title ?? cIp}
+        >
+          {children}
+        </GenericLinkButton>
+      ) : (
+        <LinkAnchor
+          key={`${cIp}-${i}`}
+          onClick={onClick ?? ((e: SyntheticEvent) => goToNetworkDetails(e, cIp))}
+          href={getHref(cIp)}
+          data-test-subj="network-details"
+        >
+          {children ? children : cIp}
+        </LinkAnchor>
+      ),
+    [Component, children, getHref, goToNetworkDetails, isButton, onClick, title]
   );
+  return isArray(ip) ? <>{ip.map(getLink)}</> : getLink(ip, 0);
 };
 
 export const NetworkDetailsLink = React.memo(NetworkDetailsLinkComponent);
diff --git a/x-pack/plugins/security_solution/public/common/components/navigation/helpers.ts b/x-pack/plugins/security_solution/public/common/components/navigation/helpers.ts
index 2674150ff5d1c..610a3c086fc2c 100644
--- a/x-pack/plugins/security_solution/public/common/components/navigation/helpers.ts
+++ b/x-pack/plugins/security_solution/public/common/components/navigation/helpers.ts
@@ -20,7 +20,7 @@ import {
 import { Query, Filter } from '../../../../../../../src/plugins/data/public';
 
 import { SearchNavTab } from './types';
-import { SourcererScopePatterns } from '../../store/sourcerer/model';
+import { SourcererUrlState } from '../../store/sourcerer/model';
 
 export const getSearch = (tab: SearchNavTab, urlState: UrlState): string => {
   if (tab && tab.urlKey != null && !isAdministration(tab.urlKey)) {
@@ -29,7 +29,7 @@ export const getSearch = (tab: SearchNavTab, urlState: UrlState): string => {
         let urlStateToReplace:
           | Filter[]
           | Query
-          | SourcererScopePatterns
+          | SourcererUrlState
           | TimelineUrl
           | UrlInputsModel
           | string = '';
diff --git a/x-pack/plugins/security_solution/public/common/components/navigation/tab_navigation/types.ts b/x-pack/plugins/security_solution/public/common/components/navigation/tab_navigation/types.ts
index c99d50698db2b..9a066037b2768 100644
--- a/x-pack/plugins/security_solution/public/common/components/navigation/tab_navigation/types.ts
+++ b/x-pack/plugins/security_solution/public/common/components/navigation/tab_navigation/types.ts
@@ -7,7 +7,7 @@
 
 import { UrlInputsModel } from '../../../store/inputs/model';
 import { CONSTANTS } from '../../url_state/constants';
-import { SourcererScopePatterns } from '../../../store/sourcerer/model';
+import { SourcererUrlState } from '../../../store/sourcerer/model';
 import { TimelineUrl } from '../../../../timelines/store/timeline/model';
 import { Filter, Query } from '../../../../../../../../src/plugins/data/public';
 
@@ -21,7 +21,7 @@ export interface TabNavigationProps extends SecuritySolutionTabNavigationProps {
   [CONSTANTS.appQuery]?: Query;
   [CONSTANTS.filters]?: Filter[];
   [CONSTANTS.savedQuery]?: string;
-  [CONSTANTS.sourcerer]: SourcererScopePatterns;
+  [CONSTANTS.sourcerer]: SourcererUrlState;
   [CONSTANTS.timerange]: UrlInputsModel;
   [CONSTANTS.timeline]: TimelineUrl;
 }
diff --git a/x-pack/plugins/security_solution/public/common/components/query_bar/index.tsx b/x-pack/plugins/security_solution/public/common/components/query_bar/index.tsx
index f8738d827e73f..253f2c3862e0c 100644
--- a/x-pack/plugins/security_solution/public/common/components/query_bar/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/query_bar/index.tsx
@@ -8,11 +8,9 @@
 import React, { memo, useMemo, useCallback } from 'react';
 import deepEqual from 'fast-deep-equal';
 
+import { DataViewBase, Filter, Query } from '@kbn/es-query';
 import {
-  Filter,
-  IIndexPattern,
   FilterManager,
-  Query,
   TimeHistory,
   TimeRange,
   SavedQuery,
@@ -26,7 +24,7 @@ export interface QueryBarComponentProps {
   dateRangeFrom?: string;
   dateRangeTo?: string;
   hideSavedQuery?: boolean;
-  indexPattern: IIndexPattern;
+  indexPattern: DataViewBase;
   isLoading?: boolean;
   isRefreshPaused?: boolean;
   filterQuery: Query;
diff --git a/x-pack/plugins/security_solution/public/common/components/search_bar/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/search_bar/index.test.tsx
index 8f82733314361..749156425bb1b 100644
--- a/x-pack/plugins/security_solution/public/common/components/search_bar/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/search_bar/index.test.tsx
@@ -6,13 +6,42 @@
  */
 
 import React from 'react';
-import { mount } from 'enzyme';
-
+import { render, fireEvent } from '@testing-library/react';
 import { InputsModelId } from '../../store/inputs/constants';
 import { SearchBarComponent } from '.';
 import { TestProviders } from '../../mock';
+import { FilterManager } from '../../../../../../../src/plugins/data/public';
+import { coreMock } from '../../../../../../../src/core/public/mocks';
 
-jest.mock('../../lib/kibana');
+const mockFilterManager = new FilterManager(coreMock.createStart().uiSettings);
+jest.mock('../../lib/kibana', () => {
+  const original = jest.requireActual('../../lib/kibana');
+  return {
+    useKibana: () => ({
+      services: {
+        ...original.useKibana().services,
+        data: {
+          ...original.useKibana().services.data,
+          query: {
+            ...original.useKibana().services.data.query,
+            filterManager: mockFilterManager,
+          },
+          ui: {
+            SearchBar: jest.fn().mockImplementation((props) => (
+              <button
+                data-test-subj="querySubmitButton"
+                onClick={() => props.onQuerySubmit({ dateRange: { from: 'now', to: 'now' } })}
+                type="button"
+              >
+                {'Hello world'}
+              </button>
+            )),
+          },
+        },
+      },
+    }),
+  };
+});
 
 describe('SearchBarComponent', () => {
   const props = {
@@ -37,9 +66,38 @@ describe('SearchBarComponent', () => {
     savedQuery: undefined,
   };
 
+  const pollForSignalIndex = jest.fn();
+  beforeEach(() => {
+    jest.resetAllMocks();
+  });
+
   it('calls setSearchBarFilter on mount', () => {
-    mount(<SearchBarComponent {...props} />, { wrappingComponent: TestProviders });
+    render(
+      <TestProviders>
+        <SearchBarComponent {...props} />
+      </TestProviders>
+    );
 
     expect(props.setSearchBarFilter).toHaveBeenCalled();
   });
+
+  it('calls pollForSignalIndex on Refresh button click', () => {
+    const { getByTestId } = render(
+      <TestProviders>
+        <SearchBarComponent {...props} pollForSignalIndex={pollForSignalIndex} />
+      </TestProviders>
+    );
+    fireEvent.click(getByTestId('querySubmitButton'));
+    expect(pollForSignalIndex).toHaveBeenCalled();
+  });
+
+  it('does not call pollForSignalIndex on Refresh button click if pollForSignalIndex not passed', () => {
+    const { getByTestId } = render(
+      <TestProviders>
+        <SearchBarComponent {...props} />
+      </TestProviders>
+    );
+    fireEvent.click(getByTestId('querySubmitButton'));
+    expect(pollForSignalIndex).not.toHaveBeenCalled();
+  });
 });
diff --git a/x-pack/plugins/security_solution/public/common/components/search_bar/index.tsx b/x-pack/plugins/security_solution/public/common/components/search_bar/index.tsx
index baaffdf239dc8..9531443e98514 100644
--- a/x-pack/plugins/security_solution/public/common/components/search_bar/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/search_bar/index.tsx
@@ -13,14 +13,9 @@ import { Dispatch } from 'redux';
 import { Subscription } from 'rxjs';
 import styled from 'styled-components';
 import deepEqual from 'fast-deep-equal';
-import {
-  FilterManager,
-  IIndexPattern,
-  TimeRange,
-  Query,
-  Filter,
-  SavedQuery,
-} from 'src/plugins/data/public';
+
+import { DataViewBase, Filter, Query } from '@kbn/es-query';
+import { FilterManager, TimeRange, SavedQuery } from 'src/plugins/data/public';
 
 import { OnTimeChangeProps } from '@elastic/eui';
 
@@ -48,7 +43,8 @@ const APP_STATE_STORAGE_KEY = 'securitySolution.searchBar.appState';
 
 interface SiemSearchBarProps {
   id: InputsModelId;
-  indexPattern: IIndexPattern;
+  indexPattern: DataViewBase;
+  pollForSignalIndex?: () => void;
   timelineId?: string;
   dataTestSubj?: string;
 }
@@ -67,6 +63,7 @@ export const SearchBarComponent = memo<SiemSearchBarProps & PropsFromRedux>(
     id,
     indexPattern,
     isLoading = false,
+    pollForSignalIndex,
     queries,
     savedQuery,
     setSavedQuery,
@@ -100,6 +97,11 @@ export const SearchBarComponent = memo<SiemSearchBarProps & PropsFromRedux>(
 
     const onQuerySubmit = useCallback(
       (payload: { dateRange: TimeRange; query?: Query }) => {
+        // if the function is there, call it to check if the signals index exists yet
+        // in order to update the index fields
+        if (pollForSignalIndex != null) {
+          pollForSignalIndex();
+        }
         const isQuickSelection =
           payload.dateRange.from.includes('now') || payload.dateRange.to.includes('now');
         let updateSearchBar: UpdateReduxSearchBar = {
@@ -144,7 +146,18 @@ export const SearchBarComponent = memo<SiemSearchBarProps & PropsFromRedux>(
 
         window.setTimeout(() => updateSearch(updateSearchBar), 0);
       },
-      [id, toStr, end, fromStr, start, filterManager, filterQuery, queries, updateSearch]
+      [
+        id,
+        pollForSignalIndex,
+        toStr,
+        end,
+        fromStr,
+        start,
+        filterManager,
+        filterQuery,
+        queries,
+        updateSearch,
+      ]
     );
 
     const onRefresh = useCallback(
diff --git a/x-pack/plugins/security_solution/public/common/components/sourcerer/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/sourcerer/index.test.tsx
index 591cba6b19381..1b23d23c5eb62 100644
--- a/x-pack/plugins/security_solution/public/common/components/sourcerer/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/sourcerer/index.test.tsx
@@ -6,13 +6,9 @@
  */
 
 import React from 'react';
-import { mount } from 'enzyme';
-import { waitFor } from '@testing-library/react';
-
-import { EuiComboBox, EuiComboBoxOptionOption } from '@elastic/eui';
+import { mount, ReactWrapper } from 'enzyme';
 import { SourcererScopeName } from '../../store/sourcerer/model';
 import { Sourcerer } from './index';
-import { DEFAULT_INDEX_PATTERN } from '../../../../common/constants';
 import { sourcererActions, sourcererModel } from '../../store/sourcerer';
 import {
   createSecuritySolutionStorageMock,
@@ -22,6 +18,7 @@ import {
   TestProviders,
 } from '../../mock';
 import { createStore, State } from '../../store';
+import { EuiSuperSelectOption } from '@elastic/eui/src/components/form/super_select/super_select_control';
 
 const mockDispatch = jest.fn();
 jest.mock('react-redux', () => {
@@ -49,16 +46,28 @@ const defaultProps = {
 };
 
 describe('Sourcerer component', () => {
-  beforeEach(() => {
-    jest.clearAllMocks();
-    jest.restoreAllMocks();
-  });
   const state: State = mockGlobalState;
+  const { id, patternList, title } = state.sourcerer.defaultDataView;
+  const patternListNoSignals = patternList
+    .filter((p) => p !== state.sourcerer.signalIndexName)
+    .sort();
+  const checkOptionsAndSelections = (wrapper: ReactWrapper, patterns: string[]) => ({
+    availableOptionCount: wrapper.find(`[data-test-subj="sourcerer-combo-option"]`).length,
+    optionsSelected: patterns.every((pattern) =>
+      wrapper
+        .find(`[data-test-subj="sourcerer-combo-box"] span[title="${pattern}"]`)
+        .first()
+        .exists()
+    ),
+  });
+
   const { storage } = createSecuritySolutionStorageMock();
   let store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
 
   beforeEach(() => {
     store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
+    jest.clearAllMocks();
+    jest.restoreAllMocks();
   });
 
   it('renders tooltip', () => {
@@ -99,20 +108,145 @@ describe('Sourcerer component', () => {
     );
     wrapper.find(`[data-test-subj="sourcerer-trigger"]`).first().simulate('click');
     expect(
-      wrapper.find(`[data-test-subj="indexPattern-switcher"]`).first().prop('selectedOptions')
-    ).toEqual(mockOptions);
+      wrapper.find(`[data-test-subj="sourcerer-combo-box"]`).first().prop('selectedOptions')
+    ).toEqual(
+      patternListNoSignals.map((p) => ({
+        label: p,
+        value: p,
+      }))
+    );
+  });
+  it('Removes duplicate options from title', () => {
+    store = createStore(
+      {
+        ...state,
+        sourcerer: {
+          ...state.sourcerer,
+          defaultDataView: {
+            ...state.sourcerer.defaultDataView,
+            id: '1234',
+            title: 'filebeat-*,auditbeat-*,auditbeat-*,auditbeat-*,auditbeat-*',
+            patternList: ['filebeat-*', 'auditbeat-*'],
+          },
+          kibanaDataViews: [
+            {
+              ...state.sourcerer.defaultDataView,
+              id: '1234',
+              title: 'filebeat-*,auditbeat-*,auditbeat-*,auditbeat-*,auditbeat-*',
+              patternList: ['filebeat-*', 'auditbeat-*'],
+            },
+          ],
+          sourcererScopes: {
+            ...state.sourcerer.sourcererScopes,
+            [SourcererScopeName.default]: {
+              ...mockGlobalState.sourcerer.sourcererScopes[SourcererScopeName.default],
+              loading: false,
+              selectedDataViewId: '1234',
+              selectedPatterns: ['filebeat-*'],
+            },
+          },
+        },
+      },
+      SUB_PLUGINS_REDUCER,
+      kibanaObservable,
+      storage
+    );
+    const wrapper = mount(
+      <TestProviders store={store}>
+        <Sourcerer {...defaultProps} />
+      </TestProviders>
+    );
+    wrapper.find(`[data-test-subj="sourcerer-trigger"]`).first().simulate('click');
+    wrapper
+      .find(`[data-test-subj="sourcerer-combo-box"] [data-test-subj="comboBoxToggleListButton"]`)
+      .first()
+      .simulate('click');
+    const options: Array<EuiSuperSelectOption<string>> = wrapper
+      .find(`[data-test-subj="sourcerer-combo-box"]`)
+      .first()
+      .prop('options');
+    expect(options.length).toEqual(2);
+  });
+  it('Disables options with no data', () => {
+    store = createStore(
+      {
+        ...state,
+        sourcerer: {
+          ...state.sourcerer,
+          defaultDataView: {
+            ...state.sourcerer.defaultDataView,
+            id: '1234',
+            title: 'filebeat-*,auditbeat-*,fakebeat-*',
+            patternList: ['filebeat-*', 'auditbeat-*'],
+          },
+          kibanaDataViews: [
+            {
+              ...state.sourcerer.defaultDataView,
+              id: '1234',
+              title: 'filebeat-*,auditbeat-*,fakebeat-*',
+              patternList: ['filebeat-*', 'auditbeat-*'],
+            },
+          ],
+          sourcererScopes: {
+            ...state.sourcerer.sourcererScopes,
+            [SourcererScopeName.default]: {
+              ...mockGlobalState.sourcerer.sourcererScopes[SourcererScopeName.default],
+              loading: false,
+              selectedDataViewId: '1234',
+              selectedPatterns: ['filebeat-*'],
+            },
+          },
+        },
+      },
+      SUB_PLUGINS_REDUCER,
+      kibanaObservable,
+      storage
+    );
+    const wrapper = mount(
+      <TestProviders store={store}>
+        <Sourcerer {...defaultProps} />
+      </TestProviders>
+    );
+    wrapper.find(`[data-test-subj="sourcerer-trigger"]`).first().simulate('click');
+    wrapper
+      .find(`[data-test-subj="sourcerer-combo-box"] [data-test-subj="comboBoxToggleListButton"]`)
+      .first()
+      .simulate('click');
+    const options: Array<EuiSuperSelectOption<string>> = wrapper
+      .find(`[data-test-subj="sourcerer-combo-box"]`)
+      .first()
+      .prop('options');
+    const disabledOption = options.find((o) => o.disabled);
+    expect(disabledOption?.value).toEqual('fakebeat-*');
   });
-  it('Mounts with some options selected', () => {
+  it('Mounts with multiple options selected - default', () => {
     const state2 = {
       ...mockGlobalState,
       sourcerer: {
         ...mockGlobalState.sourcerer,
+        kibanaDataViews: [
+          state.sourcerer.defaultDataView,
+          {
+            ...state.sourcerer.defaultDataView,
+            id: '1234',
+            title: 'auditbeat-*',
+            patternList: ['auditbeat-*'],
+          },
+          {
+            ...state.sourcerer.defaultDataView,
+            id: '12347',
+            title: 'packetbeat-*',
+            patternList: ['packetbeat-*'],
+          },
+        ],
         sourcererScopes: {
           ...mockGlobalState.sourcerer.sourcererScopes,
           [SourcererScopeName.default]: {
             ...mockGlobalState.sourcerer.sourcererScopes[SourcererScopeName.default],
             loading: false,
-            selectedPatterns: [DEFAULT_INDEX_PATTERN[0]],
+            patternList,
+            selectedDataViewId: id,
+            selectedPatterns: patternList.slice(0, 2),
           },
         },
       },
@@ -125,46 +259,84 @@ describe('Sourcerer component', () => {
       </TestProviders>
     );
     wrapper.find(`[data-test-subj="sourcerer-trigger"]`).first().simulate('click');
-    expect(
-      wrapper.find(`[data-test-subj="indexPattern-switcher"]`).first().prop('selectedOptions')
-    ).toEqual([mockOptions[0]]);
+    wrapper.find(`[data-test-subj="comboBoxInput"]`).first().simulate('click');
+    expect(checkOptionsAndSelections(wrapper, patternList.slice(0, 2))).toEqual({
+      // should hide signal index
+      availableOptionCount: title.split(',').length - 3,
+      optionsSelected: true,
+    });
   });
-  it('onChange calls updateSourcererScopeIndices', async () => {
+  it('Mounts with multiple options selected - timeline', () => {
+    const state2 = {
+      ...mockGlobalState,
+      sourcerer: {
+        ...mockGlobalState.sourcerer,
+        kibanaDataViews: [
+          state.sourcerer.defaultDataView,
+          {
+            ...state.sourcerer.defaultDataView,
+            id: '1234',
+            title: 'auditbeat-*',
+            patternList: ['auditbeat-*'],
+          },
+          {
+            ...state.sourcerer.defaultDataView,
+            id: '12347',
+            title: 'packetbeat-*',
+            patternList: ['packetbeat-*'],
+          },
+        ],
+        sourcererScopes: {
+          ...mockGlobalState.sourcerer.sourcererScopes,
+          [SourcererScopeName.timeline]: {
+            ...mockGlobalState.sourcerer.sourcererScopes[SourcererScopeName.timeline],
+            loading: false,
+            patternList,
+            selectedDataViewId: id,
+            selectedPatterns: patternList.slice(0, 2),
+          },
+        },
+      },
+    };
+
+    store = createStore(state2, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
     const wrapper = mount(
       <TestProviders store={store}>
-        <Sourcerer {...defaultProps} />
+        <Sourcerer scope={sourcererModel.SourcererScopeName.timeline} />
       </TestProviders>
     );
     wrapper.find(`[data-test-subj="sourcerer-trigger"]`).first().simulate('click');
-    expect(
-      wrapper.find(`[data-test-subj="sourcerer-popover"]`).first().prop('isOpen')
-    ).toBeTruthy();
-    await waitFor(() => {
-      (
-        wrapper.find(EuiComboBox).props() as unknown as {
-          onChange: (a: EuiComboBoxOptionOption[]) => void;
-        }
-      ).onChange([mockOptions[0], mockOptions[1]]);
-      wrapper.update();
+    wrapper.find(`[data-test-subj="comboBoxInput"]`).first().simulate('click');
+    expect(checkOptionsAndSelections(wrapper, patternList.slice(0, 2))).toEqual({
+      // should show every option except fakebeat-*
+      availableOptionCount: title.split(',').length - 2,
+      optionsSelected: true,
     });
-    wrapper.find(`[data-test-subj="add-index"]`).first().simulate('click');
-    expect(wrapper.find(`[data-test-subj="sourcerer-popover"]`).first().prop('isOpen')).toBeFalsy();
-
-    expect(mockDispatch).toHaveBeenCalledWith(
-      sourcererActions.setSelectedIndexPatterns({
-        id: SourcererScopeName.default,
-        selectedPatterns: [mockOptions[0].value, mockOptions[1].value],
-      })
-    );
   });
-  it('resets to config index patterns', async () => {
+  it('onSave dispatches setSelectedDataView', async () => {
     store = createStore(
       {
         ...state,
         sourcerer: {
           ...state.sourcerer,
-          kibanaIndexPatterns: [{ id: '1234', title: 'auditbeat-*' }],
-          configIndexPatterns: ['packetbeat-*'],
+          kibanaDataViews: [
+            state.sourcerer.defaultDataView,
+            {
+              ...state.sourcerer.defaultDataView,
+              id: '1234',
+              title: 'filebeat-*',
+              patternList: ['filebeat-*'],
+            },
+          ],
+          sourcererScopes: {
+            ...state.sourcerer.sourcererScopes,
+            [SourcererScopeName.default]: {
+              ...mockGlobalState.sourcerer.sourcererScopes[SourcererScopeName.default],
+              loading: false,
+              selectedDataViewId: id,
+              selectedPatterns: patternList.slice(0, 2),
+            },
+          },
         },
       },
       SUB_PLUGINS_REDUCER,
@@ -177,16 +349,60 @@ describe('Sourcerer component', () => {
       </TestProviders>
     );
     wrapper.find(`[data-test-subj="sourcerer-trigger"]`).first().simulate('click');
-    expect(wrapper.find(`[data-test-subj="config-option"]`).first().exists()).toBeFalsy();
+    wrapper.find(`[data-test-subj="comboBoxInput"]`).first().simulate('click');
+    expect(checkOptionsAndSelections(wrapper, patternList.slice(0, 2))).toEqual({
+      availableOptionCount: title.split(',').length - 3,
+      optionsSelected: true,
+    });
+
+    wrapper.find(`[data-test-subj="sourcerer-combo-option"]`).first().simulate('click');
+    expect(checkOptionsAndSelections(wrapper, patternList.slice(0, 3))).toEqual({
+      availableOptionCount: title.split(',').length - 4,
+      optionsSelected: true,
+    });
+    wrapper.find(`[data-test-subj="sourcerer-save"]`).first().simulate('click');
+    expect(wrapper.find(`[data-test-subj="sourcerer-popover"]`).first().prop('isOpen')).toBeFalsy();
+
+    expect(mockDispatch).toHaveBeenCalledWith(
+      sourcererActions.setSelectedDataView({
+        id: SourcererScopeName.default,
+        selectedDataViewId: id,
+        selectedPatterns: patternList.slice(0, 3),
+      })
+    );
+  });
+  it('resets to default index pattern', async () => {
+    const wrapper = mount(
+      <TestProviders store={store}>
+        <Sourcerer {...defaultProps} />
+      </TestProviders>
+    );
+    wrapper.find(`[data-test-subj="sourcerer-trigger"]`).first().simulate('click');
+    wrapper.find(`[data-test-subj="comboBoxInput"]`).first().simulate('click');
+
+    expect(checkOptionsAndSelections(wrapper, patternListNoSignals)).toEqual({
+      availableOptionCount: 1,
+      optionsSelected: true,
+    });
+
     wrapper
       .find(
-        `[data-test-subj="indexPattern-switcher"] [title="packetbeat-*"] button.euiBadge__iconButton`
+        `[data-test-subj="sourcerer-combo-box"] [title="${patternList[0]}"] button.euiBadge__iconButton`
       )
       .first()
       .simulate('click');
-    expect(wrapper.find(`[data-test-subj="config-option"]`).first().exists()).toBeTruthy();
+    expect(
+      checkOptionsAndSelections(wrapper, patternListNoSignals.slice(1, patternListNoSignals.length))
+    ).toEqual({
+      availableOptionCount: 2,
+      optionsSelected: true,
+    });
+
     wrapper.find(`[data-test-subj="sourcerer-reset"]`).first().simulate('click');
-    expect(wrapper.find(`[data-test-subj="config-option"]`).first().exists()).toBeFalsy();
+    expect(checkOptionsAndSelections(wrapper, patternListNoSignals)).toEqual({
+      availableOptionCount: 1,
+      optionsSelected: true,
+    });
   });
   it('disables saving when no index patterns are selected', () => {
     store = createStore(
@@ -194,7 +410,15 @@ describe('Sourcerer component', () => {
         ...state,
         sourcerer: {
           ...state.sourcerer,
-          kibanaIndexPatterns: [{ id: '1234', title: 'auditbeat-*' }],
+          kibanaDataViews: [
+            state.sourcerer.defaultDataView,
+            {
+              ...state.sourcerer.defaultDataView,
+              id: '1234',
+              title: 'auditbeat-*',
+              patternList: ['auditbeat-*'],
+            },
+          ],
         },
       },
       SUB_PLUGINS_REDUCER,
@@ -208,78 +432,152 @@ describe('Sourcerer component', () => {
     );
     wrapper.find('[data-test-subj="sourcerer-trigger"]').first().simulate('click');
     wrapper.find('[data-test-subj="comboBoxClearButton"]').first().simulate('click');
-    expect(wrapper.find('[data-test-subj="add-index"]').first().prop('disabled')).toBeTruthy();
+    expect(wrapper.find('[data-test-subj="sourcerer-save"]').first().prop('disabled')).toBeTruthy();
   });
-  it('returns index pattern options for kibanaIndexPatterns and configIndexPatterns', () => {
-    store = createStore(
-      {
-        ...state,
-        sourcerer: {
-          ...state.sourcerer,
-          kibanaIndexPatterns: [{ id: '1234', title: 'auditbeat-*' }],
-          configIndexPatterns: ['packetbeat-*'],
+  it('Selects a different index pattern', async () => {
+    const state2 = {
+      ...mockGlobalState,
+      sourcerer: {
+        ...mockGlobalState.sourcerer,
+        kibanaDataViews: [
+          state.sourcerer.defaultDataView,
+          {
+            ...state.sourcerer.defaultDataView,
+            id: '1234',
+            title: 'fakebeat-*,neatbeat-*',
+            patternList: ['fakebeat-*'],
+          },
+        ],
+        sourcererScopes: {
+          ...mockGlobalState.sourcerer.sourcererScopes,
+          [SourcererScopeName.default]: {
+            ...mockGlobalState.sourcerer.sourcererScopes[SourcererScopeName.default],
+            loading: false,
+            patternList,
+            selectedDataViewId: id,
+            selectedPatterns: patternList.slice(0, 2),
+          },
         },
       },
-      SUB_PLUGINS_REDUCER,
-      kibanaObservable,
-      storage
-    );
+    };
+
+    store = createStore(state2, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
     const wrapper = mount(
       <TestProviders store={store}>
         <Sourcerer {...defaultProps} />
       </TestProviders>
     );
     wrapper.find(`[data-test-subj="sourcerer-trigger"]`).first().simulate('click');
-    expect(wrapper.find(`[data-test-subj="config-option"]`).first().exists()).toBeFalsy();
-    wrapper
-      .find(
-        `[data-test-subj="indexPattern-switcher"] [title="auditbeat-*"] button.euiBadge__iconButton`
-      )
-      .first()
-      .simulate('click');
-    wrapper.update();
-    expect(wrapper.find(`[data-test-subj="kip-option"]`).first().text()).toEqual(' auditbeat-*');
-    wrapper
-      .find(
-        `[data-test-subj="indexPattern-switcher"] [title="packetbeat-*"] button.euiBadge__iconButton`
-      )
-      .first()
-      .simulate('click');
-    wrapper.update();
-    expect(wrapper.find(`[data-test-subj="config-option"]`).first().text()).toEqual('packetbeat-*');
+    wrapper.find(`button[data-test-subj="sourcerer-select"]`).first().simulate('click');
+
+    wrapper.find(`[data-test-subj="dataView-option-super"]`).first().simulate('click');
+    expect(checkOptionsAndSelections(wrapper, ['fakebeat-*'])).toEqual({
+      availableOptionCount: 0,
+      optionsSelected: true,
+    });
+    wrapper.find(`[data-test-subj="sourcerer-save"]`).first().simulate('click');
+
+    expect(mockDispatch).toHaveBeenCalledWith(
+      sourcererActions.setSelectedDataView({
+        id: SourcererScopeName.default,
+        selectedDataViewId: '1234',
+        selectedPatterns: ['fakebeat-*'],
+      })
+    );
   });
-  it('combines index pattern options for kibanaIndexPatterns and configIndexPatterns', () => {
-    store = createStore(
-      {
-        ...state,
-        sourcerer: {
-          ...state.sourcerer,
-          kibanaIndexPatterns: [
-            { id: '1234', title: 'auditbeat-*' },
-            { id: '5678', title: 'packetbeat-*' },
-          ],
-          configIndexPatterns: ['packetbeat-*'],
+  it('Does display signals index on timeline sourcerer', () => {
+    const state2 = {
+      ...mockGlobalState,
+      sourcerer: {
+        ...mockGlobalState.sourcerer,
+        kibanaDataViews: [
+          state.sourcerer.defaultDataView,
+          {
+            ...state.sourcerer.defaultDataView,
+            id: '1234',
+            title: 'auditbeat-*',
+            patternList: ['auditbeat-*'],
+          },
+          {
+            ...state.sourcerer.defaultDataView,
+            id: '12347',
+            title: 'packetbeat-*',
+            patternList: ['packetbeat-*'],
+          },
+        ],
+        sourcererScopes: {
+          ...mockGlobalState.sourcerer.sourcererScopes,
+          [SourcererScopeName.timeline]: {
+            ...mockGlobalState.sourcerer.sourcererScopes[SourcererScopeName.timeline],
+            loading: false,
+            patternList,
+            selectedDataViewId: id,
+            selectedPatterns: patternList.slice(0, 2),
+          },
         },
       },
-      SUB_PLUGINS_REDUCER,
-      kibanaObservable,
-      storage
+    };
+
+    store = createStore(state2, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
+    const wrapper = mount(
+      <TestProviders store={store}>
+        <Sourcerer scope={sourcererModel.SourcererScopeName.timeline} />
+      </TestProviders>
+    );
+    wrapper.find(`[data-test-subj="sourcerer-trigger"]`).first().simulate('click');
+    wrapper.find(`[data-test-subj="comboBoxToggleListButton"]`).first().simulate('click');
+    expect(wrapper.find(`[data-test-subj="sourcerer-combo-option"]`).at(6).text()).toEqual(
+      mockGlobalState.sourcerer.signalIndexName
     );
+  });
+  it('Does not display signals index on default sourcerer', () => {
+    const state2 = {
+      ...mockGlobalState,
+      sourcerer: {
+        ...mockGlobalState.sourcerer,
+        kibanaDataViews: [
+          state.sourcerer.defaultDataView,
+          {
+            ...state.sourcerer.defaultDataView,
+            id: '1234',
+            title: 'auditbeat-*',
+            patternList: ['auditbeat-*'],
+          },
+          {
+            ...state.sourcerer.defaultDataView,
+            id: '12347',
+            title: 'packetbeat-*',
+            patternList: ['packetbeat-*'],
+          },
+        ],
+        sourcererScopes: {
+          ...mockGlobalState.sourcerer.sourcererScopes,
+          [SourcererScopeName.default]: {
+            ...mockGlobalState.sourcerer.sourcererScopes[SourcererScopeName.default],
+            loading: false,
+            patternList,
+            selectedDataViewId: id,
+            selectedPatterns: patternList.slice(0, 2),
+          },
+        },
+      },
+    };
+
+    store = createStore(state2, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
     const wrapper = mount(
       <TestProviders store={store}>
         <Sourcerer {...defaultProps} />
       </TestProviders>
     );
     wrapper.find(`[data-test-subj="sourcerer-trigger"]`).first().simulate('click');
-    wrapper
-      .find(
-        `[data-test-subj="indexPattern-switcher"] [title="packetbeat-*"] button.euiBadge__iconButton`
-      )
-      .first()
-      .simulate('click');
-    wrapper.update();
+    wrapper.find(`[data-test-subj="comboBoxInput"]`).first().simulate('click');
     expect(
-      wrapper.find(`[title="packetbeat-*"] [data-test-subj="kip-option"]`).first().text()
-    ).toEqual(' packetbeat-*');
+      wrapper
+        .find(
+          `[data-test-subj="sourcerer-combo-box"] span[title="${mockGlobalState.sourcerer.signalIndexName}"]`
+        )
+        .first()
+        .exists()
+    ).toBeFalsy();
   });
 });
diff --git a/x-pack/plugins/security_solution/public/common/components/sourcerer/index.tsx b/x-pack/plugins/security_solution/public/common/components/sourcerer/index.tsx
index 3e922176f9982..6f32282c53040 100644
--- a/x-pack/plugins/security_solution/public/common/components/sourcerer/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/sourcerer/index.tsx
@@ -10,24 +10,26 @@ import {
   EuiButtonEmpty,
   EuiComboBox,
   EuiComboBoxOptionOption,
-  EuiIcon,
   EuiFlexGroup,
   EuiFlexItem,
+  EuiIcon,
   EuiPopover,
   EuiPopoverTitle,
   EuiSpacer,
+  EuiSuperSelect,
   EuiText,
   EuiToolTip,
 } from '@elastic/eui';
 import deepEqual from 'fast-deep-equal';
 import React, { useCallback, useEffect, useMemo, useState } from 'react';
-import { useDispatch, useSelector } from 'react-redux';
+import { useDispatch } from 'react-redux';
 import styled from 'styled-components';
 
 import * as i18n from './translations';
-import { sourcererActions, sourcererModel } from '../../store/sourcerer';
-import { State } from '../../store';
-import { getSourcererScopeSelector, SourcererScopeSelector } from './selectors';
+import { sourcererActions, sourcererModel, sourcererSelectors } from '../../store/sourcerer';
+import { getScopePatternListSelection } from '../../store/sourcerer/helpers';
+import { useDeepEqualSelector } from '../../hooks/use_selector';
+import { SourcererScopeName } from '../../store/sourcerer/model';
 
 const PopoverContent = styled.div`
   width: 600px;
@@ -40,30 +42,77 @@ interface SourcererComponentProps {
   scope: sourcererModel.SourcererScopeName;
 }
 
+const getPatternListWithoutSignals = (
+  patternList: string[],
+  signalIndexName: string | null
+): string[] => patternList.filter((p) => p !== signalIndexName);
+
 export const Sourcerer = React.memo<SourcererComponentProps>(({ scope: scopeId }) => {
   const dispatch = useDispatch();
-  const sourcererScopeSelector = useMemo(getSourcererScopeSelector, []);
-  const { configIndexPatterns, kibanaIndexPatterns, sourcererScope } = useSelector<
-    State,
-    SourcererScopeSelector
-  >((state) => sourcererScopeSelector(state, scopeId), deepEqual);
-  const { selectedPatterns, loading } = sourcererScope;
+  const sourcererScopeSelector = useMemo(() => sourcererSelectors.getSourcererScopeSelector(), []);
+  const {
+    defaultDataView,
+    kibanaDataViews,
+    signalIndexName,
+    sourcererScope: { selectedDataViewId, selectedPatterns, loading },
+  } = useDeepEqualSelector((state) => sourcererScopeSelector(state, scopeId));
+
   const [isPopoverOpen, setPopoverIsOpen] = useState(false);
+
+  const [dataViewId, setDataViewId] = useState<string>(selectedDataViewId ?? defaultDataView.id);
+
+  const { patternList, selectablePatterns } = useMemo(() => {
+    const theDataView = kibanaDataViews.find((dataView) => dataView.id === dataViewId);
+    return theDataView != null
+      ? scopeId === SourcererScopeName.default
+        ? {
+            patternList: getPatternListWithoutSignals(
+              theDataView.title
+                .split(',')
+                // remove duplicates patterns from selector
+                .filter((pattern, i, self) => self.indexOf(pattern) === i),
+              signalIndexName
+            ),
+            selectablePatterns: getPatternListWithoutSignals(
+              theDataView.patternList,
+              signalIndexName
+            ),
+          }
+        : {
+            patternList: theDataView.title
+              .split(',')
+              // remove duplicates patterns from selector
+              .filter((pattern, i, self) => self.indexOf(pattern) === i),
+            selectablePatterns: theDataView.patternList,
+          }
+      : { patternList: [], selectablePatterns: [] };
+  }, [kibanaDataViews, scopeId, signalIndexName, dataViewId]);
+
+  const selectableOptions = useMemo(
+    () =>
+      patternList.map((indexName) => ({
+        label: indexName,
+        value: indexName,
+        disabled: !selectablePatterns.includes(indexName),
+      })),
+    [selectablePatterns, patternList]
+  );
+
   const [selectedOptions, setSelectedOptions] = useState<Array<EuiComboBoxOptionOption<string>>>(
-    selectedPatterns.map((indexSelected) => ({
-      label: indexSelected,
-      value: indexSelected,
+    selectedPatterns.map((indexName) => ({
+      label: indexName,
+      value: indexName,
     }))
   );
   const isSavingDisabled = useMemo(() => selectedOptions.length === 0, [selectedOptions]);
 
   const setPopoverIsOpenCb = useCallback(() => setPopoverIsOpen((prevState) => !prevState), []);
-
-  const onChangeIndexPattern = useCallback(
-    (newSelectedPatterns: string[]) => {
+  const onChangeDataView = useCallback(
+    (newSelectedDataView: string, newSelectedPatterns: string[]) => {
       dispatch(
-        sourcererActions.setSelectedIndexPatterns({
+        sourcererActions.setSelectedDataView({
           id: scopeId,
+          selectedDataViewId: newSelectedDataView,
           selectedPatterns: newSelectedPatterns,
         })
       );
@@ -72,52 +121,55 @@ export const Sourcerer = React.memo<SourcererComponentProps>(({ scope: scopeId }
   );
 
   const renderOption = useCallback(
-    ({ value }) =>
-      kibanaIndexPatterns.some((kip) => kip.title === value) ? (
-        <span data-test-subj="kip-option">
-          <EuiIcon type="logoKibana" size="s" /> {value}
-        </span>
-      ) : (
-        <span data-test-subj="config-option">{value}</span>
-      ),
-    [kibanaIndexPatterns]
+    ({ value }) => <span data-test-subj="sourcerer-combo-option">{value}</span>,
+    []
   );
 
   const onChangeCombo = useCallback((newSelectedOptions) => {
     setSelectedOptions(newSelectedOptions);
   }, []);
 
+  const onChangeSuper = useCallback(
+    (newSelectedOption) => {
+      setDataViewId(newSelectedOption);
+      setSelectedOptions(
+        getScopePatternListSelection(
+          kibanaDataViews.find((dataView) => dataView.id === newSelectedOption),
+          scopeId,
+          signalIndexName,
+          newSelectedOption === defaultDataView.id
+        ).map((indexSelected: string) => ({
+          label: indexSelected,
+          value: indexSelected,
+        }))
+      );
+    },
+    [defaultDataView.id, kibanaDataViews, scopeId, signalIndexName]
+  );
+
   const resetDataSources = useCallback(() => {
+    setDataViewId(defaultDataView.id);
     setSelectedOptions(
-      configIndexPatterns.map((indexSelected) => ({
-        label: indexSelected,
-        value: indexSelected,
-      }))
+      getScopePatternListSelection(defaultDataView, scopeId, signalIndexName, true).map(
+        (indexSelected: string) => ({
+          label: indexSelected,
+          value: indexSelected,
+        })
+      )
     );
-  }, [configIndexPatterns]);
+  }, [defaultDataView, scopeId, signalIndexName]);
 
   const handleSaveIndices = useCallback(() => {
-    onChangeIndexPattern(selectedOptions.map((so) => so.label));
+    onChangeDataView(
+      dataViewId,
+      selectedOptions.map((so) => so.label)
+    );
     setPopoverIsOpen(false);
-  }, [onChangeIndexPattern, selectedOptions]);
+  }, [onChangeDataView, dataViewId, selectedOptions]);
 
   const handleClosePopOver = useCallback(() => {
     setPopoverIsOpen(false);
   }, []);
-
-  const indexesPatternOptions = useMemo(
-    () =>
-      [...configIndexPatterns, ...kibanaIndexPatterns.map((kip) => kip.title)].reduce<
-        Array<EuiComboBoxOptionOption<string>>
-      >((acc, index) => {
-        if (index != null && !acc.some((o) => o.label.includes(index))) {
-          return [...acc, { label: index, value: index }];
-        }
-        return acc;
-      }, []),
-    [configIndexPatterns, kibanaIndexPatterns]
-  );
-
   const trigger = useMemo(
     () => (
       <EuiButtonEmpty
@@ -136,37 +188,43 @@ export const Sourcerer = React.memo<SourcererComponentProps>(({ scope: scopeId }
     [setPopoverIsOpenCb, loading]
   );
 
-  const comboBox = useMemo(
-    () => (
-      <EuiComboBox
-        data-test-subj="indexPattern-switcher"
-        placeholder={i18n.PICK_INDEX_PATTERNS}
-        fullWidth
-        options={indexesPatternOptions}
-        selectedOptions={selectedOptions}
-        onChange={onChangeCombo}
-        renderOption={renderOption}
-      />
-    ),
-    [indexesPatternOptions, onChangeCombo, renderOption, selectedOptions]
+  const dataViewSelectOptions = useMemo(
+    () =>
+      kibanaDataViews.map(({ title, id }) => ({
+        inputDisplay:
+          id === defaultDataView.id ? (
+            <span data-test-subj="security-option-super">
+              <EuiIcon type="logoSecurity" size="s" /> {i18n.SIEM_DATA_VIEW_LABEL}
+            </span>
+          ) : (
+            <span data-test-subj="dataView-option-super">
+              <EuiIcon type="logoKibana" size="s" /> {title}
+            </span>
+          ),
+        value: id,
+      })),
+    [defaultDataView.id, kibanaDataViews]
   );
 
   useEffect(() => {
-    const newSelecteOptions = selectedPatterns.map((indexSelected) => ({
-      label: indexSelected,
-      value: indexSelected,
-    }));
-    setSelectedOptions((prevSelectedOptions) => {
-      if (!deepEqual(newSelecteOptions, prevSelectedOptions)) {
-        return newSelecteOptions;
-      }
-      return prevSelectedOptions;
-    });
+    setDataViewId((prevSelectedOption) =>
+      selectedDataViewId != null && !deepEqual(selectedDataViewId, prevSelectedOption)
+        ? selectedDataViewId
+        : prevSelectedOption
+    );
+  }, [selectedDataViewId]);
+  useEffect(() => {
+    setSelectedOptions(
+      selectedPatterns.map((indexName) => ({
+        label: indexName,
+        value: indexName,
+      }))
+    );
   }, [selectedPatterns]);
 
   const tooltipContent = useMemo(
-    () => (isPopoverOpen ? null : sourcererScope.selectedPatterns.sort().join(', ')),
-    [isPopoverOpen, sourcererScope.selectedPatterns]
+    () => (isPopoverOpen ? null : selectedPatterns.join(', ')),
+    [selectedPatterns, isPopoverOpen]
   );
 
   const buttonWithTooptip = useMemo(() => {
@@ -196,7 +254,24 @@ export const Sourcerer = React.memo<SourcererComponentProps>(({ scope: scopeId }
         <EuiSpacer size="s" />
         <EuiText color="default">{i18n.INDEX_PATTERNS_SELECTION_LABEL}</EuiText>
         <EuiSpacer size="xs" />
-        {comboBox}
+        <EuiSuperSelect
+          data-test-subj="sourcerer-select"
+          placeholder={i18n.PICK_INDEX_PATTERNS}
+          fullWidth
+          options={dataViewSelectOptions}
+          valueOfSelected={dataViewId}
+          onChange={onChangeSuper}
+        />
+        <EuiSpacer size="xs" />
+        <EuiComboBox
+          data-test-subj="sourcerer-combo-box"
+          fullWidth
+          onChange={onChangeCombo}
+          options={selectableOptions}
+          placeholder={i18n.PICK_INDEX_PATTERNS}
+          renderOption={renderOption}
+          selectedOptions={selectedOptions}
+        />
         <EuiSpacer size="s" />
         <EuiFlexGroup alignItems="center" justifyContent="spaceBetween">
           <EuiFlexItem>
@@ -214,7 +289,7 @@ export const Sourcerer = React.memo<SourcererComponentProps>(({ scope: scopeId }
             <EuiButton
               onClick={handleSaveIndices}
               disabled={isSavingDisabled}
-              data-test-subj="add-index"
+              data-test-subj="sourcerer-save"
               fill
               fullWidth
               size="s"
diff --git a/x-pack/plugins/security_solution/public/common/components/sourcerer/selectors.tsx b/x-pack/plugins/security_solution/public/common/components/sourcerer/selectors.tsx
deleted file mode 100644
index 13cf6fff4a5c8..0000000000000
--- a/x-pack/plugins/security_solution/public/common/components/sourcerer/selectors.tsx
+++ /dev/null
@@ -1,36 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { State } from '../../store';
-import { sourcererSelectors } from '../../store/sourcerer';
-import { KibanaIndexPatterns, ManageScope, SourcererScopeName } from '../../store/sourcerer/model';
-
-export interface SourcererScopeSelector {
-  configIndexPatterns: string[];
-  kibanaIndexPatterns: KibanaIndexPatterns;
-  sourcererScope: ManageScope;
-}
-
-export const getSourcererScopeSelector = () => {
-  const getKibanaIndexPatternsSelector = sourcererSelectors.kibanaIndexPatternsSelector();
-  const getScopesSelector = sourcererSelectors.scopesSelector();
-  const getConfigIndexPatternsSelector = sourcererSelectors.configIndexPatternsSelector();
-
-  const mapStateToProps = (state: State, scopeId: SourcererScopeName): SourcererScopeSelector => {
-    const kibanaIndexPatterns = getKibanaIndexPatternsSelector(state);
-    const scope = getScopesSelector(state)[scopeId];
-    const configIndexPatterns = getConfigIndexPatternsSelector(state);
-
-    return {
-      kibanaIndexPatterns,
-      configIndexPatterns,
-      sourcererScope: scope,
-    };
-  };
-
-  return mapStateToProps;
-};
diff --git a/x-pack/plugins/security_solution/public/common/components/sourcerer/translations.ts b/x-pack/plugins/security_solution/public/common/components/sourcerer/translations.ts
index 45299afad99d1..03fdc5d191719 100644
--- a/x-pack/plugins/security_solution/public/common/components/sourcerer/translations.ts
+++ b/x-pack/plugins/security_solution/public/common/components/sourcerer/translations.ts
@@ -11,9 +11,12 @@ export const SOURCERER = i18n.translate('xpack.securitySolution.indexPatterns.da
   defaultMessage: 'Data sources',
 });
 
-export const ALL_DEFAULT = i18n.translate('xpack.securitySolution.indexPatterns.allDefault', {
-  defaultMessage: 'All default',
-});
+export const SIEM_DATA_VIEW_LABEL = i18n.translate(
+  'xpack.securitySolution.indexPatterns.kipLabel',
+  {
+    defaultMessage: 'Default Security Data View',
+  }
+);
 
 export const SELECT_INDEX_PATTERNS = i18n.translate('xpack.securitySolution.indexPatterns.help', {
   defaultMessage: 'Data sources selection',
diff --git a/x-pack/plugins/security_solution/public/common/components/threat_match/entry_item.test.tsx b/x-pack/plugins/security_solution/public/common/components/threat_match/entry_item.test.tsx
index 4b153f0c75775..0550ef389585e 100644
--- a/x-pack/plugins/security_solution/public/common/components/threat_match/entry_item.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/threat_match/entry_item.test.tsx
@@ -11,7 +11,7 @@ import { EuiComboBox, EuiComboBoxOptionOption } from '@elastic/eui';
 
 import { EntryItem } from './entry_item';
 import { fields, getField } from '../../../../../../../src/plugins/data/common/mocks';
-import { IndexPattern } from 'src/plugins/data/public';
+import { DataViewBase } from '@kbn/es-query';
 
 jest.mock('../../../common/lib/kibana');
 
@@ -31,7 +31,7 @@ describe('EntryItem', () => {
             id: '1234',
             title: 'logstash-*',
             fields,
-          } as IndexPattern
+          } as DataViewBase
         }
         showLabel={true}
         onChange={jest.fn()}
@@ -40,7 +40,7 @@ describe('EntryItem', () => {
             id: '1234',
             title: 'logstash-*',
             fields,
-          } as IndexPattern
+          } as DataViewBase
         }
       />
     );
@@ -64,14 +64,14 @@ describe('EntryItem', () => {
             id: '1234',
             title: 'logstash-*',
             fields,
-          } as IndexPattern
+          } as DataViewBase
         }
         threatIndexPatterns={
           {
             id: '1234',
             title: 'logstash-*',
             fields,
-          } as IndexPattern
+          } as DataViewBase
         }
         showLabel={false}
         onChange={mockOnChange}
@@ -111,14 +111,14 @@ describe('EntryItem', () => {
             id: '1234',
             title: 'logstash-*',
             fields,
-          } as IndexPattern
+          } as DataViewBase
         }
         threatIndexPatterns={
           {
             id: '1234',
             title: 'logstash-*',
             fields,
-          } as IndexPattern
+          } as DataViewBase
         }
         showLabel={false}
         onChange={mockOnChange}
diff --git a/x-pack/plugins/security_solution/public/common/components/threat_match/entry_item.tsx b/x-pack/plugins/security_solution/public/common/components/threat_match/entry_item.tsx
index 99c5b37046505..777ef2069ff4f 100644
--- a/x-pack/plugins/security_solution/public/common/components/threat_match/entry_item.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/threat_match/entry_item.tsx
@@ -10,16 +10,15 @@ import { EuiFormRow, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 import styled from 'styled-components';
 
 import { FieldComponent } from '@kbn/securitysolution-autocomplete';
-import { IndexPatternFieldBase } from '@kbn/es-query';
-import { IndexPattern } from '../../../../../../../src/plugins/data/common';
+import { DataViewBase, DataViewFieldBase } from '@kbn/es-query';
 import { FormattedEntry, Entry } from './types';
 import * as i18n from './translations';
 import { getEntryOnFieldChange, getEntryOnThreatFieldChange } from './helpers';
 
 interface EntryItemProps {
   entry: FormattedEntry;
-  indexPattern: IndexPattern;
-  threatIndexPatterns: IndexPattern;
+  indexPattern: DataViewBase;
+  threatIndexPatterns: DataViewBase;
   showLabel: boolean;
   onChange: (arg: Entry, i: number) => void;
 }
@@ -41,7 +40,7 @@ export const EntryItem: React.FC<EntryItemProps> = ({
   onChange,
 }): JSX.Element => {
   const handleFieldChange = useCallback(
-    ([newField]: IndexPatternFieldBase[]): void => {
+    ([newField]: DataViewFieldBase[]): void => {
       const { updatedEntry, index } = getEntryOnFieldChange(entry, newField);
       onChange(updatedEntry, index);
     },
@@ -49,7 +48,7 @@ export const EntryItem: React.FC<EntryItemProps> = ({
   );
 
   const handleThreatFieldChange = useCallback(
-    ([newField]: IndexPatternFieldBase[]): void => {
+    ([newField]: DataViewFieldBase[]): void => {
       const { updatedEntry, index } = getEntryOnThreatFieldChange(entry, newField);
       onChange(updatedEntry, index);
     },
diff --git a/x-pack/plugins/security_solution/public/common/components/threat_match/helpers.test.tsx b/x-pack/plugins/security_solution/public/common/components/threat_match/helpers.test.tsx
index 0e5f379a18767..9a5051fe0cafb 100644
--- a/x-pack/plugins/security_solution/public/common/components/threat_match/helpers.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/threat_match/helpers.test.tsx
@@ -7,7 +7,8 @@
 
 import { fields, getField } from '../../../../../../../src/plugins/data/common/mocks';
 import { Entry, EmptyEntry, ThreatMapEntries, FormattedEntry } from './types';
-import { FieldSpec, IndexPattern } from '../../../../../../../src/plugins/data/common';
+import { FieldSpec } from '../../../../../../../src/plugins/data/common';
+import { DataViewBase } from '@kbn/es-query';
 import moment from 'moment-timezone';
 
 import {
@@ -24,12 +25,12 @@ jest.mock('uuid', () => ({
   v4: jest.fn().mockReturnValue('123'),
 }));
 
-const getMockIndexPattern = (): IndexPattern =>
+const getMockIndexPattern = (): DataViewBase =>
   ({
     id: '1234',
     title: 'logstash-*',
     fields,
-  } as IndexPattern);
+  } as DataViewBase);
 
 const getMockEntry = (): FormattedEntry => ({
   id: '123',
@@ -51,7 +52,7 @@ describe('Helpers', () => {
 
   describe('#getFormattedEntry', () => {
     test('it returns entry with a value when "item.field" is of type "text" and matching keyword field exists', () => {
-      const payloadIndexPattern: IndexPattern = {
+      const payloadIndexPattern: DataViewBase = {
         ...getMockIndexPattern(),
         fields: [
           ...fields,
@@ -66,7 +67,7 @@ describe('Helpers', () => {
             readFromDocValues: true,
           },
         ],
-      } as IndexPattern;
+      } as DataViewBase;
       const payloadItem: Entry = {
         field: 'machine.os.raw.text',
         type: 'mapping',
@@ -171,7 +172,7 @@ describe('Helpers', () => {
     });
 
     test('it returns formatted entries', () => {
-      const payloadIndexPattern: IndexPattern = getMockIndexPattern();
+      const payloadIndexPattern: DataViewBase = getMockIndexPattern();
       const payloadItems: Entry[] = [
         { field: 'machine.os', type: 'mapping', value: 'machine.os' },
         { field: 'ip', type: 'mapping', value: 'ip' },
diff --git a/x-pack/plugins/security_solution/public/common/components/threat_match/helpers.tsx b/x-pack/plugins/security_solution/public/common/components/threat_match/helpers.tsx
index 3f8e5b1602db8..7b0385ab6902f 100644
--- a/x-pack/plugins/security_solution/public/common/components/threat_match/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/threat_match/helpers.tsx
@@ -10,8 +10,7 @@ import { i18n } from '@kbn/i18n';
 import { addIdToItem } from '@kbn/securitysolution-utils';
 import { ThreatMap, threatMap, ThreatMapping } from '@kbn/securitysolution-io-ts-alerting-types';
 
-import { IndexPatternFieldBase } from '@kbn/es-query';
-import { IndexPattern } from '../../../../../../../src/plugins/data/common';
+import { DataViewBase, DataViewFieldBase } from '@kbn/es-query';
 import { Entry, FormattedEntry, ThreatMapEntries, EmptyEntry } from './types';
 import { ValidationFunc } from '../../../../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib';
 import { ERROR_CODE } from '../../../../../../../src/plugins/es_ui_shared/static/forms/helpers/field_validators/types';
@@ -19,13 +18,13 @@ import { ERROR_CODE } from '../../../../../../../src/plugins/es_ui_shared/static
 /**
  * Formats the entry into one that is easily usable for the UI.
  *
- * @param patterns IndexPattern containing available fields on rule index
+ * @param patterns DataViewBase containing available fields on rule index
  * @param item item entry
  * @param itemIndex entry index
  */
 export const getFormattedEntry = (
-  indexPattern: IndexPattern,
-  threatIndexPatterns: IndexPattern,
+  indexPattern: DataViewBase,
+  threatIndexPatterns: DataViewBase,
   item: Entry,
   itemIndex: number,
   uuidGen: () => string = uuid.v4
@@ -51,12 +50,12 @@ export const getFormattedEntry = (
 /**
  * Formats the entries to be easily usable for the UI
  *
- * @param patterns IndexPattern containing available fields on rule index
+ * @param patterns DataViewBase containing available fields on rule index
  * @param entries item entries
  */
 export const getFormattedEntries = (
-  indexPattern: IndexPattern,
-  threatIndexPatterns: IndexPattern,
+  indexPattern: DataViewBase,
+  threatIndexPatterns: DataViewBase,
   entries: Entry[]
 ): FormattedEntry[] => {
   return entries.reduce<FormattedEntry[]>((acc, item, index) => {
@@ -91,7 +90,7 @@ export const getUpdatedEntriesOnDelete = (
  */
 export const getEntryOnFieldChange = (
   item: FormattedEntry,
-  newField: IndexPatternFieldBase
+  newField: DataViewFieldBase
 ): { updatedEntry: Entry; index: number } => {
   const { entryIndex } = item;
   return {
@@ -114,7 +113,7 @@ export const getEntryOnFieldChange = (
  */
 export const getEntryOnThreatFieldChange = (
   item: FormattedEntry,
-  newField: IndexPatternFieldBase
+  newField: DataViewFieldBase
 ): { updatedEntry: Entry; index: number } => {
   const { entryIndex } = item;
   return {
diff --git a/x-pack/plugins/security_solution/public/common/components/threat_match/index.test.tsx b/x-pack/plugins/security_solution/public/common/components/threat_match/index.test.tsx
index 872f78d91eebb..e26c889b7e94a 100644
--- a/x-pack/plugins/security_solution/public/common/components/threat_match/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/threat_match/index.test.tsx
@@ -16,7 +16,7 @@ import { useKibana } from '../../../common/lib/kibana';
 
 import { ThreatMatchComponent } from './';
 import { ThreatMapEntries } from './types';
-import { IndexPattern } from 'src/plugins/data/public';
+import { DataViewBase } from '@kbn/es-query';
 import { getMockTheme } from '../../lib/kibana/kibana_react.mock';
 
 const mockTheme = getMockTheme({
@@ -65,14 +65,14 @@ describe('ThreatMatchComponent', () => {
               id: '1234',
               title: 'logstash-*',
               fields,
-            } as IndexPattern
+            } as DataViewBase
           }
           threatIndexPatterns={
             {
               id: '1234',
               title: 'logstash-*',
               fields,
-            } as IndexPattern
+            } as DataViewBase
           }
           onChange={jest.fn()}
         />
@@ -94,14 +94,14 @@ describe('ThreatMatchComponent', () => {
               id: '1234',
               title: 'logstash-*',
               fields,
-            } as IndexPattern
+            } as DataViewBase
           }
           threatIndexPatterns={
             {
               id: '1234',
               title: 'logstash-*',
               fields,
-            } as IndexPattern
+            } as DataViewBase
           }
           onChange={jest.fn()}
         />
@@ -123,14 +123,14 @@ describe('ThreatMatchComponent', () => {
               id: '1234',
               title: 'logstash-*',
               fields,
-            } as IndexPattern
+            } as DataViewBase
           }
           threatIndexPatterns={
             {
               id: '1234',
               title: 'logstash-*',
               fields,
-            } as IndexPattern
+            } as DataViewBase
           }
           onChange={jest.fn()}
         />
@@ -151,14 +151,14 @@ describe('ThreatMatchComponent', () => {
               id: '1234',
               title: 'logstash-*',
               fields,
-            } as IndexPattern
+            } as DataViewBase
           }
           threatIndexPatterns={
             {
               id: '1234',
               title: 'logstash-*',
               fields,
-            } as IndexPattern
+            } as DataViewBase
           }
           onChange={jest.fn()}
         />
@@ -188,14 +188,14 @@ describe('ThreatMatchComponent', () => {
               id: '1234',
               title: 'logstash-*',
               fields,
-            } as IndexPattern
+            } as DataViewBase
           }
           threatIndexPatterns={
             {
               id: '1234',
               title: 'logstash-*',
               fields,
-            } as IndexPattern
+            } as DataViewBase
           }
           onChange={jest.fn()}
         />
@@ -225,14 +225,14 @@ describe('ThreatMatchComponent', () => {
               id: '1234',
               title: 'logstash-*',
               fields,
-            } as IndexPattern
+            } as DataViewBase
           }
           threatIndexPatterns={
             {
               id: '1234',
               title: 'logstash-*',
               fields,
-            } as IndexPattern
+            } as DataViewBase
           }
           onChange={jest.fn()}
         />
@@ -255,14 +255,14 @@ describe('ThreatMatchComponent', () => {
               id: '1234',
               title: 'logstash-*',
               fields,
-            } as IndexPattern
+            } as DataViewBase
           }
           threatIndexPatterns={
             {
               id: '1234',
               title: 'logstash-*',
               fields,
-            } as IndexPattern
+            } as DataViewBase
           }
           onChange={jest.fn()}
         />
@@ -286,14 +286,14 @@ describe('ThreatMatchComponent', () => {
               id: '1234',
               title: 'logstash-*',
               fields,
-            } as IndexPattern
+            } as DataViewBase
           }
           threatIndexPatterns={
             {
               id: '1234',
               title: 'logstash-*',
               fields,
-            } as IndexPattern
+            } as DataViewBase
           }
           onChange={jest.fn()}
         />
diff --git a/x-pack/plugins/security_solution/public/common/components/threat_match/index.tsx b/x-pack/plugins/security_solution/public/common/components/threat_match/index.tsx
index 3e4f0283145e4..5ea17939ed780 100644
--- a/x-pack/plugins/security_solution/public/common/components/threat_match/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/threat_match/index.tsx
@@ -8,10 +8,9 @@
 import React, { useCallback, useEffect, useReducer } from 'react';
 import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 import styled from 'styled-components';
-
+import { DataViewBase } from '@kbn/es-query';
 import { ThreatMapping } from '@kbn/securitysolution-io-ts-alerting-types';
 import { ListItemComponent } from './list_item';
-import { IndexPattern } from '../../../../../../../src/plugins/data/common';
 import { AndOrBadge } from '../and_or_badge';
 import { LogicButtons } from './logic_buttons';
 import { ThreatMapEntries } from './types';
@@ -45,8 +44,8 @@ interface OnChangeProps {
 
 interface ThreatMatchComponentProps {
   listItems: ThreatMapEntries[];
-  indexPatterns: IndexPattern;
-  threatIndexPatterns: IndexPattern;
+  indexPatterns: DataViewBase;
+  threatIndexPatterns: DataViewBase;
   onChange: (arg: OnChangeProps) => void;
 }
 
diff --git a/x-pack/plugins/security_solution/public/common/components/threat_match/list_item.test.tsx b/x-pack/plugins/security_solution/public/common/components/threat_match/list_item.test.tsx
index d6704b3a9cf17..e2325ace26591 100644
--- a/x-pack/plugins/security_solution/public/common/components/threat_match/list_item.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/threat_match/list_item.test.tsx
@@ -14,7 +14,7 @@ import { fields } from '../../../../../../../src/plugins/data/common/mocks';
 
 import { ListItemComponent } from './list_item';
 import { ThreatMapEntries } from './types';
-import { IndexPattern } from 'src/plugins/data/public';
+import { DataViewBase } from '@kbn/es-query';
 import { getMockTheme } from '../../lib/kibana/kibana_react.mock';
 
 const mockTheme = getMockTheme({
@@ -81,14 +81,14 @@ describe('ListItemComponent', () => {
                 id: '1234',
                 title: 'logstash-*',
                 fields,
-              } as IndexPattern
+              } as DataViewBase
             }
             threatIndexPatterns={
               {
                 id: '1234',
                 title: 'logstash-*',
                 fields,
-              } as IndexPattern
+              } as DataViewBase
             }
             andLogicIncluded={true}
             isOnlyItem={false}
@@ -114,7 +114,7 @@ describe('ListItemComponent', () => {
                 id: '1234',
                 title: 'logstash-*',
                 fields,
-              } as IndexPattern
+              } as DataViewBase
             }
             andLogicIncluded={true}
             isOnlyItem={false}
@@ -125,7 +125,7 @@ describe('ListItemComponent', () => {
                 id: '1234',
                 title: 'logstash-*',
                 fields,
-              } as IndexPattern
+              } as DataViewBase
             }
           />
         </ThemeProvider>
@@ -145,14 +145,14 @@ describe('ListItemComponent', () => {
                 id: '1234',
                 title: 'logstash-*',
                 fields,
-              } as IndexPattern
+              } as DataViewBase
             }
             threatIndexPatterns={
               {
                 id: '1234',
                 title: 'logstash-*',
                 fields,
-              } as IndexPattern
+              } as DataViewBase
             }
             andLogicIncluded={true}
             isOnlyItem={false}
@@ -178,14 +178,14 @@ describe('ListItemComponent', () => {
                 id: '1234',
                 title: 'logstash-*',
                 fields,
-              } as IndexPattern
+              } as DataViewBase
             }
             threatIndexPatterns={
               {
                 id: '1234',
                 title: 'logstash-*',
                 fields,
-              } as IndexPattern
+              } as DataViewBase
             }
             andLogicIncluded={false}
             isOnlyItem={false}
@@ -219,14 +219,14 @@ describe('ListItemComponent', () => {
               id: '1234',
               title: 'logstash-*',
               fields,
-            } as IndexPattern
+            } as DataViewBase
           }
           threatIndexPatterns={
             {
               id: '1234',
               title: 'logstash-*',
               fields,
-            } as IndexPattern
+            } as DataViewBase
           }
           andLogicIncluded={false}
           isOnlyItem={true}
@@ -250,14 +250,14 @@ describe('ListItemComponent', () => {
               id: '1234',
               title: 'logstash-*',
               fields,
-            } as IndexPattern
+            } as DataViewBase
           }
           threatIndexPatterns={
             {
               id: '1234',
               title: 'logstash-*',
               fields,
-            } as IndexPattern
+            } as DataViewBase
           }
           andLogicIncluded={false}
           isOnlyItem={false}
@@ -281,14 +281,14 @@ describe('ListItemComponent', () => {
               id: '1234',
               title: 'logstash-*',
               fields,
-            } as IndexPattern
+            } as DataViewBase
           }
           threatIndexPatterns={
             {
               id: '1234',
               title: 'logstash-*',
               fields,
-            } as IndexPattern
+            } as DataViewBase
           }
           andLogicIncluded={false}
           // if entryItemIndex is not 0, wouldn't make sense for
@@ -314,14 +314,14 @@ describe('ListItemComponent', () => {
               id: '1234',
               title: 'logstash-*',
               fields,
-            } as IndexPattern
+            } as DataViewBase
           }
           threatIndexPatterns={
             {
               id: '1234',
               title: 'logstash-*',
               fields,
-            } as IndexPattern
+            } as DataViewBase
           }
           andLogicIncluded={false}
           isOnlyItem={true}
@@ -346,14 +346,14 @@ describe('ListItemComponent', () => {
               id: '1234',
               title: 'logstash-*',
               fields,
-            } as IndexPattern
+            } as DataViewBase
           }
           threatIndexPatterns={
             {
               id: '1234',
               title: 'logstash-*',
               fields,
-            } as IndexPattern
+            } as DataViewBase
           }
           andLogicIncluded={false}
           isOnlyItem={true}
diff --git a/x-pack/plugins/security_solution/public/common/components/threat_match/list_item.tsx b/x-pack/plugins/security_solution/public/common/components/threat_match/list_item.tsx
index eda12ce3b0f5a..e01c28ecb54eb 100644
--- a/x-pack/plugins/security_solution/public/common/components/threat_match/list_item.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/threat_match/list_item.tsx
@@ -9,7 +9,7 @@ import React, { useMemo, useCallback } from 'react';
 import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 import styled from 'styled-components';
 
-import { IndexPattern } from '../../../../../../../src/plugins/data/common';
+import { DataViewBase } from '@kbn/es-query';
 import { getFormattedEntries, getUpdatedEntriesOnDelete } from './helpers';
 import { FormattedEntry, ThreatMapEntries, Entry } from './types';
 import { EntryItem } from './entry_item';
@@ -24,8 +24,8 @@ const MyOverflowContainer = styled(EuiFlexItem)`
 interface ListItemProps {
   listItem: ThreatMapEntries;
   listItemIndex: number;
-  indexPattern: IndexPattern;
-  threatIndexPatterns: IndexPattern;
+  indexPattern: DataViewBase;
+  threatIndexPatterns: DataViewBase;
   andLogicIncluded: boolean;
   isOnlyItem: boolean;
   onDeleteEntryItem: (item: ThreatMapEntries, index: number) => void;
diff --git a/x-pack/plugins/security_solution/public/common/components/threat_match/types.ts b/x-pack/plugins/security_solution/public/common/components/threat_match/types.ts
index 3d3a18b425e01..852e68aa259c8 100644
--- a/x-pack/plugins/security_solution/public/common/components/threat_match/types.ts
+++ b/x-pack/plugins/security_solution/public/common/components/threat_match/types.ts
@@ -5,14 +5,14 @@
  * 2.0.
  */
 
-import { IndexPatternFieldBase } from '@kbn/es-query';
+import { DataViewFieldBase } from '@kbn/es-query';
 import { ThreatMap, ThreatMapEntry } from '@kbn/securitysolution-io-ts-alerting-types';
 
 export interface FormattedEntry {
   id: string;
-  field: IndexPatternFieldBase | undefined;
+  field: DataViewFieldBase | undefined;
   type: 'mapping';
-  value: IndexPatternFieldBase | undefined;
+  value: DataViewFieldBase | undefined;
   entryIndex: number;
 }
 
diff --git a/x-pack/plugins/security_solution/public/common/components/top_n/index.tsx b/x-pack/plugins/security_solution/public/common/components/top_n/index.tsx
index 1eef44d587ed0..ac9acb62c5834 100644
--- a/x-pack/plugins/security_solution/public/common/components/top_n/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/top_n/index.tsx
@@ -8,15 +8,11 @@
 import React, { useMemo } from 'react';
 import { connect, ConnectedProps } from 'react-redux';
 
+import { DataViewBase, Filter, Query } from '@kbn/es-query';
 import { useGlobalTime } from '../../containers/use_global_time';
 import { BrowserFields } from '../../containers/source';
 import { useKibana } from '../../lib/kibana';
-import {
-  esQuery,
-  Filter,
-  Query,
-  IIndexPattern,
-} from '../../../../../../../src/plugins/data/public';
+import { esQuery } from '../../../../../../../src/plugins/data/public';
 import { inputsModel, inputsSelectors, State } from '../../store';
 import { timelineDefaults } from '../../../timelines/store/timeline/defaults';
 import { timelineSelectors } from '../../../timelines/store/timeline';
@@ -77,7 +73,7 @@ const connector = connect(makeMapStateToProps);
 export interface OwnProps {
   browserFields: BrowserFields;
   field: string;
-  indexPattern: IIndexPattern;
+  indexPattern: DataViewBase;
   timelineId?: string;
   toggleTopN: () => void;
   onFilterAdded?: () => void;
diff --git a/x-pack/plugins/security_solution/public/common/components/top_n/selectors.tsx b/x-pack/plugins/security_solution/public/common/components/top_n/selectors.tsx
index f13a85da6baed..de3472b7c455f 100644
--- a/x-pack/plugins/security_solution/public/common/components/top_n/selectors.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/top_n/selectors.tsx
@@ -7,6 +7,7 @@
 
 import { State } from '../../store';
 import { sourcererSelectors } from '../../store/selectors';
+import { SourcererScopeName } from '../../store/sourcerer/model';
 
 export interface IndicesSelector {
   all: string[];
@@ -14,25 +15,17 @@ export interface IndicesSelector {
 }
 
 export const getIndicesSelector = () => {
-  const getkibanaIndexPatternsSelector = sourcererSelectors.kibanaIndexPatternsSelector();
-  const getConfigIndexPatternsSelector = sourcererSelectors.configIndexPatternsSelector();
   const getSignalIndexNameSelector = sourcererSelectors.signalIndexNameSelector();
+  const getScopeSelector = sourcererSelectors.scopeIdSelector();
 
-  const mapStateToProps = (state: State): IndicesSelector => {
-    const rawIndices = new Set(getConfigIndexPatternsSelector(state));
-    const kibanaIndexPatterns = getkibanaIndexPatternsSelector(state);
-    const alertIndexName = getSignalIndexNameSelector(state);
-    kibanaIndexPatterns.forEach(({ title }) => {
-      if (title !== alertIndexName) {
-        rawIndices.add(title);
-      }
-    });
+  return (state: State, scopeId: SourcererScopeName): IndicesSelector => {
+    const signalIndexName = getSignalIndexNameSelector(state);
+    const { selectedPatterns } = getScopeSelector(state, scopeId);
+    const raw: string[] = selectedPatterns.filter((index) => index !== signalIndexName);
 
     return {
-      all: alertIndexName != null ? [...rawIndices, alertIndexName] : [...rawIndices],
-      raw: [...rawIndices],
+      all: signalIndexName != null ? [...raw, signalIndexName] : [...raw],
+      raw,
     };
   };
-
-  return mapStateToProps;
 };
diff --git a/x-pack/plugins/security_solution/public/common/components/top_n/top_n.tsx b/x-pack/plugins/security_solution/public/common/components/top_n/top_n.tsx
index f40ee8670171c..9c99189e1b79e 100644
--- a/x-pack/plugins/security_solution/public/common/components/top_n/top_n.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/top_n/top_n.tsx
@@ -11,10 +11,10 @@ import React, { useCallback, useEffect, useMemo, useState } from 'react';
 import { useSelector } from 'react-redux';
 import styled from 'styled-components';
 
+import { DataViewBase, Filter, Query } from '@kbn/es-query';
 import { GlobalTimeArgs } from '../../containers/use_global_time';
 import { EventsByDataset } from '../../../overview/components/events_by_dataset';
 import { SignalsByCategory } from '../../../overview/components/signals_by_category';
-import { Filter, IIndexPattern, Query } from '../../../../../../../src/plugins/data/public';
 import { InputsModelId } from '../../store/inputs/constants';
 import { TimelineEventsType } from '../../../../common/types/timeline';
 
@@ -23,6 +23,7 @@ import * as i18n from './translations';
 import { getIndicesSelector, IndicesSelector } from './selectors';
 import { State } from '../../store';
 import { AlertsStackByField } from '../../../detections/components/alerts_kpis/common/types';
+import { SourcererScopeName } from '../../store/sourcerer/model';
 
 const TopNContainer = styled.div`
   min-width: 600px;
@@ -53,7 +54,7 @@ export interface Props extends Pick<GlobalTimeArgs, 'from' | 'to' | 'deleteQuery
   defaultView: TimelineEventsType;
   field: AlertsStackByField;
   filters: Filter[];
-  indexPattern: IIndexPattern;
+  indexPattern: DataViewBase;
   options: TopNOption[];
   paddingSize?: 's' | 'm' | 'l' | 'none';
   query: Query;
@@ -90,7 +91,15 @@ const TopNComponent: React.FC<Props> = ({
   );
   const indicesSelector = useMemo(getIndicesSelector, []);
   const { all: allIndices, raw: rawIndices } = useSelector<State, IndicesSelector>(
-    (state) => indicesSelector(state),
+    (state) =>
+      indicesSelector(
+        state,
+        timelineId != null
+          ? defaultView === 'alert'
+            ? SourcererScopeName.detections
+            : SourcererScopeName.timeline
+          : SourcererScopeName.default
+      ),
     deepEqual
   );
 
diff --git a/x-pack/plugins/security_solution/public/common/components/url_state/helpers.ts b/x-pack/plugins/security_solution/public/common/components/url_state/helpers.ts
index 5b6bb0400ccdf..1ff98528a20b8 100644
--- a/x-pack/plugins/security_solution/public/common/components/url_state/helpers.ts
+++ b/x-pack/plugins/security_solution/public/common/components/url_state/helpers.ts
@@ -24,7 +24,7 @@ import { NavTab } from '../navigation/types';
 import { CONSTANTS, UrlStateType } from './constants';
 import { ReplaceStateInLocation, KeyUrlState, ValueUrlState } from './types';
 import { sourcererSelectors } from '../../store/sourcerer';
-import { SourcererScopeName, SourcererScopePatterns } from '../../store/sourcerer/model';
+import { SourcererScopeName, SourcererUrlState } from '../../store/sourcerer/model';
 
 export const isDetectionsPages = (pageName: string) =>
   pageName === SecurityPageName.alerts ||
@@ -156,9 +156,18 @@ export const makeMapStateToProps = () => {
     }
     const sourcerer = getSourcererScopes(state);
     const activeScopes: SourcererScopeName[] = Object.keys(sourcerer) as SourcererScopeName[];
-    const selectedPatterns: SourcererScopePatterns = activeScopes
+    const selectedPatterns: SourcererUrlState = activeScopes
       .filter((scope) => scope === SourcererScopeName.default)
-      .reduce((acc, scope) => ({ ...acc, [scope]: sourcerer[scope]?.selectedPatterns }), {});
+      .reduce(
+        (acc, scope) => ({
+          ...acc,
+          [scope]: {
+            id: sourcerer[scope]?.selectedDataViewId,
+            selectedPatterns: sourcerer[scope]?.selectedPatterns,
+          },
+        }),
+        {}
+      );
 
     return {
       urlState: {
diff --git a/x-pack/plugins/security_solution/public/common/components/url_state/initialize_redux_by_url.tsx b/x-pack/plugins/security_solution/public/common/components/url_state/initialize_redux_by_url.tsx
index f04cf30da61f5..11312e942c1eb 100644
--- a/x-pack/plugins/security_solution/public/common/components/url_state/initialize_redux_by_url.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/url_state/initialize_redux_by_url.tsx
@@ -28,7 +28,7 @@ import {
   queryTimelineById,
   dispatchUpdateTimeline,
 } from '../../../timelines/components/open_timeline/helpers';
-import { SourcererScopeName, SourcererScopePatterns } from '../../store/sourcerer/model';
+import { SourcererScopeName, SourcererUrlState } from '../../store/sourcerer/model';
 import { timelineActions } from '../../../timelines/store/timeline';
 
 export const useSetInitialStateFromUrl = () => {
@@ -55,16 +55,17 @@ export const useSetInitialStateFromUrl = () => {
           updateTimerange(newUrlStateString, dispatch);
         }
         if (urlKey === CONSTANTS.sourcerer) {
-          const sourcererState = decodeRisonUrlState<SourcererScopePatterns>(newUrlStateString);
+          const sourcererState = decodeRisonUrlState<SourcererUrlState>(newUrlStateString);
           if (sourcererState != null) {
             const activeScopes: SourcererScopeName[] = Object.keys(sourcererState).filter(
               (key) => !(key === SourcererScopeName.default && isDetectionsPages(pageName))
             ) as SourcererScopeName[];
             activeScopes.forEach((scope) =>
               dispatch(
-                sourcererActions.setSelectedIndexPatterns({
+                sourcererActions.setSelectedDataView({
                   id: scope,
-                  selectedPatterns: sourcererState[scope] ?? [],
+                  selectedDataViewId: sourcererState[scope]?.id ?? '',
+                  selectedPatterns: sourcererState[scope]?.selectedPatterns ?? [],
                 })
               )
             );
diff --git a/x-pack/plugins/security_solution/public/common/components/url_state/normalize_time_range.test.ts b/x-pack/plugins/security_solution/public/common/components/url_state/normalize_time_range.test.ts
index b5e4b04d2cd95..a87b1206c0082 100644
--- a/x-pack/plugins/security_solution/public/common/components/url_state/normalize_time_range.test.ts
+++ b/x-pack/plugins/security_solution/public/common/components/url_state/normalize_time_range.test.ts
@@ -13,23 +13,12 @@ import {
   RelativeTimeRange,
   isRelativeTimeRange,
 } from '../../store/inputs/model';
-
+import DateMath from '@elastic/datemath';
 import { getTimeRangeSettings } from '../../utils/default_date_settings';
 
 const getTimeRangeSettingsMock = getTimeRangeSettings as jest.Mock;
 
 jest.mock('../../utils/default_date_settings');
-jest.mock('@elastic/datemath', () => ({
-  parse: (date: string) => {
-    if (date === 'now') {
-      return { toISOString: () => '2020-07-08T08:20:18.966Z' };
-    }
-
-    if (date === 'now-24h') {
-      return { toISOString: () => '2020-07-07T08:20:18.966Z' };
-    }
-  },
-}));
 
 getTimeRangeSettingsMock.mockImplementation(() => ({
   from: '2020-07-04T08:20:18.966Z',
@@ -39,6 +28,19 @@ getTimeRangeSettingsMock.mockImplementation(() => ({
 }));
 
 describe('#normalizeTimeRange', () => {
+  let dateMathSpy: jest.SpyInstance;
+  beforeAll(() => {
+    dateMathSpy = jest.spyOn(DateMath, 'parse');
+    dateMathSpy.mockImplementation((date: string) =>
+      date === 'now'
+        ? { toISOString: () => new Date('2020-07-08T08:20:18.966Z') }
+        : { toISOString: () => new Date('2020-07-07T08:20:18.966Z') }
+    );
+  });
+
+  afterAll(() => {
+    jest.clearAllMocks();
+  });
   test('Absolute time range returns defaults for empty strings', () => {
     const dateTimeRange: URLTimeRange = {
       kind: 'absolute',
diff --git a/x-pack/plugins/security_solution/public/common/components/url_state/test_dependencies.ts b/x-pack/plugins/security_solution/public/common/components/url_state/test_dependencies.ts
index f0bd69b21c617..f722c5ec0da00 100644
--- a/x-pack/plugins/security_solution/public/common/components/url_state/test_dependencies.ts
+++ b/x-pack/plugins/security_solution/public/common/components/url_state/test_dependencies.ts
@@ -84,9 +84,7 @@ export const defaultProps: UrlStateContainerPropTypes = {
   indexPattern: {
     fields: [
       {
-        aggregatable: true,
         name: '@timestamp',
-        searchable: true,
         type: 'date',
       },
     ],
diff --git a/x-pack/plugins/security_solution/public/common/components/url_state/types.ts b/x-pack/plugins/security_solution/public/common/components/url_state/types.ts
index 06ed33ac69f6e..2626f4fb03c23 100644
--- a/x-pack/plugins/security_solution/public/common/components/url_state/types.ts
+++ b/x-pack/plugins/security_solution/public/common/components/url_state/types.ts
@@ -5,21 +5,15 @@
  * 2.0.
  */
 
-import {
-  Filter,
-  FilterManager,
-  IIndexPattern,
-  Query,
-  SavedQueryService,
-} from 'src/plugins/data/public';
-
+import { Filter, FilterManager, Query, SavedQueryService } from 'src/plugins/data/public';
+import { DataViewBase } from '@kbn/es-query';
 import { UrlInputsModel } from '../../store/inputs/model';
 import { TimelineUrl } from '../../../timelines/store/timeline/model';
 import { RouteSpyState } from '../../utils/route/types';
 import { SecurityNav } from '../navigation/types';
 
 import { CONSTANTS, UrlStateType } from './constants';
-import { SourcererScopePatterns } from '../../store/sourcerer/model';
+import { SourcererUrlState } from '../../store/sourcerer/model';
 
 export const ALL_URL_STATE_KEYS: KeyUrlState[] = [
   CONSTANTS.appQuery,
@@ -48,7 +42,7 @@ export interface UrlState {
   [CONSTANTS.appQuery]?: Query;
   [CONSTANTS.filters]?: Filter[];
   [CONSTANTS.savedQuery]?: string;
-  [CONSTANTS.sourcerer]: SourcererScopePatterns;
+  [CONSTANTS.sourcerer]: SourcererUrlState;
   [CONSTANTS.timerange]: UrlInputsModel;
   [CONSTANTS.timeline]: TimelineUrl;
 }
@@ -58,7 +52,7 @@ export type ValueUrlState = UrlState[keyof UrlState];
 
 export interface UrlStateProps {
   navTabs: SecurityNav;
-  indexPattern?: IIndexPattern;
+  indexPattern?: DataViewBase;
   mapToUrlState?: (value: string) => UrlState;
   onChange?: (urlState: UrlState, previousUrlState: UrlState) => void;
   onInitialize?: (urlState: UrlState) => void;
@@ -89,7 +83,7 @@ export interface UrlStateToRedux {
 
 export interface SetInitialStateFromUrl {
   filterManager: FilterManager;
-  indexPattern: IIndexPattern | undefined;
+  indexPattern: DataViewBase | undefined;
   pageName: string;
   savedQueries: SavedQueryService;
   urlStateToUpdate: UrlStateToRedux[];
diff --git a/x-pack/plugins/security_solution/public/common/containers/kuery_autocompletion/index.tsx b/x-pack/plugins/security_solution/public/common/containers/kuery_autocompletion/index.tsx
deleted file mode 100644
index 7ed4ba6944eb7..0000000000000
--- a/x-pack/plugins/security_solution/public/common/containers/kuery_autocompletion/index.tsx
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React, { useState } from 'react';
-import { QuerySuggestion, IIndexPattern } from '../../../../../../../src/plugins/data/public';
-import { useKibana } from '../../lib/kibana';
-
-type RendererResult = React.ReactElement<JSX.Element> | null;
-type RendererFunction<RenderArgs, Result = RendererResult> = (args: RenderArgs) => Result;
-
-interface KueryAutocompletionLifecycleProps {
-  children: RendererFunction<{
-    isLoadingSuggestions: boolean;
-    loadSuggestions: (expression: string, cursorPosition: number, maxSuggestions?: number) => void;
-    suggestions: QuerySuggestion[];
-  }>;
-  indexPattern: IIndexPattern;
-}
-
-interface KueryAutocompletionCurrentRequest {
-  expression: string;
-  cursorPosition: number;
-}
-
-export const KueryAutocompletion = React.memo<KueryAutocompletionLifecycleProps>(
-  ({ children, indexPattern }) => {
-    const [currentRequest, setCurrentRequest] = useState<KueryAutocompletionCurrentRequest | null>(
-      null
-    );
-    const [suggestions, setSuggestions] = useState<QuerySuggestion[]>([]);
-    const kibana = useKibana();
-    const loadSuggestions = async (
-      expression: string,
-      cursorPosition: number,
-      maxSuggestions?: number
-    ) => {
-      const language = 'kuery';
-
-      if (!kibana.services.data.autocomplete.hasQuerySuggestions(language)) {
-        return;
-      }
-
-      const futureRequest = {
-        expression,
-        cursorPosition,
-      };
-      setCurrentRequest({
-        expression,
-        cursorPosition,
-      });
-      setSuggestions([]);
-
-      if (
-        futureRequest &&
-        futureRequest.expression !== (currentRequest && currentRequest.expression) &&
-        futureRequest.cursorPosition !== (currentRequest && currentRequest.cursorPosition)
-      ) {
-        const newSuggestions =
-          (await kibana.services.data.autocomplete.getQuerySuggestions({
-            language: 'kuery',
-            indexPatterns: [indexPattern],
-            boolFilter: [],
-            query: expression,
-            selectionStart: cursorPosition,
-            selectionEnd: cursorPosition,
-          })) || [];
-
-        setCurrentRequest(null);
-        setSuggestions(maxSuggestions ? newSuggestions.slice(0, maxSuggestions) : newSuggestions);
-      }
-    };
-
-    return children({
-      isLoadingSuggestions: currentRequest !== null,
-      loadSuggestions,
-      suggestions,
-    });
-  }
-);
-
-KueryAutocompletion.displayName = 'KueryAutocompletion';
diff --git a/x-pack/plugins/security_solution/public/common/containers/source/index.test.tsx b/x-pack/plugins/security_solution/public/common/containers/source/index.test.tsx
index 564d47f85da3f..d33afdf881f97 100644
--- a/x-pack/plugins/security_solution/public/common/containers/source/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/containers/source/index.test.tsx
@@ -7,7 +7,31 @@
 
 import { IndexField } from '../../../../common/search_strategy/index_fields';
 import { getBrowserFields } from '.';
+import { useDataView } from './use_data_view';
 import { mockBrowserFields, mocksSource } from './mock';
+import { SourcererScopeName } from '../../store/sourcerer/model';
+import { createStore, State } from '../../store';
+import {
+  createSecuritySolutionStorageMock,
+  kibanaObservable,
+  mockGlobalState,
+  SUB_PLUGINS_REDUCER,
+} from '../../mock';
+import { act, renderHook } from '@testing-library/react-hooks';
+import { Provider } from 'react-redux';
+import React from 'react';
+import { useKibana } from '../../lib/kibana';
+
+const mockDispatch = jest.fn();
+jest.mock('react-redux', () => {
+  const original = jest.requireActual('react-redux');
+
+  return {
+    ...original,
+    useDispatch: () => mockDispatch,
+  };
+});
+jest.mock('../../lib/kibana'); // , () => ({
 
 describe('source/index.tsx', () => {
   describe('getBrowserFields', () => {
@@ -28,4 +52,89 @@ describe('source/index.tsx', () => {
       expect(fields).toEqual(mockBrowserFields);
     });
   });
+  describe('useDataView hook', () => {
+    const sourcererState = mockGlobalState.sourcerer;
+    const state: State = {
+      ...mockGlobalState,
+      sourcerer: {
+        ...sourcererState,
+        kibanaDataViews: [
+          ...sourcererState.kibanaDataViews,
+          {
+            ...sourcererState.defaultDataView,
+            id: 'something-random',
+            title: 'something,random',
+            patternList: ['something', 'random'],
+          },
+        ],
+        sourcererScopes: {
+          ...sourcererState.sourcererScopes,
+          [SourcererScopeName.default]: {
+            ...sourcererState.sourcererScopes[SourcererScopeName.default],
+          },
+          [SourcererScopeName.detections]: {
+            ...sourcererState.sourcererScopes[SourcererScopeName.detections],
+          },
+          [SourcererScopeName.timeline]: {
+            ...sourcererState.sourcererScopes[SourcererScopeName.timeline],
+          },
+        },
+      },
+    };
+    const mockSearchResponse = {
+      ...mocksSource,
+      indicesExist: ['auditbeat-*', sourcererState.signalIndexName],
+      isRestore: false,
+      rawResponse: {},
+      runtimeMappings: {},
+    };
+    const { storage } = createSecuritySolutionStorageMock();
+    const store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
+
+    beforeEach(() => {
+      jest.clearAllMocks();
+      const mock = {
+        subscribe: ({ next }: { next: Function }) => next(mockSearchResponse),
+        unsubscribe: jest.fn(),
+      };
+
+      (useKibana as jest.Mock).mockReturnValue({
+        services: {
+          data: {
+            search: {
+              search: jest.fn().mockReturnValue({
+                subscribe: ({ next }: { next: Function }) => {
+                  next(mockSearchResponse);
+                  return mock;
+                },
+                unsubscribe: jest.fn(),
+              }),
+            },
+          },
+        },
+      });
+    });
+    it('sets field data for data view', async () => {
+      await act(async () => {
+        const { rerender, waitForNextUpdate, result } = renderHook<
+          string,
+          { indexFieldsSearch: (id: string) => void }
+        >(() => useDataView(), {
+          wrapper: ({ children }) => <Provider store={store}>{children}</Provider>,
+        });
+        await waitForNextUpdate();
+        rerender();
+        act(() => result.current.indexFieldsSearch('neato'));
+        expect(mockDispatch.mock.calls[0][0]).toEqual({
+          type: 'x-pack/security_solution/local/sourcerer/SET_DATA_VIEW_LOADING',
+          payload: { id: 'neato', loading: true },
+        });
+        const { type: sourceType, payload } = mockDispatch.mock.calls[1][0];
+        expect(sourceType).toEqual('x-pack/security_solution/local/sourcerer/SET_DATA_VIEW');
+        expect(payload.id).toEqual('neato');
+        expect(Object.keys(payload.browserFields)).toHaveLength(10);
+        expect(payload.docValueFields).toEqual([{ field: '@timestamp' }]);
+      });
+    });
+  });
 });
diff --git a/x-pack/plugins/security_solution/public/common/containers/source/index.tsx b/x-pack/plugins/security_solution/public/common/containers/source/index.tsx
index a894dbdd1dda7..1bbd484a33d1e 100644
--- a/x-pack/plugins/security_solution/public/common/containers/source/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/containers/source/index.tsx
@@ -5,30 +5,26 @@
  * 2.0.
  */
 
-import { keyBy, pick, isEmpty, isEqual, isUndefined } from 'lodash/fp';
+import { isEmpty, isEqual, isUndefined, keyBy, pick } from 'lodash/fp';
 import memoizeOne from 'memoize-one';
-import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
-import { useDispatch } from 'react-redux';
-import { IIndexPattern } from 'src/plugins/data/public';
+import { useCallback, useEffect, useRef, useState } from 'react';
+import { DataViewBase } from '@kbn/es-query';
 import { Subscription } from 'rxjs';
 
 import { useKibana } from '../../lib/kibana';
 import {
-  IndexField,
-  IndexFieldsStrategyResponse,
-  IndexFieldsStrategyRequest,
   BrowserField,
   BrowserFields,
-} from '../../../../common/search_strategy/index_fields';
-import { isErrorResponse, isCompleteResponse } from '../../../../../../../src/plugins/data/common';
-import { useDeepEqualSelector } from '../../../common/hooks/use_selector';
+  DocValueFields,
+  IndexField,
+  IndexFieldsStrategyRequest,
+  IndexFieldsStrategyResponse,
+} from '../../../../../timelines/common';
+import { isCompleteResponse, isErrorResponse } from '../../../../../../../src/plugins/data/common';
 import * as i18n from './translations';
-import { SourcererScopeName } from '../../store/sourcerer/model';
-import { sourcererActions, sourcererSelectors } from '../../store/sourcerer';
-import { DocValueFields } from '../../../../common/search_strategy/common';
 import { useAppToasts } from '../../hooks/use_app_toasts';
 
-export { BrowserField, BrowserFields, DocValueFields };
+export type { BrowserField, BrowserFields, DocValueFields };
 
 export const getAllBrowserFields = (browserFields: BrowserFields): Array<Partial<BrowserField>> =>
   Object.values(browserFields).reduce<Array<Partial<BrowserField>>>(
@@ -45,7 +41,7 @@ export const getAllFieldsByName = (
   keyBy('name', getAllBrowserFields(browserFields));
 
 export const getIndexFields = memoizeOne(
-  (title: string, fields: IndexField[]): IIndexPattern =>
+  (title: string, fields: IndexField[]): DataViewBase =>
     fields && fields.length > 0
       ? {
           fields: fields.map((field) =>
@@ -95,7 +91,6 @@ export const getDocValueFields = memoizeOne(
               ...accumulator,
               {
                 field: field.name,
-                format: field.format ? field.format : undefined,
               },
             ];
           }
@@ -119,9 +114,13 @@ interface FetchIndexReturn {
   docValueFields: DocValueFields[];
   indexes: string[];
   indexExists: boolean;
-  indexPatterns: IIndexPattern;
+  indexPatterns: DataViewBase;
 }
 
+/**
+ * Independent index fields hook/request
+ * returns state directly, no redux
+ */
 export const useFetchIndex = (
   indexNames: string[],
   onlyCheckIfIndicesExist: boolean = false
@@ -147,7 +146,7 @@ export const useFetchIndex = (
         abortCtrl.current = new AbortController();
         setLoading(true);
         searchSubscription$.current = data.search
-          .search<IndexFieldsStrategyRequest, IndexFieldsStrategyResponse>(
+          .search<IndexFieldsStrategyRequest<'indices'>, IndexFieldsStrategyResponse>(
             { indices: iNames, onlyCheckIfIndicesExist },
             {
               abortSignal: abortCtrl.current.signal,
@@ -161,7 +160,6 @@ export const useFetchIndex = (
 
                 previousIndexesName.current = response.indicesExist;
                 setLoading(false);
-
                 setState({
                   browserFields: getBrowserFields(stringifyIndices, response.indexFields),
                   docValueFields: getDocValueFields(stringifyIndices, response.indexFields),
@@ -205,95 +203,3 @@ export const useFetchIndex = (
 
   return [isLoading, state];
 };
-
-export const useIndexFields = (sourcererScopeName: SourcererScopeName) => {
-  const { data } = useKibana().services;
-  const abortCtrl = useRef(new AbortController());
-  const searchSubscription$ = useRef(new Subscription());
-  const dispatch = useDispatch();
-  const indexNamesSelectedSelector = useMemo(
-    () => sourcererSelectors.getIndexNamesSelectedSelector(),
-    []
-  );
-  const { indexNames, previousIndexNames } = useDeepEqualSelector<{
-    indexNames: string[];
-    previousIndexNames: string;
-  }>((state) => indexNamesSelectedSelector(state, sourcererScopeName));
-  const { addError, addWarning } = useAppToasts();
-
-  const setLoading = useCallback(
-    (loading: boolean) => {
-      dispatch(sourcererActions.setSourcererScopeLoading({ id: sourcererScopeName, loading }));
-    },
-    [dispatch, sourcererScopeName]
-  );
-
-  const indexFieldsSearch = useCallback(
-    (indicesName) => {
-      const asyncSearch = async () => {
-        abortCtrl.current = new AbortController();
-        setLoading(true);
-        searchSubscription$.current = data.search
-          .search<IndexFieldsStrategyRequest, IndexFieldsStrategyResponse>(
-            { indices: indicesName, onlyCheckIfIndicesExist: false },
-            {
-              abortSignal: abortCtrl.current.signal,
-              strategy: 'indexFields',
-            }
-          )
-          .subscribe({
-            next: (response) => {
-              if (isCompleteResponse(response)) {
-                const stringifyIndices = response.indicesExist.sort().join();
-                dispatch(
-                  sourcererActions.setSource({
-                    id: sourcererScopeName,
-                    payload: {
-                      browserFields: getBrowserFields(stringifyIndices, response.indexFields),
-                      docValueFields: getDocValueFields(stringifyIndices, response.indexFields),
-                      errorMessage: null,
-                      id: sourcererScopeName,
-                      indexPattern: getIndexFields(stringifyIndices, response.indexFields),
-                      // If checking for DE signals index, lie and say the index is created (it's
-                      // no longer created on startup, but is created lazily before writing).
-                      indicesExist:
-                        sourcererScopeName === SourcererScopeName.detections
-                          ? true
-                          : response.indicesExist.length > 0,
-                      loading: false,
-                    },
-                  })
-                );
-                searchSubscription$.current.unsubscribe();
-              } else if (isErrorResponse(response)) {
-                setLoading(false);
-                addWarning(i18n.ERROR_BEAT_FIELDS);
-                searchSubscription$.current.unsubscribe();
-              }
-            },
-            error: (msg) => {
-              setLoading(false);
-              addError(msg, {
-                title: i18n.FAIL_BEAT_FIELDS,
-              });
-              searchSubscription$.current.unsubscribe();
-            },
-          });
-      };
-      searchSubscription$.current.unsubscribe();
-      abortCtrl.current.abort();
-      asyncSearch();
-    },
-    [data.search, dispatch, addError, addWarning, setLoading, sourcererScopeName]
-  );
-
-  useEffect(() => {
-    if (!isEmpty(indexNames) && previousIndexNames !== indexNames.sort().join()) {
-      indexFieldsSearch(indexNames);
-    }
-    return () => {
-      searchSubscription$.current.unsubscribe();
-      abortCtrl.current.abort();
-    };
-  }, [indexNames, indexFieldsSearch, previousIndexNames]);
-};
diff --git a/x-pack/plugins/security_solution/public/common/containers/source/mock.ts b/x-pack/plugins/security_solution/public/common/containers/source/mock.ts
index c176e64da1ba2..e34972f5226f3 100644
--- a/x-pack/plugins/security_solution/public/common/containers/source/mock.ts
+++ b/x-pack/plugins/security_solution/public/common/containers/source/mock.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { MappingRuntimeFields } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import { DEFAULT_INDEX_PATTERN } from '../../../../common/constants';
 import { DocValueFields } from '../../../../common/search_strategy';
 import { BrowserFields } from '../../../../common/search_strategy/index_fields';
@@ -22,6 +23,7 @@ export const mocksSource = {
       searchable: true,
       type: 'date',
       aggregatable: true,
+      readFromDocValues: true,
     },
     {
       category: 'agent',
@@ -330,7 +332,13 @@ export const mocksSource = {
 };
 
 export const mockIndexFields = [
-  { aggregatable: true, name: '@timestamp', searchable: true, type: 'date' },
+  {
+    aggregatable: true,
+    name: '@timestamp',
+    searchable: true,
+    type: 'date',
+    readFromDocValues: true,
+  },
   { aggregatable: true, name: 'agent.ephemeral_id', searchable: true, type: 'string' },
   { aggregatable: true, name: 'agent.hostname', searchable: true, type: 'string' },
   { aggregatable: true, name: 'agent.id', searchable: true, type: 'string' },
@@ -459,6 +467,7 @@ export const mockBrowserFields: BrowserFields = {
         name: '@timestamp',
         searchable: true,
         type: 'date',
+        readFromDocValues: true,
       },
     },
   },
@@ -726,3 +735,12 @@ export const mockDocValueFields: DocValueFields[] = [
     format: 'date_time',
   },
 ];
+
+export const mockRuntimeMappings: MappingRuntimeFields = {
+  '@a.runtime.field': {
+    script: {
+      source: 'emit("Radical dude: " + doc[\'host.name\'].value)',
+    },
+    type: 'keyword',
+  },
+};
diff --git a/x-pack/plugins/security_solution/public/common/containers/source/use_data_view.tsx b/x-pack/plugins/security_solution/public/common/containers/source/use_data_view.tsx
new file mode 100644
index 0000000000000..a0178d45a9e07
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/containers/source/use_data_view.tsx
@@ -0,0 +1,120 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useCallback, useEffect, useRef } from 'react';
+import { Subscription } from 'rxjs';
+import { useDispatch } from 'react-redux';
+import memoizeOne from 'memoize-one';
+import { pick } from 'lodash/fp';
+import { useKibana } from '../../lib/kibana';
+import { useAppToasts } from '../../hooks/use_app_toasts';
+import { sourcererActions } from '../../store/sourcerer';
+import {
+  DELETED_SECURITY_SOLUTION_DATA_VIEW,
+  IndexField,
+  IndexFieldsStrategyRequest,
+  IndexFieldsStrategyResponse,
+} from '../../../../../timelines/common';
+import {
+  FieldSpec,
+  isCompleteResponse,
+  isErrorResponse,
+} from '../../../../../../../src/plugins/data/common';
+import * as i18n from './translations';
+import { getBrowserFields, getDocValueFields } from './';
+
+const getEsFields = memoizeOne(
+  (fields: IndexField[]): FieldSpec[] =>
+    fields && fields.length > 0
+      ? fields.map((field) =>
+          pick(['name', 'searchable', 'type', 'aggregatable', 'esTypes', 'subType'], field)
+        )
+      : [],
+  (newArgs, lastArgs) => newArgs[0].length === lastArgs[0].length
+);
+
+export const useDataView = (): { indexFieldsSearch: (selectedDataViewId: string) => void } => {
+  const { data } = useKibana().services;
+  const abortCtrl = useRef(new AbortController());
+  const searchSubscription$ = useRef(new Subscription());
+  const dispatch = useDispatch();
+  const { addError, addWarning } = useAppToasts();
+
+  const setLoading = useCallback(
+    ({ id, loading }: { id: string; loading: boolean }) => {
+      dispatch(sourcererActions.setDataViewLoading({ id, loading }));
+    },
+    [dispatch]
+  );
+
+  const indexFieldsSearch = useCallback(
+    (selectedDataViewId: string) => {
+      const asyncSearch = async () => {
+        abortCtrl.current = new AbortController();
+        setLoading({ id: selectedDataViewId, loading: true });
+        searchSubscription$.current = data.search
+          .search<IndexFieldsStrategyRequest<'dataView'>, IndexFieldsStrategyResponse>(
+            {
+              dataViewId: selectedDataViewId,
+              onlyCheckIfIndicesExist: false,
+            },
+            {
+              abortSignal: abortCtrl.current.signal,
+              strategy: 'indexFields',
+            }
+          )
+          .subscribe({
+            next: (response) => {
+              if (isCompleteResponse(response)) {
+                const patternString = response.indicesExist.sort().join();
+
+                dispatch(
+                  sourcererActions.setDataView({
+                    browserFields: getBrowserFields(patternString, response.indexFields),
+                    docValueFields: getDocValueFields(patternString, response.indexFields),
+                    id: selectedDataViewId,
+                    indexFields: getEsFields(response.indexFields),
+                    loading: false,
+                    runtimeMappings: response.runtimeMappings,
+                  })
+                );
+                searchSubscription$.current.unsubscribe();
+              } else if (isErrorResponse(response)) {
+                setLoading({ id: selectedDataViewId, loading: false });
+                addWarning(i18n.ERROR_BEAT_FIELDS);
+                searchSubscription$.current.unsubscribe();
+              }
+            },
+            error: (msg) => {
+              if (msg.message === DELETED_SECURITY_SOLUTION_DATA_VIEW) {
+                // reload app if security solution data view is deleted
+                return location.reload();
+              }
+              setLoading({ id: selectedDataViewId, loading: false });
+              addError(msg, {
+                title: i18n.FAIL_BEAT_FIELDS,
+              });
+              searchSubscription$.current.unsubscribe();
+            },
+          });
+      };
+      searchSubscription$.current.unsubscribe();
+      abortCtrl.current.abort();
+      asyncSearch();
+    },
+    [addError, addWarning, data.search, dispatch, setLoading]
+  );
+
+  useEffect(() => {
+    return () => {
+      searchSubscription$.current.unsubscribe();
+      abortCtrl.current.abort();
+    };
+  }, []);
+
+  return { indexFieldsSearch };
+};
diff --git a/x-pack/plugins/security_solution/public/common/containers/sourcerer/api.ts b/x-pack/plugins/security_solution/public/common/containers/sourcerer/api.ts
new file mode 100644
index 0000000000000..54008848c2f71
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/containers/sourcerer/api.ts
@@ -0,0 +1,32 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { KibanaServices } from '../../lib/kibana';
+import { SOURCERER_API_URL } from '../../../../common/constants';
+import { KibanaDataView } from '../../store/sourcerer/model';
+
+export interface GetSourcererDataView {
+  signal: AbortSignal;
+  body: {
+    patternList: string[];
+  };
+}
+
+export interface SecurityDataView {
+  defaultDataView: KibanaDataView;
+  kibanaDataViews: KibanaDataView[];
+}
+
+export const postSourcererDataView = async ({
+  body,
+  signal,
+}: GetSourcererDataView): Promise<SecurityDataView> =>
+  KibanaServices.get().http.fetch(SOURCERER_API_URL, {
+    method: 'POST',
+    body: JSON.stringify(body),
+    signal,
+  });
diff --git a/x-pack/plugins/security_solution/public/common/containers/sourcerer/index.test.tsx b/x-pack/plugins/security_solution/public/common/containers/sourcerer/index.test.tsx
index ec28326f7d170..2e060973c431f 100644
--- a/x-pack/plugins/security_solution/public/common/containers/sourcerer/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/containers/sourcerer/index.test.tsx
@@ -7,14 +7,14 @@
 
 import React from 'react';
 import { act, renderHook } from '@testing-library/react-hooks';
+import { waitFor } from '@testing-library/react';
 import { Provider } from 'react-redux';
 
-import { getScopeFromPath, useInitSourcerer } from '.';
+import { getScopeFromPath, useInitSourcerer, useSourcererDataView } from '.';
 import { mockPatterns } from './mocks';
-// import { SourcererScopeName } from '../../store/sourcerer/model';
 import { RouteSpyState } from '../../utils/route/types';
-import { SecurityPageName } from '../../../../common/constants';
-import { createStore, State } from '../../store';
+import { DEFAULT_INDEX_PATTERN, SecurityPageName } from '../../../../common/constants';
+import { createStore } from '../../store';
 import {
   useUserInfo,
   initialState as userInfoState,
@@ -24,8 +24,10 @@ import {
   kibanaObservable,
   mockGlobalState,
   SUB_PLUGINS_REDUCER,
+  mockSourcererState,
 } from '../../mock';
-import { SourcererScopeName } from '../../store/sourcerer/model';
+import { SelectedDataView, SourcererScopeName } from '../../store/sourcerer/model';
+import { postSourcererDataView } from './api';
 
 const mockRouteSpy: RouteSpyState = {
   pageName: SecurityPageName.overview,
@@ -37,6 +39,7 @@ const mockRouteSpy: RouteSpyState = {
 const mockDispatch = jest.fn();
 const mockUseUserInfo = useUserInfo as jest.Mock;
 jest.mock('../../../detections/components/user_info');
+jest.mock('./api');
 jest.mock('react-redux', () => {
   const original = jest.requireActual('react-redux');
 
@@ -48,6 +51,7 @@ jest.mock('react-redux', () => {
 jest.mock('../../utils/route/use_route_spy', () => ({
   useRouteSpy: () => [mockRouteSpy],
 }));
+
 jest.mock('../../lib/kibana', () => ({
   useToasts: jest.fn().mockReturnValue({
     addError: jest.fn(),
@@ -84,36 +88,13 @@ jest.mock('../../lib/kibana', () => ({
 }));
 
 describe('Sourcerer Hooks', () => {
-  const state: State = {
-    ...mockGlobalState,
-    sourcerer: {
-      ...mockGlobalState.sourcerer,
-      sourcererScopes: {
-        ...mockGlobalState.sourcerer.sourcererScopes,
-        [SourcererScopeName.default]: {
-          ...mockGlobalState.sourcerer.sourcererScopes[SourcererScopeName.default],
-          indexPattern: {
-            fields: [],
-            title: '',
-          },
-        },
-        [SourcererScopeName.timeline]: {
-          ...mockGlobalState.sourcerer.sourcererScopes[SourcererScopeName.timeline],
-          indexPattern: {
-            fields: [],
-            title: '',
-          },
-        },
-      },
-    },
-  };
   const { storage } = createSecuritySolutionStorageMock();
-  let store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
+  let store: ReturnType<typeof createStore>;
 
   beforeEach(() => {
     jest.clearAllMocks();
     jest.restoreAllMocks();
-    store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
+    store = createStore(mockGlobalState, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
     mockUseUserInfo.mockImplementation(() => userInfoState);
   });
   it('initializes loading default and timeline index patterns', async () => {
@@ -125,34 +106,88 @@ describe('Sourcerer Hooks', () => {
       rerender();
       expect(mockDispatch).toBeCalledTimes(2);
       expect(mockDispatch.mock.calls[0][0]).toEqual({
-        type: 'x-pack/security_solution/local/sourcerer/SET_SOURCERER_SCOPE_LOADING',
-        payload: { id: 'default', loading: true },
+        type: 'x-pack/security_solution/local/sourcerer/SET_DATA_VIEW_LOADING',
+        payload: { id: 'security-solution', loading: true },
       });
       expect(mockDispatch.mock.calls[1][0]).toEqual({
-        type: 'x-pack/security_solution/local/sourcerer/SET_SOURCERER_SCOPE_LOADING',
-        payload: { id: 'timeline', loading: true },
+        type: 'x-pack/security_solution/local/sourcerer/SET_SELECTED_DATA_VIEW',
+        payload: {
+          id: 'timeline',
+          selectedDataViewId: 'security-solution',
+          selectedPatterns: [
+            '.siem-signals-spacename',
+            'apm-*-transaction*',
+            'auditbeat-*',
+            'endgame-*',
+            'filebeat-*',
+            'logs-*',
+            'packetbeat-*',
+            'traces-apm*',
+            'winlogbeat-*',
+          ],
+        },
       });
     });
   });
   it('sets signal index name', async () => {
+    const mockNewDataViews = {
+      defaultDataView: mockSourcererState.defaultDataView,
+      kibanaDataViews: [mockSourcererState.defaultDataView],
+    };
+    (postSourcererDataView as jest.Mock).mockResolvedValue(mockNewDataViews);
+
+    store = createStore(
+      {
+        ...mockGlobalState,
+        sourcerer: {
+          ...mockGlobalState.sourcerer,
+          signalIndexName: null,
+          defaultDataView: {
+            ...mockGlobalState.sourcerer.defaultDataView,
+            title: DEFAULT_INDEX_PATTERN.join(','),
+            patternList: DEFAULT_INDEX_PATTERN,
+          },
+        },
+      },
+      SUB_PLUGINS_REDUCER,
+      kibanaObservable,
+      storage
+    );
     await act(async () => {
       mockUseUserInfo.mockImplementation(() => ({
         ...userInfoState,
         loading: false,
-        signalIndexName: 'signals-*',
+        signalIndexName: mockSourcererState.signalIndexName,
       }));
       const { rerender, waitForNextUpdate } = renderHook<string, void>(() => useInitSourcerer(), {
         wrapper: ({ children }) => <Provider store={store}>{children}</Provider>,
       });
       await waitForNextUpdate();
       rerender();
-      expect(mockDispatch.mock.calls[2][0]).toEqual({
-        type: 'x-pack/security_solution/local/sourcerer/SET_SIGNAL_INDEX_NAME',
-        payload: { signalIndexName: 'signals-*' },
-      });
-      expect(mockDispatch.mock.calls[3][0]).toEqual({
-        type: 'x-pack/security_solution/local/sourcerer/SET_SELECTED_INDEX_PATTERNS',
-        payload: { id: 'timeline', selectedPatterns: ['signals-*'] },
+      await waitFor(() => {
+        expect(mockDispatch.mock.calls[2][0]).toEqual({
+          type: 'x-pack/security_solution/local/sourcerer/SET_SOURCERER_SCOPE_LOADING',
+          payload: { loading: true },
+        });
+        expect(mockDispatch.mock.calls[3][0]).toEqual({
+          type: 'x-pack/security_solution/local/sourcerer/SET_SIGNAL_INDEX_NAME',
+          payload: { signalIndexName: mockSourcererState.signalIndexName },
+        });
+        expect(mockDispatch.mock.calls[4][0]).toEqual({
+          type: 'x-pack/security_solution/local/sourcerer/SET_DATA_VIEW_LOADING',
+          payload: {
+            id: mockSourcererState.defaultDataView.id,
+            loading: true,
+          },
+        });
+        expect(mockDispatch.mock.calls[5][0]).toEqual({
+          type: 'x-pack/security_solution/local/sourcerer/SET_SOURCERER_DATA_VIEWS',
+          payload: mockNewDataViews,
+        });
+        expect(mockDispatch.mock.calls[6][0]).toEqual({
+          type: 'x-pack/security_solution/local/sourcerer/SET_SOURCERER_SCOPE_LOADING',
+          payload: { loading: false },
+        });
       });
     });
   });
@@ -160,7 +195,7 @@ describe('Sourcerer Hooks', () => {
     await act(async () => {
       mockUseUserInfo.mockImplementation(() => ({
         ...userInfoState,
-        signalIndexName: 'signals-*',
+        signalIndexName: mockSourcererState.signalIndexName,
         isSignalIndexExists: true,
       }));
       const { rerender, waitForNextUpdate } = renderHook<string, void>(
@@ -171,9 +206,130 @@ describe('Sourcerer Hooks', () => {
       );
       await waitForNextUpdate();
       rerender();
-      expect(mockDispatch.mock.calls[1][0]).toEqual({
-        type: 'x-pack/security_solution/local/sourcerer/SET_SELECTED_INDEX_PATTERNS',
-        payload: { id: 'detections', selectedPatterns: ['signals-*'] },
+      expect(mockDispatch.mock.calls[2][0]).toEqual({
+        type: 'x-pack/security_solution/local/sourcerer/SET_SELECTED_DATA_VIEW',
+        payload: {
+          id: 'detections',
+          selectedDataViewId: mockSourcererState.defaultDataView.id,
+          selectedPatterns: [mockSourcererState.signalIndexName],
+        },
+      });
+    });
+  });
+
+  describe('useSourcererDataView', () => {
+    it('Should exclude elastic cloud alias when selected patterns include "logs-*" as an alias', async () => {
+      await act(async () => {
+        const { result, rerender, waitForNextUpdate } = renderHook<
+          SourcererScopeName,
+          SelectedDataView
+        >(() => useSourcererDataView(), {
+          wrapper: ({ children }) => <Provider store={store}>{children}</Provider>,
+        });
+        await waitForNextUpdate();
+        rerender();
+        expect(result.current.selectedPatterns).toEqual([
+          '-*elastic-cloud-logs-*',
+          ...mockGlobalState.sourcerer.sourcererScopes.default.selectedPatterns,
+        ]);
+      });
+    });
+
+    it('Should NOT exclude elastic cloud alias when selected patterns does NOT include "logs-*" as an alias', async () => {
+      await act(async () => {
+        store = createStore(
+          {
+            ...mockGlobalState,
+            sourcerer: {
+              ...mockGlobalState.sourcerer,
+              sourcererScopes: {
+                ...mockGlobalState.sourcerer.sourcererScopes,
+                [SourcererScopeName.default]: {
+                  ...mockGlobalState.sourcerer.sourcererScopes[SourcererScopeName.default],
+                  selectedPatterns: [
+                    'apm-*-transaction*',
+                    'auditbeat-*',
+                    'endgame-*',
+                    'filebeat-*',
+                    'packetbeat-*',
+                    'traces-apm*',
+                    'winlogbeat-*',
+                  ],
+                },
+              },
+            },
+          },
+          SUB_PLUGINS_REDUCER,
+          kibanaObservable,
+          storage
+        );
+        const { result, rerender, waitForNextUpdate } = renderHook<
+          SourcererScopeName,
+          SelectedDataView
+        >(() => useSourcererDataView(), {
+          wrapper: ({ children }) => <Provider store={store}>{children}</Provider>,
+        });
+        await waitForNextUpdate();
+        rerender();
+        expect(result.current.selectedPatterns).toEqual([
+          'apm-*-transaction*',
+          'auditbeat-*',
+          'endgame-*',
+          'filebeat-*',
+          'packetbeat-*',
+          'traces-apm*',
+          'winlogbeat-*',
+        ]);
+      });
+    });
+
+    it('Should NOT exclude elastic cloud alias when selected patterns include "logs-endpoint.event-*" as an alias', async () => {
+      await act(async () => {
+        store = createStore(
+          {
+            ...mockGlobalState,
+            sourcerer: {
+              ...mockGlobalState.sourcerer,
+              sourcererScopes: {
+                ...mockGlobalState.sourcerer.sourcererScopes,
+                [SourcererScopeName.default]: {
+                  ...mockGlobalState.sourcerer.sourcererScopes[SourcererScopeName.default],
+                  selectedPatterns: [
+                    'apm-*-transaction*',
+                    'auditbeat-*',
+                    'endgame-*',
+                    'filebeat-*',
+                    'packetbeat-*',
+                    'traces-apm*',
+                    'winlogbeat-*',
+                    'logs-endpoint.event-*',
+                  ],
+                },
+              },
+            },
+          },
+          SUB_PLUGINS_REDUCER,
+          kibanaObservable,
+          storage
+        );
+        const { result, rerender, waitForNextUpdate } = renderHook<
+          SourcererScopeName,
+          SelectedDataView
+        >(() => useSourcererDataView(), {
+          wrapper: ({ children }) => <Provider store={store}>{children}</Provider>,
+        });
+        await waitForNextUpdate();
+        rerender();
+        expect(result.current.selectedPatterns).toEqual([
+          'apm-*-transaction*',
+          'auditbeat-*',
+          'endgame-*',
+          'filebeat-*',
+          'logs-endpoint.event-*',
+          'packetbeat-*',
+          'traces-apm*',
+          'winlogbeat-*',
+        ]);
       });
     });
   });
diff --git a/x-pack/plugins/security_solution/public/common/containers/sourcerer/index.tsx b/x-pack/plugins/security_solution/public/common/containers/sourcerer/index.tsx
index 615bc104b14f9..4ca8bf037261a 100644
--- a/x-pack/plugins/security_solution/public/common/containers/sourcerer/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/containers/sourcerer/index.tsx
@@ -5,133 +5,298 @@
  * 2.0.
  */
 
-import { useEffect, useMemo, useRef } from 'react';
+import { useCallback, useEffect, useMemo, useRef } from 'react';
 import { useDispatch } from 'react-redux';
-
+import { i18n } from '@kbn/i18n';
 import { matchPath } from 'react-router-dom';
 import { sourcererActions, sourcererSelectors } from '../../store/sourcerer';
-import { SourcererScopeName } from '../../store/sourcerer/model';
-import { useIndexFields } from '../source';
+import { SelectedDataView, SourcererScopeName } from '../../store/sourcerer/model';
 import { useUserInfo } from '../../../detections/components/user_info';
 import { timelineSelectors } from '../../../timelines/store/timeline';
 import { ALERTS_PATH, CASES_PATH, RULES_PATH, UEBA_PATH } from '../../../../common/constants';
 import { TimelineId } from '../../../../common';
 import { useDeepEqualSelector } from '../../hooks/use_selector';
+import { getScopePatternListSelection } from '../../store/sourcerer/helpers';
+import { useAppToasts } from '../../hooks/use_app_toasts';
+import { postSourcererDataView } from './api';
+import { useDataView } from '../source/use_data_view';
 
 export const useInitSourcerer = (
   scopeId: SourcererScopeName.default | SourcererScopeName.detections = SourcererScopeName.default
 ) => {
   const dispatch = useDispatch();
+  const abortCtrl = useRef(new AbortController());
   const initialTimelineSourcerer = useRef(true);
   const initialDetectionSourcerer = useRef(true);
   const { loading: loadingSignalIndex, isSignalIndexExists, signalIndexName } = useUserInfo();
-  const getConfigIndexPatternsSelector = useMemo(
-    () => sourcererSelectors.configIndexPatternsSelector(),
+  const getDefaultDataViewSelector = useMemo(
+    () => sourcererSelectors.defaultDataViewSelector(),
     []
   );
-  const ConfigIndexPatterns = useDeepEqualSelector(getConfigIndexPatternsSelector);
+  const defaultDataView = useDeepEqualSelector(getDefaultDataViewSelector);
+
+  const { addError } = useAppToasts();
+
+  useEffect(() => {
+    if (defaultDataView.error != null) {
+      addError(defaultDataView.error, {
+        title: i18n.translate('xpack.securitySolution.sourcerer.permissions.title', {
+          defaultMessage: 'Write role required to generate data',
+        }),
+        toastMessage: i18n.translate('xpack.securitySolution.sourcerer.permissions.toastMessage', {
+          defaultMessage:
+            'Users with write permission need to access the Elastic Security app to initialize the app source data.',
+        }),
+      });
+    }
+  }, [addError, defaultDataView.error]);
 
   const getSignalIndexNameSelector = useMemo(
     () => sourcererSelectors.signalIndexNameSelector(),
     []
   );
-  const signalIndexNameSelector = useDeepEqualSelector(getSignalIndexNameSelector);
+  const signalIndexNameSourcerer = useDeepEqualSelector(getSignalIndexNameSelector);
 
   const getTimelineSelector = useMemo(() => timelineSelectors.getTimelineByIdSelector(), []);
   const activeTimeline = useDeepEqualSelector((state) =>
     getTimelineSelector(state, TimelineId.active)
   );
+  const scopeIdSelector = useMemo(() => sourcererSelectors.scopeIdSelector(), []);
+  const { selectedDataViewId: scopeDataViewId } = useDeepEqualSelector((state) =>
+    scopeIdSelector(state, scopeId)
+  );
+  const { selectedDataViewId: timelineDataViewId } = useDeepEqualSelector((state) =>
+    scopeIdSelector(state, SourcererScopeName.timeline)
+  );
+  const activeDataViewIds = useMemo(
+    () => [...new Set([scopeDataViewId, timelineDataViewId])],
+    [scopeDataViewId, timelineDataViewId]
+  );
+  const { indexFieldsSearch } = useDataView();
 
-  useIndexFields(scopeId);
-  useIndexFields(SourcererScopeName.timeline);
-
-  useEffect(() => {
-    if (!loadingSignalIndex && signalIndexName != null && signalIndexNameSelector == null) {
-      dispatch(sourcererActions.setSignalIndexName({ signalIndexName }));
-    }
-  }, [dispatch, loadingSignalIndex, signalIndexName, signalIndexNameSelector]);
+  useEffect(
+    () => activeDataViewIds.forEach((id) => id != null && id.length > 0 && indexFieldsSearch(id)),
+    [activeDataViewIds, indexFieldsSearch]
+  );
 
   // Related to timeline
   useEffect(() => {
     if (
       !loadingSignalIndex &&
       signalIndexName != null &&
-      signalIndexNameSelector == null &&
+      signalIndexNameSourcerer == null &&
       (activeTimeline == null || activeTimeline.savedObjectId == null) &&
-      initialTimelineSourcerer.current
+      initialTimelineSourcerer.current &&
+      defaultDataView.id.length > 0
     ) {
       initialTimelineSourcerer.current = false;
       dispatch(
-        sourcererActions.setSelectedIndexPatterns({
+        sourcererActions.setSelectedDataView({
           id: SourcererScopeName.timeline,
-          selectedPatterns: [...ConfigIndexPatterns, signalIndexName],
+          selectedDataViewId: defaultDataView.id,
+          selectedPatterns: getScopePatternListSelection(
+            defaultDataView,
+            SourcererScopeName.timeline,
+            signalIndexName,
+            true
+          ),
         })
       );
     } else if (
-      signalIndexNameSelector != null &&
+      signalIndexNameSourcerer != null &&
       (activeTimeline == null || activeTimeline.savedObjectId == null) &&
-      initialTimelineSourcerer.current
+      initialTimelineSourcerer.current &&
+      defaultDataView.id.length > 0
     ) {
       initialTimelineSourcerer.current = false;
       dispatch(
-        sourcererActions.setSelectedIndexPatterns({
+        sourcererActions.setSelectedDataView({
           id: SourcererScopeName.timeline,
-          selectedPatterns: [...ConfigIndexPatterns, signalIndexNameSelector],
+          selectedDataViewId: defaultDataView.id,
+          selectedPatterns: getScopePatternListSelection(
+            defaultDataView,
+            SourcererScopeName.timeline,
+            signalIndexNameSourcerer,
+            true
+          ),
         })
       );
     }
   }, [
     activeTimeline,
-    ConfigIndexPatterns,
+    defaultDataView,
     dispatch,
     loadingSignalIndex,
     signalIndexName,
-    signalIndexNameSelector,
+    signalIndexNameSourcerer,
   ]);
 
+  const updateSourcererDataView = useCallback(
+    (newSignalsIndex: string) => {
+      const asyncSearch = async (newPatternList: string[]) => {
+        abortCtrl.current = new AbortController();
+
+        dispatch(sourcererActions.setSourcererScopeLoading({ loading: true }));
+        try {
+          const response = await postSourcererDataView({
+            body: { patternList: newPatternList },
+            signal: abortCtrl.current.signal,
+          });
+
+          if (response.defaultDataView.patternList.includes(newSignalsIndex)) {
+            // first time signals is defined and validated in the sourcerer
+            // redo indexFieldsSearch
+            indexFieldsSearch(response.defaultDataView.id);
+          }
+          dispatch(sourcererActions.setSourcererDataViews(response));
+          dispatch(sourcererActions.setSourcererScopeLoading({ loading: false }));
+        } catch (err) {
+          addError(err, {
+            title: i18n.translate('xpack.securitySolution.sourcerer.error.title', {
+              defaultMessage: 'Error updating Security Data View',
+            }),
+            toastMessage: i18n.translate('xpack.securitySolution.sourcerer.error.toastMessage', {
+              defaultMessage: 'Refresh the page',
+            }),
+          });
+          dispatch(sourcererActions.setSourcererScopeLoading({ loading: false }));
+        }
+      };
+
+      if (defaultDataView.title.indexOf(newSignalsIndex) === -1) {
+        abortCtrl.current.abort();
+        asyncSearch([...defaultDataView.title.split(','), newSignalsIndex]);
+      }
+    },
+    [defaultDataView.title, dispatch, indexFieldsSearch, addError]
+  );
+  useEffect(() => {
+    if (
+      !loadingSignalIndex &&
+      signalIndexName != null &&
+      signalIndexNameSourcerer == null &&
+      defaultDataView.id.length > 0
+    ) {
+      // update signal name also updates sourcerer
+      // we hit this the first time signal index is created
+      updateSourcererDataView(signalIndexName);
+      dispatch(sourcererActions.setSignalIndexName({ signalIndexName }));
+    }
+  }, [
+    defaultDataView.id,
+    dispatch,
+    indexFieldsSearch,
+    isSignalIndexExists,
+    loadingSignalIndex,
+    signalIndexName,
+    signalIndexNameSourcerer,
+    updateSourcererDataView,
+  ]);
   // Related to the detection page
   useEffect(() => {
     if (
       scopeId === SourcererScopeName.detections &&
       isSignalIndexExists &&
       signalIndexName != null &&
-      initialDetectionSourcerer.current
+      initialDetectionSourcerer.current &&
+      defaultDataView.id.length > 0
     ) {
       initialDetectionSourcerer.current = false;
       dispatch(
-        sourcererActions.setSelectedIndexPatterns({
-          id: scopeId,
-          selectedPatterns: [signalIndexName],
+        sourcererActions.setSelectedDataView({
+          id: SourcererScopeName.detections,
+          selectedDataViewId: defaultDataView.id,
+          selectedPatterns: getScopePatternListSelection(
+            defaultDataView,
+            SourcererScopeName.detections,
+            signalIndexName,
+            true
+          ),
         })
       );
     } else if (
       scopeId === SourcererScopeName.detections &&
-      signalIndexNameSelector != null &&
-      initialTimelineSourcerer.current
+      signalIndexNameSourcerer != null &&
+      initialTimelineSourcerer.current &&
+      defaultDataView.id.length > 0
     ) {
       initialDetectionSourcerer.current = false;
-      dispatch(
-        sourcererActions.setSelectedIndexPatterns({
-          id: scopeId,
-          selectedPatterns: [signalIndexNameSelector],
-        })
-      );
+      sourcererActions.setSelectedDataView({
+        id: SourcererScopeName.detections,
+        selectedDataViewId: defaultDataView.id,
+        selectedPatterns: getScopePatternListSelection(
+          defaultDataView,
+          SourcererScopeName.detections,
+          signalIndexNameSourcerer,
+          true
+        ),
+      });
     }
-  }, [dispatch, isSignalIndexExists, scopeId, signalIndexName, signalIndexNameSelector]);
+  }, [
+    defaultDataView,
+    dispatch,
+    isSignalIndexExists,
+    scopeId,
+    signalIndexName,
+    signalIndexNameSourcerer,
+  ]);
 };
 
-export const useSourcererScope = (scope: SourcererScopeName = SourcererScopeName.default) => {
+const LOGS_WILDCARD_INDEX = 'logs-*';
+export const EXCLUDE_ELASTIC_CLOUD_INDEX = '-*elastic-cloud-logs-*';
+
+export const useSourcererDataView = (
+  scopeId: SourcererScopeName = SourcererScopeName.default
+): SelectedDataView => {
   const sourcererScopeSelector = useMemo(() => sourcererSelectors.getSourcererScopeSelector(), []);
-  return useDeepEqualSelector((state) => sourcererScopeSelector(state, scope));
+  const {
+    signalIndexName,
+    sourcererDataView: selectedDataView,
+    sourcererScope: { selectedPatterns: scopeSelectedPatterns, loading },
+  }: sourcererSelectors.SourcererScopeSelector = useDeepEqualSelector((state) =>
+    sourcererScopeSelector(state, scopeId)
+  );
+
+  const selectedPatterns = useMemo(
+    () =>
+      scopeSelectedPatterns.some((index) => index === LOGS_WILDCARD_INDEX)
+        ? [...scopeSelectedPatterns, EXCLUDE_ELASTIC_CLOUD_INDEX]
+        : scopeSelectedPatterns,
+    [scopeSelectedPatterns]
+  );
+
+  return useMemo(
+    () => ({
+      browserFields: selectedDataView.browserFields,
+      dataViewId: selectedDataView.id,
+      docValueFields: selectedDataView.docValueFields,
+      indexPattern: {
+        fields: selectedDataView.indexFields,
+        title: selectedPatterns.join(','),
+      },
+      indicesExist:
+        scopeId === SourcererScopeName.detections
+          ? selectedDataView.patternList.includes(`${signalIndexName}`)
+          : scopeId === SourcererScopeName.default
+          ? selectedDataView.patternList.filter((i) => i !== signalIndexName).length > 0
+          : selectedDataView.patternList.length > 0,
+      loading: loading || selectedDataView.loading,
+      runtimeMappings: selectedDataView.runtimeMappings,
+      // all active & inactive patterns in DATA_VIEW
+      patternList: selectedDataView.title.split(','),
+      // selected patterns in DATA_VIEW
+      selectedPatterns: selectedPatterns.sort(),
+    }),
+    [loading, selectedPatterns, signalIndexName, scopeId, selectedDataView]
+  );
 };
 
 export const getScopeFromPath = (
   pathname: string
-): SourcererScopeName.default | SourcererScopeName.detections => {
-  return matchPath(pathname, {
+): SourcererScopeName.default | SourcererScopeName.detections =>
+  matchPath(pathname, {
     path: [ALERTS_PATH, `${RULES_PATH}/id/:id`, `${UEBA_PATH}/:id`, `${CASES_PATH}/:detailName`],
     strict: false,
   }) == null
     ? SourcererScopeName.default
     : SourcererScopeName.detections;
-};
diff --git a/x-pack/plugins/security_solution/public/common/containers/sourcerer/use_signal_helpers.test.tsx b/x-pack/plugins/security_solution/public/common/containers/sourcerer/use_signal_helpers.test.tsx
new file mode 100644
index 0000000000000..a387bd2211a66
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/containers/sourcerer/use_signal_helpers.test.tsx
@@ -0,0 +1,95 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import {
+  createSecuritySolutionStorageMock,
+  kibanaObservable,
+  mockGlobalState,
+  SUB_PLUGINS_REDUCER,
+  TestProviders,
+} from '../../mock';
+import { act, renderHook } from '@testing-library/react-hooks';
+import { useSignalHelpers } from './use_signal_helpers';
+import { createStore, State } from '../../store';
+
+describe('useSignalHelpers', () => {
+  const wrapperContainer: React.FC<{ children?: React.ReactNode }> = ({ children }) => (
+    <TestProviders>{children}</TestProviders>
+  );
+
+  test('Default state, does not need init and does not need poll', async () => {
+    await act(async () => {
+      const { result, waitForNextUpdate } = renderHook(() => useSignalHelpers(), {
+        wrapper: wrapperContainer,
+      });
+      await waitForNextUpdate();
+      expect(result.current.signalIndexNeedsInit).toEqual(false);
+      expect(result.current.pollForSignalIndex).toEqual(undefined);
+    });
+  });
+  test('Needs init and does not need poll when signal index is not yet in default data view', async () => {
+    const state: State = {
+      ...mockGlobalState,
+      sourcerer: {
+        ...mockGlobalState.sourcerer,
+        defaultDataView: {
+          ...mockGlobalState.sourcerer.defaultDataView,
+          title: `auditbeat-*,packetbeat-*`,
+          patternList: ['packetbeat-*', 'auditbeat-*'],
+        },
+        kibanaDataViews: [
+          {
+            ...mockGlobalState.sourcerer.defaultDataView,
+            title: `auditbeat-*,packetbeat-*`,
+            patternList: ['packetbeat-*', 'auditbeat-*'],
+          },
+        ],
+      },
+    };
+    const { storage } = createSecuritySolutionStorageMock();
+    const store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
+    await act(async () => {
+      const { result, waitForNextUpdate } = renderHook(() => useSignalHelpers(), {
+        wrapper: ({ children }) => <TestProviders store={store}>{children}</TestProviders>,
+      });
+      await waitForNextUpdate();
+      expect(result.current.signalIndexNeedsInit).toEqual(true);
+      expect(result.current.pollForSignalIndex).toEqual(undefined);
+    });
+  });
+  test('Init happened and signal index does not have data yet, poll function becomes available', async () => {
+    const state: State = {
+      ...mockGlobalState,
+      sourcerer: {
+        ...mockGlobalState.sourcerer,
+        defaultDataView: {
+          ...mockGlobalState.sourcerer.defaultDataView,
+          title: `auditbeat-*,packetbeat-*,${mockGlobalState.sourcerer.signalIndexName}`,
+          patternList: ['packetbeat-*', 'auditbeat-*'],
+        },
+        kibanaDataViews: [
+          {
+            ...mockGlobalState.sourcerer.defaultDataView,
+            title: `auditbeat-*,packetbeat-*,${mockGlobalState.sourcerer.signalIndexName}`,
+            patternList: ['packetbeat-*', 'auditbeat-*'],
+          },
+        ],
+      },
+    };
+    const { storage } = createSecuritySolutionStorageMock();
+    const store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
+    await act(async () => {
+      const { result, waitForNextUpdate } = renderHook(() => useSignalHelpers(), {
+        wrapper: ({ children }) => <TestProviders store={store}>{children}</TestProviders>,
+      });
+      await waitForNextUpdate();
+      expect(result.current.signalIndexNeedsInit).toEqual(false);
+      expect(result.current.pollForSignalIndex).not.toEqual(undefined);
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/common/containers/sourcerer/use_signal_helpers.tsx b/x-pack/plugins/security_solution/public/common/containers/sourcerer/use_signal_helpers.tsx
new file mode 100644
index 0000000000000..602997361f38b
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/containers/sourcerer/use_signal_helpers.tsx
@@ -0,0 +1,92 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useCallback, useMemo, useRef } from 'react';
+import { i18n } from '@kbn/i18n';
+import { useDispatch } from 'react-redux';
+import { sourcererSelectors } from '../../store';
+import { useDeepEqualSelector } from '../../hooks/use_selector';
+import { useSourcererDataView } from '.';
+import { SourcererScopeName } from '../../store/sourcerer/model';
+import { postSourcererDataView } from './api';
+import { sourcererActions } from '../../store/sourcerer';
+import { useDataView } from '../source/use_data_view';
+import { useAppToasts } from '../../hooks/use_app_toasts';
+
+export const useSignalHelpers = (): {
+  /* when defined, signal index has been initiated but does not exist */
+  pollForSignalIndex?: () => void;
+  /* when false, signal index has been initiated */
+  signalIndexNeedsInit: boolean;
+} => {
+  const { indicesExist } = useSourcererDataView(SourcererScopeName.detections);
+  const { indexFieldsSearch } = useDataView();
+  const dispatch = useDispatch();
+  const { addError } = useAppToasts();
+  const abortCtrl = useRef(new AbortController());
+
+  const getDefaultDataViewSelector = useMemo(
+    () => sourcererSelectors.defaultDataViewSelector(),
+    []
+  );
+  const getSignalIndexNameSelector = useMemo(
+    () => sourcererSelectors.signalIndexNameSelector(),
+    []
+  );
+  const signalIndexNameSourcerer = useDeepEqualSelector(getSignalIndexNameSelector);
+  const defaultDataView = useDeepEqualSelector(getDefaultDataViewSelector);
+
+  const signalIndexNeedsInit = useMemo(
+    () => !defaultDataView.title.includes(`${signalIndexNameSourcerer}`),
+    [defaultDataView.title, signalIndexNameSourcerer]
+  );
+  const shouldWePollForIndex = useMemo(
+    () => !indicesExist && !signalIndexNeedsInit,
+    [indicesExist, signalIndexNeedsInit]
+  );
+
+  const pollForSignalIndex = useCallback(() => {
+    const asyncSearch = async () => {
+      abortCtrl.current = new AbortController();
+      try {
+        const response = await postSourcererDataView({
+          body: { patternList: defaultDataView.title.split(',') },
+          signal: abortCtrl.current.signal,
+        });
+
+        if (
+          signalIndexNameSourcerer !== null &&
+          response.defaultDataView.patternList.includes(signalIndexNameSourcerer)
+        ) {
+          // first time signals is defined and validated in the sourcerer
+          // redo indexFieldsSearch
+          indexFieldsSearch(response.defaultDataView.id);
+          dispatch(sourcererActions.setSourcererDataViews(response));
+        }
+      } catch (err) {
+        addError(err, {
+          title: i18n.translate('xpack.securitySolution.sourcerer.error.title', {
+            defaultMessage: 'Error updating Security Data View',
+          }),
+          toastMessage: i18n.translate('xpack.securitySolution.sourcerer.error.toastMessage', {
+            defaultMessage: 'Refresh the page',
+          }),
+        });
+      }
+    };
+
+    if (signalIndexNameSourcerer !== null) {
+      abortCtrl.current.abort();
+      asyncSearch();
+    }
+  }, [addError, defaultDataView.title, dispatch, indexFieldsSearch, signalIndexNameSourcerer]);
+
+  return {
+    ...(shouldWePollForIndex ? { pollForSignalIndex } : {}),
+    signalIndexNeedsInit,
+  };
+};
diff --git a/x-pack/plugins/security_solution/public/common/lib/keury/index.ts b/x-pack/plugins/security_solution/public/common/lib/keury/index.ts
index 1e7574cdae26d..b9f2f9a297bce 100644
--- a/x-pack/plugins/security_solution/public/common/lib/keury/index.ts
+++ b/x-pack/plugins/security_solution/public/common/lib/keury/index.ts
@@ -14,12 +14,12 @@ import {
   buildEsQuery,
   toElasticsearchQuery,
   fromKueryExpression,
-  IndexPatternBase,
+  DataViewBase,
 } from '@kbn/es-query';
 
 export const convertKueryToElasticSearchQuery = (
   kueryExpression: string,
-  indexPattern?: IndexPatternBase
+  indexPattern?: DataViewBase
 ) => {
   try {
     return kueryExpression
@@ -30,10 +30,7 @@ export const convertKueryToElasticSearchQuery = (
   }
 };
 
-export const convertKueryToDslFilter = (
-  kueryExpression: string,
-  indexPattern: IndexPatternBase
-) => {
+export const convertKueryToDslFilter = (kueryExpression: string, indexPattern: DataViewBase) => {
   try {
     return kueryExpression
       ? toElasticsearchQuery(fromKueryExpression(kueryExpression), indexPattern)
@@ -75,7 +72,7 @@ export const convertToBuildEsQuery = ({
   filters,
 }: {
   config: EsQueryConfig;
-  indexPattern: IndexPatternBase;
+  indexPattern: DataViewBase;
   queries: Query[];
   filters: Filter[];
 }): [string, undefined] | [undefined, Error] => {
diff --git a/x-pack/plugins/security_solution/public/common/mock/global_state.ts b/x-pack/plugins/security_solution/public/common/mock/global_state.ts
index cb6536d585c1e..2d804392580d0 100644
--- a/x-pack/plugins/security_solution/public/common/mock/global_state.ts
+++ b/x-pack/plugins/security_solution/public/common/mock/global_state.ts
@@ -26,6 +26,8 @@ import {
   DEFAULT_INTERVAL_TYPE,
   DEFAULT_INTERVAL_VALUE,
   DEFAULT_INDEX_PATTERN,
+  DEFAULT_DATA_VIEW_ID,
+  DEFAULT_SIGNALS_INDEX,
 } from '../../../common/constants';
 import { networkModel } from '../../network/store';
 import { uebaModel } from '../../ueba/store';
@@ -33,9 +35,30 @@ import { TimelineType, TimelineStatus, TimelineTabs } from '../../../common/type
 import { mockManagementState } from '../../management/store/reducer';
 import { ManagementState } from '../../management/types';
 import { initialSourcererState, SourcererScopeName } from '../store/sourcerer/model';
-import { mockBrowserFields, mockDocValueFields } from '../containers/source/mock';
-import { mockIndexPattern } from './index_pattern';
 import { allowedExperimentalValues } from '../../../common/experimental_features';
+import { getScopePatternListSelection } from '../store/sourcerer/helpers';
+import {
+  mockBrowserFields,
+  mockDocValueFields,
+  mockIndexFields,
+  mockRuntimeMappings,
+} from '../containers/source/mock';
+
+export const mockSourcererState = {
+  ...initialSourcererState,
+  signalIndexName: `${DEFAULT_SIGNALS_INDEX}-spacename`,
+  defaultDataView: {
+    ...initialSourcererState.defaultDataView,
+    browserFields: mockBrowserFields,
+    docValueFields: mockDocValueFields,
+    id: DEFAULT_DATA_VIEW_ID,
+    indexFields: mockIndexFields,
+    loading: false,
+    patternList: [...DEFAULT_INDEX_PATTERN, `${DEFAULT_SIGNALS_INDEX}-spacename`],
+    runtimeMappings: mockRuntimeMappings,
+    title: [...DEFAULT_INDEX_PATTERN, `${DEFAULT_SIGNALS_INDEX}-spacename`].join(','),
+  },
+};
 
 export const mockGlobalState: State = {
   app: {
@@ -241,6 +264,7 @@ export const mockGlobalState: State = {
       test: {
         activeTab: TimelineTabs.query,
         prevActiveTab: TimelineTabs.notes,
+        dataViewId: DEFAULT_DATA_VIEW_ID,
         deletedEventIds: [],
         documentType: '',
         queryFields: [],
@@ -294,24 +318,48 @@ export const mockGlobalState: State = {
     insertTimeline: null,
   },
   sourcerer: {
-    ...initialSourcererState,
+    ...mockSourcererState,
+    defaultDataView: {
+      ...mockSourcererState.defaultDataView,
+      title: `${mockSourcererState.defaultDataView.title},fakebeat-*`,
+    },
+    kibanaDataViews: [
+      {
+        ...mockSourcererState.defaultDataView,
+        title: `${mockSourcererState.defaultDataView.title},fakebeat-*`,
+      },
+    ],
     sourcererScopes: {
-      ...initialSourcererState.sourcererScopes,
+      ...mockSourcererState.sourcererScopes,
       [SourcererScopeName.default]: {
-        ...initialSourcererState.sourcererScopes[SourcererScopeName.default],
-        selectedPatterns: DEFAULT_INDEX_PATTERN,
-        browserFields: mockBrowserFields,
-        indexPattern: mockIndexPattern,
-        docValueFields: mockDocValueFields,
-        loading: false,
+        ...mockSourcererState.sourcererScopes[SourcererScopeName.default],
+        selectedDataViewId: mockSourcererState.defaultDataView.id,
+        selectedPatterns: getScopePatternListSelection(
+          mockSourcererState.defaultDataView,
+          SourcererScopeName.default,
+          mockSourcererState.signalIndexName,
+          true
+        ),
+      },
+      [SourcererScopeName.detections]: {
+        ...mockSourcererState.sourcererScopes[SourcererScopeName.detections],
+        selectedDataViewId: mockSourcererState.defaultDataView.id,
+        selectedPatterns: getScopePatternListSelection(
+          mockSourcererState.defaultDataView,
+          SourcererScopeName.detections,
+          mockSourcererState.signalIndexName,
+          true
+        ),
       },
       [SourcererScopeName.timeline]: {
-        ...initialSourcererState.sourcererScopes[SourcererScopeName.timeline],
-        selectedPatterns: DEFAULT_INDEX_PATTERN,
-        browserFields: mockBrowserFields,
-        indexPattern: mockIndexPattern,
-        docValueFields: mockDocValueFields,
-        loading: false,
+        ...mockSourcererState.sourcererScopes[SourcererScopeName.timeline],
+        selectedDataViewId: mockSourcererState.defaultDataView.id,
+        selectedPatterns: getScopePatternListSelection(
+          mockSourcererState.defaultDataView,
+          SourcererScopeName.timeline,
+          mockSourcererState.signalIndexName,
+          true
+        ),
       },
     },
   },
diff --git a/x-pack/plugins/security_solution/public/common/mock/index_pattern.ts b/x-pack/plugins/security_solution/public/common/mock/index_pattern.ts
index d19d6ee734654..a03976f0f7e76 100644
--- a/x-pack/plugins/security_solution/public/common/mock/index_pattern.ts
+++ b/x-pack/plugins/security_solution/public/common/mock/index_pattern.ts
@@ -5,9 +5,9 @@
  * 2.0.
  */
 
-import { IIndexPattern } from '../../../../../../src/plugins/data/common';
+import { SecuritySolutionDataViewBase } from '../types';
 
-export const mockIndexPattern: IIndexPattern = {
+export const mockIndexPattern: SecuritySolutionDataViewBase = {
   fields: [
     {
       name: '@timestamp',
diff --git a/x-pack/plugins/security_solution/public/common/mock/timeline_results.ts b/x-pack/plugins/security_solution/public/common/mock/timeline_results.ts
index 80899324fe92f..a6c16a82deca0 100644
--- a/x-pack/plugins/security_solution/public/common/mock/timeline_results.ts
+++ b/x-pack/plugins/security_solution/public/common/mock/timeline_results.ts
@@ -1955,6 +1955,7 @@ export const mockTimelineModel: TimelineModel = {
   columns: mockTimelineModelColumns,
   defaultColumns: mockTimelineModelColumns,
   dataProviders: [],
+  dataViewId: '',
   dateRange: {
     end: '2020-03-18T13:52:38.929Z',
     start: '2020-03-18T13:46:38.929Z',
@@ -2091,6 +2092,7 @@ export const defaultTimelineProps: CreateTimelineProps = {
         queryMatch: { field: '_id', operator: ':', value: '1' },
       },
     ],
+    dataViewId: '',
     dateRange: { end: '2018-11-05T19:03:25.937Z', start: '2018-11-05T18:58:25.937Z' },
     deletedEventIds: [],
     description: '',
diff --git a/x-pack/plugins/security_solution/public/common/store/reducer.test.ts b/x-pack/plugins/security_solution/public/common/store/reducer.test.ts
index 6b4d61035258d..1cbf08c354b33 100644
--- a/x-pack/plugins/security_solution/public/common/store/reducer.test.ts
+++ b/x-pack/plugins/security_solution/public/common/store/reducer.test.ts
@@ -5,10 +5,15 @@
  * 2.0.
  */
 
-import { parseExperimentalConfigValue } from '../../..//common/experimental_features';
+import { parseExperimentalConfigValue } from '../../../common/experimental_features';
 import { SecuritySubPlugins } from '../../app/types';
 import { createInitialState } from './reducer';
+import { mockSourcererState } from '../mock';
+import { useSourcererDataView } from '../containers/sourcerer';
+import { useDeepEqualSelector } from '../hooks/use_selector';
+import { renderHook } from '@testing-library/react-hooks';
 
+jest.mock('../hooks/use_selector');
 jest.mock('../lib/kibana', () => ({
   KibanaServices: {
     get: jest.fn(() => ({ uiSettings: { get: () => ({ from: 'now-24h', to: 'now' }) } })),
@@ -21,26 +26,38 @@ describe('createInitialState', () => {
       SecuritySubPlugins['store']['initialState'],
       'app' | 'dragAndDrop' | 'inputs' | 'sourcerer'
     >;
-    test('indicesExist should be TRUE if configIndexPatterns is NOT empty', () => {
-      const initState = createInitialState(mockPluginState, {
-        kibanaIndexPatterns: [{ id: '1234567890987654321', title: 'mock-kibana' }],
-        configIndexPatterns: ['auditbeat-*', 'filebeat'],
-        signalIndexName: 'siem-signals-default',
-        enableExperimental: parseExperimentalConfigValue([]),
-      });
+    const defaultState = {
+      defaultDataView: mockSourcererState.defaultDataView,
+      enableExperimental: parseExperimentalConfigValue([]),
+      kibanaDataViews: [mockSourcererState.defaultDataView],
+      signalIndexName: 'siem-signals-default',
+    };
+    const initState = createInitialState(mockPluginState, defaultState);
+    beforeEach(() => {
+      (useDeepEqualSelector as jest.Mock).mockImplementation((cb) => cb(initState));
+    });
+    afterEach(() => {
+      (useDeepEqualSelector as jest.Mock).mockClear();
+    });
 
-      expect(initState.sourcerer?.sourcererScopes.default.indicesExist).toEqual(true);
+    test('indicesExist should be TRUE if configIndexPatterns is NOT empty', async () => {
+      const { result } = renderHook(() => useSourcererDataView());
+      expect(result.current.indicesExist).toEqual(true);
     });
 
     test('indicesExist should be FALSE if configIndexPatterns is empty', () => {
-      const initState = createInitialState(mockPluginState, {
-        kibanaIndexPatterns: [{ id: '1234567890987654321', title: 'mock-kibana' }],
-        configIndexPatterns: [],
-        signalIndexName: 'siem-signals-default',
-        enableExperimental: parseExperimentalConfigValue([]),
+      const state = createInitialState(mockPluginState, {
+        ...defaultState,
+        defaultDataView: {
+          ...defaultState.defaultDataView,
+          id: '',
+          title: '',
+          patternList: [],
+        },
       });
-
-      expect(initState.sourcerer?.sourcererScopes.default.indicesExist).toEqual(false);
+      (useDeepEqualSelector as jest.Mock).mockImplementation((cb) => cb(state));
+      const { result } = renderHook(() => useSourcererDataView());
+      expect(result.current.indicesExist).toEqual(false);
     });
   });
 });
diff --git a/x-pack/plugins/security_solution/public/common/store/reducer.ts b/x-pack/plugins/security_solution/public/common/store/reducer.ts
index 4a6009b2e41a8..9faa00ae20bb8 100644
--- a/x-pack/plugins/security_solution/public/common/store/reducer.ts
+++ b/x-pack/plugins/security_solution/public/common/store/reducer.ts
@@ -21,15 +21,15 @@ import { SecuritySubPlugins } from '../../app/types';
 import { ManagementPluginReducer } from '../../management';
 import { State } from './types';
 import { AppAction } from './actions';
-import { KibanaIndexPatterns } from './sourcerer/model';
+import { initDataView, SourcererModel, SourcererScopeName } from './sourcerer/model';
 import { ExperimentalFeatures } from '../../../common/experimental_features';
+import { getScopePatternListSelection } from './sourcerer/helpers';
 
 export type SubPluginsInitReducer = HostsPluginReducer &
   UebaPluginReducer &
   NetworkPluginReducer &
   TimelinePluginReducer &
   ManagementPluginReducer;
-
 /**
  * Factory for the 'initialState' that is used to preload state into the Security App's redux store.
  */
@@ -39,17 +39,38 @@ export const createInitialState = (
     'app' | 'dragAndDrop' | 'inputs' | 'sourcerer'
   >,
   {
-    kibanaIndexPatterns,
-    configIndexPatterns,
+    defaultDataView,
+    kibanaDataViews,
     signalIndexName,
     enableExperimental,
   }: {
-    kibanaIndexPatterns: KibanaIndexPatterns;
-    configIndexPatterns: string[];
-    signalIndexName: string | null;
+    defaultDataView: SourcererModel['defaultDataView'];
+    kibanaDataViews: SourcererModel['kibanaDataViews'];
+    signalIndexName: SourcererModel['signalIndexName'];
     enableExperimental: ExperimentalFeatures;
   }
 ): State => {
+  const initialPatterns = {
+    [SourcererScopeName.default]: getScopePatternListSelection(
+      defaultDataView,
+      SourcererScopeName.default,
+      signalIndexName,
+      true
+    ),
+    [SourcererScopeName.detections]: getScopePatternListSelection(
+      defaultDataView,
+      SourcererScopeName.detections,
+      signalIndexName,
+      true
+    ),
+    [SourcererScopeName.timeline]: getScopePatternListSelection(
+      defaultDataView,
+      SourcererScopeName.timeline,
+      signalIndexName,
+      true
+    ),
+  };
+
   const preloadedState: State = {
     ...pluginsInitState,
     app: { ...initialAppState, enableExperimental },
@@ -59,13 +80,24 @@ export const createInitialState = (
       ...sourcererModel.initialSourcererState,
       sourcererScopes: {
         ...sourcererModel.initialSourcererState.sourcererScopes,
-        default: {
+        [SourcererScopeName.default]: {
           ...sourcererModel.initialSourcererState.sourcererScopes.default,
-          indicesExist: configIndexPatterns.length > 0,
+          selectedDataViewId: defaultDataView.id,
+          selectedPatterns: initialPatterns[SourcererScopeName.default],
+        },
+        [SourcererScopeName.detections]: {
+          ...sourcererModel.initialSourcererState.sourcererScopes.detections,
+          selectedDataViewId: defaultDataView.id,
+          selectedPatterns: initialPatterns[SourcererScopeName.detections],
+        },
+        [SourcererScopeName.timeline]: {
+          ...sourcererModel.initialSourcererState.sourcererScopes.timeline,
+          selectedDataViewId: defaultDataView.id,
+          selectedPatterns: initialPatterns[SourcererScopeName.timeline],
         },
       },
-      kibanaIndexPatterns,
-      configIndexPatterns,
+      defaultDataView,
+      kibanaDataViews: kibanaDataViews.map((dataView) => ({ ...initDataView, ...dataView })),
       signalIndexName,
     },
   };
diff --git a/x-pack/plugins/security_solution/public/common/store/routing/index.ts b/x-pack/plugins/security_solution/public/common/store/routing/index.ts
index 1b13b70063f55..2ea4a93a81758 100644
--- a/x-pack/plugins/security_solution/public/common/store/routing/index.ts
+++ b/x-pack/plugins/security_solution/public/common/store/routing/index.ts
@@ -5,4 +5,4 @@
  * 2.0.
  */
 
-export { RoutingAction } from './action';
+export type { RoutingAction } from './action';
diff --git a/x-pack/plugins/security_solution/public/common/store/sourcerer/actions.ts b/x-pack/plugins/security_solution/public/common/store/sourcerer/actions.ts
index 5162776d3ddf5..aa0689de9cca3 100644
--- a/x-pack/plugins/security_solution/public/common/store/sourcerer/actions.ts
+++ b/x-pack/plugins/security_solution/public/common/store/sourcerer/actions.ts
@@ -8,35 +8,39 @@
 import actionCreatorFactory from 'typescript-fsa';
 import { TimelineEventsType } from '../../../../common/types/timeline';
 
-import { KibanaIndexPatterns, ManageScopeInit, SourcererScopeName } from './model';
+import { SourcererDataView, SourcererScopeName } from './model';
+import { SecurityDataView } from '../../containers/sourcerer/api';
 
 const actionCreator = actionCreatorFactory('x-pack/security_solution/local/sourcerer');
 
-export const setSource = actionCreator<{
-  id: SourcererScopeName;
-  payload: ManageScopeInit;
-}>('SET_SOURCE');
+export const setDataView = actionCreator<{
+  browserFields: SourcererDataView['browserFields'];
+  docValueFields: SourcererDataView['docValueFields'];
+  id: SourcererDataView['id'];
+  indexFields: SourcererDataView['indexFields'];
+  loading: SourcererDataView['loading'];
+  runtimeMappings: SourcererDataView['runtimeMappings'];
+}>('SET_DATA_VIEW');
 
-export const setIndexPatternsList = actionCreator<{
-  kibanaIndexPatterns: KibanaIndexPatterns;
-  configIndexPatterns: string[];
-}>('SET_INDEX_PATTERNS_LIST');
+export const setDataViewLoading = actionCreator<{
+  id: string;
+  loading: boolean;
+}>('SET_DATA_VIEW_LOADING');
 
 export const setSignalIndexName =
   actionCreator<{ signalIndexName: string }>('SET_SIGNAL_INDEX_NAME');
 
-export const setSourcererScopeLoading = actionCreator<{ id: SourcererScopeName; loading: boolean }>(
-  'SET_SOURCERER_SCOPE_LOADING'
-);
+export const setSourcererDataViews = actionCreator<SecurityDataView>('SET_SOURCERER_DATA_VIEWS');
 
-export const setSelectedIndexPatterns = actionCreator<{
-  id: SourcererScopeName;
-  selectedPatterns: string[];
-  eventType?: TimelineEventsType;
-}>('SET_SELECTED_INDEX_PATTERNS');
+export const setSourcererScopeLoading = actionCreator<{
+  id?: SourcererScopeName;
+  loading: boolean;
+}>('SET_SOURCERER_SCOPE_LOADING');
 
-export const initTimelineIndexPatterns = actionCreator<{
+export interface SelectedDataViewPayload {
   id: SourcererScopeName;
+  selectedDataViewId: string;
   selectedPatterns: string[];
   eventType?: TimelineEventsType;
-}>('INIT_TIMELINE_INDEX_PATTERNS');
+}
+export const setSelectedDataView = actionCreator<SelectedDataViewPayload>('SET_SELECTED_DATA_VIEW');
diff --git a/x-pack/plugins/security_solution/public/common/store/sourcerer/helpers.test.ts b/x-pack/plugins/security_solution/public/common/store/sourcerer/helpers.test.ts
index f498cb640317a..83a556442f849 100644
--- a/x-pack/plugins/security_solution/public/common/store/sourcerer/helpers.test.ts
+++ b/x-pack/plugins/security_solution/public/common/store/sourcerer/helpers.test.ts
@@ -5,58 +5,242 @@
  * 2.0.
  */
 
-import { createDefaultIndexPatterns, Args } from './helpers';
-import { initialSourcererState, SourcererScopeName } from './model';
+import { mockGlobalState } from '../../mock';
+import { SourcererScopeName } from './model';
+import {
+  defaultDataViewByEventType,
+  getScopePatternListSelection,
+  validateSelectedPatterns,
+} from './helpers';
 
-let defaultArgs: Args = {
-  eventType: 'all',
-  id: SourcererScopeName.default,
-  selectedPatterns: ['auditbeat-*', 'packetbeat-*'],
-  state: {
-    ...initialSourcererState,
-    configIndexPatterns: ['filebeat-*', 'auditbeat-*', 'packetbeat-*'],
-    kibanaIndexPatterns: [{ id: '123', title: 'journalbeat-*' }],
-    signalIndexName: 'signals-*',
-  },
+const signalIndexName = mockGlobalState.sourcerer.signalIndexName;
+
+const dataView = {
+  ...mockGlobalState.sourcerer.defaultDataView,
+  title: `auditbeat-*,packetbeat-*,${signalIndexName}`,
+  patternList: ['packetbeat-*', 'auditbeat-*', `${signalIndexName}`],
 };
-const eventTypes: Array<Args['eventType']> = ['all', 'raw', 'alert', 'signal', 'custom'];
-const ids: Array<Args['id']> = [
-  SourcererScopeName.default,
-  SourcererScopeName.detections,
-  SourcererScopeName.timeline,
-];
-describe('createDefaultIndexPatterns', () => {
-  ids.forEach((id) => {
-    eventTypes.forEach((et) => {
-      describe(`id: ${id}, eventType: ${et}`, () => {
-        beforeEach(() => {
-          defaultArgs = {
-            ...defaultArgs,
-            id,
-            eventType: et,
-          };
+const patternListNoSignals = mockGlobalState.sourcerer.defaultDataView.patternList
+  .filter((p) => p !== signalIndexName)
+  .sort();
+const patternListSignals = [
+  signalIndexName,
+  ...mockGlobalState.sourcerer.defaultDataView.patternList.filter((p) => p !== signalIndexName),
+].sort();
+
+describe('sourcerer store helpers', () => {
+  describe('getScopePatternListSelection', () => {
+    it('is not a default data view, returns patternList sorted', () => {
+      const result = getScopePatternListSelection(
+        {
+          ...dataView,
+          id: '1234',
+        },
+        SourcererScopeName.default,
+        signalIndexName,
+        false
+      );
+      expect(result).toEqual([`${signalIndexName}`, 'auditbeat-*', 'packetbeat-*']);
+    });
+    it('default data view, SourcererScopeName.timeline, returns patternList sorted', () => {
+      const result = getScopePatternListSelection(
+        dataView,
+        SourcererScopeName.timeline,
+        signalIndexName,
+        true
+      );
+      expect(result).toEqual([signalIndexName, 'auditbeat-*', 'packetbeat-*']);
+    });
+    it('default data view, SourcererScopeName.default, returns patternList sorted without signals index', () => {
+      const result = getScopePatternListSelection(
+        dataView,
+        SourcererScopeName.default,
+        signalIndexName,
+        true
+      );
+      expect(result).toEqual(['auditbeat-*', 'packetbeat-*']);
+    });
+    it('default data view, SourcererScopeName.detections, returns patternList with only signals index', () => {
+      const result = getScopePatternListSelection(
+        dataView,
+        SourcererScopeName.detections,
+        signalIndexName,
+        true
+      );
+      expect(result).toEqual([signalIndexName]);
+    });
+  });
+  describe('validateSelectedPatterns', () => {
+    const payload = {
+      id: SourcererScopeName.default,
+      selectedDataViewId: dataView.id,
+      selectedPatterns: ['auditbeat-*'],
+    };
+    it('sets selectedPattern', () => {
+      const result = validateSelectedPatterns(mockGlobalState.sourcerer, payload);
+      expect(result).toEqual({
+        [SourcererScopeName.default]: {
+          ...mockGlobalState.sourcerer.sourcererScopes[SourcererScopeName.default],
+          selectedPatterns: ['auditbeat-*'],
+        },
+      });
+    });
+    it('sets to default when empty array is passed and scope is default', () => {
+      const result = validateSelectedPatterns(mockGlobalState.sourcerer, {
+        ...payload,
+        selectedPatterns: [],
+      });
+      expect(result).toEqual({
+        [SourcererScopeName.default]: {
+          ...mockGlobalState.sourcerer.sourcererScopes[SourcererScopeName.default],
+          selectedPatterns: patternListNoSignals,
+        },
+      });
+    });
+    it('sets to default when empty array is passed and scope is detections', () => {
+      const result = validateSelectedPatterns(mockGlobalState.sourcerer, {
+        ...payload,
+        id: SourcererScopeName.detections,
+        selectedPatterns: [],
+      });
+      expect(result).toEqual({
+        [SourcererScopeName.detections]: {
+          ...mockGlobalState.sourcerer.sourcererScopes[SourcererScopeName.detections],
+          selectedDataViewId: dataView.id,
+          selectedPatterns: [signalIndexName],
+        },
+      });
+    });
+    it('sets to default when empty array is passed and scope is timeline', () => {
+      const result = validateSelectedPatterns(mockGlobalState.sourcerer, {
+        ...payload,
+        id: SourcererScopeName.timeline,
+        selectedPatterns: [],
+      });
+      expect(result).toEqual({
+        [SourcererScopeName.timeline]: {
+          ...mockGlobalState.sourcerer.sourcererScopes[SourcererScopeName.timeline],
+          selectedDataViewId: dataView.id,
+          selectedPatterns: [
+            signalIndexName,
+            ...mockGlobalState.sourcerer.defaultDataView.patternList.filter(
+              (p) => p !== signalIndexName
+            ),
+          ].sort(),
+        },
+      });
+    });
+    describe('handles missing dataViewId, 7.16 -> 8.0', () => {
+      it('selectedPatterns.length > 0 & all selectedPatterns exist in defaultDataView, set dataViewId to defaultDataView.id', () => {
+        const result = validateSelectedPatterns(mockGlobalState.sourcerer, {
+          ...payload,
+          id: SourcererScopeName.timeline,
+          selectedDataViewId: '',
+          selectedPatterns: [
+            mockGlobalState.sourcerer.defaultDataView.patternList[3],
+            mockGlobalState.sourcerer.defaultDataView.patternList[4],
+          ],
         });
-        it('Selected patterns', () => {
-          const result = createDefaultIndexPatterns(defaultArgs);
-          expect(result).toEqual(['auditbeat-*', 'packetbeat-*']);
+        expect(result).toEqual({
+          [SourcererScopeName.timeline]: {
+            ...mockGlobalState.sourcerer.sourcererScopes[SourcererScopeName.timeline],
+            selectedDataViewId: dataView.id,
+            selectedPatterns: [
+              mockGlobalState.sourcerer.defaultDataView.patternList[3],
+              mockGlobalState.sourcerer.defaultDataView.patternList[4],
+            ],
+          },
         });
-        it('No selected patterns', () => {
-          const newArgs = {
-            ...defaultArgs,
-            selectedPatterns: [],
-          };
-          const result = createDefaultIndexPatterns(newArgs);
-          if (
-            id === SourcererScopeName.detections ||
-            (id === SourcererScopeName.timeline && (et === 'alert' || et === 'signal'))
-          ) {
-            expect(result).toEqual(['signals-*']);
-          } else if (id === SourcererScopeName.timeline && et === 'all') {
-            expect(result).toEqual(['filebeat-*', 'auditbeat-*', 'packetbeat-*', 'signals-*']);
-          } else {
-            expect(result).toEqual(['filebeat-*', 'auditbeat-*', 'packetbeat-*']);
-          }
+      });
+      it('selectedPatterns.length > 0 & a pattern in selectedPatterns does not exist in defaultDataView, set dataViewId to null', () => {
+        const result = validateSelectedPatterns(mockGlobalState.sourcerer, {
+          ...payload,
+          id: SourcererScopeName.timeline,
+          selectedDataViewId: '',
+          selectedPatterns: [
+            mockGlobalState.sourcerer.defaultDataView.patternList[3],
+            'journalbeat-*',
+          ],
         });
+        expect(result).toEqual({
+          [SourcererScopeName.timeline]: {
+            ...mockGlobalState.sourcerer.sourcererScopes[SourcererScopeName.timeline],
+            selectedDataViewId: null,
+            selectedPatterns: [
+              mockGlobalState.sourcerer.defaultDataView.patternList[3],
+              'journalbeat-*',
+            ],
+          },
+        });
+      });
+    });
+  });
+  describe('defaultDataViewByEventType', () => {
+    it('defaults with no eventType', () => {
+      const result = defaultDataViewByEventType({ state: mockGlobalState.sourcerer });
+      expect(result).toEqual({
+        selectedDataViewId: dataView.id,
+        selectedPatterns: patternListSignals,
+      });
+    });
+    it('defaults with eventType: all', () => {
+      const result = defaultDataViewByEventType({
+        state: mockGlobalState.sourcerer,
+        eventType: 'all',
+      });
+      expect(result).toEqual({
+        selectedDataViewId: dataView.id,
+        selectedPatterns: patternListSignals,
+      });
+    });
+    it('defaults with eventType: raw', () => {
+      const result = defaultDataViewByEventType({
+        state: mockGlobalState.sourcerer,
+        eventType: 'raw',
+      });
+      expect(result).toEqual({
+        selectedDataViewId: dataView.id,
+        selectedPatterns: patternListNoSignals,
+      });
+    });
+    it('defaults with eventType: alert', () => {
+      const result = defaultDataViewByEventType({
+        state: mockGlobalState.sourcerer,
+        eventType: 'alert',
+      });
+      expect(result).toEqual({
+        selectedDataViewId: dataView.id,
+        selectedPatterns: [signalIndexName],
+      });
+    });
+    it('defaults with eventType: signal', () => {
+      const result = defaultDataViewByEventType({
+        state: mockGlobalState.sourcerer,
+        eventType: 'signal',
+      });
+      expect(result).toEqual({
+        selectedDataViewId: dataView.id,
+        selectedPatterns: [signalIndexName],
+      });
+    });
+    it('defaults with eventType: custom', () => {
+      const result = defaultDataViewByEventType({
+        state: mockGlobalState.sourcerer,
+        eventType: 'custom',
+      });
+      expect(result).toEqual({
+        selectedDataViewId: dataView.id,
+        selectedPatterns: patternListSignals,
+      });
+    });
+    it('defaults with eventType: eql', () => {
+      const result = defaultDataViewByEventType({
+        state: mockGlobalState.sourcerer,
+        eventType: 'eql',
+      });
+      expect(result).toEqual({
+        selectedDataViewId: dataView.id,
+        selectedPatterns: patternListSignals,
       });
     });
   });
diff --git a/x-pack/plugins/security_solution/public/common/store/sourcerer/helpers.ts b/x-pack/plugins/security_solution/public/common/store/sourcerer/helpers.ts
index fd3a6f1fab3c1..1b4efa72127f3 100644
--- a/x-pack/plugins/security_solution/public/common/store/sourcerer/helpers.ts
+++ b/x-pack/plugins/security_solution/public/common/store/sourcerer/helpers.ts
@@ -6,8 +6,9 @@
  */
 
 import { isEmpty } from 'lodash';
-import { SourcererModel, SourcererScopeName } from './model';
-import { TimelineEventsType } from '../../../../common/types/timeline';
+import { SourcererDataView, SourcererModel, SourcererScopeById, SourcererScopeName } from './model';
+import { TimelineEventsType } from '../../../../common';
+import { SelectedDataViewPayload } from './actions';
 
 export interface Args {
   eventType?: TimelineEventsType;
@@ -15,40 +16,131 @@ export interface Args {
   selectedPatterns: string[];
   state: SourcererModel;
 }
-export const createDefaultIndexPatterns = ({ eventType, id, selectedPatterns, state }: Args) => {
-  const kibanaIndexPatterns = state.kibanaIndexPatterns.map((kip) => kip.title);
-  const newSelectedPatterns = selectedPatterns.filter(
-    (sp) =>
-      state.configIndexPatterns.includes(sp) ||
-      kibanaIndexPatterns.includes(sp) ||
-      (!isEmpty(state.signalIndexName) && state.signalIndexName === sp)
-  );
-  if (isEmpty(newSelectedPatterns)) {
-    let defaultIndexPatterns = state.configIndexPatterns;
-    if (id === SourcererScopeName.timeline && isEmpty(newSelectedPatterns)) {
-      defaultIndexPatterns = defaultIndexPatternByEventType({ state, eventType });
-    } else if (id === SourcererScopeName.detections && isEmpty(newSelectedPatterns)) {
-      defaultIndexPatterns = [state.signalIndexName ?? ''];
+
+export const getScopePatternListSelection = (
+  theDataView: SourcererDataView | undefined,
+  sourcererScope: SourcererScopeName,
+  signalIndexName: SourcererModel['signalIndexName'],
+  isDefaultDataView: boolean
+): string[] => {
+  const patternList: string[] =
+    theDataView != null && theDataView.id !== null ? theDataView.patternList : [];
+
+  if (!isDefaultDataView) {
+    return patternList.sort();
+  }
+  // when our SIEM data view is set, here are the defaults
+  switch (sourcererScope) {
+    case SourcererScopeName.default:
+      return patternList.filter((index) => index !== signalIndexName).sort();
+    case SourcererScopeName.detections:
+      // set to signalIndexName whether or not it exists yet in the patternList
+      return (signalIndexName != null ? [signalIndexName] : []).sort();
+    case SourcererScopeName.timeline:
+      return (
+        signalIndexName != null
+          ? [
+              // remove signalIndexName in case its already in there and add it whether or not it exists yet in the patternList
+              ...patternList.filter((index) => index !== signalIndexName),
+              signalIndexName,
+            ]
+          : patternList
+      ).sort();
+  }
+};
+
+export const validateSelectedPatterns = (
+  state: SourcererModel,
+  payload: SelectedDataViewPayload
+): Partial<SourcererScopeById> => {
+  const { id, eventType, ...rest } = payload;
+  let dataView = state.kibanaDataViews.find((p) => p.id === rest.selectedDataViewId);
+  // dedupe because these could come from a silly url or pre 8.0 timeline
+  const dedupePatterns = [...new Set(rest.selectedPatterns)];
+  let selectedPatterns =
+    dataView != null
+      ? dedupePatterns.filter(
+          (pattern) =>
+            // Typescript is being mean and telling me dataView could be undefined here
+            // so redoing the dataView != null check
+            (dataView != null && dataView.patternList.includes(pattern)) ||
+            // this is a hack, but sometimes signal index is deleted and is getting regenerated. it gets set before it is put in the dataView
+            state.signalIndexName == null
+        )
+      : // 7.16 -> 8.0 this will get hit because dataView == null
+        dedupePatterns;
+  if (selectedPatterns.length > 0 && dataView == null) {
+    // we have index patterns, but not a data view id
+    // find out if we have these index patterns in the defaultDataView
+    const areAllPatternsInDefault = selectedPatterns.every(
+      (pattern) => state.defaultDataView.title.indexOf(pattern) > -1
+    );
+    if (areAllPatternsInDefault) {
+      dataView = state.defaultDataView;
+      selectedPatterns = selectedPatterns.filter(
+        (pattern) => dataView != null && dataView.patternList.includes(pattern)
+      );
     }
-    return defaultIndexPatterns;
   }
-  return newSelectedPatterns;
+
+  // TO DO: Steph/sourcerer If dataView is still undefined here, create temporary dataView
+  // and prompt user to go create this dataView
+  // currently UI will take the undefined dataView and default to defaultDataView anyways
+  // this is a "strategically merged" bug ;)
+  // https://github.com/elastic/security-team/issues/1921
+
+  return {
+    [id]: {
+      ...state.sourcererScopes[id],
+      ...rest,
+      selectedDataViewId: dataView?.id ?? null,
+      selectedPatterns,
+      ...(isEmpty(selectedPatterns)
+        ? id === SourcererScopeName.timeline
+          ? defaultDataViewByEventType({ state, eventType })
+          : {
+              selectedPatterns: getScopePatternListSelection(
+                dataView ?? state.defaultDataView,
+                id,
+                state.signalIndexName,
+                (dataView ?? state.defaultDataView).id === state.defaultDataView.id
+              ),
+            }
+        : {}),
+      loading: false,
+    },
+  };
 };
 
-export const defaultIndexPatternByEventType = ({
+// TODO: Steph/sourcerer eventType will be alerts only, when ui updates delete raw
+export const defaultDataViewByEventType = ({
   state,
   eventType,
 }: {
   state: SourcererModel;
   eventType?: TimelineEventsType;
 }) => {
-  let defaultIndexPatterns = state.configIndexPatterns;
-  if (eventType === 'all' && !isEmpty(state.signalIndexName)) {
-    defaultIndexPatterns = [...state.configIndexPatterns, state.signalIndexName ?? ''];
+  const {
+    signalIndexName,
+    defaultDataView: { id, patternList },
+  } = state;
+  if (signalIndexName != null && (eventType === 'signal' || eventType === 'alert')) {
+    return {
+      selectedPatterns: [signalIndexName],
+      selectedDataViewId: id,
+    };
   } else if (eventType === 'raw') {
-    defaultIndexPatterns = state.configIndexPatterns;
-  } else if (!isEmpty(state.signalIndexName) && (eventType === 'signal' || eventType === 'alert')) {
-    defaultIndexPatterns = [state.signalIndexName ?? ''];
+    return {
+      selectedPatterns: patternList.filter((index) => index !== signalIndexName).sort(),
+      selectedDataViewId: id,
+    };
   }
-  return defaultIndexPatterns;
+  return {
+    selectedPatterns: [
+      // remove signalIndexName in case its already in there and add it whether or not it exists yet in the patternList
+      ...patternList.filter((index) => index !== signalIndexName),
+      signalIndexName,
+    ].sort(),
+    selectedDataViewId: id,
+  };
 };
diff --git a/x-pack/plugins/security_solution/public/common/store/sourcerer/model.ts b/x-pack/plugins/security_solution/public/common/store/sourcerer/model.ts
index 8f7fbd99f932d..a22a04d025d19 100644
--- a/x-pack/plugins/security_solution/public/common/store/sourcerer/model.ts
+++ b/x-pack/plugins/security_solution/public/common/store/sourcerer/model.ts
@@ -5,72 +5,133 @@
  * 2.0.
  */
 
-import { IIndexPattern } from '../../../../../../../src/plugins/data/common';
-import { DocValueFields } from '../../../../common/search_strategy/common';
+import { MappingRuntimeFields } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import {
   BrowserFields,
+  DocValueFields,
   EMPTY_BROWSER_FIELDS,
   EMPTY_DOCVALUE_FIELD,
-  EMPTY_INDEX_PATTERN,
-} from '../../../../common/search_strategy/index_fields';
-
-export type ErrorModel = Error[];
-
+  EMPTY_INDEX_FIELDS,
+} from '../../../../../timelines/common';
+import { SecuritySolutionDataViewBase } from '../../types';
+/** Uniquely identifies a Sourcerer Scope */
 export enum SourcererScopeName {
   default = 'default',
   detections = 'detections',
   timeline = 'timeline',
 }
 
-export interface ManageScope {
-  browserFields: BrowserFields;
-  docValueFields: DocValueFields[];
-  errorMessage: string | null;
+/**
+ * Data related to each sourcerer scope
+ */
+export interface SourcererScope {
+  /** Uniquely identifies a Sourcerer Scope */
   id: SourcererScopeName;
-  indexPattern: Omit<IIndexPattern, 'fieldFormatMap'>;
-  indicesExist: boolean | undefined | null;
+  /** is an update being made to the sourcerer data view */
   loading: boolean;
+  /** selected data view id */
+  selectedDataViewId: string;
+  /** selected patterns within the data view */
   selectedPatterns: string[];
 }
 
-export interface ManageScopeInit extends Partial<ManageScope> {
-  id: SourcererScopeName;
+export type SourcererScopeById = Record<SourcererScopeName, SourcererScope>;
+
+export interface KibanaDataView {
+  /** Uniquely identifies a Kibana Data View */
+  id: string;
+  /**  list of active patterns that return data  */
+  patternList: string[];
+  /**
+   * title of Kibana Data View
+   * title also serves as "all pattern list", including inactive
+   * comma separated string
+   */
+  title: string;
 }
 
-export type SourcererScopeById = Record<SourcererScopeName | string, ManageScope>;
+/**
+ * DataView from Kibana + timelines/index_fields enhanced field data
+ */
+export interface SourcererDataView extends KibanaDataView {
+  /** we need this for @timestamp data */
+  browserFields: BrowserFields;
+  /** we need this for @timestamp data */
+  docValueFields: DocValueFields[];
+  /** comes from dataView.fields.toSpec() */
+  indexFields: SecuritySolutionDataViewBase['fields'];
+  /** set when data view fields are fetched */
+  loading: boolean;
+  /**
+   * Needed to pass to search strategy
+   * Remove once issue resolved: https://github.com/elastic/kibana/issues/111762
+   */
+  runtimeMappings: MappingRuntimeFields;
+}
 
-export type KibanaIndexPatterns = Array<{ id: string; title: string }>;
+/**
+ * Combined data from SourcererDataView and SourcererScope to create
+ * selected data view state
+ */
+export interface SelectedDataView {
+  browserFields: SourcererDataView['browserFields'];
+  dataViewId: SourcererDataView['id'];
+  docValueFields: SourcererDataView['docValueFields'];
+  /**
+   * DataViewBase with enhanced index fields used in timelines
+   */
+  indexPattern: SecuritySolutionDataViewBase;
+  /** do the selected indices exist  */
+  indicesExist: boolean;
+  /** is an update being made to the data view */
+  loading: boolean;
+  /** all active & inactive patterns from SourcererDataView['title']  */
+  patternList: string[];
+  runtimeMappings: SourcererDataView['runtimeMappings'];
+  /** all selected patterns from SourcererScope['selectedPatterns']  */
+  selectedPatterns: string[];
+}
 
-// ManageSourcerer
+/**
+ * sourcerer model for redux
+ */
 export interface SourcererModel {
-  kibanaIndexPatterns: KibanaIndexPatterns;
-  configIndexPatterns: string[];
+  /** default security-solution data view */
+  defaultDataView: SourcererDataView & { error?: unknown };
+  /** all Kibana data views, including security-solution */
+  kibanaDataViews: SourcererDataView[];
+  /** security solution signals index name */
   signalIndexName: string | null;
+  /** sourcerer scope data by id */
   sourcererScopes: SourcererScopeById;
 }
 
-export const initSourcererScope: Pick<
-  ManageScope,
-  | 'browserFields'
-  | 'docValueFields'
-  | 'errorMessage'
-  | 'indexPattern'
-  | 'indicesExist'
-  | 'loading'
-  | 'selectedPatterns'
-> = {
+export type SourcererUrlState = Partial<{
+  [id in SourcererScopeName]: {
+    id: string;
+    selectedPatterns: string[];
+  };
+}>;
+
+export const initSourcererScope: Omit<SourcererScope, 'id'> = {
+  loading: false,
+  selectedDataViewId: '',
+  selectedPatterns: [],
+};
+export const initDataView = {
   browserFields: EMPTY_BROWSER_FIELDS,
   docValueFields: EMPTY_DOCVALUE_FIELD,
-  errorMessage: null,
-  indexPattern: EMPTY_INDEX_PATTERN,
-  indicesExist: true,
+  id: '',
+  indexFields: EMPTY_INDEX_FIELDS,
   loading: false,
-  selectedPatterns: [],
+  patternList: [],
+  runtimeMappings: {},
+  title: '',
 };
 
 export const initialSourcererState: SourcererModel = {
-  kibanaIndexPatterns: [],
-  configIndexPatterns: [],
+  defaultDataView: initDataView,
+  kibanaDataViews: [],
   signalIndexName: null,
   sourcererScopes: {
     [SourcererScopeName.default]: {
@@ -87,8 +148,3 @@ export const initialSourcererState: SourcererModel = {
     },
   },
 };
-
-export type FSourcererScopePatterns = {
-  [id in SourcererScopeName]: string[];
-};
-export type SourcererScopePatterns = Partial<FSourcererScopePatterns>;
diff --git a/x-pack/plugins/security_solution/public/common/store/sourcerer/reducer.ts b/x-pack/plugins/security_solution/public/common/store/sourcerer/reducer.ts
index 662671e1dda3a..e1747a6786cdb 100644
--- a/x-pack/plugins/security_solution/public/common/store/sourcerer/reducer.ts
+++ b/x-pack/plugins/security_solution/public/common/store/sourcerer/reducer.ts
@@ -5,83 +5,89 @@
  * 2.0.
  */
 
-import { isEmpty } from 'lodash/fp';
 import { reducerWithInitialState } from 'typescript-fsa-reducers';
 
 import {
-  setIndexPatternsList,
+  setSourcererDataViews,
   setSourcererScopeLoading,
-  setSelectedIndexPatterns,
+  setSelectedDataView,
   setSignalIndexName,
-  setSource,
-  initTimelineIndexPatterns,
+  setDataView,
+  setDataViewLoading,
 } from './actions';
-import { initialSourcererState, SourcererModel } from './model';
-import { createDefaultIndexPatterns, defaultIndexPatternByEventType } from './helpers';
+import { initDataView, initialSourcererState, SourcererModel, SourcererScopeName } from './model';
+import { validateSelectedPatterns } from './helpers';
 
 export type SourcererState = SourcererModel;
 
 export const sourcererReducer = reducerWithInitialState(initialSourcererState)
-  .case(setIndexPatternsList, (state, { kibanaIndexPatterns, configIndexPatterns }) => ({
-    ...state,
-    kibanaIndexPatterns,
-    configIndexPatterns,
-  }))
   .case(setSignalIndexName, (state, { signalIndexName }) => ({
     ...state,
     signalIndexName,
   }))
+  .case(setDataViewLoading, (state, { id, loading }) => ({
+    ...state,
+    ...(id === state.defaultDataView.id
+      ? {
+          defaultDataView: { ...state.defaultDataView, loading },
+        }
+      : {}),
+    kibanaDataViews: state.kibanaDataViews.map((dv) => (dv.id === id ? { ...dv, loading } : dv)),
+  }))
+  .case(setSourcererDataViews, (state, { defaultDataView, kibanaDataViews }) => ({
+    ...state,
+    defaultDataView: {
+      ...state.defaultDataView,
+      ...defaultDataView,
+    },
+    kibanaDataViews: kibanaDataViews.map((dataView) => ({
+      ...(state.kibanaDataViews.find(({ id }) => id === dataView.id) ?? initDataView),
+      ...dataView,
+    })),
+  }))
   .case(setSourcererScopeLoading, (state, { id, loading }) => ({
     ...state,
     sourcererScopes: {
       ...state.sourcererScopes,
-      [id]: {
-        ...state.sourcererScopes[id],
-        loading,
-      },
+      ...(id != null
+        ? {
+            [id]: {
+              ...state.sourcererScopes[id],
+              loading,
+            },
+          }
+        : {
+            [SourcererScopeName.default]: {
+              ...state.sourcererScopes[SourcererScopeName.default],
+              loading,
+            },
+            [SourcererScopeName.detections]: {
+              ...state.sourcererScopes[SourcererScopeName.detections],
+              loading,
+            },
+            [SourcererScopeName.timeline]: {
+              ...state.sourcererScopes[SourcererScopeName.timeline],
+              loading,
+            },
+          }),
     },
   }))
-  .case(setSelectedIndexPatterns, (state, { id, selectedPatterns, eventType }) => {
-    return {
-      ...state,
-      sourcererScopes: {
-        ...state.sourcererScopes,
-        [id]: {
-          ...state.sourcererScopes[id],
-          selectedPatterns: createDefaultIndexPatterns({ eventType, id, selectedPatterns, state }),
-        },
-      },
-    };
-  })
-  .case(initTimelineIndexPatterns, (state, { id, selectedPatterns, eventType }) => {
-    return {
-      ...state,
-      sourcererScopes: {
-        ...state.sourcererScopes,
-        [id]: {
-          ...state.sourcererScopes[id],
-          selectedPatterns: isEmpty(selectedPatterns)
-            ? defaultIndexPatternByEventType({ state, eventType })
-            : selectedPatterns,
-        },
-      },
-    };
-  })
-
-  .case(setSource, (state, { id, payload }) => {
-    const { ...sourcererScopes } = payload;
-    return {
-      ...state,
-      sourcererScopes: {
-        ...state.sourcererScopes,
-        [id]: {
-          ...state.sourcererScopes[id],
-          ...sourcererScopes,
-          ...(state.sourcererScopes[id].selectedPatterns.length === 0
-            ? { selectedPatterns: state.configIndexPatterns }
-            : {}),
-        },
-      },
-    };
-  })
+  .case(setSelectedDataView, (state, payload) => ({
+    ...state,
+    sourcererScopes: {
+      ...state.sourcererScopes,
+      ...validateSelectedPatterns(state, payload),
+    },
+  }))
+  .case(setDataView, (state, dataView) => ({
+    ...state,
+    ...(dataView.id === state.defaultDataView.id
+      ? {
+          defaultDataView: { ...state.defaultDataView, ...dataView },
+        }
+      : {}),
+    kibanaDataViews: state.kibanaDataViews.map((dv) =>
+      dv.id === dataView.id ? { ...dv, ...dataView } : dv
+    ),
+  }))
   .build();
diff --git a/x-pack/plugins/security_solution/public/common/store/sourcerer/selectors.test.ts b/x-pack/plugins/security_solution/public/common/store/sourcerer/selectors.test.ts
deleted file mode 100644
index 1edda4f997cdf..0000000000000
--- a/x-pack/plugins/security_solution/public/common/store/sourcerer/selectors.test.ts
+++ /dev/null
@@ -1,75 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { cloneDeep } from 'lodash/fp';
-import { mockGlobalState } from '../../mock';
-import { SourcererScopeName } from './model';
-import { getSourcererScopeSelector } from './selectors';
-
-describe('Sourcerer selectors', () => {
-  describe('getSourcererScopeSelector', () => {
-    it('Should exclude elastic cloud alias when selected patterns include "logs-*" as an alias', () => {
-      const mapStateToProps = getSourcererScopeSelector();
-      expect(mapStateToProps(mockGlobalState, SourcererScopeName.default).selectedPatterns).toEqual(
-        [
-          'apm-*-transaction*',
-          'auditbeat-*',
-          'endgame-*',
-          'filebeat-*',
-          'logs-*',
-          'packetbeat-*',
-          'traces-apm*',
-          'winlogbeat-*',
-          '-*elastic-cloud-logs-*',
-        ]
-      );
-    });
-
-    it('Should NOT exclude elastic cloud alias when selected patterns does NOT include "logs-*" as an alias', () => {
-      const mapStateToProps = getSourcererScopeSelector();
-      const myMockGlobalState = cloneDeep(mockGlobalState);
-      myMockGlobalState.sourcerer.sourcererScopes.default.selectedPatterns =
-        myMockGlobalState.sourcerer.sourcererScopes.default.selectedPatterns.filter(
-          (index) => !index.includes('logs-*')
-        );
-      expect(
-        mapStateToProps(myMockGlobalState, SourcererScopeName.default).selectedPatterns
-      ).toEqual([
-        'apm-*-transaction*',
-        'auditbeat-*',
-        'endgame-*',
-        'filebeat-*',
-        'packetbeat-*',
-        'traces-apm*',
-        'winlogbeat-*',
-      ]);
-    });
-
-    it('Should NOT exclude elastic cloud alias when selected patterns include "logs-endpoint.event-*" as an alias', () => {
-      const mapStateToProps = getSourcererScopeSelector();
-      const myMockGlobalState = cloneDeep(mockGlobalState);
-      myMockGlobalState.sourcerer.sourcererScopes.default.selectedPatterns = [
-        ...myMockGlobalState.sourcerer.sourcererScopes.default.selectedPatterns.filter(
-          (index) => !index.includes('logs-*')
-        ),
-        'logs-endpoint.event-*',
-      ];
-      expect(
-        mapStateToProps(myMockGlobalState, SourcererScopeName.default).selectedPatterns
-      ).toEqual([
-        'apm-*-transaction*',
-        'auditbeat-*',
-        'endgame-*',
-        'filebeat-*',
-        'logs-endpoint.event-*',
-        'packetbeat-*',
-        'traces-apm*',
-        'winlogbeat-*',
-      ]);
-    });
-  });
-});
diff --git a/x-pack/plugins/security_solution/public/common/store/sourcerer/selectors.ts b/x-pack/plugins/security_solution/public/common/store/sourcerer/selectors.ts
index 53702bcf23b89..b72d7bfde2dcc 100644
--- a/x-pack/plugins/security_solution/public/common/store/sourcerer/selectors.ts
+++ b/x-pack/plugins/security_solution/public/common/store/sourcerer/selectors.ts
@@ -5,24 +5,34 @@
  * 2.0.
  */
 
-import memoizeOne from 'memoize-one';
 import { createSelector } from 'reselect';
 import { State } from '../types';
-import { SourcererScopeById, ManageScope, KibanaIndexPatterns, SourcererScopeName } from './model';
-
-export const sourcererKibanaIndexPatternsSelector = ({ sourcerer }: State): KibanaIndexPatterns =>
-  sourcerer.kibanaIndexPatterns;
+import {
+  SourcererDataView,
+  SourcererModel,
+  SourcererScope,
+  SourcererScopeById,
+  SourcererScopeName,
+} from './model';
+
+export const sourcererKibanaDataViewsSelector = ({
+  sourcerer,
+}: State): SourcererModel['kibanaDataViews'] => sourcerer.kibanaDataViews;
 
 export const sourcererSignalIndexNameSelector = ({ sourcerer }: State): string | null =>
   sourcerer.signalIndexName;
 
-export const sourcererConfigIndexPatternsSelector = ({ sourcerer }: State): string[] =>
-  sourcerer.configIndexPatterns;
+export const sourcererDefaultDataViewSelector = ({
+  sourcerer,
+}: State): SourcererModel['defaultDataView'] => sourcerer.defaultDataView;
+
+export const dataViewSelector = ({ sourcerer }: State, id: string): SourcererDataView =>
+  sourcerer.kibanaDataViews.find((dataView) => dataView.id === id) ?? sourcerer.defaultDataView;
 
 export const sourcererScopeIdSelector = (
   { sourcerer }: State,
   scopeId: SourcererScopeName
-): ManageScope => sourcerer.sourcererScopes[scopeId];
+): SourcererScope => sourcerer.sourcererScopes[scopeId];
 
 export const scopeIdSelector = () => createSelector(sourcererScopeIdSelector, (scope) => scope);
 
@@ -31,85 +41,43 @@ export const sourcererScopesSelector = ({ sourcerer }: State): SourcererScopeByI
 
 export const scopesSelector = () => createSelector(sourcererScopesSelector, (scopes) => scopes);
 
-export const kibanaIndexPatternsSelector = () =>
-  createSelector(
-    sourcererKibanaIndexPatternsSelector,
-    (kibanaIndexPatterns) => kibanaIndexPatterns
-  );
+export const kibanaDataViewsSelector = () =>
+  createSelector(sourcererKibanaDataViewsSelector, (dataViews) => dataViews);
 
 export const signalIndexNameSelector = () =>
   createSelector(sourcererSignalIndexNameSelector, (signalIndexName) => signalIndexName);
 
-export const configIndexPatternsSelector = () =>
-  createSelector(
-    sourcererConfigIndexPatternsSelector,
-    (configIndexPatterns) => configIndexPatterns
-  );
+export const defaultDataViewSelector = () =>
+  createSelector(sourcererDefaultDataViewSelector, (dataViews) => dataViews);
 
-export const getIndexNamesSelectedSelector = () => {
-  const getScopeSelector = scopeIdSelector();
-  const getConfigIndexPatternsSelector = configIndexPatternsSelector();
+export const sourcererDataViewSelector = () =>
+  createSelector(dataViewSelector, (dataView) => dataView);
 
-  const mapStateToProps = (
-    state: State,
-    scopeId: SourcererScopeName
-  ): { indexNames: string[]; previousIndexNames: string } => {
-    const scope = getScopeSelector(state, scopeId);
-    const configIndexPatterns = getConfigIndexPatternsSelector(state);
-    return {
-      indexNames:
-        scope.selectedPatterns.length === 0 ? configIndexPatterns : scope.selectedPatterns,
-      previousIndexNames: scope.indexPattern.title,
-    };
-  };
-  return mapStateToProps;
-};
+export interface SourcererScopeSelector extends Omit<SourcererModel, 'sourcererScopes'> {
+  sourcererDataView: SourcererDataView;
+  sourcererScope: SourcererScope;
+}
 
-export const getAllExistingIndexNamesSelector = () => {
+export const getSourcererScopeSelector = () => {
+  const getKibanaDataViewsSelector = kibanaDataViewsSelector();
+  const getDefaultDataViewSelector = defaultDataViewSelector();
   const getSignalIndexNameSelector = signalIndexNameSelector();
-  const getConfigIndexPatternsSelector = configIndexPatternsSelector();
+  const getSourcererDataViewSelector = sourcererDataViewSelector();
+  const getScopeSelector = scopeIdSelector();
 
-  const mapStateToProps = (state: State): string[] => {
+  return (state: State, scopeId: SourcererScopeName): SourcererScopeSelector => {
+    const kibanaDataViews = getKibanaDataViewsSelector(state);
+    const defaultDataView = getDefaultDataViewSelector(state);
     const signalIndexName = getSignalIndexNameSelector(state);
-    const configIndexPatterns = getConfigIndexPatternsSelector(state);
-
-    return signalIndexName != null
-      ? [...configIndexPatterns, signalIndexName]
-      : configIndexPatterns;
-  };
-
-  return mapStateToProps;
-};
-
-const EXCLUDE_ELASTIC_CLOUD_INDEX = '-*elastic-cloud-logs-*';
-
-export const getSourcererScopeSelector = () => {
-  const getScopeIdSelector = scopeIdSelector();
-  const getSelectedPatterns = memoizeOne((selectedPatternsStr: string): string[] => {
-    const selectedPatterns = selectedPatternsStr.length > 0 ? selectedPatternsStr.split(',') : [];
-    return selectedPatterns.some((index) => index === 'logs-*')
-      ? [...selectedPatterns, EXCLUDE_ELASTIC_CLOUD_INDEX]
-      : selectedPatterns;
-  });
-
-  const getIndexPattern = memoizeOne(
-    (indexPattern, title) => ({
-      ...indexPattern,
-      title,
-    }),
-    (newArgs, lastArgs) => newArgs[0] === lastArgs[0] && newArgs[1].length === lastArgs[1].length
-  );
-
-  const mapStateToProps = (state: State, scopeId: SourcererScopeName): ManageScope => {
-    const scope = getScopeIdSelector(state, scopeId);
-    const selectedPatterns = getSelectedPatterns(scope.selectedPatterns.sort().join());
-    const indexPattern = getIndexPattern(scope.indexPattern, selectedPatterns.join());
+    const scope = getScopeSelector(state, scopeId);
+    const sourcererDataView = getSourcererDataViewSelector(state, scope.selectedDataViewId);
 
     return {
-      ...scope,
-      selectedPatterns,
-      indexPattern,
+      defaultDataView,
+      kibanaDataViews,
+      signalIndexName,
+      sourcererDataView,
+      sourcererScope: scope,
     };
   };
-  return mapStateToProps;
 };
diff --git a/x-pack/plugins/security_solution/public/common/types.ts b/x-pack/plugins/security_solution/public/common/types.ts
index 7d7dab6e4fc3c..83a93769603e7 100644
--- a/x-pack/plugins/security_solution/public/common/types.ts
+++ b/x-pack/plugins/security_solution/public/common/types.ts
@@ -6,6 +6,9 @@
  */
 
 import { ResponseErrorAttributes } from 'kibana/server';
+import { DataViewBase } from '@kbn/es-query';
+import { FieldSpec } from '../../../../../src/plugins/data_views/common';
+
 export interface ServerApiError {
   statusCode: number;
   error: string;
@@ -16,3 +19,10 @@ export interface ServerApiError {
 export interface SecuritySolutionUiConfigType {
   enableExperimental: string[];
 }
+
+/**
+ * DataViewBase with enhanced index fields used in timelines
+ */
+export interface SecuritySolutionDataViewBase extends DataViewBase {
+  fields: FieldSpec[];
+}
diff --git a/x-pack/plugins/security_solution/public/common/utils/empty_view/use_show_pages_with_empty_view.test.tsx b/x-pack/plugins/security_solution/public/common/utils/empty_view/use_show_pages_with_empty_view.test.tsx
index 981f7e9e876ea..01dbfbed6a0c2 100644
--- a/x-pack/plugins/security_solution/public/common/utils/empty_view/use_show_pages_with_empty_view.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/utils/empty_view/use_show_pages_with_empty_view.test.tsx
@@ -16,7 +16,7 @@ jest.mock('../route/use_route_spy', () => ({
     .mockImplementationOnce(() => [{ pageName: 'network' }]),
 }));
 jest.mock('../../../common/containers/sourcerer', () => ({
-  useSourcererScope: jest
+  useSourcererDataView: jest
     .fn()
     .mockImplementationOnce(() => [{ indicesExist: false }])
     .mockImplementationOnce(() => [{ indicesExist: false }])
diff --git a/x-pack/plugins/security_solution/public/common/utils/empty_view/use_show_pages_with_empty_view.tsx b/x-pack/plugins/security_solution/public/common/utils/empty_view/use_show_pages_with_empty_view.tsx
index 10cc4be10a61b..f863cecffe3d6 100644
--- a/x-pack/plugins/security_solution/public/common/utils/empty_view/use_show_pages_with_empty_view.tsx
+++ b/x-pack/plugins/security_solution/public/common/utils/empty_view/use_show_pages_with_empty_view.tsx
@@ -8,7 +8,7 @@
 import { useState, useEffect } from 'react';
 import { useRouteSpy } from '../route/use_route_spy';
 import { SecurityPageName } from '../../../app/types';
-import { useSourcererScope } from '../../../common/containers/sourcerer';
+import { useSourcererDataView } from '../../containers/sourcerer';
 
 // Used to detect if we're on a top level page that is empty and set page background color to match the subdued Empty State
 const isPageNameWithEmptyView = (currentName: string) => {
@@ -23,7 +23,7 @@ const isPageNameWithEmptyView = (currentName: string) => {
 
 export const useShowPagesWithEmptyView = () => {
   const [{ pageName }] = useRouteSpy();
-  const { indicesExist } = useSourcererScope();
+  const { indicesExist } = useSourcererDataView();
 
   const shouldShowEmptyState = isPageNameWithEmptyView(pageName) && !indicesExist;
 
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.test.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.test.tsx
index 835784031e065..a4660356b8630 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.test.tsx
@@ -142,6 +142,7 @@ describe('alert actions', () => {
             ],
             defaultColumns: defaultHeaders,
             dataProviders: [],
+            dataViewId: '',
             dateRange: {
               end: '2018-11-05T19:03:25.937Z',
               start: '2018-11-05T18:58:25.937Z',
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.tsx
index fb958c775e68c..213f8c78e3b8d 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.tsx
@@ -7,12 +7,21 @@
 
 /* eslint-disable complexity */
 
-import dateMath from '@elastic/datemath';
-import { getOr, isEmpty } from 'lodash/fp';
+import { get, getOr, isEmpty } from 'lodash/fp';
 import moment from 'moment';
-import { i18n } from '@kbn/i18n';
+
+import dateMath from '@elastic/datemath';
 
 import { FilterStateStore, Filter } from '@kbn/es-query';
+import { i18n } from '@kbn/i18n';
+import { ALERT_RULE_FROM, ALERT_RULE_TYPE, ALERT_RULE_NOTE } from '@kbn/rule-data-utils';
+
+import {
+  ALERT_ORIGINAL_TIME,
+  ALERT_GROUP_ID,
+  ALERT_RULE_TIMELINE_ID,
+  ALERT_THRESHOLD_RESULT,
+} from '../../../../common/field_maps/field_names';
 import {
   KueryFilterQueryKind,
   TimelineId,
@@ -40,6 +49,7 @@ import {
   formatTimelineResultToModel,
 } from '../../../timelines/components/open_timeline/helpers';
 import { convertKueryToElasticSearchQuery } from '../../../common/lib/keury';
+import { getField } from '../../../helpers';
 import {
   replaceTemplateFieldFromQuery,
   replaceTemplateFieldFromMatchFilters,
@@ -68,10 +78,18 @@ export const getUpdateAlertsQuery = (eventIds: Readonly<string[]>) => {
 export const getFilterAndRuleBounds = (
   data: TimelineNonEcsData[][]
 ): [string[], number, number] => {
-  const stringFilter = data?.[0].filter((d) => d.field === 'signal.rule.filters')?.[0]?.value ?? [];
+  const stringFilter =
+    data?.[0].filter(
+      (d) => d.field === 'signal.rule.filters' || d.field === 'kibana.alert.rule.filters'
+    )?.[0]?.value ?? [];
 
   const eventTimes = data
-    .flatMap((alert) => alert.filter((d) => d.field === 'signal.original_time')?.[0]?.value ?? [])
+    .flatMap(
+      (alert) =>
+        alert.filter(
+          (d) => d.field === 'signal.original_time' || d.field === 'kibana.alert.original_time'
+        )?.[0]?.value ?? []
+    )
     .map((d) => moment(d));
 
   return [stringFilter, moment.min(eventTimes).valueOf(), moment.max(eventTimes).valueOf()];
@@ -134,10 +152,9 @@ export const determineToAndFrom = ({ ecs }: { ecs: Ecs[] | Ecs }) => {
     };
   }
   const ecsData = ecs as Ecs;
+  const ruleFrom = getField(ecsData, ALERT_RULE_FROM);
   const elapsedTimeRule = moment.duration(
-    moment().diff(
-      dateMath.parse(ecsData?.signal?.rule?.from != null ? ecsData.signal?.rule?.from[0] : 'now-0s')
-    )
+    moment().diff(dateMath.parse(ruleFrom != null ? ruleFrom[0] : 'now-0s'))
   );
   const from = moment(ecsData?.timestamp ?? new Date())
     .subtract(elapsedTimeRule)
@@ -161,6 +178,7 @@ export const getThresholdAggregationData = (
   ecsData: Ecs | Ecs[],
   nonEcsData: TimelineNonEcsData[]
 ): ThresholdAggregationData => {
+  // TODO: AAD fields
   const thresholdEcsData: Ecs[] = Array.isArray(ecsData) ? ecsData : [ecsData];
   return thresholdEcsData.reduce<ThresholdAggregationData>(
     (outerAcc, thresholdData) => {
@@ -177,9 +195,14 @@ export const getThresholdAggregationData = (
       };
 
       try {
-        thresholdResult = JSON.parse((thresholdData.signal?.threshold_result as string[])[0]);
+        try {
+          thresholdResult = JSON.parse((thresholdData.signal?.threshold_result as string[])[0]);
+        } catch (err) {
+          thresholdResult = JSON.parse((get(ALERT_THRESHOLD_RESULT, thresholdData) as string[])[0]);
+        }
         aggField = JSON.parse(threshold[0]).field;
       } catch (err) {
+        // Legacy support
         thresholdResult = {
           terms: [
             {
@@ -192,13 +215,15 @@ export const getThresholdAggregationData = (
         };
       }
 
-      // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-      const originalTime = moment(thresholdData.signal?.original_time![0]);
-      const now = moment();
-      // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-      const ruleFrom = dateMath.parse(thresholdData.signal?.rule?.from![0]!);
-      const ruleInterval = moment.duration(now.diff(ruleFrom));
+      // Legacy support
+      const ruleFromStr = getField(thresholdData, ALERT_RULE_FROM)[0];
+      const ruleFrom = dateMath.parse(ruleFromStr) ?? moment(); // The fallback here will essentially ensure 0 results
+      const originalTimeStr = getField(thresholdData, ALERT_ORIGINAL_TIME)[0];
+      const originalTime = originalTimeStr != null ? moment(originalTimeStr) : ruleFrom;
+      const ruleInterval = moment.duration(moment().diff(ruleFrom));
       const fromOriginalTime = originalTime.clone().subtract(ruleInterval); // This is the default... can overshoot
+      // End legacy support
+
       const aggregationFields = Array.isArray(aggField) ? aggField : [aggField];
 
       return {
@@ -255,16 +280,19 @@ export const getThresholdAggregationData = (
   );
 };
 
-export const isEqlRuleWithGroupId = (ecsData: Ecs) =>
-  ecsData.signal?.rule?.type?.length &&
-  ecsData.signal?.rule?.type[0] === 'eql' &&
-  ecsData.signal?.group?.id?.length;
+export const isEqlRuleWithGroupId = (ecsData: Ecs) => {
+  const ruleType = getField(ecsData, ALERT_RULE_TYPE);
+  const groupId = getField(ecsData, ALERT_GROUP_ID);
+  return ruleType?.length && ruleType[0] === 'eql' && groupId?.length;
+};
 
-export const isThresholdRule = (ecsData: Ecs) =>
-  ecsData.signal?.rule?.type?.length && ecsData.signal?.rule?.type[0] === 'threshold';
+export const isThresholdRule = (ecsData: Ecs) => {
+  const ruleType = getField(ecsData, ALERT_RULE_TYPE);
+  return Array.isArray(ruleType) && ruleType.length && ruleType[0] === 'threshold';
+};
 
 export const buildAlertsKqlFilter = (
-  key: '_id' | 'signal.group.id',
+  key: '_id' | 'signal.group.id' | 'kibana.alert.group.id',
   alertIds: string[]
 ): Filter[] => {
   return [
@@ -283,7 +311,7 @@ export const buildAlertsKqlFilter = (
         negate: false,
         disabled: false,
         type: 'phrases',
-        key,
+        key: key.replace('signal.', 'kibana.alert.'),
         value: alertIds.join(),
         params: alertIds,
       },
@@ -383,9 +411,11 @@ export const sendAlertToTimelineAction = async ({
    */
   const ecsData: Ecs = Array.isArray(ecs) && ecs.length > 0 ? ecs[0] : (ecs as Ecs);
   const alertIds = Array.isArray(ecs) ? ecs.map((d) => d._id) : [];
-  const noteContent = ecsData.signal?.rule?.note != null ? ecsData.signal?.rule?.note[0] : '';
+  const ruleNote = getField(ecsData, ALERT_RULE_NOTE);
+  const noteContent = Array.isArray(ruleNote) && ruleNote.length > 0 ? ruleNote[0] : '';
+  const ruleTimelineId = getField(ecsData, ALERT_RULE_TIMELINE_ID);
   const timelineId =
-    ecsData.signal?.rule?.timeline_id != null ? ecsData.signal?.rule?.timeline_id[0] : '';
+    Array.isArray(ruleTimelineId) && ruleTimelineId.length > 0 ? ruleTimelineId[0] : '';
   const { to, from } = determineToAndFrom({ ecs });
 
   // For now we do not want to populate the template timeline if we have alertIds
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx
index 4bd516d0b1338..7777d075a4b9c 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/index.tsx
@@ -18,7 +18,7 @@ import {
   displaySuccessToast,
   useStateToaster,
 } from '../../../common/components/toasters';
-import { useSourcererScope } from '../../../common/containers/sourcerer';
+import { useSourcererDataView } from '../../../common/containers/sourcerer';
 import { useAppToasts } from '../../../common/hooks/use_app_toasts';
 import { useIsExperimentalFeatureEnabled } from '../../../common/hooks/use_experimental_features';
 import { useInvalidFilterQuery } from '../../../common/hooks/use_invalid_filter_query';
@@ -100,7 +100,7 @@ export const AlertsTableComponent: React.FC<AlertsTableComponentProps> = ({
     indexPattern: indexPatterns,
     loading: indexPatternsLoading,
     selectedPatterns,
-  } = useSourcererScope(SourcererScopeName.detections);
+  } = useSourcererDataView(SourcererScopeName.detections);
   const kibana = useKibana();
   const [, dispatchToaster] = useStateToaster();
   const { addWarning } = useAppToasts();
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/use_add_to_case_actions.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/use_add_to_case_actions.tsx
index e14c3e916a35e..a342b01b038ca 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/use_add_to_case_actions.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/use_add_to_case_actions.tsx
@@ -8,7 +8,7 @@
 import { useMemo } from 'react';
 import { useGetUserCasesPermissions, useKibana } from '../../../../common/lib/kibana';
 import { TimelineId, TimelineNonEcsData } from '../../../../../common';
-import { APP_UI_ID } from '../../../../../common/constants';
+import { APP_ID } from '../../../../../common/constants';
 import { useInsertTimeline } from '../../../../cases/components/use_insert_timeline';
 import { Ecs } from '../../../../../common/ecs';
 
@@ -39,7 +39,7 @@ export const useAddToCaseActions = ({
             event: { data: nonEcsData ?? [], ecs: ecsData, _id: ecsData?._id },
             useInsertTimeline: insertTimelineHook,
             casePermissions,
-            appId: APP_UI_ID,
+            appId: APP_ID,
             onClose: afterCaseSelection,
           }
         : null,
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/autocomplete_field/index.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/autocomplete_field/index.tsx
index 22fabcd15b194..91dbadbb209e1 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/autocomplete_field/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/autocomplete_field/index.tsx
@@ -8,14 +8,14 @@
 import React, { useCallback, useMemo } from 'react';
 import { EuiFormRow } from '@elastic/eui';
 import { FieldComponent } from '@kbn/securitysolution-autocomplete';
-import { IndexPatternBase, IndexPatternFieldBase } from '@kbn/es-query';
+import { DataViewBase, DataViewFieldBase } from '@kbn/es-query';
 import { FieldHook } from '../../../../../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib';
 
 interface AutocompleteFieldProps {
   dataTestSubj: string;
   field: FieldHook;
   idAria: string;
-  indices: IndexPatternBase;
+  indices: DataViewBase;
   isDisabled: boolean;
   fieldType: string;
   placeholder?: string;
@@ -31,7 +31,7 @@ export const AutocompleteField = ({
   placeholder,
 }: AutocompleteFieldProps) => {
   const handleFieldChange = useCallback(
-    ([newField]: IndexPatternFieldBase[]): void => {
+    ([newField]: DataViewFieldBase[]): void => {
       // TODO: Update onChange type in FieldComponent as newField can be undefined
       field.setValue(newField?.name ?? '');
     },
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/description_step/helpers.test.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/description_step/helpers.test.tsx
index 62e787952aa73..1ab9f92bc6d80 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/description_step/helpers.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/description_step/helpers.test.tsx
@@ -14,8 +14,8 @@ import {
   esFilters,
   FilterManager,
   UI_SETTINGS,
-  IndexPattern,
 } from '../../../../../../../../src/plugins/data/public';
+import { DataViewBase } from '@kbn/es-query';
 import { SeverityBadge } from '../severity_badge';
 
 import * as i18n from './translations';
@@ -146,7 +146,7 @@ describe('helpers', () => {
           fields: [{ name: 'event.category', type: 'test type' }],
           title: 'test title',
           getFormatterForField: () => ({ convert: (val: unknown) => val }),
-        } as unknown as IndexPattern,
+        } as unknown as DataViewBase,
       });
       const wrapper = shallow<React.ReactElement>(result[0].description as React.ReactElement);
       const filterLabelComponent = wrapper.find(esFilters.FilterLabel).at(0);
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/description_step/index.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/description_step/index.tsx
index ab84f1a65cc4b..e403da9e49090 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/description_step/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/description_step/index.tsx
@@ -11,12 +11,8 @@ import React, { memo, useState } from 'react';
 import styled from 'styled-components';
 
 import { ThreatMapping, Threats, Type } from '@kbn/securitysolution-io-ts-alerting-types';
-import {
-  IIndexPattern,
-  Filter,
-  esFilters,
-  FilterManager,
-} from '../../../../../../../../src/plugins/data/public';
+import { DataViewBase } from '@kbn/es-query';
+import { Filter, esFilters, FilterManager } from '../../../../../../../../src/plugins/data/public';
 import { DEFAULT_TIMELINE_TITLE } from '../../../../timelines/components/timeline/translations';
 import { useKibana } from '../../../../common/lib/kibana';
 import { AboutStepRiskScore, AboutStepSeverity } from '../../../pages/detection_engine/rules/types';
@@ -55,7 +51,7 @@ const DescriptionListContainer = styled(EuiDescriptionList)`
 interface StepRuleDescriptionProps<T> {
   columns?: 'multi' | 'single' | 'singleSplit';
   data: unknown;
-  indexPatterns?: IIndexPattern;
+  indexPatterns?: DataViewBase;
   schema: FormSchema<T>;
 }
 
@@ -129,7 +125,7 @@ export const buildListItems = <T,>(
   data: unknown,
   schema: FormSchema<T>,
   filterManager: FilterManager,
-  indexPatterns?: IIndexPattern
+  indexPatterns?: DataViewBase
 ): ListItems[] =>
   Object.keys(schema).reduce<ListItems[]>(
     (acc, field) => [
@@ -161,7 +157,7 @@ export const getDescriptionItem = (
   label: string,
   data: unknown,
   filterManager: FilterManager,
-  indexPatterns?: IIndexPattern
+  indexPatterns?: DataViewBase
 ): ListItems[] => {
   if (field === 'queryBar') {
     const filters = addFilterStateIfNotThere(get('queryBar.filters', data) ?? []);
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/description_step/types.ts b/x-pack/plugins/security_solution/public/detections/components/rules/description_step/types.ts
index dc5e7fea8e771..02c25e5c12bee 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/description_step/types.ts
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/description_step/types.ts
@@ -7,12 +7,8 @@
 
 import { ReactNode } from 'react';
 import { Threats } from '@kbn/securitysolution-io-ts-alerting-types';
-
-import {
-  IIndexPattern,
-  Filter,
-  FilterManager,
-} from '../../../../../../../../src/plugins/data/public';
+import { DataViewBase } from '@kbn/es-query';
+import { Filter, FilterManager } from '../../../../../../../../src/plugins/data/public';
 
 export interface ListItems {
   title: NonNullable<ReactNode>;
@@ -25,7 +21,7 @@ export interface BuildQueryBarDescription {
   filterManager: FilterManager;
   query: string;
   savedId: string;
-  indexPatterns?: IIndexPattern;
+  indexPatterns?: DataViewBase;
   queryLabel?: string;
 }
 
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/query_bar/index.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/query_bar/index.tsx
index 6bda4a0e0f6b8..42f92f8cb6ce1 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/query_bar/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/query_bar/index.tsx
@@ -10,14 +10,8 @@ import React, { useCallback, useEffect, useState } from 'react';
 import { Subscription } from 'rxjs';
 import styled from 'styled-components';
 import deepEqual from 'fast-deep-equal';
-
-import {
-  Filter,
-  IIndexPattern,
-  Query,
-  FilterManager,
-  SavedQuery,
-} from '../../../../../../../../src/plugins/data/public';
+import { DataViewBase, Filter, Query } from '@kbn/es-query';
+import { FilterManager, SavedQuery } from '../../../../../../../../src/plugins/data/public';
 
 import { BrowserFields } from '../../../../common/containers/source';
 import { OpenTimelineModal } from '../../../../timelines/components/open_timeline/open_timeline_modal';
@@ -43,7 +37,7 @@ interface QueryBarDefineRuleProps {
   field: FieldHook;
   idAria: string;
   isLoading: boolean;
-  indexPattern: IIndexPattern;
+  indexPattern: DataViewBase;
   onCloseTimelineSearch: () => void;
   openTimelineSearch: boolean;
   resizeParentContainer?: (height: number) => void;
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/risk_score_mapping/index.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/risk_score_mapping/index.tsx
index e9cbcb6c38268..fbeea64cae7da 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/risk_score_mapping/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/risk_score_mapping/index.tsx
@@ -21,7 +21,7 @@ import styled from 'styled-components';
 import { noop } from 'lodash/fp';
 import { RiskScoreMapping } from '@kbn/securitysolution-io-ts-alerting-types';
 import { FieldComponent } from '@kbn/securitysolution-autocomplete';
-import { IndexPatternBase, IndexPatternFieldBase } from '@kbn/es-query';
+import { DataViewBase, DataViewFieldBase } from '@kbn/es-query';
 import * as i18n from './translations';
 import { FieldHook } from '../../../../../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib';
 import { AboutStepRiskScore } from '../../../pages/detection_engine/rules/types';
@@ -46,7 +46,7 @@ interface RiskScoreFieldProps {
   dataTestSubj: string;
   field: FieldHook<AboutStepRiskScore>;
   idAria: string;
-  indices: IndexPatternBase;
+  indices: DataViewBase;
   isDisabled: boolean;
   placeholder?: string;
 }
@@ -78,7 +78,7 @@ export const RiskScoreField = ({
   );
 
   const handleRiskScoreMappingChange = useCallback(
-    ([newField]: IndexPatternFieldBase[]): void => {
+    ([newField]: DataViewFieldBase[]): void => {
       setValue({
         value,
         isMappingChecked,
@@ -231,8 +231,8 @@ export const RiskScoreField = ({
 };
 
 /**
- * Looks for field metadata (IndexPatternFieldBase) in existing index pattern.
- * If specified field doesn't exist, returns a stub IndexPatternFieldBase created based on the mapping --
+ * Looks for field metadata (DataViewFieldBase) in existing index pattern.
+ * If specified field doesn't exist, returns a stub DataViewFieldBase created based on the mapping --
  * because the field might not have been indexed yet, but we still need to display the mapping.
  *
  * @param mapping Mapping of a specified field name to risk score.
@@ -240,8 +240,8 @@ export const RiskScoreField = ({
  */
 const getFieldTypeByMapping = (
   mapping: RiskScoreMapping,
-  pattern: IndexPatternBase
-): IndexPatternFieldBase => {
+  pattern: DataViewBase
+): DataViewFieldBase => {
   const field = mapping?.[0]?.field ?? '';
   const [knownFieldType] = pattern.fields.filter(({ name }) => field != null && field === name);
   return knownFieldType ?? { name: field, type: 'number' };
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/severity_mapping/index.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/severity_mapping/index.tsx
index 4eca6f32d0c1f..f6578fab0c5fb 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/severity_mapping/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/severity_mapping/index.tsx
@@ -29,7 +29,7 @@ import {
   AutocompleteFieldMatchComponent,
 } from '@kbn/securitysolution-autocomplete';
 
-import { IndexPatternBase, IndexPatternFieldBase } from '@kbn/es-query';
+import { DataViewBase, DataViewFieldBase } from '@kbn/es-query';
 import * as i18n from './translations';
 import { FieldHook } from '../../../../../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib';
 import { SeverityOptionItem } from '../step_about_rule/data';
@@ -56,7 +56,7 @@ interface SeverityFieldProps {
   dataTestSubj: string;
   field: FieldHook<AboutStepSeverity>;
   idAria: string;
-  indices: IndexPatternBase;
+  indices: DataViewBase;
   isDisabled: boolean;
   options: SeverityOptionItem[];
 }
@@ -85,7 +85,7 @@ export const SeverityField = ({
   );
 
   const handleFieldChange = useCallback(
-    (index: number, severity: Severity, [newField]: IndexPatternFieldBase[]): void => {
+    (index: number, severity: Severity, [newField]: DataViewFieldBase[]): void => {
       const newMappingItems: SeverityMapping = [
         {
           ...mapping[index],
@@ -295,8 +295,8 @@ export const SeverityField = ({
 };
 
 /**
- * Looks for field metadata (IndexPatternFieldBase) in existing index pattern.
- * If specified field doesn't exist, returns a stub IndexPatternFieldBase created based on the mapping --
+ * Looks for field metadata (DataViewFieldBase) in existing index pattern.
+ * If specified field doesn't exist, returns a stub DataViewFieldBase created based on the mapping --
  * because the field might not have been indexed yet, but we still need to display the mapping.
  *
  * @param mapping Mapping of a specified field name + value to a certain severity value.
@@ -304,8 +304,8 @@ export const SeverityField = ({
  */
 const getFieldTypeByMapping = (
   mapping: SeverityMappingItem,
-  pattern: IndexPatternBase
-): IndexPatternFieldBase => {
+  pattern: DataViewBase
+): DataViewFieldBase => {
   const { field } = mapping;
   const [knownFieldType] = pattern.fields.filter(({ name }) => field === name);
   return knownFieldType ?? { name: field, type: 'string' };
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/index.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/index.tsx
index 65528d86a4027..6471faf657fa0 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/index.tsx
@@ -10,7 +10,6 @@ import React, { FC, memo, useCallback, useState, useEffect, useMemo } from 'reac
 import styled from 'styled-components';
 import { isEqual } from 'lodash';
 
-import { IndexPattern } from 'src/plugins/data/public';
 import {
   DEFAULT_INDEX_KEY,
   DEFAULT_THREAT_INDEX_KEY,
@@ -324,10 +323,10 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
     ({ threatMapping }) => (
       <ThreatMatchInput
         handleResetThreatIndices={handleResetThreatIndices}
-        indexPatterns={indexPatterns as IndexPattern}
+        indexPatterns={indexPatterns}
         threatBrowserFields={threatBrowserFields}
         threatIndexModified={threatIndexModified}
-        threatIndexPatterns={threatIndexPatterns as IndexPattern}
+        threatIndexPatterns={threatIndexPatterns}
         threatIndexPatternsLoading={threatIndexPatternsLoading}
         threatMapping={threatMapping}
         onValidityChange={setIsThreatQueryBarValid}
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/translations.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/translations.tsx
index 7b5342d85f82a..d41d36813dee2 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/translations.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/translations.tsx
@@ -21,20 +21,6 @@ export const INVALID_CUSTOM_QUERY = i18n.translate(
   }
 );
 
-export const CONFIG_INDICES = i18n.translate(
-  'xpack.securitySolution.detectionEngine.createRule.stepDefineRule.indicesFromConfigDescription',
-  {
-    defaultMessage: 'Use Elasticsearch indices from Security Solution advanced settings',
-  }
-);
-
-export const CUSTOM_INDICES = i18n.translate(
-  'xpack.securitySolution.detectionEngine.createRule.stepDefineRule.indicesCustomDescription',
-  {
-    defaultMessage: 'Provide custom list of indices',
-  }
-);
-
 export const INDEX_HELPER_TEXT = i18n.translate(
   'xpack.securitySolution.detectionEngine.createRule.stepDefineRule.indicesHelperDescription',
   {
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/threatmatch_input/index.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/threatmatch_input/index.tsx
index 73e9dcdd94c03..91158979a82c5 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/threatmatch_input/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/threatmatch_input/index.tsx
@@ -7,7 +7,7 @@
 
 import React, { useCallback, useEffect, useState } from 'react';
 import { EuiFlexGroup, EuiFlexItem, EuiSpacer, EuiFormRow } from '@elastic/eui';
-
+import { DataViewBase } from '@kbn/es-query';
 import { ThreatMapEntries } from '../../../../common/components/threat_match/types';
 import { ThreatMatchComponent } from '../../../../common/components/threat_match';
 import { BrowserField } from '../../../../common/containers/source';
@@ -21,7 +21,6 @@ import {
 import { DefineStepRule } from '../../../pages/detection_engine/rules/types';
 import { schema } from '../step_define_rule/schema';
 import { QueryBarDefineRule } from '../query_bar';
-import { IndexPattern } from '../../../../../../../../src/plugins/data/public';
 import * as i18n from '../step_define_rule/translations';
 import { MyLabelButton } from '../step_define_rule';
 
@@ -30,8 +29,8 @@ const CommonUseField = getUseField({ component: Field });
 interface ThreatMatchInputProps {
   threatMapping: FieldHook;
   threatBrowserFields: Readonly<Record<string, Partial<BrowserField>>>;
-  threatIndexPatterns: IndexPattern;
-  indexPatterns: IndexPattern;
+  threatIndexPatterns: DataViewBase;
+  indexPatterns: DataViewBase;
   threatIndexPatternsLoading: boolean;
   threatIndexModified: boolean;
   handleResetThreatIndices: () => void;
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.test.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.test.tsx
index 0d0c51bc540b4..eeb22a2aa071c 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.test.tsx
@@ -19,7 +19,7 @@ import {
 } from '../../../common/mock';
 import { DetectionEnginePage } from './detection_engine';
 import { useUserData } from '../../components/user_info';
-import { useSourcererScope } from '../../../common/containers/sourcerer';
+import { useSourcererDataView } from '../../../common/containers/sourcerer';
 import { createStore, State } from '../../../common/store';
 import { mockHistory, Router } from '../../../common/mock/router';
 import { mockTimelines } from '../../../common/mock/mock_timelines_plugin';
@@ -110,7 +110,7 @@ describe('DetectionEnginePageComponent', () => {
         canUserREAD: true,
       },
     ]);
-    (useSourcererScope as jest.Mock).mockReturnValue({
+    (useSourcererDataView as jest.Mock).mockReturnValue({
       indicesExist: true,
       indexPattern: {},
     });
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.tsx
index ebda4f2b4232f..204387f4a241b 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine.tsx
@@ -66,7 +66,9 @@ import {
   buildShowBuildingBlockFilterRuleRegistry,
   buildThreatMatchFilter,
 } from '../../components/alerts_table/default_config';
-import { useSourcererScope } from '../../../common/containers/sourcerer';
+import { useSourcererDataView } from '../../../common/containers/sourcerer';
+import { useSignalHelpers } from '../../../common/containers/sourcerer/use_signal_helpers';
+
 import { SourcererScopeName } from '../../../common/store/sourcerer/model';
 import { NeedAdminForUpdateRulesCallOut } from '../../components/callouts/need_admin_for_update_callout';
 import { MissingPrivilegesCallOut } from '../../components/callouts/missing_privileges_callout';
@@ -78,7 +80,6 @@ import {
   FILTER_OPEN,
 } from '../../components/alerts_table/alerts_filter_group';
 import { EmptyPage } from '../../../common/components/empty_page';
-
 /**
  * Need a 100% height here to account for the graph/analyze tool, which sets no explicit height parameters, but fills the available space.
  */
@@ -235,7 +236,9 @@ const DetectionEnginePageComponent: React.FC<DetectionEngineComponentProps> = ({
     [setShowOnlyThreatIndicatorAlerts]
   );
 
-  const { indicesExist, indexPattern } = useSourcererScope(SourcererScopeName.detections);
+  const { indexPattern } = useSourcererDataView(SourcererScopeName.detections);
+
+  const { signalIndexNeedsInit, pollForSignalIndex } = useSignalHelpers();
 
   const onSkipFocusBeforeEventsTable = useCallback(() => {
     focusUtilityBarAction(containerElement.current);
@@ -291,35 +294,38 @@ const DetectionEnginePageComponent: React.FC<DetectionEngineComponentProps> = ({
     );
   }
 
-  if (!loading && (indicesExist === false || needsListsConfiguration)) {
+  if ((!loading && signalIndexNeedsInit) || needsListsConfiguration) {
     return (
       <SecuritySolutionPageWrapper>
         <DetectionEngineHeaderPage border title={i18n.PAGE_TITLE} />
         <DetectionEngineNoIndex
-          needsSignalsIndex={indicesExist === false}
+          needsSignalsIndex={signalIndexNeedsInit}
           needsListsIndex={needsListsConfiguration}
         />
       </SecuritySolutionPageWrapper>
     );
   }
-
   return (
     <>
       {hasEncryptionKey != null && !hasEncryptionKey && <NoApiIntegrationKeyCallOut />}
       <NeedAdminForUpdateRulesCallOut />
       <MissingPrivilegesCallOut />
-      {indicesExist && (hasIndexRead === false || canUserREAD === false) ? (
+      {!signalIndexNeedsInit && (hasIndexRead === false || canUserREAD === false) ? (
         <EmptyPage
           actions={emptyPageActions}
           message={i18n.ALERTS_FEATURE_NO_PERMISSIONS_MSG}
           data-test-subj="no_feature_permissions-alerts"
           title={i18n.FEATURE_NO_PERMISSIONS_TITLE}
         />
-      ) : indicesExist && hasIndexRead && canUserREAD ? (
+      ) : !signalIndexNeedsInit && hasIndexRead && canUserREAD ? (
         <StyledFullHeightContainer onKeyDown={onKeyDown} ref={containerElement}>
           <EuiWindowEvent event="resize" handler={noop} />
           <FiltersGlobal show={showGlobalFilters({ globalFullScreen, graphEventId })}>
-            <SiemSearchBar id="global" indexPattern={indexPattern} />
+            <SiemSearchBar
+              id="global"
+              pollForSignalIndex={pollForSignalIndex}
+              indexPattern={indexPattern}
+            />
           </FiltersGlobal>
           <SecuritySolutionPageWrapper
             noPadding={globalFullScreen}
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.test.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.test.tsx
index 006e497a20a7b..9227de3462d0e 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.test.tsx
@@ -23,7 +23,7 @@ import { useUserData } from '../../../../components/user_info';
 import { useRuleStatus } from '../../../../containers/detection_engine/rules';
 import { useRuleWithFallback } from '../../../../containers/detection_engine/rules/use_rule_with_fallback';
 
-import { useSourcererScope } from '../../../../../common/containers/sourcerer';
+import { useSourcererDataView } from '../../../../../common/containers/sourcerer';
 import { useParams } from 'react-router-dom';
 import { mockHistory, Router } from '../../../../../common/mock/router';
 
@@ -128,7 +128,7 @@ describe('RuleDetailsPageComponent', () => {
   beforeAll(() => {
     (useUserData as jest.Mock).mockReturnValue([{}]);
     (useParams as jest.Mock).mockReturnValue({});
-    (useSourcererScope as jest.Mock).mockReturnValue({
+    (useSourcererDataView as jest.Mock).mockReturnValue({
       indicesExist: true,
       indexPattern: {},
     });
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx
index ca71ac6783f59..9f56467043dd2 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/details/index.tsx
@@ -60,7 +60,6 @@ import { DetectionEngineHeaderPage } from '../../../../components/detection_engi
 import { AlertsHistogramPanel } from '../../../../components/alerts_kpis/alerts_histogram_panel';
 import { AlertsTable } from '../../../../components/alerts_table';
 import { useUserData } from '../../../../components/user_info';
-import { OverviewEmpty } from '../../../../../overview/components/overview_empty';
 import { StepDefineRule } from '../../../../components/rules/step_define_rule';
 import { StepScheduleRule } from '../../../../components/rules/step_schedule_rule';
 import {
@@ -104,7 +103,7 @@ import {
 } from '../../../../../timelines/components/timeline/helpers';
 import { timelineActions, timelineSelectors } from '../../../../../timelines/store/timeline';
 import { timelineDefaults } from '../../../../../timelines/store/timeline/defaults';
-import { useSourcererScope } from '../../../../../common/containers/sourcerer';
+import { useSourcererDataView } from '../../../../../common/containers/sourcerer';
 import { SourcererScopeName } from '../../../../../common/store/sourcerer/model';
 import {
   getToolTipContent,
@@ -127,6 +126,7 @@ import {
   AlertsTableFilterGroup,
   FILTER_OPEN,
 } from '../../../../components/alerts_table/alerts_filter_group';
+import { useSignalHelpers } from '../../../../../common/containers/sourcerer/use_signal_helpers';
 
 /**
  * Need a 100% height here to account for the graph/analyze tool, which sets no explicit height parameters, but fills the available space.
@@ -218,6 +218,7 @@ const RuleDetailsPageComponent: React.FC<DetectionEngineComponentProps> = ({
     loading: ruleLoading,
     isExistingRule,
   } = useRuleWithFallback(ruleId);
+  const { pollForSignalIndex } = useSignalHelpers();
   const [loadingStatus, ruleStatus, fetchRuleStatus] = useRuleStatus(ruleId);
   const [currentStatus, setCurrentStatus] = useState<RuleInfoStatus | null>(
     ruleStatus?.current_status ?? null
@@ -623,8 +624,7 @@ const RuleDetailsPageComponent: React.FC<DetectionEngineComponentProps> = ({
     [setShowOnlyThreatIndicatorAlerts]
   );
 
-  const { indicesExist, indexPattern } = useSourcererScope(SourcererScopeName.detections);
-
+  const { indexPattern } = useSourcererDataView(SourcererScopeName.detections);
   const exceptionLists = useMemo((): {
     lists: ExceptionListIdentifiers[];
     allowedExceptionListTypes: ExceptionListTypeEnum[];
@@ -696,192 +696,188 @@ const RuleDetailsPageComponent: React.FC<DetectionEngineComponentProps> = ({
     <>
       <NeedAdminForUpdateRulesCallOut />
       <MissingPrivilegesCallOut />
-      {indicesExist ? (
-        <StyledFullHeightContainer onKeyDown={onKeyDown} ref={containerElement}>
-          <EuiWindowEvent event="resize" handler={noop} />
-          <FiltersGlobal show={showGlobalFilters({ globalFullScreen, graphEventId })}>
-            <SiemSearchBar id="global" indexPattern={indexPattern} />
-          </FiltersGlobal>
-
-          <SecuritySolutionPageWrapper noPadding={globalFullScreen}>
-            <Display show={!globalFullScreen}>
-              <DetectionEngineHeaderPage
-                backOptions={{
-                  path: getRulesUrl(),
-                  text: i18n.BACK_TO_RULES,
-                  pageId: SecurityPageName.rules,
-                  dataTestSubj: 'ruleDetailsBackToAllRules',
-                }}
-                border
-                subtitle={subTitle}
-                subtitle2={
-                  <>
-                    <EuiFlexGroup gutterSize="xs" alignItems="center" justifyContent="flexStart">
-                      <EuiFlexItem grow={false}>
-                        {statusI18n.STATUS}
-                        {':'}
-                      </EuiFlexItem>
-                      {ruleStatusInfo}
-                    </EuiFlexGroup>
-                  </>
-                }
-                title={title}
-                badgeOptions={badgeOptions}
-              >
-                <EuiFlexGroup alignItems="center">
-                  <EuiFlexItem grow={false}>
-                    <EuiToolTip
-                      position="top"
-                      content={getToolTipContent(rule, hasMlPermissions, hasActionsPrivileges)}
-                    >
-                      <EuiFlexGroup>
-                        <RuleSwitch
-                          id={rule?.id ?? '-1'}
-                          isDisabled={
-                            !isExistingRule ||
-                            !canEditRuleWithActions(rule, hasActionsPrivileges) ||
-                            !userHasPermissions(canUserCRUD) ||
-                            (!hasMlPermissions && !rule?.enabled)
-                          }
-                          enabled={isExistingRule && (rule?.enabled ?? false)}
-                          onChange={handleOnChangeEnabledRule}
-                        />
-                        <EuiFlexItem>{i18n.ACTIVATE_RULE}</EuiFlexItem>
-                      </EuiFlexGroup>
-                    </EuiToolTip>
-                  </EuiFlexItem>
-
-                  <EuiFlexItem grow={false}>
-                    <EuiFlexGroup alignItems="center" gutterSize="s" responsive={false}>
-                      <EuiFlexItem grow={false}>{editRule}</EuiFlexItem>
-                      <EuiFlexItem grow={false}>
-                        <RuleActionsOverflow
-                          rule={rule}
-                          userHasPermissions={isExistingRule && userHasPermissions(canUserCRUD)}
-                          canDuplicateRuleWithActions={canEditRuleWithActions(
-                            rule,
-                            hasActionsPrivileges
-                          )}
-                        />
-                      </EuiFlexItem>
+      <StyledFullHeightContainer onKeyDown={onKeyDown} ref={containerElement}>
+        <EuiWindowEvent event="resize" handler={noop} />
+        <FiltersGlobal show={showGlobalFilters({ globalFullScreen, graphEventId })}>
+          <SiemSearchBar
+            id="global"
+            pollForSignalIndex={pollForSignalIndex}
+            indexPattern={indexPattern}
+          />
+        </FiltersGlobal>
+
+        <SecuritySolutionPageWrapper noPadding={globalFullScreen}>
+          <Display show={!globalFullScreen}>
+            <DetectionEngineHeaderPage
+              backOptions={{
+                path: getRulesUrl(),
+                text: i18n.BACK_TO_RULES,
+                pageId: SecurityPageName.rules,
+                dataTestSubj: 'ruleDetailsBackToAllRules',
+              }}
+              border
+              subtitle={subTitle}
+              subtitle2={
+                <>
+                  <EuiFlexGroup gutterSize="xs" alignItems="center" justifyContent="flexStart">
+                    <EuiFlexItem grow={false}>
+                      {statusI18n.STATUS}
+                      {':'}
+                    </EuiFlexItem>
+                    {ruleStatusInfo}
+                  </EuiFlexGroup>
+                </>
+              }
+              title={title}
+              badgeOptions={badgeOptions}
+            >
+              <EuiFlexGroup alignItems="center">
+                <EuiFlexItem grow={false}>
+                  <EuiToolTip
+                    position="top"
+                    content={getToolTipContent(rule, hasMlPermissions, hasActionsPrivileges)}
+                  >
+                    <EuiFlexGroup>
+                      <RuleSwitch
+                        id={rule?.id ?? '-1'}
+                        isDisabled={
+                          !isExistingRule ||
+                          !canEditRuleWithActions(rule, hasActionsPrivileges) ||
+                          !userHasPermissions(canUserCRUD) ||
+                          (!hasMlPermissions && !rule?.enabled)
+                        }
+                        enabled={isExistingRule && (rule?.enabled ?? false)}
+                        onChange={handleOnChangeEnabledRule}
+                      />
+                      <EuiFlexItem>{i18n.ACTIVATE_RULE}</EuiFlexItem>
                     </EuiFlexGroup>
-                  </EuiFlexItem>
-                </EuiFlexGroup>
-              </DetectionEngineHeaderPage>
-              {ruleError}
-              {getLegacyUrlConflictCallout}
-              <EuiSpacer />
-              <EuiFlexGroup>
-                <EuiFlexItem data-test-subj="aboutRule" component="section" grow={1}>
-                  <StepAboutRuleToggleDetails
-                    loading={isLoading}
-                    stepData={aboutRuleData}
-                    stepDataDetails={modifiedAboutRuleDetailsData}
-                  />
+                  </EuiToolTip>
                 </EuiFlexItem>
 
-                <EuiFlexItem grow={1}>
-                  <EuiFlexGroup direction="column">
-                    <EuiFlexItem component="section" grow={1}>
-                      <StepPanel loading={isLoading} title={ruleI18n.DEFINITION}>
-                        {defineRuleData != null && (
-                          <StepDefineRule
-                            descriptionColumns="singleSplit"
-                            isReadOnlyView={true}
-                            isLoading={false}
-                            defaultValues={defineRuleData}
-                          />
+                <EuiFlexItem grow={false}>
+                  <EuiFlexGroup alignItems="center" gutterSize="s" responsive={false}>
+                    <EuiFlexItem grow={false}>{editRule}</EuiFlexItem>
+                    <EuiFlexItem grow={false}>
+                      <RuleActionsOverflow
+                        rule={rule}
+                        userHasPermissions={isExistingRule && userHasPermissions(canUserCRUD)}
+                        canDuplicateRuleWithActions={canEditRuleWithActions(
+                          rule,
+                          hasActionsPrivileges
                         )}
-                      </StepPanel>
-                    </EuiFlexItem>
-                    <EuiSpacer />
-                    <EuiFlexItem data-test-subj="schedule" component="section" grow={1}>
-                      <StepPanel loading={isLoading} title={ruleI18n.SCHEDULE}>
-                        {scheduleRuleData != null && (
-                          <StepScheduleRule
-                            descriptionColumns="singleSplit"
-                            isReadOnlyView={true}
-                            isLoading={false}
-                            defaultValues={scheduleRuleData}
-                          />
-                        )}
-                      </StepPanel>
+                      />
                     </EuiFlexItem>
                   </EuiFlexGroup>
                 </EuiFlexItem>
               </EuiFlexGroup>
-              <EuiSpacer />
-              {tabs}
-              <EuiSpacer />
-            </Display>
-            {ruleDetailTab === RuleDetailTabs.alerts && hasIndexRead && (
-              <>
-                <EuiFlexGroup alignItems="center" justifyContent="spaceBetween">
-                  <EuiFlexItem grow={false}>
-                    <AlertsTableFilterGroup
-                      status={filterGroup}
-                      onFilterGroupChanged={onFilterGroupChangedCallback}
-                    />
+            </DetectionEngineHeaderPage>
+            {ruleError}
+            {getLegacyUrlConflictCallout}
+            <EuiSpacer />
+            <EuiFlexGroup>
+              <EuiFlexItem data-test-subj="aboutRule" component="section" grow={1}>
+                <StepAboutRuleToggleDetails
+                  loading={isLoading}
+                  stepData={aboutRuleData}
+                  stepDataDetails={modifiedAboutRuleDetailsData}
+                />
+              </EuiFlexItem>
+
+              <EuiFlexItem grow={1}>
+                <EuiFlexGroup direction="column">
+                  <EuiFlexItem component="section" grow={1}>
+                    <StepPanel loading={isLoading} title={ruleI18n.DEFINITION}>
+                      {defineRuleData != null && (
+                        <StepDefineRule
+                          descriptionColumns="singleSplit"
+                          isReadOnlyView={true}
+                          isLoading={false}
+                          defaultValues={defineRuleData}
+                        />
+                      )}
+                    </StepPanel>
                   </EuiFlexItem>
-                  <EuiFlexItem grow={false}>
-                    {updatedAt &&
-                      timelinesUi.getLastUpdated({
-                        updatedAt: updatedAt || Date.now(),
-                        showUpdating,
-                      })}
+                  <EuiSpacer />
+                  <EuiFlexItem data-test-subj="schedule" component="section" grow={1}>
+                    <StepPanel loading={isLoading} title={ruleI18n.SCHEDULE}>
+                      {scheduleRuleData != null && (
+                        <StepScheduleRule
+                          descriptionColumns="singleSplit"
+                          isReadOnlyView={true}
+                          isLoading={false}
+                          defaultValues={scheduleRuleData}
+                        />
+                      )}
+                    </StepPanel>
                   </EuiFlexItem>
                 </EuiFlexGroup>
-                <EuiSpacer size="l" />
-                <Display show={!globalFullScreen}>
-                  <AlertsHistogramPanel
-                    filters={alertMergedFilters}
-                    query={query}
-                    signalIndexName={signalIndexName}
-                    defaultStackByOption={defaultRuleStackByOption}
-                    updateDateRange={updateDateRangeCallback}
-                  />
-                  <EuiSpacer />
-                </Display>
-                {ruleId != null && (
-                  <AlertsTable
-                    filterGroup={filterGroup}
-                    timelineId={TimelineId.detectionsRulesDetailsPage}
-                    defaultFilters={alertsTableDefaultFilters}
-                    hasIndexWrite={hasIndexWrite ?? false}
-                    hasIndexMaintenance={hasIndexMaintenance ?? false}
-                    from={from}
-                    loading={loading}
-                    showBuildingBlockAlerts={showBuildingBlockAlerts}
-                    showOnlyThreatIndicatorAlerts={showOnlyThreatIndicatorAlerts}
-                    onShowBuildingBlockAlertsChanged={onShowBuildingBlockAlertsChangedCallback}
-                    onShowOnlyThreatIndicatorAlertsChanged={onShowOnlyThreatIndicatorAlertsCallback}
-                    onRuleChange={refreshRule}
-                    to={to}
+              </EuiFlexItem>
+            </EuiFlexGroup>
+            <EuiSpacer />
+            {tabs}
+            <EuiSpacer />
+          </Display>
+          {ruleDetailTab === RuleDetailTabs.alerts && hasIndexRead && (
+            <>
+              <EuiFlexGroup alignItems="center" justifyContent="spaceBetween">
+                <EuiFlexItem grow={false}>
+                  <AlertsTableFilterGroup
+                    status={filterGroup}
+                    onFilterGroupChanged={onFilterGroupChangedCallback}
                   />
-                )}
-              </>
-            )}
-            {ruleDetailTab === RuleDetailTabs.exceptions && (
-              <ExceptionsViewer
-                ruleId={ruleId ?? ''}
-                ruleName={rule?.name ?? ''}
-                ruleIndices={ruleIndices}
-                availableListTypes={exceptionLists.allowedExceptionListTypes}
-                commentsAccordionId={'ruleDetailsTabExceptions'}
-                exceptionListsMeta={exceptionLists.lists}
-                onRuleChange={refreshRule}
-              />
-            )}
-            {ruleDetailTab === RuleDetailTabs.failures && <FailureHistory id={rule?.id} />}
-          </SecuritySolutionPageWrapper>
-        </StyledFullHeightContainer>
-      ) : (
-        <SecuritySolutionPageWrapper>
-          <DetectionEngineHeaderPage border title={i18n.PAGE_TITLE} />
-
-          <OverviewEmpty />
+                </EuiFlexItem>
+                <EuiFlexItem grow={false}>
+                  {updatedAt &&
+                    timelinesUi.getLastUpdated({
+                      updatedAt: updatedAt || Date.now(),
+                      showUpdating,
+                    })}
+                </EuiFlexItem>
+              </EuiFlexGroup>
+              <EuiSpacer size="l" />
+              <Display show={!globalFullScreen}>
+                <AlertsHistogramPanel
+                  filters={alertMergedFilters}
+                  query={query}
+                  signalIndexName={signalIndexName}
+                  defaultStackByOption={defaultRuleStackByOption}
+                  updateDateRange={updateDateRangeCallback}
+                />
+                <EuiSpacer />
+              </Display>
+              {ruleId != null && (
+                <AlertsTable
+                  filterGroup={filterGroup}
+                  timelineId={TimelineId.detectionsRulesDetailsPage}
+                  defaultFilters={alertsTableDefaultFilters}
+                  hasIndexWrite={hasIndexWrite ?? false}
+                  hasIndexMaintenance={hasIndexMaintenance ?? false}
+                  from={from}
+                  loading={loading}
+                  showBuildingBlockAlerts={showBuildingBlockAlerts}
+                  showOnlyThreatIndicatorAlerts={showOnlyThreatIndicatorAlerts}
+                  onShowBuildingBlockAlertsChanged={onShowBuildingBlockAlertsChangedCallback}
+                  onShowOnlyThreatIndicatorAlertsChanged={onShowOnlyThreatIndicatorAlertsCallback}
+                  onRuleChange={refreshRule}
+                  to={to}
+                />
+              )}
+            </>
+          )}
+          {ruleDetailTab === RuleDetailTabs.exceptions && (
+            <ExceptionsViewer
+              ruleId={ruleId ?? ''}
+              ruleName={rule?.name ?? ''}
+              ruleIndices={ruleIndices}
+              availableListTypes={exceptionLists.allowedExceptionListTypes}
+              commentsAccordionId={'ruleDetailsTabExceptions'}
+              exceptionListsMeta={exceptionLists.lists}
+              onRuleChange={refreshRule}
+            />
+          )}
+          {ruleDetailTab === RuleDetailTabs.failures && <FailureHistory id={rule?.id} />}
         </SecuritySolutionPageWrapper>
-      )}
+      </StyledFullHeightContainer>
 
       <SpyRoute pageName={SecurityPageName.rules} state={{ ruleName: rule?.name }} />
     </>
diff --git a/x-pack/plugins/security_solution/public/helpers.tsx b/x-pack/plugins/security_solution/public/helpers.tsx
index 066e6a4cb4684..f160d293dd475 100644
--- a/x-pack/plugins/security_solution/public/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/helpers.tsx
@@ -5,7 +5,8 @@
  * 2.0.
  */
 
-import { isEmpty } from 'lodash/fp';
+import { ALERT_RULE_UUID } from '@kbn/rule-data-utils';
+import { get, isEmpty } from 'lodash/fp';
 import React from 'react';
 import { matchPath, RouteProps, Redirect } from 'react-router-dom';
 
@@ -22,6 +23,7 @@ import {
   OVERVIEW_PATH,
   CASES_PATH,
 } from '../common/constants';
+import { Ecs } from '../common/ecs';
 import {
   FactoryQueryTypes,
   StrategyResponseType,
@@ -208,3 +210,27 @@ export const RedirectRoute = React.memo<{ capabilities: Capabilities }>(({ capab
   return <Redirect to={OVERVIEW_PATH} />;
 });
 RedirectRoute.displayName = 'RedirectRoute';
+
+const siemSignalsFieldMappings: Record<string, string> = {
+  [ALERT_RULE_UUID]: 'signal.rule.id',
+};
+
+const alertFieldMappings: Record<string, string> = {
+  'signal.rule.id': ALERT_RULE_UUID,
+};
+
+/*
+ * Deprecation notice: This functionality should be removed when support for signal.* is no longer
+ * supported.
+ *
+ * Selectively returns the AAD field value (kibana.alert.*) or the legacy field value
+ * (signal.*), whichever is present. For backwards compatibility.
+ */
+export const getField = (ecsData: Ecs, field: string) => {
+  const aadField = (alertFieldMappings[field] ?? field).replace('signal', 'kibana.alert');
+  const siemSignalsField = (siemSignalsFieldMappings[field] ?? field).replace(
+    'kibana.alert',
+    'signal'
+  );
+  return get(aadField, ecsData) ?? get(siemSignalsField, ecsData);
+};
diff --git a/x-pack/plugins/security_solution/public/hosts/pages/details/index.tsx b/x-pack/plugins/security_solution/public/hosts/pages/details/index.tsx
index 9bf046f40edb4..55c799f3bda43 100644
--- a/x-pack/plugins/security_solution/public/hosts/pages/details/index.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/pages/details/index.tsx
@@ -47,11 +47,11 @@ import { Display } from '../display';
 import { timelineSelectors } from '../../../timelines/store/timeline';
 import { TimelineId } from '../../../../common/types/timeline';
 import { timelineDefaults } from '../../../timelines/store/timeline/defaults';
-import { useSourcererScope } from '../../../common/containers/sourcerer';
 import { useDeepEqualSelector, useShallowEqualSelector } from '../../../common/hooks/use_selector';
 import { ID, useHostDetails } from '../../containers/hosts/details';
 import { manageQuery } from '../../../common/components/page/manage_query';
 import { useInvalidFilterQuery } from '../../../common/hooks/use_invalid_filter_query';
+import { useSourcererDataView } from '../../../common/containers/sourcerer';
 
 const HostOverviewManage = manageQuery(HostOverview);
 
@@ -97,7 +97,7 @@ const HostDetailsComponent: React.FC<HostDetailsProps> = ({ detailName, hostDeta
     [dispatch]
   );
 
-  const { docValueFields, indicesExist, indexPattern, selectedPatterns } = useSourcererScope();
+  const { docValueFields, indexPattern, indicesExist, selectedPatterns } = useSourcererDataView();
   const [loading, { inspect, hostDetails: hostOverview, id, refetch }] = useHostDetails({
     endDate: to,
     startDate: from,
diff --git a/x-pack/plugins/security_solution/public/hosts/pages/details/types.ts b/x-pack/plugins/security_solution/public/hosts/pages/details/types.ts
index 21924fe929320..cd9ee9ce01869 100644
--- a/x-pack/plugins/security_solution/public/hosts/pages/details/types.ts
+++ b/x-pack/plugins/security_solution/public/hosts/pages/details/types.ts
@@ -6,7 +6,7 @@
  */
 
 import { ActionCreator } from 'typescript-fsa';
-import { Query, IIndexPattern, Filter } from 'src/plugins/data/public';
+import { DataViewBase, Filter, Query } from '@kbn/es-query';
 import { InputsModelId } from '../../../common/store/inputs/constants';
 import { HostsTableType } from '../../store/model';
 import { HostsQueryProps } from '../types';
@@ -62,7 +62,7 @@ export type HostDetailsTabsProps = HostBodyComponentDispatchProps &
     indexNames: string[];
     pageFilters?: Filter[];
     filterQuery?: string;
-    indexPattern: IIndexPattern;
+    indexPattern: DataViewBase;
     type: hostsModel.HostsType;
   };
 
diff --git a/x-pack/plugins/security_solution/public/hosts/pages/hosts.test.tsx b/x-pack/plugins/security_solution/public/hosts/pages/hosts.test.tsx
index d05b091381cca..51dd9d230324f 100644
--- a/x-pack/plugins/security_solution/public/hosts/pages/hosts.test.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/pages/hosts.test.tsx
@@ -23,7 +23,7 @@ import { inputsActions } from '../../common/store/inputs';
 import { State, createStore } from '../../common/store';
 import { Hosts } from './hosts';
 import { HostsTabs } from './hosts_tabs';
-import { useSourcererScope } from '../../common/containers/sourcerer';
+import { useSourcererDataView } from '../../common/containers/sourcerer';
 
 jest.mock('../../common/containers/sourcerer');
 
@@ -57,10 +57,10 @@ const mockHistory = {
   createHref: jest.fn(),
   listen: jest.fn(),
 };
-const mockUseSourcererScope = useSourcererScope as jest.Mock;
+const mockUseSourcererDataView = useSourcererDataView as jest.Mock;
 describe('Hosts - rendering', () => {
   test('it renders the Setup Instructions text when no index is available', async () => {
-    mockUseSourcererScope.mockReturnValue({
+    mockUseSourcererDataView.mockReturnValue({
       indicesExist: false,
     });
 
@@ -75,7 +75,7 @@ describe('Hosts - rendering', () => {
   });
 
   test('it DOES NOT render the Setup Instructions text when an index is available', async () => {
-    mockUseSourcererScope.mockReturnValue({
+    mockUseSourcererDataView.mockReturnValue({
       indicesExist: true,
       indexPattern: {},
     });
@@ -90,7 +90,7 @@ describe('Hosts - rendering', () => {
   });
 
   test('it should render tab navigation', async () => {
-    mockUseSourcererScope.mockReturnValue({
+    mockUseSourcererDataView.mockReturnValue({
       indicesExist: true,
       indexPattern: {},
     });
@@ -137,7 +137,7 @@ describe('Hosts - rendering', () => {
         },
       },
     ];
-    mockUseSourcererScope.mockReturnValue({
+    mockUseSourcererDataView.mockReturnValue({
       indicesExist: true,
       indexPattern: { fields: [], title: 'title' },
     });
diff --git a/x-pack/plugins/security_solution/public/hosts/pages/hosts.tsx b/x-pack/plugins/security_solution/public/hosts/pages/hosts.tsx
index b1c7c25c794c1..8417e8f3ae8b3 100644
--- a/x-pack/plugins/security_solution/public/hosts/pages/hosts.tsx
+++ b/x-pack/plugins/security_solution/public/hosts/pages/hosts.tsx
@@ -50,7 +50,7 @@ import {
 } from '../../timelines/components/timeline/helpers';
 import { timelineSelectors } from '../../timelines/store/timeline';
 import { timelineDefaults } from '../../timelines/store/timeline/defaults';
-import { useSourcererScope } from '../../common/containers/sourcerer';
+import { useSourcererDataView } from '../../common/containers/sourcerer';
 import { useDeepEqualSelector, useShallowEqualSelector } from '../../common/hooks/use_selector';
 import { useInvalidFilterQuery } from '../../common/hooks/use_invalid_filter_query';
 import { ID } from '../containers/hosts';
@@ -111,7 +111,7 @@ const HostsComponent = () => {
     },
     [dispatch]
   );
-  const { docValueFields, indicesExist, indexPattern, selectedPatterns } = useSourcererScope();
+  const { docValueFields, indicesExist, indexPattern, selectedPatterns } = useSourcererDataView();
   const [filterQuery, kqlError] = useMemo(
     () =>
       convertToBuildEsQuery({
diff --git a/x-pack/plugins/security_solution/public/index.ts b/x-pack/plugins/security_solution/public/index.ts
index 3d2412b326b54..5f2f6014822ab 100644
--- a/x-pack/plugins/security_solution/public/index.ts
+++ b/x-pack/plugins/security_solution/public/index.ts
@@ -12,4 +12,5 @@ export type { TimelineModel } from './timelines/store/timeline/model';
 
 export const plugin = (context: PluginInitializerContext): Plugin => new Plugin(context);
 
-export { Plugin, PluginSetup };
+export type { PluginSetup };
+export { Plugin };
diff --git a/x-pack/plugins/security_solution/public/management/components/artifact_entry_card/components/criteria_conditions.tsx b/x-pack/plugins/security_solution/public/management/components/artifact_entry_card/components/criteria_conditions.tsx
index 24244aad3ef99..048b79c354803 100644
--- a/x-pack/plugins/security_solution/public/management/components/artifact_entry_card/components/criteria_conditions.tsx
+++ b/x-pack/plugins/security_solution/public/management/components/artifact_entry_card/components/criteria_conditions.tsx
@@ -89,7 +89,7 @@ export const CriteriaConditions = memo<CriteriaConditionsProps>(
     };
 
     const getEntryOperator = (type: string, operator: string) => {
-      if (type === 'nested') return;
+      if (type === 'nested') return '';
       return operator === 'included'
         ? OPERATOR_TYPE_LABELS_INCLUDED[type as keyof typeof OPERATOR_TYPE_LABELS_INCLUDED] ?? type
         : OPERATOR_TYPE_LABELS_EXCLUDED[type as keyof typeof OPERATOR_TYPE_LABELS_EXCLUDED] ?? type;
diff --git a/x-pack/plugins/security_solution/public/management/components/policies_selector/index.ts b/x-pack/plugins/security_solution/public/management/components/policies_selector/index.ts
index 1b25a8af9d3fc..7ebfcb8c9f4ab 100644
--- a/x-pack/plugins/security_solution/public/management/components/policies_selector/index.ts
+++ b/x-pack/plugins/security_solution/public/management/components/policies_selector/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { PoliciesSelector, PolicySelectionItem, PoliciesSelectorProps } from './policies_selector';
+export type { PolicySelectionItem, PoliciesSelectorProps } from './policies_selector';
+export { PoliciesSelector } from './policies_selector';
diff --git a/x-pack/plugins/security_solution/public/management/components/search_exceptions/index.ts b/x-pack/plugins/security_solution/public/management/components/search_exceptions/index.ts
index 6a870dbb06c66..2477545776689 100644
--- a/x-pack/plugins/security_solution/public/management/components/search_exceptions/index.ts
+++ b/x-pack/plugins/security_solution/public/management/components/search_exceptions/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { SearchExceptions, SearchExceptionsProps } from './search_exceptions';
+export type { SearchExceptionsProps } from './search_exceptions';
+export { SearchExceptions } from './search_exceptions';
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/index.tsx b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/index.tsx
index 70f5bca339c82..ac361ff8f16ad 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/index.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/index.tsx
@@ -25,4 +25,4 @@ export const EndpointsContainer = memo(() => {
 
 EndpointsContainer.displayName = 'EndpointsContainer';
 export { endpointListFleetApisHttpMock } from './mocks';
-export { EndpointListFleetApisHttpMockInterface } from './mocks';
+export type { EndpointListFleetApisHttpMockInterface } from './mocks';
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/action.ts b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/action.ts
index 05d28c1cbf27f..6e9c1f69cb060 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/action.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/action.ts
@@ -7,6 +7,7 @@
 
 import { Action } from 'redux';
 import { EuiSuperDatePickerRecentRange } from '@elastic/eui';
+import { DataViewBase } from '@kbn/es-query';
 import {
   HostResultList,
   HostInfo,
@@ -17,7 +18,6 @@ import {
 import { ServerApiError } from '../../../../common/types';
 import { GetPolicyListResponse } from '../../policy/types';
 import { EndpointState } from '../types';
-import { IIndexPattern } from '../../../../../../../../src/plugins/data/public';
 
 export interface ServerReturnedEndpointList {
   type: 'serverReturnedEndpointList';
@@ -96,7 +96,7 @@ export interface ServerReturnedEndpointExistValue {
 
 export interface ServerReturnedMetadataPatterns {
   type: 'serverReturnedMetadataPatterns';
-  payload: IIndexPattern[];
+  payload: DataViewBase[];
 }
 
 export interface ServerFailedToReturnMetadataPatterns {
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.ts b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.ts
index 3506d2c22ce3f..ec9672b645ca3 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.ts
@@ -9,6 +9,7 @@ import { Dispatch } from 'redux';
 import semverGte from 'semver/functions/gte';
 
 import { CoreStart, HttpStart } from 'kibana/public';
+import { DataViewBase, Query } from '@kbn/es-query';
 import {
   ActivityLog,
   GetHostPolicyResponse,
@@ -67,7 +68,6 @@ import {
   metadataCurrentIndexPattern,
   METADATA_UNITED_INDEX,
 } from '../../../../../common/endpoint/constants';
-import { IIndexPattern, Query } from '../../../../../../../../src/plugins/data/public';
 import {
   createFailedResourceState,
   createLoadedResourceState,
@@ -94,7 +94,7 @@ export const endpointMiddlewareFactory: ImmutableMiddlewareFactory<EndpointState
   // or else wrong pattern might be loaded
   async function fetchIndexPatterns(
     state: ImmutableObject<EndpointState>
-  ): Promise<IIndexPattern[]> {
+  ): Promise<DataViewBase[]> {
     const packageVersion = endpointPackageVersion(state) ?? '';
     const parsedPackageVersion = packageVersion.includes('-')
       ? packageVersion.substring(0, packageVersion.indexOf('-'))
@@ -108,7 +108,7 @@ export const endpointMiddlewareFactory: ImmutableMiddlewareFactory<EndpointState
     const fields = await indexPatterns.getFieldsForWildcard({
       pattern: indexPatternToFetch,
     });
-    const indexPattern: IIndexPattern = {
+    const indexPattern: DataViewBase = {
       title: indexPatternToFetch,
       fields,
     };
@@ -397,7 +397,7 @@ async function endpointDetailsListMiddleware({
 }: {
   store: ImmutableMiddlewareAPI<EndpointState, AppAction>;
   coreStart: CoreStart;
-  fetchIndexPatterns: (state: ImmutableObject<EndpointState>) => Promise<IIndexPattern[]>;
+  fetchIndexPatterns: (state: ImmutableObject<EndpointState>) => Promise<DataViewBase[]>;
 }) {
   const { getState, dispatch } = store;
 
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/types.ts b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/types.ts
index 0fa96fe00fd2c..1a87223cdd01f 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/types.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/types.ts
@@ -6,6 +6,7 @@
  */
 
 import { EuiSuperDatePickerRecentRange } from '@elastic/eui';
+import { DataViewBase } from '@kbn/es-query';
 import {
   ActivityLog,
   HostInfo,
@@ -20,7 +21,6 @@ import {
 } from '../../../../common/endpoint/types';
 import { ServerApiError } from '../../../common/types';
 import { GetPackagesResponse } from '../../../../../fleet/common';
-import { IIndexPattern } from '../../../../../../../src/plugins/data/public';
 import { AsyncResourceState } from '../../state';
 import { TRANSFORM_STATES } from '../../../../common/constants';
 
@@ -86,7 +86,7 @@ export interface EndpointState {
   /** Tracks whether hosts exist and helps control if onboarding should be visible */
   endpointsExist: boolean;
   /** index patterns for query bar */
-  patterns: IIndexPattern[];
+  patterns: DataViewBase[];
   /** api error from retrieving index patters for query bar */
   patternsError?: ServerApiError;
   /** Is auto-refresh enabled */
diff --git a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/details/components/log_entry.tsx b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/details/components/log_entry.tsx
index 79af2ecb354fd..87de2d42a9844 100644
--- a/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/details/components/log_entry.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/view/details/components/log_entry.tsx
@@ -129,9 +129,9 @@ const useLogEntryUIProps = (
       if (isIsolateAction) {
         if (isCompleted) {
           if (isSuccessful) {
-            return i18.ACTIVITY_LOG.LogEntry.response.unisolationCompletedAndSuccessful;
+            return i18.ACTIVITY_LOG.LogEntry.response.isolationCompletedAndSuccessful;
           }
-          return i18.ACTIVITY_LOG.LogEntry.response.unisolationCompletedAndUnsuccessful;
+          return i18.ACTIVITY_LOG.LogEntry.response.isolationCompletedAndUnsuccessful;
         } else if (isSuccessful) {
           return i18.ACTIVITY_LOG.LogEntry.response.isolationSuccessful;
         } else {
diff --git a/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/host_isolation_exceptions_list.test.tsx b/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/host_isolation_exceptions_list.test.tsx
index 0983d6bcb755d..2911264d7061a 100644
--- a/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/host_isolation_exceptions_list.test.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/host_isolation_exceptions/view/host_isolation_exceptions_list.test.tsx
@@ -168,9 +168,8 @@ describe('When on the host isolation exceptions page', () => {
       it('should show the create flyout when the add button is pressed', async () => {
         render();
         await dataReceived();
-        act(() => {
-          userEvent.click(renderResult.getByTestId('hostIsolationExceptionsListAddButton'));
-        });
+        userEvent.click(renderResult.getByTestId('hostIsolationExceptionsListAddButton'));
+        await dataReceived();
         expect(renderResult.getByTestId('hostIsolationExceptionsCreateEditFlyout')).toBeTruthy();
       });
 
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/index.ts b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/index.ts
index bc9e42ddf7f52..c771cef28e73d 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/index.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/index.ts
@@ -20,4 +20,4 @@ export interface EndpointPolicyDetailsStatePluginState {
 export interface EndpointPolicyDetailsStatePluginReducer {
   policyDetails: ImmutableReducer<PolicyDetailsState, AppAction>;
 }
-export { PolicyDetailsAction } from './action';
+export type { PolicyDetailsAction } from './action';
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/logical_condition/index.ts b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/logical_condition/index.ts
index c017e7dec5248..44f378b15fa0f 100644
--- a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/logical_condition/index.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/logical_condition/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { LogicalConditionBuilder, LogicalConditionBuilderProps } from './logical_condition_builder';
+export type { LogicalConditionBuilderProps } from './logical_condition_builder';
+export { LogicalConditionBuilder } from './logical_condition_builder';
diff --git a/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map.test.tsx b/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map.test.tsx
index 63a4571ca11e5..d9201e62268ab 100644
--- a/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map.test.tsx
@@ -52,7 +52,7 @@ jest.mock('./index_patterns_missing_prompt', () => {
 describe('EmbeddedMapComponent', () => {
   const setQuery: jest.Mock = jest.fn();
   const mockSelector = {
-    kibanaIndexPatterns: [
+    kibanaDataViews: [
       { id: '6f1eeb50-023d-11eb-bcb6-6ba0578012a9', title: 'filebeat-*' },
       { id: '28995490-023d-11eb-bcb6-6ba0578012a9', title: 'auditbeat-*' },
     ],
@@ -132,7 +132,7 @@ describe('EmbeddedMapComponent', () => {
     const spy = jest.spyOn(redux, 'useSelector');
     spy.mockReturnValue({
       ...mockSelector,
-      kibanaIndexPatterns: [],
+      kibanaDataViews: [],
     });
 
     (createEmbeddable as jest.Mock).mockResolvedValue(mockCreateEmbeddable);
diff --git a/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map.tsx b/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map.tsx
index f2cb974a5b5c1..15a0f870d7bda 100644
--- a/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map.tsx
@@ -28,8 +28,9 @@ import * as i18n from './translations';
 import { MapEmbeddable } from '../../../../../../plugins/maps/public/embeddable';
 import { Query, Filter } from '../../../../../../../src/plugins/data/public';
 import { useKibana } from '../../../common/lib/kibana';
-import { getDefaultSourcererSelector } from './selector';
 import { getLayerList } from './map_config';
+import { sourcererSelectors } from '../../../common/store/sourcerer';
+import { SourcererScopeName } from '../../../common/store/sourcerer/model';
 import { useDeepEqualSelector } from '../../../common/hooks/use_selector';
 
 interface EmbeddableMapProps {
@@ -95,13 +96,13 @@ export const EmbeddedMapComponent = ({
   const [isIndexError, setIsIndexError] = useState(false);
 
   const [, dispatchToaster] = useStateToaster();
-  const defaultSourcererScopeSelector = useMemo(getDefaultSourcererSelector, []);
-  const { kibanaIndexPatterns, sourcererScope } = useDeepEqualSelector(
-    defaultSourcererScopeSelector
-  );
+
+  const sourcererScopeSelector = useMemo(() => sourcererSelectors.getSourcererScopeSelector(), []);
+  const { kibanaDataViews, sourcererScope }: sourcererSelectors.SourcererScopeSelector =
+    useDeepEqualSelector((state) => sourcererScopeSelector(state, SourcererScopeName.default));
 
   const [mapIndexPatterns, setMapIndexPatterns] = useState(
-    kibanaIndexPatterns.filter((kip) => sourcererScope.selectedPatterns.includes(kip.title))
+    kibanaDataViews.filter((dataView) => sourcererScope.selectedPatterns.includes(dataView.title))
   );
 
   // This portalNode provided by react-reverse-portal allows us re-parent the MapToolTip within our
@@ -114,8 +115,8 @@ export const EmbeddedMapComponent = ({
 
   useEffect(() => {
     setMapIndexPatterns((prevMapIndexPatterns) => {
-      const newIndexPatterns = kibanaIndexPatterns.filter((kip) =>
-        sourcererScope.selectedPatterns.includes(kip.title)
+      const newIndexPatterns = kibanaDataViews.filter((dataView) =>
+        sourcererScope.selectedPatterns.includes(dataView.title)
       );
       if (!deepEqual(newIndexPatterns, prevMapIndexPatterns)) {
         if (newIndexPatterns.length === 0) {
@@ -125,7 +126,7 @@ export const EmbeddedMapComponent = ({
       }
       return prevMapIndexPatterns;
     });
-  }, [kibanaIndexPatterns, sourcererScope.selectedPatterns]);
+  }, [kibanaDataViews, sourcererScope.selectedPatterns]);
 
   // Initial Load useEffect
   useEffect(() => {
diff --git a/x-pack/plugins/security_solution/public/network/components/embeddables/selector.test.tsx b/x-pack/plugins/security_solution/public/network/components/embeddables/selector.test.tsx
deleted file mode 100644
index 99efe50a467a2..0000000000000
--- a/x-pack/plugins/security_solution/public/network/components/embeddables/selector.test.tsx
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { State } from '../../../common/store';
-
-import { getDefaultSourcererSelector } from './selector';
-
-jest.mock('../../../common/store/sourcerer', () => ({
-  sourcererSelectors: {
-    kibanaIndexPatternsSelector: jest.fn().mockReturnValue(jest.fn()),
-    scopesSelector: jest.fn().mockReturnValue(jest.fn().mockReturnValue({ default: '' })),
-  },
-}));
-
-describe('getDefaultSourcererSelector', () => {
-  test('Returns correct format', () => {
-    const mockMapStateToProps = getDefaultSourcererSelector();
-    const result = mockMapStateToProps({} as State);
-    expect(result).toHaveProperty('kibanaIndexPatterns');
-    expect(result).toHaveProperty('sourcererScope');
-  });
-});
diff --git a/x-pack/plugins/security_solution/public/network/components/embeddables/selector.tsx b/x-pack/plugins/security_solution/public/network/components/embeddables/selector.tsx
deleted file mode 100644
index c646276d710a2..0000000000000
--- a/x-pack/plugins/security_solution/public/network/components/embeddables/selector.tsx
+++ /dev/null
@@ -1,36 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { State } from '../../../common/store';
-import { sourcererSelectors } from '../../../common/store/sourcerer';
-import {
-  KibanaIndexPatterns,
-  ManageScope,
-  SourcererScopeName,
-} from '../../../common/store/sourcerer/model';
-
-export interface DefaultSourcererSelector {
-  kibanaIndexPatterns: KibanaIndexPatterns;
-  sourcererScope: ManageScope;
-}
-
-export const getDefaultSourcererSelector = () => {
-  const getKibanaIndexPatternsSelector = sourcererSelectors.kibanaIndexPatternsSelector();
-  const getScopesSelector = sourcererSelectors.scopesSelector();
-
-  const mapStateToProps = (state: State): DefaultSourcererSelector => {
-    const kibanaIndexPatterns = getKibanaIndexPatternsSelector(state);
-    const scope = getScopesSelector(state)[SourcererScopeName.default];
-
-    return {
-      kibanaIndexPatterns,
-      sourcererScope: scope,
-    };
-  };
-
-  return mapStateToProps;
-};
diff --git a/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/columns.tsx b/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/columns.tsx
index 28953730ce3cf..4c50a3a0f49c5 100644
--- a/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/columns.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/columns.tsx
@@ -8,8 +8,7 @@
 import { get } from 'lodash/fp';
 import numeral from '@elastic/numeral';
 import React from 'react';
-import { IIndexPattern } from 'src/plugins/data/public';
-
+import { DataViewBase } from '@kbn/es-query';
 import { CountryFlagAndName } from '../source_destination/country_flag';
 import {
   FlowTargetSourceDest,
@@ -47,7 +46,7 @@ export type NetworkTopCountriesColumnsNetworkDetails = [
 ];
 
 export const getNetworkTopCountriesColumns = (
-  indexPattern: IIndexPattern,
+  indexPattern: DataViewBase,
   flowTarget: FlowTargetSourceDest,
   type: networkModel.NetworkType,
   tableId: string
@@ -161,7 +160,7 @@ export const getNetworkTopCountriesColumns = (
 ];
 
 export const getCountriesColumnsCurated = (
-  indexPattern: IIndexPattern,
+  indexPattern: DataViewBase,
   flowTarget: FlowTargetSourceDest,
   type: networkModel.NetworkType,
   tableId: string
diff --git a/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/index.tsx b/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/index.tsx
index d4a611c7f557f..23b453c0f7384 100644
--- a/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/index.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/network_top_countries_table/index.tsx
@@ -9,7 +9,7 @@ import { last } from 'lodash/fp';
 import React, { useCallback, useMemo } from 'react';
 import { useDispatch } from 'react-redux';
 import deepEqual from 'fast-deep-equal';
-import { IIndexPattern } from 'src/plugins/data/public';
+import { DataViewBase } from '@kbn/es-query';
 
 import { networkActions, networkModel, networkSelectors } from '../../store';
 import {
@@ -31,7 +31,7 @@ interface NetworkTopCountriesTableProps {
   fakeTotalCount: number;
   flowTargeted: FlowTargetSourceDest;
   id: string;
-  indexPattern: IIndexPattern;
+  indexPattern: DataViewBase;
   isInspect: boolean;
   loading: boolean;
   loadPage: (newActivePage: number) => void;
diff --git a/x-pack/plugins/security_solution/public/network/pages/details/index.test.tsx b/x-pack/plugins/security_solution/public/network/pages/details/index.test.tsx
index 612acdc813c92..7d8389d95f33e 100644
--- a/x-pack/plugins/security_solution/public/network/pages/details/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/pages/details/index.test.tsx
@@ -10,7 +10,7 @@ import { Router, useParams } from 'react-router-dom';
 
 import '../../../common/mock/match_media';
 
-import { useSourcererScope } from '../../../common/containers/sourcerer';
+import { useSourcererDataView } from '../../../common/containers/sourcerer';
 import {
   mockGlobalState,
   TestProviders,
@@ -87,7 +87,7 @@ const getMockHistory = (ip: string) => ({
 describe('Network Details', () => {
   const mount = useMountAppended();
   beforeAll(() => {
-    (useSourcererScope as jest.Mock).mockReturnValue({
+    (useSourcererDataView as jest.Mock).mockReturnValue({
       indicesExist: false,
       indexPattern: {},
     });
@@ -131,7 +131,7 @@ describe('Network Details', () => {
 
   test('it renders ipv6 headline', async () => {
     const ip = 'fe80--24ce-f7ff-fede-a571';
-    (useSourcererScope as jest.Mock).mockReturnValue({
+    (useSourcererDataView as jest.Mock).mockReturnValue({
       indicesExist: true,
       indexPattern: {},
     });
diff --git a/x-pack/plugins/security_solution/public/network/pages/details/index.tsx b/x-pack/plugins/security_solution/public/network/pages/details/index.tsx
index 5aee4022a7f30..e0ede2d23846e 100644
--- a/x-pack/plugins/security_solution/public/network/pages/details/index.tsx
+++ b/x-pack/plugins/security_solution/public/network/pages/details/index.tsx
@@ -48,7 +48,7 @@ import { AnomaliesQueryTabBody } from '../../../common/containers/anomalies/anom
 import { esQuery } from '../../../../../../../src/plugins/data/public';
 import { networkModel } from '../../store';
 import { SecurityPageName } from '../../../app/types';
-import { useSourcererScope } from '../../../common/containers/sourcerer';
+import { useSourcererDataView } from '../../../common/containers/sourcerer';
 import { useInvalidFilterQuery } from '../../../common/hooks/use_invalid_filter_query';
 export { getBreadcrumbs } from './utils';
 
@@ -92,7 +92,7 @@ const NetworkDetailsComponent: React.FC = () => {
     dispatch(setNetworkDetailsTablesActivePageToZero());
   }, [detailName, dispatch]);
 
-  const { docValueFields, indicesExist, indexPattern, selectedPatterns } = useSourcererScope();
+  const { docValueFields, indicesExist, indexPattern, selectedPatterns } = useSourcererDataView();
   const ip = decodeIpv6(detailName);
   const [filterQuery, kqlError] = convertToBuildEsQuery({
     config: esQuery.getEsQueryConfig(uiSettings),
diff --git a/x-pack/plugins/security_solution/public/network/pages/details/types.ts b/x-pack/plugins/security_solution/public/network/pages/details/types.ts
index b91a22cbd5fc3..02722f4709bcc 100644
--- a/x-pack/plugins/security_solution/public/network/pages/details/types.ts
+++ b/x-pack/plugins/security_solution/public/network/pages/details/types.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { IIndexPattern } from 'src/plugins/data/public';
+import { DataViewBase } from '@kbn/es-query';
 
 import { ESTermQuery } from '../../../../common/typed_json';
 import { NetworkType } from '../../store/model';
@@ -38,5 +38,5 @@ export type TlsQueryTableComponentProps = OwnProps & {
 
 export type NetworkWithIndexComponentsQueryTableProps = OwnProps & {
   flowTarget: FlowTargetSourceDest;
-  indexPattern: IIndexPattern;
+  indexPattern: DataViewBase;
 };
diff --git a/x-pack/plugins/security_solution/public/network/pages/navigation/types.ts b/x-pack/plugins/security_solution/public/network/pages/navigation/types.ts
index 075aa46637a07..96b72caf03300 100644
--- a/x-pack/plugins/security_solution/public/network/pages/navigation/types.ts
+++ b/x-pack/plugins/security_solution/public/network/pages/navigation/types.ts
@@ -5,8 +5,8 @@
  * 2.0.
  */
 
+import { DataViewBase } from '@kbn/es-query';
 import { ESTermQuery } from '../../../../common/typed_json';
-import { IIndexPattern } from '../../../../../../../src/plugins/data/common';
 
 import { NavTab } from '../../../common/components/navigation/types';
 import { FlowTargetSourceDest } from '../../../../common/search_strategy/security_solution/network';
@@ -32,7 +32,7 @@ export type NetworkComponentQueryProps = QueryTabBodyProps & {
 };
 
 export type IPsQueryTabBodyProps = QueryTabBodyProps & {
-  indexPattern: IIndexPattern;
+  indexPattern: DataViewBase;
   flowTarget: FlowTargetSourceDest;
 };
 
@@ -49,7 +49,7 @@ export type NetworkRoutesProps = GlobalTimeArgs & {
   docValueFields: DocValueFields[];
   type: networkModel.NetworkType;
   filterQuery?: string | ESTermQuery;
-  indexPattern: IIndexPattern;
+  indexPattern: DataViewBase;
   indexNames: string[];
   setAbsoluteRangeDatePicker: SetAbsoluteRangeDatePicker;
 };
diff --git a/x-pack/plugins/security_solution/public/network/pages/network.test.tsx b/x-pack/plugins/security_solution/public/network/pages/network.test.tsx
index 764b8fcd0444b..d0fff882cdc86 100644
--- a/x-pack/plugins/security_solution/public/network/pages/network.test.tsx
+++ b/x-pack/plugins/security_solution/public/network/pages/network.test.tsx
@@ -11,7 +11,7 @@ import { Router } from 'react-router-dom';
 import { waitFor } from '@testing-library/react';
 import '../../common/mock/match_media';
 import { Filter } from '../../../../../../src/plugins/data/common/es_query';
-import { useSourcererScope } from '../../common/containers/sourcerer';
+import { useSourcererDataView } from '../../common/containers/sourcerer';
 import {
   TestProviders,
   mockGlobalState,
@@ -70,10 +70,10 @@ const mockProps = {
   capabilitiesFetched: true,
   hasMlUserPermissions: true,
 };
-const mockUseSourcererScope = useSourcererScope as jest.Mock;
+const mockUseSourcererDataView = useSourcererDataView as jest.Mock;
 describe('Network page - rendering', () => {
   test('it renders the Setup Instructions text when no index is available', () => {
-    mockUseSourcererScope.mockReturnValue({
+    mockUseSourcererDataView.mockReturnValue({
       selectedPatterns: [],
       indicesExist: false,
     });
@@ -89,7 +89,7 @@ describe('Network page - rendering', () => {
   });
 
   test('it DOES NOT render the Setup Instructions text when an index is available', async () => {
-    mockUseSourcererScope.mockReturnValue({
+    mockUseSourcererDataView.mockReturnValue({
       selectedPatterns: [],
       indicesExist: true,
       indexPattern: {},
@@ -138,7 +138,7 @@ describe('Network page - rendering', () => {
         },
       },
     ];
-    mockUseSourcererScope.mockReturnValue({
+    mockUseSourcererDataView.mockReturnValue({
       selectedPatterns: [],
       indicesExist: true,
       indexPattern: { fields: [], title: 'title' },
diff --git a/x-pack/plugins/security_solution/public/network/pages/network.tsx b/x-pack/plugins/security_solution/public/network/pages/network.tsx
index af7f513afd744..f38a26da00599 100644
--- a/x-pack/plugins/security_solution/public/network/pages/network.tsx
+++ b/x-pack/plugins/security_solution/public/network/pages/network.tsx
@@ -49,7 +49,7 @@ import {
 import { timelineSelectors } from '../../timelines/store/timeline';
 import { TimelineId } from '../../../common/types/timeline';
 import { timelineDefaults } from '../../timelines/store/timeline/defaults';
-import { useSourcererScope } from '../../common/containers/sourcerer';
+import { useSourcererDataView } from '../../common/containers/sourcerer';
 import { useDeepEqualSelector, useShallowEqualSelector } from '../../common/hooks/use_selector';
 import { useInvalidFilterQuery } from '../../common/hooks/use_invalid_filter_query';
 /**
@@ -109,7 +109,7 @@ const NetworkComponent = React.memo<NetworkComponentProps>(
       [dispatch]
     );
 
-    const { docValueFields, indicesExist, indexPattern, selectedPatterns } = useSourcererScope();
+    const { docValueFields, indicesExist, indexPattern, selectedPatterns } = useSourcererDataView();
 
     const onSkipFocusBeforeEventsTable = useCallback(() => {
       containerElement.current
diff --git a/x-pack/plugins/security_solution/public/overview/components/alerts_by_category/index.tsx b/x-pack/plugins/security_solution/public/overview/components/alerts_by_category/index.tsx
index e74e8f82d8244..bce9dd9fa9d0c 100644
--- a/x-pack/plugins/security_solution/public/overview/components/alerts_by_category/index.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/alerts_by_category/index.tsx
@@ -9,17 +9,13 @@ import numeral from '@elastic/numeral';
 import React, { useEffect, useMemo, useCallback } from 'react';
 import { Position } from '@elastic/charts';
 
+import { DataViewBase, Filter, Query } from '@kbn/es-query';
 import { DEFAULT_NUMBER_FORMAT, APP_UI_ID } from '../../../../common/constants';
 import { SHOWING, UNIT } from '../../../common/components/alerts_viewer/translations';
 import { MatrixHistogram } from '../../../common/components/matrix_histogram';
 import { useKibana, useUiSetting$ } from '../../../common/lib/kibana';
 import { convertToBuildEsQuery } from '../../../common/lib/keury';
-import {
-  Filter,
-  esQuery,
-  IIndexPattern,
-  Query,
-} from '../../../../../../../src/plugins/data/public';
+import { esQuery } from '../../../../../../../src/plugins/data/public';
 import { HostsTableType } from '../../../hosts/store/model';
 
 import * as i18n from '../../pages/translations';
@@ -42,7 +38,7 @@ const DEFAULT_STACK_BY = 'event.module';
 interface Props extends Pick<GlobalTimeArgs, 'from' | 'to' | 'deleteQuery' | 'setQuery'> {
   filters: Filter[];
   hideHeaderChildren?: boolean;
-  indexPattern: IIndexPattern;
+  indexPattern: DataViewBase;
   indexNames: string[];
   query: Query;
 }
diff --git a/x-pack/plugins/security_solution/public/overview/components/event_counts/index.tsx b/x-pack/plugins/security_solution/public/overview/components/event_counts/index.tsx
index 919057d6b5eab..8ec38549477fa 100644
--- a/x-pack/plugins/security_solution/public/overview/components/event_counts/index.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/event_counts/index.tsx
@@ -9,6 +9,7 @@ import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 import React, { useMemo } from 'react';
 import styled from 'styled-components';
 
+import { DataViewBase, Filter, Query } from '@kbn/es-query';
 import { ID as OverviewHostQueryId } from '../../containers/overview_host';
 import { OverviewHost } from '../overview_host';
 import { OverviewNetwork } from '../overview_network';
@@ -16,12 +17,7 @@ import { filterHostData } from '../../../hosts/pages/navigation/alerts_query_tab
 import { useKibana } from '../../../common/lib/kibana';
 import { convertToBuildEsQuery } from '../../../common/lib/keury';
 import { filterNetworkData } from '../../../network/pages/navigation/alerts_query_tab_body';
-import {
-  Filter,
-  esQuery,
-  IIndexPattern,
-  Query,
-} from '../../../../../../../src/plugins/data/public';
+import { esQuery } from '../../../../../../../src/plugins/data/public';
 import { GlobalTimeArgs } from '../../../common/containers/use_global_time';
 import { useInvalidFilterQuery } from '../../../common/hooks/use_invalid_filter_query';
 
@@ -32,7 +28,7 @@ const HorizontalSpacer = styled(EuiFlexItem)`
 interface Props extends Pick<GlobalTimeArgs, 'from' | 'to' | 'setQuery'> {
   filters: Filter[];
   indexNames: string[];
-  indexPattern: IIndexPattern;
+  indexPattern: DataViewBase;
   query: Query;
 }
 
diff --git a/x-pack/plugins/security_solution/public/overview/components/events_by_dataset/index.tsx b/x-pack/plugins/security_solution/public/overview/components/events_by_dataset/index.tsx
index 562d1d1fd7aad..a184ba572d77c 100644
--- a/x-pack/plugins/security_solution/public/overview/components/events_by_dataset/index.tsx
+++ b/x-pack/plugins/security_solution/public/overview/components/events_by_dataset/index.tsx
@@ -10,6 +10,7 @@ import numeral from '@elastic/numeral';
 import React, { useEffect, useMemo, useCallback } from 'react';
 import uuid from 'uuid';
 
+import { DataViewBase, Filter, Query } from '@kbn/es-query';
 import { DEFAULT_NUMBER_FORMAT, APP_UI_ID } from '../../../../common/constants';
 import { SHOWING, UNIT } from '../../../common/components/events_viewer/translations';
 import { getTabsOnHostsUrl } from '../../../common/components/link_to/redirect_to_hosts';
@@ -22,12 +23,7 @@ import { eventsStackByOptions } from '../../../hosts/pages/navigation';
 import { convertToBuildEsQuery } from '../../../common/lib/keury';
 import { useKibana, useUiSetting$ } from '../../../common/lib/kibana';
 import { histogramConfigs } from '../../../hosts/pages/navigation/events_query_tab_body';
-import {
-  Filter,
-  esQuery,
-  IIndexPattern,
-  Query,
-} from '../../../../../../../src/plugins/data/public';
+import { esQuery } from '../../../../../../../src/plugins/data/public';
 import { HostsTableType } from '../../../hosts/store/model';
 import { InputsModelId } from '../../../common/store/inputs/constants';
 import { GlobalTimeArgs } from '../../../common/containers/use_global_time';
@@ -46,7 +42,7 @@ interface Props extends Pick<GlobalTimeArgs, 'from' | 'to' | 'deleteQuery' | 'se
   combinedQueries?: string;
   filters: Filter[];
   headerChildren?: React.ReactNode;
-  indexPattern: IIndexPattern;
+  indexPattern: DataViewBase;
   indexNames: string[];
   onlyField?: string;
   paddingSize?: 's' | 'm' | 'l' | 'none';
diff --git a/x-pack/plugins/security_solution/public/overview/components/link_panel/index.ts b/x-pack/plugins/security_solution/public/overview/components/link_panel/index.ts
index 64c8d6a38efe7..9d404abcf2223 100644
--- a/x-pack/plugins/security_solution/public/overview/components/link_panel/index.ts
+++ b/x-pack/plugins/security_solution/public/overview/components/link_panel/index.ts
@@ -8,4 +8,4 @@
 export { InnerLinkPanel } from './inner_link_panel';
 export { isLinkPanelListItem } from './helpers';
 export { LinkPanel } from './link_panel';
-export { LinkPanelListItem } from './types';
+export type { LinkPanelListItem } from './types';
diff --git a/x-pack/plugins/security_solution/public/overview/pages/overview.test.tsx b/x-pack/plugins/security_solution/public/overview/pages/overview.test.tsx
index ab5ae4f613e38..2539490be16fb 100644
--- a/x-pack/plugins/security_solution/public/overview/pages/overview.test.tsx
+++ b/x-pack/plugins/security_solution/public/overview/pages/overview.test.tsx
@@ -21,7 +21,7 @@ import {
   initialUserPrivilegesState,
   useUserPrivileges,
 } from '../../common/components/user_privileges';
-import { useSourcererScope } from '../../common/containers/sourcerer';
+import { useSourcererDataView } from '../../common/containers/sourcerer';
 import { useFetchIndex } from '../../common/containers/source';
 import { useIsThreatIntelModuleEnabled } from '../containers/overview_cti_links/use_is_threat_intel_module_enabled';
 import { useCtiEventCounts } from '../containers/overview_cti_links/use_cti_event_counts';
@@ -107,7 +107,7 @@ const endpointNoticeMessage = (hasMessageValue: boolean) => {
     clearAllMessages: () => undefined,
   };
 };
-const mockUseSourcererScope = useSourcererScope as jest.Mock;
+const mockUseSourcererDataView = useSourcererDataView as jest.Mock;
 const mockUseUserPrivileges = useUserPrivileges as jest.Mock;
 const mockUseFetchIndex = useFetchIndex as jest.Mock;
 const mockUseMessagesStorage: jest.Mock = useMessagesStorage as jest.Mock<UseMessagesStorage>;
@@ -141,7 +141,7 @@ describe('Overview', () => {
 
   describe('rendering', () => {
     test('it DOES NOT render the Getting started text when an index is available', () => {
-      mockUseSourcererScope.mockReturnValue({
+      mockUseSourcererDataView.mockReturnValue({
         selectedPatterns: [],
         indicesExist: true,
         indexPattern: {},
@@ -168,7 +168,7 @@ describe('Overview', () => {
           indexExists: false,
         },
       ]);
-      mockUseSourcererScope.mockReturnValue({
+      mockUseSourcererDataView.mockReturnValue({
         selectedPatterns: [],
         indicesExist: true,
         indexPattern: {},
@@ -195,7 +195,7 @@ describe('Overview', () => {
           indexExists: false,
         },
       ]);
-      mockUseSourcererScope.mockReturnValueOnce({
+      mockUseSourcererDataView.mockReturnValueOnce({
         selectedPatterns: [],
         indicesExist: true,
         indexPattern: {},
@@ -216,7 +216,7 @@ describe('Overview', () => {
     });
 
     test('it does NOT render the Endpoint banner when the endpoint index is available AND storage is set', () => {
-      mockUseSourcererScope.mockReturnValue({
+      mockUseSourcererDataView.mockReturnValue({
         selectedPatterns: [],
         indexExists: true,
         indexPattern: {},
@@ -237,7 +237,7 @@ describe('Overview', () => {
     });
 
     test('it does NOT render the Endpoint banner when an index IS available but storage is NOT set', () => {
-      mockUseSourcererScope.mockReturnValue({
+      mockUseSourcererDataView.mockReturnValue({
         selectedPatterns: [],
         indicesExist: true,
         indexPattern: {},
@@ -258,7 +258,7 @@ describe('Overview', () => {
     });
 
     test('it does NOT render the Endpoint banner when Ingest is NOT available', () => {
-      mockUseSourcererScope.mockReturnValue({
+      mockUseSourcererDataView.mockReturnValue({
         selectedPatterns: [],
         indicesExist: true,
         indexPattern: {},
@@ -281,7 +281,7 @@ describe('Overview', () => {
 
     describe('when no index is available', () => {
       beforeEach(() => {
-        mockUseSourcererScope.mockReturnValue({
+        mockUseSourcererDataView.mockReturnValue({
           selectedPatterns: [],
           indicesExist: false,
         });
diff --git a/x-pack/plugins/security_solution/public/overview/pages/overview.tsx b/x-pack/plugins/security_solution/public/overview/pages/overview.tsx
index 10fa4e4c4e925..3a98f062db65d 100644
--- a/x-pack/plugins/security_solution/public/overview/pages/overview.tsx
+++ b/x-pack/plugins/security_solution/public/overview/pages/overview.tsx
@@ -27,7 +27,7 @@ import { SecurityPageName } from '../../app/types';
 import { EndpointNotice } from '../components/endpoint_notice';
 import { useMessagesStorage } from '../../common/containers/local_storage/use_messages_storage';
 import { ENDPOINT_METADATA_INDEX } from '../../../common/constants';
-import { useSourcererScope } from '../../common/containers/sourcerer';
+import { useSourcererDataView } from '../../common/containers/sourcerer';
 import { Sourcerer } from '../../common/components/sourcerer';
 import { SourcererScopeName } from '../../common/store/sourcerer/model';
 import { useDeepEqualSelector } from '../../common/hooks/use_selector';
@@ -56,7 +56,7 @@ const OverviewComponent = () => {
   const filters = useDeepEqualSelector(getGlobalFiltersQuerySelector);
 
   const { from, deleteQuery, setQuery, to } = useGlobalTime();
-  const { indicesExist, indexPattern, selectedPatterns } = useSourcererScope();
+  const { indicesExist, indexPattern, selectedPatterns } = useSourcererDataView();
 
   const endpointMetadataIndex = useMemo<string[]>(() => {
     return [ENDPOINT_METADATA_INDEX];
diff --git a/x-pack/plugins/security_solution/public/overview/pages/summary.tsx b/x-pack/plugins/security_solution/public/overview/pages/summary.tsx
deleted file mode 100644
index e706fcc39bd1e..0000000000000
--- a/x-pack/plugins/security_solution/public/overview/pages/summary.tsx
+++ /dev/null
@@ -1,90 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React from 'react';
-import { EuiFlexItem, EuiLink, EuiText } from '@elastic/eui';
-import { FormattedMessage } from '@kbn/i18n/react';
-
-import { ADD_DATA_PATH } from '../../../common/constants';
-
-import { useKibana } from '../../common/lib/kibana';
-
-export const Summary = React.memo(() => {
-  const { docLinks, http } = useKibana().services;
-  const basePath = http.basePath.get();
-  return (
-    <EuiFlexItem>
-      <EuiText>
-        <h2>
-          <FormattedMessage
-            id="xpack.securitySolution.overview.startedTitle"
-            defaultMessage="Getting started"
-          />
-        </h2>
-
-        <p>
-          <FormattedMessage
-            id="xpack.securitySolution.overview.startedText"
-            defaultMessage="Welcome to Security Information &amp; Event Management (SIEM). Get started by reviewing our {docs} or {data}. For information about upcoming features and tutorials, be sure to check out our {siemSolution} page."
-            values={{
-              docs: (
-                <EuiLink href={docLinks.links.siem.guide} target="blank">
-                  <FormattedMessage
-                    id="xpack.securitySolution.overview.startedText.docsLinkText"
-                    defaultMessage="documentation"
-                  />
-                </EuiLink>
-              ),
-              data: (
-                <EuiLink href={`${basePath}${ADD_DATA_PATH}`}>
-                  <FormattedMessage
-                    id="xpack.securitySolution.overview.startedText.dataLinkText"
-                    defaultMessage="ingesting data"
-                  />
-                </EuiLink>
-              ),
-              siemSolution: (
-                <EuiLink href="https://www.elastic.co/solutions/siem" target="blank">
-                  <FormattedMessage
-                    id="xpack.securitySolution.overview.startedText.siemSolutionLinkText"
-                    defaultMessage="SIEM solution"
-                  />
-                </EuiLink>
-              ),
-            }}
-          />
-        </p>
-
-        <h2>
-          <FormattedMessage
-            id="xpack.securitySolution.overview.feedbackTitle"
-            defaultMessage="Feedback"
-          />
-        </h2>
-
-        <p>
-          <FormattedMessage
-            id="xpack.securitySolution.overview.feedbackText"
-            defaultMessage="If you have input or suggestions regarding your experience with Elastic SIEM, please feel free to {feedback}."
-            values={{
-              feedback: (
-                <EuiLink href="https://discuss.elastic.co/c/security" target="blank">
-                  <FormattedMessage
-                    id="xpack.securitySolution.overview.feedbackText.feedbackLinkText"
-                    defaultMessage="submit feedback online"
-                  />
-                </EuiLink>
-              ),
-            }}
-          />
-        </p>
-      </EuiText>
-    </EuiFlexItem>
-  );
-});
-
-Summary.displayName = 'Summary';
diff --git a/x-pack/plugins/security_solution/public/plugin.tsx b/x-pack/plugins/security_solution/public/plugin.tsx
index 6167aa72a47b4..1d60175d56f60 100644
--- a/x-pack/plugins/security_solution/public/plugin.tsx
+++ b/x-pack/plugins/security_solution/public/plugin.tsx
@@ -43,14 +43,11 @@ import {
   APP_ICON_SOLUTION,
   DETECTION_ENGINE_INDEX_URL,
   SERVER_APP_ID,
+  SOURCERER_API_URL,
 } from '../common/constants';
 
 import { getDeepLinks } from './app/deep_links';
 import { getSubPluginRoutesByCapabilities, manageOldSiemRoutes } from './helpers';
-import {
-  IndexFieldsStrategyRequest,
-  IndexFieldsStrategyResponse,
-} from '../common/search_strategy/index_fields';
 import { SecurityAppStore } from './common/store/store';
 import { licenseService } from './common/hooks/use_license';
 import { SecuritySolutionUiConfigType } from './common/types';
@@ -65,6 +62,8 @@ import {
 } from '../common/experimental_features';
 import type { TimelineState } from '../../timelines/public';
 import { LazyEndpointCustomAssetsExtension } from './management/pages/policy/view/ingest_manager_integration/lazy_endpoint_custom_assets_extension';
+import { initDataView, SourcererModel, KibanaDataView } from './common/store/sourcerer/model';
+import { SecurityDataView } from './common/containers/sourcerer/api';
 
 export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, StartPlugins> {
   readonly kibanaVersion: string;
@@ -328,7 +327,6 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
       management: subPlugins.management.start(core, plugins),
     };
   }
-
   /**
    * Lazily instantiate a `SecurityAppStore`. We lazily instantiate this because it requests large dynamic imports. We instantiate it once because each subPlugin needs to share the same reference.
    */
@@ -338,32 +336,9 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
     subPlugins: StartedSubPlugins
   ): Promise<SecurityAppStore> {
     if (!this._store) {
-      const defaultIndicesName = coreStart.uiSettings.get(DEFAULT_INDEX_KEY);
-      const [{ createStore, createInitialState }, kibanaIndexPatterns, configIndexPatterns] =
-        await Promise.all([
-          this.lazyApplicationDependencies(),
-          startPlugins.data.indexPatterns.getIdsWithTitle(),
-          startPlugins.data.search
-            .search<IndexFieldsStrategyRequest, IndexFieldsStrategyResponse>(
-              { indices: defaultIndicesName, onlyCheckIfIndicesExist: true },
-              {
-                strategy: 'indexFields',
-              }
-            )
-            .toPromise(),
-        ]);
-
       let signal: { name: string | null } = { name: null };
       try {
-        // const { index_name: indexName } = await coreStart.http.fetch(
-        //   `${BASE_RAC_ALERTS_API_PATH}/index`,
-        //   {
-        //     method: 'GET',
-        //     query: { features: SERVER_APP_ID },
-        //   }
-        // );
-        // signal = { name: indexName[0] };
-        if (coreStart.application.capabilities[SERVER_APP_ID].read === true) {
+        if (coreStart.application.capabilities[SERVER_APP_ID].show === true) {
           signal = await coreStart.http.fetch(DETECTION_ENGINE_INDEX_URL, {
             method: 'GET',
           });
@@ -372,6 +347,28 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
         signal = { name: null };
       }
 
+      const configPatternList = coreStart.uiSettings.get(DEFAULT_INDEX_KEY);
+      let defaultDataView: SourcererModel['defaultDataView'];
+      let kibanaDataViews: SourcererModel['kibanaDataViews'];
+      try {
+        // check for/generate default Security Solution Kibana data view
+        const sourcererDataViews: SecurityDataView = await coreStart.http.fetch(SOURCERER_API_URL, {
+          method: 'POST',
+          body: JSON.stringify({
+            patternList: [...configPatternList, ...(signal.name != null ? [signal.name] : [])],
+          }),
+        });
+        defaultDataView = { ...initDataView, ...sourcererDataViews.defaultDataView };
+        kibanaDataViews = sourcererDataViews.kibanaDataViews.map((dataView: KibanaDataView) => ({
+          ...initDataView,
+          ...dataView,
+        }));
+      } catch (error) {
+        defaultDataView = { ...initDataView, error };
+        kibanaDataViews = [];
+      }
+      const { createStore, createInitialState } = await this.lazyApplicationDependencies();
+
       const appLibs: AppObservableLibs = { kibana: coreStart };
       const libs$ = new BehaviorSubject(appLibs);
 
@@ -414,8 +411,8 @@ export class Plugin implements IPlugin<PluginSetup, PluginStart, SetupPlugins, S
             ...subPlugins.management.store.initialState,
           },
           {
-            kibanaIndexPatterns,
-            configIndexPatterns: configIndexPatterns.indicesExist,
+            defaultDataView,
+            kibanaDataViews,
             signalIndexName: signal.name,
             enableExperimental: this.experimentalFeatures,
           }
diff --git a/x-pack/plugins/security_solution/public/resolver/store/camera/index.ts b/x-pack/plugins/security_solution/public/resolver/store/camera/index.ts
index f900ab92a58b5..e42906ec2029f 100644
--- a/x-pack/plugins/security_solution/public/resolver/store/camera/index.ts
+++ b/x-pack/plugins/security_solution/public/resolver/store/camera/index.ts
@@ -20,4 +20,4 @@
  * would not be in the camera's viewport would be ignored.
  */
 export { cameraReducer } from './reducer';
-export { CameraAction } from './action';
+export type { CameraAction } from './action';
diff --git a/x-pack/plugins/security_solution/public/shared_imports.ts b/x-pack/plugins/security_solution/public/shared_imports.ts
index dda4179cd853c..8934ad9dab4cd 100644
--- a/x-pack/plugins/security_solution/public/shared_imports.ts
+++ b/x-pack/plugins/security_solution/public/shared_imports.ts
@@ -5,28 +5,30 @@
  * 2.0.
  */
 
+export type {
+  FieldHook,
+  FieldValidateResponse,
+  FormData,
+  FormHook,
+  FormSchema,
+  ValidationError,
+  ValidationFunc,
+} from '../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib';
 export {
   getUseField,
   getFieldValidityAndErrorMessage,
-  FieldHook,
-  FieldValidateResponse,
   FIELD_TYPES,
   Form,
-  FormData,
   FormDataProvider,
-  FormHook,
-  FormSchema,
   UseField,
   UseMultiFields,
   useForm,
   useFormContext,
   useFormData,
-  ValidationError,
-  ValidationFunc,
   VALIDATION_TYPES,
 } from '../../../../src/plugins/es_ui_shared/static/forms/hook_form_lib';
 export { Field, SelectField } from '../../../../src/plugins/es_ui_shared/static/forms/components';
 export { fieldValidators } from '../../../../src/plugins/es_ui_shared/static/forms/helpers';
-export { ERROR_CODE } from '../../../../src/plugins/es_ui_shared/static/forms/helpers/field_validators/types';
+export type { ERROR_CODE } from '../../../../src/plugins/es_ui_shared/static/forms/helpers/field_validators/types';
 
 export { ExceptionBuilder } from '../../lists/public';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/flyout/header/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/flyout/header/index.test.tsx
index 206fcb2dc087c..7b103fae483b1 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/flyout/header/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/flyout/header/index.test.tsx
@@ -12,12 +12,12 @@ import { TestProviders, mockIndexNames, mockIndexPattern } from '../../../../com
 import { TimelineId } from '../../../../../common/types/timeline';
 import { useTimelineKpis } from '../../../containers/kpis';
 import { FlyoutHeader } from '.';
-import { useSourcererScope } from '../../../../common/containers/sourcerer';
+import { useSourcererDataView } from '../../../../common/containers/sourcerer';
 import { mockBrowserFields, mockDocValueFields } from '../../../../common/containers/source/mock';
 import { useMountAppended } from '../../../../common/utils/use_mount_appended';
 import { getEmptyValue } from '../../../../common/components/empty_value';
 
-const mockUseSourcererScope: jest.Mock = useSourcererScope as jest.Mock;
+const mockUseSourcererDataView: jest.Mock = useSourcererDataView as jest.Mock;
 jest.mock('../../../../common/containers/sourcerer');
 
 const mockUseTimelineKpis: jest.Mock = useTimelineKpis as jest.Mock;
@@ -62,7 +62,7 @@ describe('header', () => {
 
   beforeEach(() => {
     // Mocking these services is required for the header component to render.
-    mockUseSourcererScope.mockImplementation(() => defaultMocks);
+    mockUseSourcererDataView.mockImplementation(() => defaultMocks);
     useKibanaMock().services.application.capabilities = {
       navLinks: {},
       management: {},
diff --git a/x-pack/plugins/security_solution/public/timelines/components/flyout/header/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/flyout/header/index.tsx
index 1fdfb744f3071..2f54cd6ce2962 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/flyout/header/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/flyout/header/index.tsx
@@ -40,7 +40,7 @@ import { useGetUserCasesPermissions, useKibana } from '../../../../common/lib/ki
 import { InspectButton } from '../../../../common/components/inspect';
 import { useTimelineKpis } from '../../../containers/kpis';
 import { esQuery } from '../../../../../../../../src/plugins/data/public';
-import { useSourcererScope } from '../../../../common/containers/sourcerer';
+import { useSourcererDataView } from '../../../../common/containers/sourcerer';
 import { TimelineModel } from '../../../../timelines/store/timeline/model';
 import {
   startSelector,
@@ -76,7 +76,7 @@ const ActiveTimelinesContainer = styled(EuiFlexItem)`
 
 const FlyoutHeaderPanelComponent: React.FC<FlyoutHeaderPanelProps> = ({ timelineId }) => {
   const dispatch = useDispatch();
-  const { indexPattern, browserFields } = useSourcererScope(SourcererScopeName.timeline);
+  const { browserFields, indexPattern } = useSourcererDataView(SourcererScopeName.timeline);
   const { uiSettings } = useKibana().services;
   const esQueryConfig = useMemo(() => esQuery.getEsQueryConfig(uiSettings), [uiSettings]);
   const getTimeline = useMemo(() => timelineSelectors.getTimelineByIdSelector(), []);
@@ -345,7 +345,7 @@ const TimelineStatusInfoComponent: React.FC<FlyoutHeaderProps> = ({ timelineId }
 const TimelineStatusInfo = React.memo(TimelineStatusInfoComponent);
 
 const FlyoutHeaderComponent: React.FC<FlyoutHeaderProps> = ({ timelineId }) => {
-  const { selectedPatterns, indexPattern, docValueFields, browserFields } = useSourcererScope(
+  const { selectedPatterns, indexPattern, docValueFields, browserFields } = useSourcererDataView(
     SourcererScopeName.timeline
   );
   const getStartSelector = useMemo(() => startSelector(), []);
diff --git a/x-pack/plugins/security_solution/public/timelines/components/graph_overlay/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/graph_overlay/index.test.tsx
index d672a3c699707..c16da16002265 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/graph_overlay/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/graph_overlay/index.test.tsx
@@ -13,15 +13,10 @@ import {
   useGlobalFullScreen,
   useTimelineFullScreen,
 } from '../../../common/containers/use_full_screen';
-import { mockTimelineModel, TestProviders } from '../../../common/mock';
+import { TestProviders } from '../../../common/mock';
 import { TimelineId } from '../../../../common/types/timeline';
 import { GraphOverlay } from '.';
 
-jest.mock('../../../common/hooks/use_selector', () => ({
-  useShallowEqualSelector: jest.fn().mockReturnValue(mockTimelineModel.savedObjectId),
-  useDeepEqualSelector: jest.fn().mockReturnValue(mockTimelineModel),
-}));
-
 jest.mock('../../../common/containers/use_full_screen', () => ({
   useGlobalFullScreen: jest.fn(),
   useTimelineFullScreen: jest.fn(),
diff --git a/x-pack/plugins/security_solution/public/timelines/components/graph_overlay/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/graph_overlay/index.tsx
index 16459381a8431..31a40c46fc0bf 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/graph_overlay/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/graph_overlay/index.tsx
@@ -30,7 +30,6 @@ import { TimelineId } from '../../../../common/types/timeline';
 import { timelineSelectors } from '../../store/timeline';
 import { timelineDefaults } from '../../store/timeline/defaults';
 import { isFullScreen } from '../timeline/body/column_headers';
-import { sourcererSelectors } from '../../../common/store';
 import { updateTimelineGraphEventId } from '../../../timelines/store/timeline/actions';
 import { Resolver } from '../../../resolver/view';
 import {
@@ -39,6 +38,8 @@ import {
   endSelector,
 } from '../../../common/components/super_date_picker/selectors';
 import * as i18n from './translations';
+import { SourcererScopeName } from '../../../common/store/sourcerer/model';
+import { useSourcererDataView } from '../../../common/containers/sourcerer';
 
 const OverlayContainer = styled.div`
   display: flex;
@@ -180,11 +181,8 @@ const GraphOverlayComponent: React.FC<OwnProps> = ({ timelineId }) => {
     globalFullScreen,
   ]);
 
-  const existingIndexNamesSelector = useMemo(
-    () => sourcererSelectors.getAllExistingIndexNamesSelector(),
-    []
-  );
-  const existingIndexNames = useDeepEqualSelector<string[]>(existingIndexNamesSelector);
+  const { selectedPatterns } = useSourcererDataView(SourcererScopeName.timeline);
+
   if (fullScreen && !isInTimeline) {
     return (
       <FullScreenOverlayContainer data-test-subj="overlayContainer">
@@ -206,7 +204,7 @@ const GraphOverlayComponent: React.FC<OwnProps> = ({ timelineId }) => {
           <StyledResolver
             databaseDocumentID={graphEventId}
             resolverComponentInstanceID={timelineId}
-            indices={existingIndexNames}
+            indices={selectedPatterns}
             shouldUpdate={shouldUpdate}
             filters={{ from, to }}
           />
@@ -238,7 +236,7 @@ const GraphOverlayComponent: React.FC<OwnProps> = ({ timelineId }) => {
           <StyledResolver
             databaseDocumentID={graphEventId}
             resolverComponentInstanceID={timelineId}
-            indices={existingIndexNames}
+            indices={selectedPatterns}
             shouldUpdate={shouldUpdate}
             filters={{ from, to }}
           />
diff --git a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/helpers.test.ts b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/helpers.test.ts
index 1b93f1556a95c..225158061ad21 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/helpers.test.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/helpers.test.ts
@@ -43,7 +43,6 @@ import {
   TimelineId,
   TimelineType,
   TimelineStatus,
-  TimelineTabs,
   KueryFilterQueryKind,
 } from '../../../../common/types/timeline';
 import {
@@ -51,7 +50,6 @@ import {
   mockTemplate as mockSelectedTemplate,
 } from './__mocks__';
 import { resolveTimeline } from '../../containers/api';
-import { defaultHeaders } from '../timeline/body/column_headers/default_headers';
 
 jest.mock('../../../common/store/inputs/actions');
 jest.mock('../../../common/components/url_state/normalize_time_range.ts');
@@ -75,6 +73,57 @@ jest.mock('../../../common/utils/default_date_settings', () => {
 
 jest.mock('../../containers/api');
 
+const columns = [
+  {
+    columnHeaderType: 'not-filtered',
+    id: '@timestamp',
+    type: 'number',
+    initialWidth: 190,
+  },
+  {
+    columnHeaderType: 'not-filtered',
+    id: 'message',
+    initialWidth: 180,
+  },
+  {
+    columnHeaderType: 'not-filtered',
+    id: 'event.category',
+    initialWidth: 180,
+  },
+  {
+    columnHeaderType: 'not-filtered',
+    id: 'event.action',
+    initialWidth: 180,
+  },
+  {
+    columnHeaderType: 'not-filtered',
+    id: 'host.name',
+    initialWidth: 180,
+  },
+  {
+    columnHeaderType: 'not-filtered',
+    id: 'source.ip',
+    initialWidth: 180,
+  },
+  {
+    columnHeaderType: 'not-filtered',
+    id: 'destination.ip',
+    initialWidth: 180,
+  },
+  {
+    columnHeaderType: 'not-filtered',
+    id: 'user.name',
+    initialWidth: 180,
+  },
+];
+const defaultTimeline = {
+  ...timelineDefaults,
+  columns,
+  version: '1',
+  savedObjectId: 'savedObject-1',
+  id: 'savedObject-1',
+};
+
 describe('helpers', () => {
   let mockResults: OpenTimelineResult[];
 
@@ -237,49 +286,6 @@ describe('helpers', () => {
   });
 
   describe('#defaultTimelineToTimelineModel', () => {
-    const columns = [
-      {
-        columnHeaderType: 'not-filtered',
-        id: '@timestamp',
-        type: 'number',
-        initialWidth: 190,
-      },
-      {
-        columnHeaderType: 'not-filtered',
-        id: 'message',
-        initialWidth: 180,
-      },
-      {
-        columnHeaderType: 'not-filtered',
-        id: 'event.category',
-        initialWidth: 180,
-      },
-      {
-        columnHeaderType: 'not-filtered',
-        id: 'event.action',
-        initialWidth: 180,
-      },
-      {
-        columnHeaderType: 'not-filtered',
-        id: 'host.name',
-        initialWidth: 180,
-      },
-      {
-        columnHeaderType: 'not-filtered',
-        id: 'source.ip',
-        initialWidth: 180,
-      },
-      {
-        columnHeaderType: 'not-filtered',
-        id: 'destination.ip',
-        initialWidth: 180,
-      },
-      {
-        columnHeaderType: 'not-filtered',
-        id: 'user.name',
-        initialWidth: 180,
-      },
-    ];
     test('if title is null, we should get the default title', () => {
       const timeline = {
         savedObjectId: 'savedObject-1',
@@ -289,65 +295,7 @@ describe('helpers', () => {
 
       const newTimeline = defaultTimelineToTimelineModel(timeline, false);
       expect(newTimeline).toEqual({
-        activeTab: TimelineTabs.query,
-        prevActiveTab: TimelineTabs.query,
-        columns,
-        defaultColumns: defaultHeaders,
-        dataProviders: [],
-        dateRange: { start: '2020-07-07T08:20:18.966Z', end: '2020-07-08T08:20:18.966Z' },
-        description: '',
-        documentType: '',
-        deletedEventIds: [],
-        eqlOptions: {
-          eventCategoryField: 'event.category',
-          tiebreakerField: '',
-          timestampField: '@timestamp',
-          query: '',
-          size: 100,
-        },
-        eventIdToNoteIds: {},
-        eventType: 'all',
-        excludedRowRendererIds: [],
-        expandedDetail: {},
-        filters: [],
-        highlightedDropAndProviderId: '',
-        historyIds: [],
-        id: 'savedObject-1',
-        indexNames: [],
-        isFavorite: false,
-        isLive: false,
-        isSelectAllChecked: false,
-        isLoading: false,
-        isSaving: false,
-        itemsPerPage: 25,
-        itemsPerPageOptions: [10, 25, 50, 100],
-        kqlMode: 'filter',
-        kqlQuery: {
-          filterQuery: null,
-        },
-        loadingEventIds: [],
-        noteIds: [],
-        pinnedEventIds: {},
-        pinnedEventsSaveObject: {},
-        queryFields: [],
-        savedObjectId: 'savedObject-1',
-        selectAll: false,
-        selectedEventIds: {},
-        show: false,
-        showCheckboxes: false,
-        sort: [
-          {
-            columnId: '@timestamp',
-            columnType: 'number',
-            sortDirection: 'desc',
-          },
-        ],
-        status: TimelineStatus.draft,
-        title: '',
-        timelineType: TimelineType.default,
-        templateTimelineId: null,
-        templateTimelineVersion: null,
-        version: '1',
+        ...defaultTimeline,
       });
     });
 
@@ -362,65 +310,8 @@ describe('helpers', () => {
 
       const newTimeline = defaultTimelineToTimelineModel(timeline, false, TimelineType.template);
       expect(newTimeline).toEqual({
-        activeTab: TimelineTabs.query,
-        prevActiveTab: TimelineTabs.query,
-        columns,
-        defaultColumns: defaultHeaders,
-        dataProviders: [],
-        dateRange: { start: '2020-07-07T08:20:18.966Z', end: '2020-07-08T08:20:18.966Z' },
-        description: '',
-        documentType: '',
-        deletedEventIds: [],
-        eqlOptions: {
-          eventCategoryField: 'event.category',
-          tiebreakerField: '',
-          timestampField: '@timestamp',
-          query: '',
-          size: 100,
-        },
-        eventIdToNoteIds: {},
-        eventType: 'all',
-        excludedRowRendererIds: [],
-        expandedDetail: {},
-        filters: [],
-        highlightedDropAndProviderId: '',
-        historyIds: [],
-        id: 'savedObject-1',
-        indexNames: [],
-        isFavorite: false,
-        isLive: false,
-        isSelectAllChecked: false,
-        isLoading: false,
-        isSaving: false,
-        itemsPerPage: 25,
-        itemsPerPageOptions: [10, 25, 50, 100],
-        kqlMode: 'filter',
-        kqlQuery: {
-          filterQuery: null,
-        },
-        loadingEventIds: [],
-        noteIds: [],
-        pinnedEventIds: {},
-        pinnedEventsSaveObject: {},
-        queryFields: [],
-        savedObjectId: 'savedObject-1',
-        selectAll: false,
-        selectedEventIds: {},
-        show: false,
-        showCheckboxes: false,
-        sort: [
-          {
-            columnId: '@timestamp',
-            columnType: 'number',
-            sortDirection: 'desc',
-          },
-        ],
-        status: TimelineStatus.draft,
-        title: '',
+        ...defaultTimeline,
         timelineType: TimelineType.template,
-        templateTimelineId: null,
-        templateTimelineVersion: null,
-        version: '1',
       });
     });
 
@@ -435,65 +326,7 @@ describe('helpers', () => {
 
       const newTimeline = defaultTimelineToTimelineModel(timeline, false, TimelineType.default);
       expect(newTimeline).toEqual({
-        activeTab: TimelineTabs.query,
-        prevActiveTab: TimelineTabs.query,
-        columns,
-        defaultColumns: defaultHeaders,
-        dataProviders: [],
-        dateRange: { start: '2020-07-07T08:20:18.966Z', end: '2020-07-08T08:20:18.966Z' },
-        description: '',
-        documentType: '',
-        deletedEventIds: [],
-        eqlOptions: {
-          eventCategoryField: 'event.category',
-          tiebreakerField: '',
-          timestampField: '@timestamp',
-          query: '',
-          size: 100,
-        },
-        eventIdToNoteIds: {},
-        eventType: 'all',
-        excludedRowRendererIds: [],
-        expandedDetail: {},
-        filters: [],
-        highlightedDropAndProviderId: '',
-        historyIds: [],
-        id: 'savedObject-1',
-        indexNames: [],
-        isFavorite: false,
-        isLive: false,
-        isSelectAllChecked: false,
-        isLoading: false,
-        isSaving: false,
-        itemsPerPage: 25,
-        itemsPerPageOptions: [10, 25, 50, 100],
-        kqlMode: 'filter',
-        kqlQuery: {
-          filterQuery: null,
-        },
-        loadingEventIds: [],
-        noteIds: [],
-        pinnedEventIds: {},
-        pinnedEventsSaveObject: {},
-        queryFields: [],
-        savedObjectId: 'savedObject-1',
-        selectAll: false,
-        selectedEventIds: {},
-        show: false,
-        showCheckboxes: false,
-        sort: [
-          {
-            columnId: '@timestamp',
-            columnType: 'number',
-            sortDirection: 'desc',
-          },
-        ],
-        status: TimelineStatus.draft,
-        title: '',
-        timelineType: TimelineType.default,
-        templateTimelineId: null,
-        templateTimelineVersion: null,
-        version: '1',
+        ...defaultTimeline,
       });
     });
 
@@ -506,65 +339,7 @@ describe('helpers', () => {
 
       const newTimeline = defaultTimelineToTimelineModel(timeline, false);
       expect(newTimeline).toEqual({
-        activeTab: TimelineTabs.query,
-        prevActiveTab: TimelineTabs.query,
-        columns,
-        defaultColumns: defaultHeaders,
-        dataProviders: [],
-        dateRange: { start: '2020-07-07T08:20:18.966Z', end: '2020-07-08T08:20:18.966Z' },
-        description: '',
-        documentType: '',
-        deletedEventIds: [],
-        eqlOptions: {
-          eventCategoryField: 'event.category',
-          tiebreakerField: '',
-          timestampField: '@timestamp',
-          query: '',
-          size: 100,
-        },
-        eventIdToNoteIds: {},
-        eventType: 'all',
-        excludedRowRendererIds: [],
-        expandedDetail: {},
-        filters: [],
-        highlightedDropAndProviderId: '',
-        historyIds: [],
-        indexNames: [],
-        id: 'savedObject-1',
-        isFavorite: false,
-        isLive: false,
-        isSelectAllChecked: false,
-        isLoading: false,
-        isSaving: false,
-        itemsPerPage: 25,
-        itemsPerPageOptions: [10, 25, 50, 100],
-        kqlMode: 'filter',
-        kqlQuery: {
-          filterQuery: null,
-        },
-        loadingEventIds: [],
-        noteIds: [],
-        pinnedEventIds: {},
-        pinnedEventsSaveObject: {},
-        queryFields: [],
-        savedObjectId: 'savedObject-1',
-        selectAll: false,
-        selectedEventIds: {},
-        show: false,
-        showCheckboxes: false,
-        sort: [
-          {
-            columnId: '@timestamp',
-            columnType: 'number',
-            sortDirection: 'desc',
-          },
-        ],
-        status: TimelineStatus.draft,
-        title: '',
-        timelineType: TimelineType.default,
-        templateTimelineId: null,
-        templateTimelineVersion: null,
-        version: '1',
+        ...defaultTimeline,
       });
     });
 
@@ -580,65 +355,8 @@ describe('helpers', () => {
 
       const newTimeline = defaultTimelineToTimelineModel(timeline, false);
       expect(newTimeline).toEqual({
-        activeTab: TimelineTabs.query,
-        prevActiveTab: TimelineTabs.query,
-        savedObjectId: 'savedObject-1',
+        ...defaultTimeline,
         columns: columnsWithoutEventAction,
-        defaultColumns: defaultHeaders,
-        version: '1',
-        dataProviders: [],
-        dateRange: { start: '2020-07-07T08:20:18.966Z', end: '2020-07-08T08:20:18.966Z' },
-        description: '',
-        documentType: '',
-        deletedEventIds: [],
-        eqlOptions: {
-          eventCategoryField: 'event.category',
-          tiebreakerField: '',
-          timestampField: '@timestamp',
-          query: '',
-          size: 100,
-        },
-        eventIdToNoteIds: {},
-        eventType: 'all',
-        excludedRowRendererIds: [],
-        expandedDetail: {},
-        filters: [],
-        highlightedDropAndProviderId: '',
-        historyIds: [],
-        indexNames: [],
-        isFavorite: false,
-        isLive: false,
-        isSelectAllChecked: false,
-        isLoading: false,
-        isSaving: false,
-        itemsPerPage: 25,
-        itemsPerPageOptions: [10, 25, 50, 100],
-        kqlMode: 'filter',
-        kqlQuery: {
-          filterQuery: null,
-        },
-        loadingEventIds: [],
-        title: '',
-        timelineType: TimelineType.default,
-        templateTimelineId: null,
-        templateTimelineVersion: null,
-        noteIds: [],
-        pinnedEventIds: {},
-        pinnedEventsSaveObject: {},
-        queryFields: [],
-        selectAll: false,
-        selectedEventIds: {},
-        show: false,
-        showCheckboxes: false,
-        sort: [
-          {
-            columnId: '@timestamp',
-            columnType: 'number',
-            sortDirection: 'desc',
-          },
-        ],
-        status: TimelineStatus.draft,
-        id: 'savedObject-1',
       });
     });
 
@@ -685,29 +403,10 @@ describe('helpers', () => {
       };
 
       const newTimeline = defaultTimelineToTimelineModel(timeline, false);
+
       expect(newTimeline).toEqual({
-        activeTab: TimelineTabs.query,
-        prevActiveTab: TimelineTabs.query,
-        savedObjectId: 'savedObject-1',
+        ...defaultTimeline,
         columns: columnsWithoutEventAction,
-        defaultColumns: defaultHeaders,
-        version: '1',
-        dateRange: { start: '2020-07-07T08:20:18.966Z', end: '2020-07-08T08:20:18.966Z' },
-        dataProviders: [],
-        description: '',
-        documentType: '',
-        deletedEventIds: [],
-        eqlOptions: {
-          eventCategoryField: 'event.category',
-          tiebreakerField: '',
-          timestampField: '@timestamp',
-          query: '',
-          size: 100,
-        },
-        eventIdToNoteIds: {},
-        eventType: 'all',
-        excludedRowRendererIds: [],
-        expandedDetail: {},
         filters: [
           {
             $state: {
@@ -752,42 +451,6 @@ describe('helpers', () => {
             },
           },
         ],
-        highlightedDropAndProviderId: '',
-        historyIds: [],
-        indexNames: [],
-        isFavorite: false,
-        isLive: false,
-        isSelectAllChecked: false,
-        isLoading: false,
-        isSaving: false,
-        itemsPerPage: 25,
-        itemsPerPageOptions: [10, 25, 50, 100],
-        kqlMode: 'filter',
-        kqlQuery: {
-          filterQuery: null,
-        },
-        loadingEventIds: [],
-        title: '',
-        timelineType: TimelineType.default,
-        templateTimelineId: null,
-        templateTimelineVersion: null,
-        noteIds: [],
-        pinnedEventIds: {},
-        pinnedEventsSaveObject: {},
-        queryFields: [],
-        selectAll: false,
-        selectedEventIds: {},
-        show: false,
-        showCheckboxes: false,
-        sort: [
-          {
-            columnId: '@timestamp',
-            columnType: 'number',
-            sortDirection: 'desc',
-          },
-        ],
-        status: TimelineStatus.draft,
-        id: 'savedObject-1',
       });
     });
 
@@ -802,65 +465,11 @@ describe('helpers', () => {
 
       const newTimeline = defaultTimelineToTimelineModel(timeline, false, TimelineType.template);
       expect(newTimeline).toEqual({
-        activeTab: TimelineTabs.query,
-        prevActiveTab: TimelineTabs.query,
-        columns,
-        defaultColumns: defaultHeaders,
-        dataProviders: [],
+        ...defaultTimeline,
         dateRange: { end: '2020-10-28T11:37:31.655Z', start: '2020-10-27T11:37:31.655Z' },
-        description: '',
-        documentType: '',
-        deletedEventIds: [],
-        eqlOptions: {
-          eventCategoryField: 'event.category',
-          tiebreakerField: '',
-          timestampField: '@timestamp',
-          query: '',
-          size: 100,
-        },
-        eventIdToNoteIds: {},
-        eventType: 'all',
-        excludedRowRendererIds: [],
-        expandedDetail: {},
-        filters: [],
-        highlightedDropAndProviderId: '',
-        historyIds: [],
-        id: 'savedObject-1',
-        indexNames: [],
-        isFavorite: false,
-        isLive: false,
-        isSelectAllChecked: false,
-        isLoading: false,
-        isSaving: false,
-        itemsPerPage: 25,
-        itemsPerPageOptions: [10, 25, 50, 100],
-        kqlMode: 'filter',
-        kqlQuery: {
-          filterQuery: null,
-        },
-        loadingEventIds: [],
-        noteIds: [],
-        pinnedEventIds: {},
-        pinnedEventsSaveObject: {},
-        queryFields: [],
-        savedObjectId: 'savedObject-1',
-        selectAll: false,
-        selectedEventIds: {},
-        show: false,
-        showCheckboxes: false,
-        sort: [
-          {
-            columnId: '@timestamp',
-            columnType: 'number',
-            sortDirection: 'desc',
-          },
-        ],
         status: TimelineStatus.immutable,
-        title: 'Awesome Timeline',
         timelineType: TimelineType.template,
-        templateTimelineId: null,
-        templateTimelineVersion: null,
-        version: '1',
+        title: 'Awesome Timeline',
       });
     });
 
@@ -875,65 +484,10 @@ describe('helpers', () => {
 
       const newTimeline = defaultTimelineToTimelineModel(timeline, false, TimelineType.default);
       expect(newTimeline).toEqual({
-        activeTab: TimelineTabs.query,
-        prevActiveTab: TimelineTabs.query,
-        columns,
-        defaultColumns: defaultHeaders,
-        dataProviders: [],
+        ...defaultTimeline,
         dateRange: { end: '2020-07-08T08:20:18.966Z', start: '2020-07-07T08:20:18.966Z' },
-        description: '',
-        documentType: '',
-        deletedEventIds: [],
-        eqlOptions: {
-          eventCategoryField: 'event.category',
-          tiebreakerField: '',
-          timestampField: '@timestamp',
-          query: '',
-          size: 100,
-        },
-        eventIdToNoteIds: {},
-        eventType: 'all',
-        excludedRowRendererIds: [],
-        expandedDetail: {},
-        filters: [],
-        highlightedDropAndProviderId: '',
-        historyIds: [],
-        id: 'savedObject-1',
-        indexNames: [],
-        isFavorite: false,
-        isLive: false,
-        isSelectAllChecked: false,
-        isLoading: false,
-        isSaving: false,
-        itemsPerPage: 25,
-        itemsPerPageOptions: [10, 25, 50, 100],
-        kqlMode: 'filter',
-        kqlQuery: {
-          filterQuery: null,
-        },
-        loadingEventIds: [],
-        noteIds: [],
-        pinnedEventIds: {},
-        pinnedEventsSaveObject: {},
-        queryFields: [],
-        savedObjectId: 'savedObject-1',
-        selectAll: false,
-        selectedEventIds: {},
-        show: false,
-        showCheckboxes: false,
-        sort: [
-          {
-            columnId: '@timestamp',
-            columnType: 'number',
-            sortDirection: 'desc',
-          },
-        ],
         status: TimelineStatus.active,
         title: 'Awesome Timeline',
-        timelineType: TimelineType.default,
-        templateTimelineId: null,
-        templateTimelineVersion: null,
-        version: '1',
       });
     });
   });
@@ -1189,6 +743,15 @@ describe('helpers', () => {
     let clock: sinon.SinonFakeTimers;
     let timelineDispatch: DispatchUpdateTimeline;
 
+    const defaultArgs = {
+      duplicate: true,
+      id: TimelineId.active,
+      from: '2020-03-26T14:35:56.356Z',
+      to: '2020-03-26T14:41:56.356Z',
+      notes: [],
+      timeline: mockTimelineModel,
+    };
+
     beforeEach(() => {
       jest.clearAllMocks();
 
@@ -1201,14 +764,7 @@ describe('helpers', () => {
     });
 
     test('it invokes date range picker dispatch', () => {
-      timelineDispatch({
-        duplicate: true,
-        id: TimelineId.active,
-        from: '2020-03-26T14:35:56.356Z',
-        to: '2020-03-26T14:41:56.356Z',
-        notes: [],
-        timeline: mockTimelineModel,
-      })();
+      timelineDispatch(defaultArgs)();
 
       expect(dispatchSetTimelineRangeDatePicker).toHaveBeenCalledWith({
         from: '2020-03-26T14:35:56.356Z',
@@ -1217,14 +773,7 @@ describe('helpers', () => {
     });
 
     test('it invokes add timeline dispatch', () => {
-      timelineDispatch({
-        duplicate: true,
-        id: TimelineId.active,
-        from: '2020-03-26T14:35:56.356Z',
-        to: '2020-03-26T14:41:56.356Z',
-        notes: [],
-        timeline: mockTimelineModel,
-      })();
+      timelineDispatch(defaultArgs)();
 
       expect(dispatchAddTimeline).toHaveBeenCalledWith({
         id: TimelineId.active,
@@ -1234,27 +783,13 @@ describe('helpers', () => {
     });
 
     test('it does not invoke kql filter query dispatches if timeline.kqlQuery.filterQuery is null', () => {
-      timelineDispatch({
-        duplicate: true,
-        id: TimelineId.active,
-        from: '2020-03-26T14:35:56.356Z',
-        to: '2020-03-26T14:41:56.356Z',
-        notes: [],
-        timeline: mockTimelineModel,
-      })();
+      timelineDispatch(defaultArgs)();
 
       expect(dispatchApplyKqlFilterQuery).not.toHaveBeenCalled();
     });
 
     test('it does not invoke notes dispatch if duplicate is true', () => {
-      timelineDispatch({
-        duplicate: true,
-        id: TimelineId.active,
-        from: '2020-03-26T14:35:56.356Z',
-        to: '2020-03-26T14:41:56.356Z',
-        notes: [],
-        timeline: mockTimelineModel,
-      })();
+      timelineDispatch(defaultArgs)();
 
       expect(dispatchAddNotes).not.toHaveBeenCalled();
     });
@@ -1270,11 +805,7 @@ describe('helpers', () => {
         },
       };
       timelineDispatch({
-        duplicate: true,
-        id: TimelineId.active,
-        from: '2020-03-26T14:35:56.356Z',
-        to: '2020-03-26T14:41:56.356Z',
-        notes: [],
+        ...defaultArgs,
         timeline: mockTimeline,
       })();
 
@@ -1292,11 +823,7 @@ describe('helpers', () => {
         },
       };
       timelineDispatch({
-        duplicate: true,
-        id: TimelineId.active,
-        from: '2020-03-26T14:35:56.356Z',
-        to: '2020-03-26T14:41:56.356Z',
-        notes: [],
+        ...defaultArgs,
         timeline: mockTimeline,
       })();
 
@@ -1314,10 +841,8 @@ describe('helpers', () => {
 
     test('it invokes dispatchAddNotes if duplicate is false', () => {
       timelineDispatch({
+        ...defaultArgs,
         duplicate: false,
-        id: TimelineId.active,
-        from: '2020-03-26T14:35:56.356Z',
-        to: '2020-03-26T14:41:56.356Z',
         notes: [
           {
             created: 1585233356356,
@@ -1326,7 +851,6 @@ describe('helpers', () => {
             note: 'I am a note',
           },
         ],
-        timeline: mockTimelineModel,
       })();
 
       expect(dispatchAddGlobalTimelineNote).not.toHaveBeenCalled();
@@ -1350,12 +874,7 @@ describe('helpers', () => {
 
     test('it invokes dispatch to create a timeline note if duplicate is true and ruleNote exists', () => {
       timelineDispatch({
-        duplicate: true,
-        id: TimelineId.active,
-        from: '2020-03-26T14:35:56.356Z',
-        to: '2020-03-26T14:41:56.356Z',
-        notes: [],
-        timeline: mockTimelineModel,
+        ...defaultArgs,
         ruleNote: '# this would be some markdown',
       })();
       const expectedNote: Note = {
diff --git a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/helpers.ts b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/helpers.ts
index f325ab34e88d5..12f0b373d24f9 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/helpers.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/helpers.ts
@@ -413,8 +413,9 @@ export const dispatchUpdateTimeline =
   () => {
     if (!isEmpty(timeline.indexNames)) {
       dispatch(
-        sourcererActions.initTimelineIndexPatterns({
+        sourcererActions.setSelectedDataView({
           id: SourcererScopeName.timeline,
+          selectedDataViewId: timeline.dataViewId,
           selectedPatterns: timeline.indexNames,
           eventType: timeline.eventType,
         })
diff --git a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/index.tsx
index 25dcdb887d336..f12731396c053 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/index.tsx
@@ -8,8 +8,7 @@
 import React, { useEffect, useState, useCallback, useMemo } from 'react';
 import { useDispatch } from 'react-redux';
 
-import { sourcererSelectors } from '../../../common/store';
-import { useShallowEqualSelector, useDeepEqualSelector } from '../../../common/hooks/use_selector';
+import { useShallowEqualSelector } from '../../../common/hooks/use_selector';
 import { SortFieldTimeline, TimelineId } from '../../../../common/types/timeline';
 import { TimelineModel } from '../../../timelines/store/timeline/model';
 import { timelineSelectors } from '../../../timelines/store/timeline';
@@ -46,6 +45,8 @@ import { useTimelineTypes } from './use_timeline_types';
 import { useTimelineStatus } from './use_timeline_status';
 import { deleteTimelinesByIds } from '../../containers/api';
 import { Direction } from '../../../../common/search_strategy';
+import { SourcererScopeName } from '../../../common/store/sourcerer/model';
+import { useSourcererDataView } from '../../../common/containers/sourcerer';
 
 interface OwnProps<TCache = object> {
   /** Displays open timeline in modal */
@@ -108,11 +109,7 @@ export const StatefulOpenTimelineComponent = React.memo<OpenTimelineOwnProps>(
       (state) => getTimeline(state, TimelineId.active)?.savedObjectId ?? ''
     );
 
-    const existingIndexNamesSelector = useMemo(
-      () => sourcererSelectors.getAllExistingIndexNamesSelector(),
-      []
-    );
-    const existingIndexNames = useDeepEqualSelector<string[]>(existingIndexNamesSelector);
+    const { dataViewId, selectedPatterns } = useSourcererDataView(SourcererScopeName.timeline);
 
     const updateTimeline = useMemo(() => dispatchUpdateTimeline(dispatch), [dispatch]);
     const updateIsLoading = useCallback(
@@ -204,7 +201,8 @@ export const StatefulOpenTimelineComponent = React.memo<OpenTimelineOwnProps>(
             dispatchCreateNewTimeline({
               id: TimelineId.active,
               columns: defaultHeaders,
-              indexNames: existingIndexNames,
+              dataViewId,
+              indexNames: selectedPatterns,
               show: false,
             })
           );
@@ -213,7 +211,7 @@ export const StatefulOpenTimelineComponent = React.memo<OpenTimelineOwnProps>(
         await deleteTimelinesByIds(timelineIds);
         refetch();
       },
-      [dispatch, existingIndexNames, refetch, timelineSavedObjectId]
+      [timelineSavedObjectId, refetch, dispatch, dataViewId, selectedPatterns]
     );
 
     const onDeleteOneTimeline: OnDeleteOneTimeline = useCallback(
diff --git a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/note_previews/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/note_previews/index.tsx
index aff12b74fbfbf..1016a430807be 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/note_previews/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/note_previews/index.tsx
@@ -26,8 +26,9 @@ import { NOTE_CONTENT_CLASS_NAME } from '../../timeline/body/helpers';
 import * as i18n from './translations';
 import { TimelineTabs } from '../../../../../common/types/timeline';
 import { useDeepEqualSelector } from '../../../../common/hooks/use_selector';
-import { sourcererSelectors } from '../../../../common/store';
 import { SaveTimelineButton } from '../../timeline/header/save_timeline_button';
+import { SourcererScopeName } from '../../../../common/store/sourcerer/model';
+import { useSourcererDataView } from '../../../../common/containers/sourcerer';
 
 export const NotePreviewsContainer = styled.section`
   padding-top: ${({ theme }) => `${theme.eui.euiSizeS}`};
@@ -45,11 +46,7 @@ const ToggleEventDetailsButtonComponent: React.FC<ToggleEventDetailsButtonProps>
   timelineId,
 }) => {
   const dispatch = useDispatch();
-  const existingIndexNamesSelector = useMemo(
-    () => sourcererSelectors.getAllExistingIndexNamesSelector(),
-    []
-  );
-  const existingIndexNames = useDeepEqualSelector<string[]>(existingIndexNamesSelector);
+  const { selectedPatterns } = useSourcererDataView(SourcererScopeName.timeline);
 
   const handleClick = useCallback(() => {
     dispatch(
@@ -59,11 +56,11 @@ const ToggleEventDetailsButtonComponent: React.FC<ToggleEventDetailsButtonProps>
         timelineId,
         params: {
           eventId,
-          indexName: existingIndexNames.join(','),
+          indexName: selectedPatterns.join(','),
         },
       })
     );
-  }, [dispatch, eventId, existingIndexNames, timelineId]);
+  }, [dispatch, eventId, selectedPatterns, timelineId]);
 
   return (
     <EuiButtonIcon
diff --git a/x-pack/plugins/security_solution/public/timelines/components/side_panel/__snapshots__/index.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/side_panel/__snapshots__/index.test.tsx.snap
index 2bb9da12e44ea..06dc3ea3ed967 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/side_panel/__snapshots__/index.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/side_panel/__snapshots__/index.test.tsx.snap
@@ -6,6 +6,7 @@ exports[`Details Panel Component DetailsPanel: rendering it should not render th
   docValueFields={Array []}
   handleOnPanelClosed={[MockFunction]}
   isFlyoutView={false}
+  runtimeMappings={Object {}}
   tabType="query"
   timelineId="test"
 />
@@ -17,6 +18,7 @@ exports[`Details Panel Component DetailsPanel: rendering it should not render th
   docValueFields={Array []}
   handleOnPanelClosed={[MockFunction]}
   isFlyoutView={false}
+  runtimeMappings={Object {}}
   tabType="query"
   timelineId="test"
 />
@@ -35,6 +37,7 @@ exports[`Details Panel Component DetailsPanel:EventDetails: rendering it should
   docValueFields={Array []}
   handleOnPanelClosed={[MockFunction]}
   isFlyoutView={false}
+  runtimeMappings={Object {}}
   tabType="query"
   timelineId="test"
 >
@@ -199,6 +202,7 @@ exports[`Details Panel Component DetailsPanel:EventDetails: rendering it should
     handleOnEventClosed={[Function]}
     isDraggable={false}
     isFlyoutView={false}
+    runtimeMappings={Object {}}
     tabType="query"
     timelineId="test"
   >
@@ -742,6 +746,7 @@ Array [
         handleOnEventClosed={[Function]}
         isDraggable={false}
         isFlyoutView={true}
+        runtimeMappings={Object {}}
         tabType="query"
         timelineId="test"
       >
@@ -1781,6 +1786,7 @@ Array [
       handleOnEventClosed={[Function]}
       isDraggable={false}
       isFlyoutView={true}
+      runtimeMappings={Object {}}
       tabType="query"
       timelineId="test"
     >
diff --git a/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/index.tsx
index 07a0aeabcb998..947786695ded3 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/index.tsx
@@ -17,6 +17,7 @@ import {
 import React, { useState, useCallback, useMemo } from 'react';
 import styled from 'styled-components';
 import deepEqual from 'fast-deep-equal';
+import { MappingRuntimeFields } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import { BrowserFields, DocValueFields } from '../../../../common/containers/source';
 import { ExpandableEvent, ExpandableEventTitle } from './expandable_event';
 import { useTimelineEventsDetails } from '../../../containers/details';
@@ -64,6 +65,7 @@ interface EventDetailsPanelProps {
   handleOnEventClosed: () => void;
   isDraggable?: boolean;
   isFlyoutView?: boolean;
+  runtimeMappings: MappingRuntimeFields;
   tabType: TimelineTabs;
   timelineId: string;
 }
@@ -76,6 +78,7 @@ const EventDetailsPanelComponent: React.FC<EventDetailsPanelProps> = ({
   handleOnEventClosed,
   isDraggable,
   isFlyoutView,
+  runtimeMappings,
   tabType,
   timelineId,
 }) => {
@@ -84,6 +87,7 @@ const EventDetailsPanelComponent: React.FC<EventDetailsPanelProps> = ({
     entityType,
     indexName: expandedEvent.indexName ?? '',
     eventId: expandedEvent.eventId ?? '',
+    runtimeMappings,
     skip: !expandedEvent.eventId,
   });
 
diff --git a/x-pack/plugins/security_solution/public/timelines/components/side_panel/host_details/__snapshots__/expandable_host.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/side_panel/host_details/__snapshots__/expandable_host.test.tsx.snap
index ad149cbcd63d0..43efd8cd824e6 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/side_panel/host_details/__snapshots__/expandable_host.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/side_panel/host_details/__snapshots__/expandable_host.test.tsx.snap
@@ -105,7 +105,15 @@ exports[`Expandable Host Component ExpandableHostDetails: rendering it should re
       id="hostsDetailsQuery"
       indexNames={
         Array [
-          "IShouldBeUsed",
+          "-*elastic-cloud-logs-*",
+          "apm-*-transaction*",
+          "auditbeat-*",
+          "endgame-*",
+          "filebeat-*",
+          "logs-*",
+          "packetbeat-*",
+          "traces-apm*",
+          "winlogbeat-*",
         ]
       }
       isDraggable={false}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/side_panel/host_details/expandable_host.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/side_panel/host_details/expandable_host.test.tsx
index c2df8959c8c94..5efeacee15a37 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/side_panel/host_details/expandable_host.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/side_panel/host_details/expandable_host.test.tsx
@@ -9,28 +9,11 @@ import { mount } from 'enzyme';
 import React from 'react';
 
 import '../../../../common/mock/match_media';
-import {
-  mockGlobalState,
-  TestProviders,
-  SUB_PLUGINS_REDUCER,
-  kibanaObservable,
-  createSecuritySolutionStorageMock,
-} from '../../../../common/mock';
-import { createStore, State } from '../../../../common/store';
+import { mockGlobalState, TestProviders } from '../../../../common/mock';
 import { ExpandableHostDetails } from './expandable_host';
+import { EXCLUDE_ELASTIC_CLOUD_INDEX } from '../../../../common/containers/sourcerer';
 
 describe('Expandable Host Component', () => {
-  const state: State = {
-    ...mockGlobalState,
-    sourcerer: {
-      ...mockGlobalState.sourcerer,
-      configIndexPatterns: ['IShouldBeUsed'],
-    },
-  };
-
-  const { storage } = createSecuritySolutionStorageMock();
-  const store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
-
   const mockProps = {
     contextID: 'text-context',
     hostName: 'testHostName',
@@ -39,7 +22,7 @@ describe('Expandable Host Component', () => {
   describe('ExpandableHostDetails: rendering', () => {
     test('it should render the HostOverview of the ExpandableHostDetails', () => {
       const wrapper = mount(
-        <TestProviders store={store}>
+        <TestProviders>
           <ExpandableHostDetails {...mockProps} />
         </TestProviders>
       );
@@ -49,12 +32,15 @@ describe('Expandable Host Component', () => {
 
     test('it should render the HostOverview of the ExpandableHostDetails with the correct indices', () => {
       const wrapper = mount(
-        <TestProviders store={store}>
+        <TestProviders>
           <ExpandableHostDetails {...mockProps} />
         </TestProviders>
       );
 
-      expect(wrapper.find('HostOverview').prop('indexNames')).toStrictEqual(['IShouldBeUsed']);
+      expect(wrapper.find('HostOverview').prop('indexNames')).toStrictEqual([
+        EXCLUDE_ELASTIC_CLOUD_INDEX,
+        ...mockGlobalState.sourcerer.sourcererScopes.default.selectedPatterns,
+      ]);
     });
   });
 });
diff --git a/x-pack/plugins/security_solution/public/timelines/components/side_panel/host_details/expandable_host.tsx b/x-pack/plugins/security_solution/public/timelines/components/side_panel/host_details/expandable_host.tsx
index 3fe8c2dcc8e08..dae1f7add11e3 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/side_panel/host_details/expandable_host.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/side_panel/host_details/expandable_host.tsx
@@ -5,14 +5,13 @@
  * 2.0.
  */
 
-import React, { useMemo } from 'react';
+import React from 'react';
 import styled from 'styled-components';
 import { i18n } from '@kbn/i18n';
 import { EuiTitle } from '@elastic/eui';
-import { sourcererSelectors } from '../../../../common/store/sourcerer';
 import { HostDetailsLink } from '../../../../common/components/links';
 import { useGlobalTime } from '../../../../common/containers/use_global_time';
-import { useSourcererScope } from '../../../../common/containers/sourcerer';
+import { useSourcererDataView } from '../../../../common/containers/sourcerer';
 import { HostOverview } from '../../../../overview/components/host_overview';
 import { setAbsoluteRangeDatePicker } from '../../../../common/store/inputs/actions';
 import { HostItem } from '../../../../../common/search_strategy';
@@ -20,7 +19,6 @@ import { AnomalyTableProvider } from '../../../../common/components/ml/anomaly/a
 import { hostToCriteria } from '../../../../common/components/ml/criteria/host_to_criteria';
 import { scoreIntervalToDateTime } from '../../../../common/components/ml/score/score_interval_to_datetime';
 import { useHostDetails, ID } from '../../../../hosts/containers/hosts/details';
-import { useDeepEqualSelector } from '../../../../common/hooks/use_selector';
 
 interface ExpandableHostProps {
   hostName: string;
@@ -57,9 +55,8 @@ export const ExpandableHostDetails = ({
   isDraggable = false,
 }: ExpandableHostProps & { contextID: string; isDraggable?: boolean }) => {
   const { to, from, isInitializing } = useGlobalTime();
-  const { docValueFields } = useSourcererScope();
   /*
-    Normally `selectedPatterns` from useSourcerScope would be where we obtain the indices,
+    Normally `selectedPatterns` from useSourcererDataView would be where we obtain the indices,
     but those indices are only loaded when viewing the pages where the sourcerer is initialized (i.e. Hosts and Overview)
     When a user goes directly to the detections page, the patterns have not been loaded yet
     as that information isn't used for the detections page. With this details component being accessible
@@ -67,15 +64,12 @@ export const ExpandableHostDetails = ({
     Otherwise, an empty array is defaulted for the `indexNames` in the query which leads to inconsistencies in the data returned
     (i.e. extraneous endpoint data is retrieved from the backend leading to endpoint data not being returned)
   */
-  const allExistingIndexNamesSelector = useMemo(
-    () => sourcererSelectors.getAllExistingIndexNamesSelector(),
-    []
-  );
-  const allPatterns = useDeepEqualSelector<string[]>(allExistingIndexNamesSelector);
+  const { docValueFields, selectedPatterns } = useSourcererDataView();
+
   const [loading, { hostDetails: hostOverview }] = useHostDetails({
     endDate: to,
     hostName,
-    indexNames: allPatterns,
+    indexNames: selectedPatterns,
     startDate: from,
   });
   return (
@@ -95,7 +89,7 @@ export const ExpandableHostDetails = ({
           anomaliesData={anomaliesData}
           isDraggable={isDraggable}
           isLoadingAnomaliesData={isLoadingAnomaliesData}
-          indexNames={allPatterns}
+          indexNames={selectedPatterns}
           loading={loading}
           startDate={from}
           endDate={to}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/side_panel/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/side_panel/index.test.tsx
index 7e530da542bf8..5870ba42405fe 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/side_panel/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/side_panel/index.test.tsx
@@ -97,6 +97,7 @@ describe('Details Panel Component', () => {
     docValueFields: [],
     handleOnPanelClosed: jest.fn(),
     isFlyoutView: false,
+    runtimeMappings: {},
     tabType: TimelineTabs.query,
     timelineId: 'test',
   };
diff --git a/x-pack/plugins/security_solution/public/timelines/components/side_panel/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/side_panel/index.tsx
index a9b1126edcaeb..1723f3f7f91af 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/side_panel/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/side_panel/index.tsx
@@ -9,6 +9,7 @@ import React, { useCallback, useMemo } from 'react';
 import { useDispatch } from 'react-redux';
 import { EuiFlyout, EuiFlyoutProps } from '@elastic/eui';
 
+import { MappingRuntimeFields } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import { timelineActions, timelineSelectors } from '../../store/timeline';
 import { timelineDefaults } from '../../store/timeline/defaults';
 import { BrowserFields, DocValueFields } from '../../../common/containers/source';
@@ -25,6 +26,7 @@ interface DetailsPanelProps {
   entityType?: EntityType;
   handleOnPanelClosed?: () => void;
   isFlyoutView?: boolean;
+  runtimeMappings: MappingRuntimeFields;
   tabType?: TimelineTabs;
   timelineId: string;
 }
@@ -41,6 +43,7 @@ export const DetailsPanel = React.memo(
     entityType,
     handleOnPanelClosed,
     isFlyoutView,
+    runtimeMappings,
     tabType,
     timelineId,
   }: DetailsPanelProps) => {
@@ -82,6 +85,7 @@ export const DetailsPanel = React.memo(
           handleOnEventClosed={closePanel}
           isDraggable={isDraggable}
           isFlyoutView={isFlyoutView}
+          runtimeMappings={runtimeMappings}
           tabType={activeTab}
           timelineId={timelineId}
         />
diff --git a/x-pack/plugins/security_solution/public/timelines/components/side_panel/network_details/expandable_network.tsx b/x-pack/plugins/security_solution/public/timelines/components/side_panel/network_details/expandable_network.tsx
index 184379cd366b1..5b13f3f2a3b1b 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/side_panel/network_details/expandable_network.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/side_panel/network_details/expandable_network.tsx
@@ -24,7 +24,7 @@ import { inputsSelectors } from '../../../../common/store';
 import { setAbsoluteRangeDatePicker } from '../../../../common/store/inputs/actions';
 import { OverviewEmpty } from '../../../../overview/components/overview_empty';
 import { esQuery } from '../../../../../../../../src/plugins/data/public';
-import { useSourcererScope } from '../../../../common/containers/sourcerer';
+import { useSourcererDataView } from '../../../../common/containers/sourcerer';
 import { useNetworkDetails } from '../../../../network/containers/details';
 import { networkModel } from '../../../../network/store';
 import { useAnomaliesTableData } from '../../../../common/components/ml/anomaly/use_anomalies_table_data';
@@ -98,7 +98,7 @@ export const ExpandableNetworkDetails = ({
     services: { uiSettings },
   } = useKibana();
 
-  const { docValueFields, indicesExist, indexPattern, selectedPatterns } = useSourcererScope();
+  const { docValueFields, indicesExist, indexPattern, selectedPatterns } = useSourcererDataView();
   const [filterQuery, kqlError] = convertToBuildEsQuery({
     config: esQuery.getEsQueryConfig(uiSettings),
     indexPattern,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/__snapshots__/index.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/__snapshots__/index.test.tsx.snap
index 25d5104a98d95..11f3d6d795d75 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/__snapshots__/index.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/__snapshots__/index.test.tsx.snap
@@ -126,6 +126,7 @@ exports[`ColumnHeaders rendering renders correctly against snapshot 1`] = `
               "packetbeat",
             ],
             "name": "@timestamp",
+            "readFromDocValues": true,
             "searchable": true,
             "type": "date",
           },
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/helpers.test.ts b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/helpers.test.ts
index 85e884703c592..c59a80ae078b2 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/helpers.test.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/helpers.test.ts
@@ -64,6 +64,7 @@ describe('helpers', () => {
           id: '@timestamp',
           indexes: ['auditbeat', 'filebeat', 'packetbeat'],
           name: '@timestamp',
+          readFromDocValues: true,
           searchable: true,
           type: 'date',
           initialWidth: 190,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/data_driven_columns/stateful_cell.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/data_driven_columns/stateful_cell.tsx
index 403756a763808..e7c03612828ab 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/data_driven_columns/stateful_cell.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/data_driven_columns/stateful_cell.tsx
@@ -51,6 +51,7 @@ const StatefulCellComponent = ({
         isExpandable: true,
         isExpanded: false,
         isDetails: false,
+        isTimeline: true,
         linkValues,
         rowIndex: ariaRowindex - 1,
         setCellProps,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/suricata/__snapshots__/suricata_row_renderer.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/suricata/__snapshots__/suricata_row_renderer.test.tsx.snap
index eeb8786b2cfa3..990f3a0af87c0 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/suricata/__snapshots__/suricata_row_renderer.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/suricata/__snapshots__/suricata_row_renderer.test.tsx.snap
@@ -127,6 +127,7 @@ exports[`suricata_row_renderer renders correctly against snapshot 1`] = `
                   "packetbeat",
                 ],
                 "name": "@timestamp",
+                "readFromDocValues": true,
                 "searchable": true,
                 "type": "date",
               },
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/__snapshots__/zeek_details.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/__snapshots__/zeek_details.test.tsx.snap
index 64ca766e4dee6..546b9a31843ac 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/__snapshots__/zeek_details.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/__snapshots__/zeek_details.test.tsx.snap
@@ -125,6 +125,7 @@ exports[`ZeekDetails rendering it renders the default ZeekDetails 1`] = `
               "packetbeat",
             ],
             "name": "@timestamp",
+            "readFromDocValues": true,
             "searchable": true,
             "type": "date",
           },
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/__snapshots__/zeek_row_renderer.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/__snapshots__/zeek_row_renderer.test.tsx.snap
index 94cbe43e93d2d..e20f63a7b9e79 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/__snapshots__/zeek_row_renderer.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/__snapshots__/zeek_row_renderer.test.tsx.snap
@@ -127,6 +127,7 @@ exports[`zeek_row_renderer renders correctly against snapshot 1`] = `
                   "packetbeat",
                 ],
                 "name": "@timestamp",
+                "readFromDocValues": true,
                 "searchable": true,
                 "type": "date",
               },
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/cell_rendering/default_cell_renderer.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/cell_rendering/default_cell_renderer.tsx
index 5b9fee621b417..6aec7ae19734c 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/cell_rendering/default_cell_renderer.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/cell_rendering/default_cell_renderer.tsx
@@ -32,6 +32,7 @@ export const DefaultCellRenderer: React.FC<CellValueElementProps> = ({
   header,
   isDetails,
   isDraggable,
+  isTimeline,
   linkValues,
   rowRenderers,
   setCellProps,
@@ -49,7 +50,7 @@ export const DefaultCellRenderer: React.FC<CellValueElementProps> = ({
     <>
       <StyledContent className={styledContentClassName} $isDetails={isDetails}>
         {getColumnRenderer(header.id, columnRenderers, data).renderColumn({
-          asPlainText: !!getLink(header.id, header.type), // we want to render value with links as plain text but keep other formatters like badge.
+          asPlainText: !!getLink(header.id, header.type) && !isTimeline, // we want to render value with links as plain text but keep other formatters like badge.
           browserFields,
           columnName: header.id,
           ecsData,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/cell_rendering/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/cell_rendering/index.tsx
index 2848a850a5227..5d66e399ece6f 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/cell_rendering/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/cell_rendering/index.tsx
@@ -5,4 +5,4 @@
  * 2.0.
  */
 
-export { CellValueElementProps } from '../../../../../common/types/timeline';
+export type { CellValueElementProps } from '../../../../../common/types/timeline';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/data_providers/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/data_providers/index.test.tsx
index ef04c1177dcd6..ddcc2df231a00 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/data_providers/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/data_providers/index.test.tsx
@@ -12,14 +12,6 @@ import { useMountAppended } from '../../../../common/utils/use_mount_appended';
 
 import { DataProviders } from '.';
 
-jest.mock('../../../../common/hooks/use_selector', () => {
-  const actual = jest.requireActual('../../../../common/hooks/use_selector');
-  return {
-    ...actual,
-    useDeepEqualSelector: jest.fn().mockReturnValue([]),
-  };
-});
-
 describe('DataProviders', () => {
   const mount = useMountAppended();
 
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/data_providers/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/data_providers/index.tsx
index f642ec35d4306..0a3a40d8f6f06 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/data_providers/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/data_providers/index.tsx
@@ -12,7 +12,7 @@ import uuid from 'uuid';
 import { IS_DRAGGING_CLASS_NAME } from '@kbn/securitysolution-t-grid';
 
 import { SourcererScopeName } from '../../../../common/store/sourcerer/model';
-import { useSourcererScope } from '../../../../common/containers/sourcerer';
+import { useSourcererDataView } from '../../../../common/containers/sourcerer';
 import { useDeepEqualSelector } from '../../../../common/hooks/use_selector';
 import { DroppableWrapper } from '../../../../common/components/drag_and_drop/droppable_wrapper';
 import { droppableTimelineProvidersPrefix } from '../../../../common/components/drag_and_drop/helpers';
@@ -85,7 +85,7 @@ const getDroppableId = (id: string): string =>
  * the data pro section.
  */
 export const DataProviders = React.memo<Props>(({ timelineId }) => {
-  const { browserFields } = useSourcererScope(SourcererScopeName.timeline);
+  const { browserFields } = useSourcererDataView(SourcererScopeName.timeline);
   const getManageTimeline = useMemo(() => timelineSelectors.getManageTimelineById(), []);
   const { isLoading } = useDeepEqualSelector((state) => getManageTimeline(state, timelineId));
   const getTimeline = useMemo(() => timelineSelectors.getTimelineByIdSelector(), []);
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/eql_tab_content/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/eql_tab_content/index.test.tsx
index ad141829858ae..553a3d0e82d29 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/eql_tab_content/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/eql_tab_content/index.test.tsx
@@ -20,7 +20,7 @@ import { useMountAppended } from '../../../../common/utils/use_mount_appended';
 import { TimelineId, TimelineTabs } from '../../../../../common/types/timeline';
 import { useTimelineEvents } from '../../../containers/index';
 import { useTimelineEventsDetails } from '../../../containers/details/index';
-import { useSourcererScope } from '../../../../common/containers/sourcerer';
+import { useSourcererDataView } from '../../../../common/containers/sourcerer';
 import { mockSourcererScope } from '../../../../common/containers/sourcerer/mocks';
 import { useDraggableKeyboardWrapper as mockUseDraggableKeyboardWrapper } from '../../../../../../timelines/public/components';
 
@@ -88,7 +88,7 @@ describe('Timeline', () => {
     ]);
     (useTimelineEventsDetails as jest.Mock).mockReturnValue([false, {}]);
 
-    (useSourcererScope as jest.Mock).mockReturnValue(mockSourcererScope);
+    (useSourcererDataView as jest.Mock).mockReturnValue(mockSourcererScope);
 
     props = {
       columns: defaultHeaders,
@@ -176,7 +176,7 @@ describe('Timeline', () => {
     });
 
     test('it does render the timeline table when the source is loading with no events', () => {
-      (useSourcererScope as jest.Mock).mockReturnValue({
+      (useSourcererDataView as jest.Mock).mockReturnValue({
         browserFields: {},
         docValueFields: [],
         loading: true,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/eql_tab_content/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/eql_tab_content/index.tsx
index 737c6b99cea75..6cb0e6f2e7982 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/eql_tab_content/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/eql_tab_content/index.tsx
@@ -47,7 +47,7 @@ import { inputsModel, inputsSelectors, State } from '../../../../common/store';
 import { sourcererActions } from '../../../../common/store/sourcerer';
 import { SourcererScopeName } from '../../../../common/store/sourcerer/model';
 import { timelineDefaults } from '../../../../timelines/store/timeline/defaults';
-import { useSourcererScope } from '../../../../common/containers/sourcerer';
+import { useSourcererDataView } from '../../../../common/containers/sourcerer';
 import { useEqlEventsCountPortal } from '../../../../common/hooks/use_timeline_events_count';
 import { TimelineModel } from '../../../../timelines/store/timeline/model';
 import { TimelineDatePickerLock } from '../date_picker_lock';
@@ -178,8 +178,9 @@ export const EqlTabContentComponent: React.FC<Props> = ({
     browserFields,
     docValueFields,
     loading: loadingSourcerer,
+    runtimeMappings,
     selectedPatterns,
-  } = useSourcererScope(SourcererScopeName.timeline);
+  } = useSourcererDataView(SourcererScopeName.timeline);
 
   const isBlankTimeline: boolean = isEmpty(eqlQuery);
 
@@ -216,6 +217,7 @@ export const EqlTabContentComponent: React.FC<Props> = ({
       language: 'eql',
       limit: itemsPerPage,
       filterQuery: eqlQuery ?? '',
+      runtimeMappings,
       startDate: start,
       skip: !canQueryTimeline(),
       timerangeKind,
@@ -346,6 +348,7 @@ export const EqlTabContentComponent: React.FC<Props> = ({
               <DetailsPanel
                 browserFields={browserFields}
                 docValueFields={docValueFields}
+                runtimeMappings={runtimeMappings}
                 tabType={TimelineTabs.eql}
                 timelineId={timelineId}
                 handleOnPanelClosed={handleOnPanelClosed}
@@ -395,12 +398,23 @@ const makeMapStateToProps = () => {
   return mapStateToProps;
 };
 const mapDispatchToProps = (dispatch: Dispatch, { timelineId }: OwnProps) => ({
-  updateEventTypeAndIndexesName: (newEventType: TimelineEventsType, newIndexNames: string[]) => {
+  updateEventTypeAndIndexesName: (
+    newEventType: TimelineEventsType,
+    newIndexNames: string[],
+    newDataViewId: string
+  ) => {
     dispatch(timelineActions.updateEventType({ id: timelineId, eventType: newEventType }));
-    dispatch(timelineActions.updateIndexNames({ id: timelineId, indexNames: newIndexNames }));
     dispatch(
-      sourcererActions.setSelectedIndexPatterns({
+      timelineActions.updateDataView({
+        dataViewId: newDataViewId,
+        id: timelineId,
+        indexNames: newIndexNames,
+      })
+    );
+    dispatch(
+      sourcererActions.setSelectedDataView({
         id: SourcererScopeName.timeline,
+        selectedDataViewId: newDataViewId,
         selectedPatterns: newIndexNames,
       })
     );
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/events.ts b/x-pack/plugins/security_solution/public/timelines/components/timeline/events.ts
index ca7c3596d13bb..c90d04e1e640a 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/events.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/events.ts
@@ -7,7 +7,7 @@
 
 import { ColumnId } from './body/column_id';
 import { DataProvider, QueryOperator } from './data_providers/data_provider';
-export {
+export type {
   OnColumnSorted,
   OnColumnsSorted,
   OnColumnRemoved,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/helpers.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/helpers.tsx
index 2c85f1547dbeb..547f005ab61ab 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/helpers.tsx
@@ -8,7 +8,7 @@
 import { isEmpty, get } from 'lodash/fp';
 import memoizeOne from 'memoize-one';
 
-import { EsQueryConfig, Filter, Query } from '@kbn/es-query';
+import { DataViewBase, EsQueryConfig, Filter, Query } from '@kbn/es-query';
 import {
   handleSkipFocus,
   elementOrChildrenHasFocus,
@@ -25,7 +25,6 @@ import {
   EXISTS_OPERATOR,
 } from './data_providers/data_provider';
 import { BrowserFields } from '../../../common/containers/source';
-import { IIndexPattern } from '../../../../../../../src/plugins/data/public';
 
 import { EVENTS_TABLE_CLASS_NAME } from './styles';
 
@@ -151,7 +150,7 @@ export const combineQueries = ({
 }: {
   config: EsQueryConfig;
   dataProviders: DataProvider[];
-  indexPattern: IIndexPattern;
+  indexPattern: DataViewBase;
   browserFields: BrowserFields;
   filters: Filter[];
   kqlQuery: Query;
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/index.test.tsx
index c91673e5f931c..bb1281c0eff2e 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/index.test.tsx
@@ -59,7 +59,7 @@ jest.mock('../../../common/containers/sourcerer', () => {
 
   return {
     ...originalModule,
-    useSourcererScope: jest.fn().mockReturnValue({
+    useSourcererDataView: jest.fn().mockReturnValue({
       browserFields: mockBrowserFields,
       docValueFields: mockDocValueFields,
       loading: false,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/index.tsx
index ca883529b5ce6..48f9274fa563f 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/index.tsx
@@ -16,7 +16,7 @@ import { timelineActions, timelineSelectors } from '../../store/timeline';
 import { timelineDefaults } from '../../../timelines/store/timeline/defaults';
 import { defaultHeaders } from './body/column_headers/default_headers';
 import { CellValueElementProps } from './cell_rendering';
-import { useSourcererScope } from '../../../common/containers/sourcerer';
+import { useSourcererDataView } from '../../../common/containers/sourcerer';
 import { SourcererScopeName } from '../../../common/store/sourcerer/model';
 import { FlyoutHeader, FlyoutHeaderPanel } from '../flyout/header';
 import { TimelineType, TimelineId, RowRenderer } from '../../../../common/types/timeline';
@@ -62,7 +62,8 @@ const StatefulTimelineComponent: React.FC<Props> = ({
   const dispatch = useDispatch();
   const containerElement = useRef<HTMLDivElement | null>(null);
   const getTimeline = useMemo(() => timelineSelectors.getTimelineByIdSelector(), []);
-  const { selectedPatterns } = useSourcererScope(SourcererScopeName.timeline);
+  const { dataViewId, selectedPatterns } = useSourcererDataView(SourcererScopeName.timeline);
+
   const { graphEventId, savedObjectId, timelineType, description } = useDeepEqualSelector((state) =>
     pick(
       ['graphEventId', 'savedObjectId', 'timelineType', 'description'],
@@ -77,6 +78,7 @@ const StatefulTimelineComponent: React.FC<Props> = ({
         timelineActions.createTimeline({
           id: timelineId,
           columns: defaultHeaders,
+          dataViewId,
           indexNames: selectedPatterns,
           expandedDetail: activeTimeline.getExpandedDetail(),
           show: false,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/notes_tab_content/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/notes_tab_content/index.tsx
index 726071b2caf74..e4d97abc0433a 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/notes_tab_content/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/notes_tab_content/index.tsx
@@ -21,7 +21,7 @@ import React, { Fragment, useCallback, useMemo, useState } from 'react';
 import { useDispatch } from 'react-redux';
 import styled from 'styled-components';
 
-import { useSourcererScope } from '../../../../common/containers/sourcerer';
+import { useSourcererDataView } from '../../../../common/containers/sourcerer';
 import { SourcererScopeName } from '../../../../common/store/sourcerer/model';
 import { timelineActions } from '../../../store/timeline';
 import {
@@ -145,8 +145,9 @@ const NotesTabContentComponent: React.FC<NotesTabContentProps> = ({ timelineId }
     noteIds,
     status: timelineStatus,
   } = useDeepEqualSelector((state) => getTimelineNotes(state, timelineId));
-
-  const { browserFields, docValueFields } = useSourcererScope(SourcererScopeName.timeline);
+  const { browserFields, docValueFields, runtimeMappings } = useSourcererDataView(
+    SourcererScopeName.timeline
+  );
 
   const getNotesAsCommentsList = useMemo(
     () => appSelectors.selectNotesAsCommentsListSelector(),
@@ -188,11 +189,19 @@ const NotesTabContentComponent: React.FC<NotesTabContentProps> = ({ timelineId }
           browserFields={browserFields}
           docValueFields={docValueFields}
           handleOnPanelClosed={handleOnPanelClosed}
+          runtimeMappings={runtimeMappings}
           tabType={TimelineTabs.notes}
           timelineId={timelineId}
         />
       ) : null,
-    [browserFields, docValueFields, expandedDetail, handleOnPanelClosed, timelineId]
+    [
+      browserFields,
+      docValueFields,
+      expandedDetail,
+      handleOnPanelClosed,
+      runtimeMappings,
+      timelineId,
+    ]
   );
 
   const SidebarContent = useMemo(
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/pinned_tab_content/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/pinned_tab_content/index.test.tsx
index cb41d0c69bc97..8707bb33da08c 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/pinned_tab_content/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/pinned_tab_content/index.test.tsx
@@ -19,7 +19,7 @@ import { useMountAppended } from '../../../../common/utils/use_mount_appended';
 import { TimelineId, TimelineTabs } from '../../../../../common/types/timeline';
 import { useTimelineEvents } from '../../../containers/index';
 import { useTimelineEventsDetails } from '../../../containers/details/index';
-import { useSourcererScope } from '../../../../common/containers/sourcerer';
+import { useSourcererDataView } from '../../../../common/containers/sourcerer';
 import { mockSourcererScope } from '../../../../common/containers/sourcerer/mocks';
 import { PinnedTabContentComponent, Props as PinnedTabContentComponentProps } from '.';
 import { Direction } from '../../../../../common/search_strategy';
@@ -93,7 +93,7 @@ describe('PinnedTabContent', () => {
     ]);
     (useTimelineEventsDetails as jest.Mock).mockReturnValue([false, {}]);
 
-    (useSourcererScope as jest.Mock).mockReturnValue(mockSourcererScope);
+    (useSourcererDataView as jest.Mock).mockReturnValue(mockSourcererScope);
 
     props = {
       columns: defaultHeaders,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/pinned_tab_content/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/pinned_tab_content/index.tsx
index 2051f95b75ae8..fbb1269b05b27 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/pinned_tab_content/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/pinned_tab_content/index.tsx
@@ -22,10 +22,9 @@ import { StatefulBody } from '../body';
 import { Footer, footerHeight } from '../footer';
 import { requiredFieldsForActions } from '../../../../detections/components/alerts_table/default_config';
 import { EventDetailsWidthProvider } from '../../../../common/components/events_viewer/event_details_width_context';
-import { sourcererSelectors } from '../../../../common/store/sourcerer';
 import { SourcererScopeName } from '../../../../common/store/sourcerer/model';
 import { timelineDefaults } from '../../../store/timeline/defaults';
-import { useSourcererScope } from '../../../../common/containers/sourcerer';
+import { useSourcererDataView } from '../../../../common/containers/sourcerer';
 import { useTimelineFullScreen } from '../../../../common/containers/use_full_screen';
 import { TimelineModel } from '../../../store/timeline/model';
 import { State } from '../../../../common/store';
@@ -37,7 +36,6 @@ import {
   ToggleDetailPanel,
 } from '../../../../../common/types/timeline';
 import { DetailsPanel } from '../../side_panel';
-import { useDeepEqualSelector } from '../../../../common/hooks/use_selector';
 import { ExitFullScreen } from '../../../../common/components/exit_full_screen';
 import { defaultControlColumn } from '../body/control_columns';
 
@@ -119,15 +117,11 @@ export const PinnedTabContentComponent: React.FC<Props> = ({
     browserFields,
     docValueFields,
     loading: loadingSourcerer,
-  } = useSourcererScope(SourcererScopeName.timeline);
+    runtimeMappings,
+    selectedPatterns,
+  } = useSourcererDataView(SourcererScopeName.timeline);
   const { setTimelineFullScreen, timelineFullScreen } = useTimelineFullScreen();
 
-  const existingIndexNamesSelector = useMemo(
-    () => sourcererSelectors.getAllExistingIndexNamesSelector(),
-    []
-  );
-  const existingIndexNames = useDeepEqualSelector<string[]>(existingIndexNamesSelector);
-
   const filterQuery = useMemo(() => {
     if (isEmpty(pinnedEventIds)) {
       return '';
@@ -188,10 +182,11 @@ export const PinnedTabContentComponent: React.FC<Props> = ({
       docValueFields,
       endDate: '',
       id: `pinned-${timelineId}`,
-      indexNames: existingIndexNames,
+      indexNames: selectedPatterns,
       fields: timelineQueryFields,
       limit: itemsPerPage,
       filterQuery,
+      runtimeMappings,
       skip: filterQuery === '',
       startDate: '',
       sort: timelineQuerySortField,
@@ -269,6 +264,7 @@ export const PinnedTabContentComponent: React.FC<Props> = ({
                 browserFields={browserFields}
                 docValueFields={docValueFields}
                 handleOnPanelClosed={handleOnPanelClosed}
+                runtimeMappings={runtimeMappings}
                 tabType={TimelineTabs.pinned}
                 timelineId={timelineId}
               />
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/use_create_timeline.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/use_create_timeline.test.tsx
index 1fea015de772f..a4dd57768372e 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/use_create_timeline.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/use_create_timeline.test.tsx
@@ -22,13 +22,6 @@ jest.mock('react-redux', () => {
   return {
     ...actual,
     useDispatch: () => mockDispatch,
-    useSelector: () => ({
-      kind: 'relative',
-      fromStr: 'now-24h',
-      toStr: 'now',
-      from: '2020-07-07T08:20:18.966Z',
-      to: '2020-07-08T08:20:18.966Z',
-    }),
   };
 });
 
@@ -135,7 +128,7 @@ describe('useCreateTimelineButton', () => {
         wrapper.find('[data-test-subj="timeline-new"]').first().simulate('click');
 
         expect(mockDispatch.mock.calls[0][0].type).toEqual(
-          'x-pack/security_solution/local/sourcerer/SET_SELECTED_INDEX_PATTERNS'
+          'x-pack/security_solution/local/sourcerer/SET_SELECTED_DATA_VIEW'
         );
         expect(mockDispatch.mock.calls[1][0].type).toEqual(
           'x-pack/security_solution/local/timeline/CREATE_TIMELINE'
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/use_create_timeline.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/use_create_timeline.tsx
index 32d05202f1d12..6b10ff20008dc 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/use_create_timeline.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/properties/use_create_timeline.tsx
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import React, { useCallback, useMemo } from 'react';
+import React, { useCallback } from 'react';
 import { useDispatch } from 'react-redux';
 import { EuiButton, EuiButtonEmpty } from '@elastic/eui';
 
@@ -19,9 +19,10 @@ import {
 } from '../../../../../common/types/timeline';
 import { useDeepEqualSelector } from '../../../../common/hooks/use_selector';
 import { inputsActions, inputsSelectors } from '../../../../common/store/inputs';
-import { sourcererActions, sourcererSelectors } from '../../../../common/store/sourcerer';
+import { sourcererActions } from '../../../../common/store/sourcerer';
 import { SourcererScopeName } from '../../../../common/store/sourcerer/model';
 import { appActions } from '../../../../common/store/app';
+import { useSourcererDataView } from '../../../../common/containers/sourcerer';
 
 interface Props {
   timelineId?: string;
@@ -31,11 +32,8 @@ interface Props {
 
 export const useCreateTimeline = ({ timelineId, timelineType, closeGearMenu }: Props) => {
   const dispatch = useDispatch();
-  const existingIndexNamesSelector = useMemo(
-    () => sourcererSelectors.getAllExistingIndexNamesSelector(),
-    []
-  );
-  const existingIndexNames = useDeepEqualSelector<string[]>(existingIndexNamesSelector);
+  const { dataViewId, selectedPatterns } = useSourcererDataView(SourcererScopeName.timeline);
+
   const { timelineFullScreen, setTimelineFullScreen } = useTimelineFullScreen();
   const globalTimeRange = useDeepEqualSelector(inputsSelectors.globalTimeRangeSelector);
   const createTimeline = useCallback(
@@ -44,18 +42,20 @@ export const useCreateTimeline = ({ timelineId, timelineType, closeGearMenu }: P
         setTimelineFullScreen(false);
       }
       dispatch(
-        sourcererActions.setSelectedIndexPatterns({
+        sourcererActions.setSelectedDataView({
           id: SourcererScopeName.timeline,
-          selectedPatterns: existingIndexNames,
+          selectedDataViewId: dataViewId,
+          selectedPatterns,
         })
       );
       dispatch(
         timelineActions.createTimeline({
-          id,
           columns: defaultHeaders,
+          dataViewId,
+          id,
+          indexNames: selectedPatterns,
           show,
           timelineType,
-          indexNames: existingIndexNames,
         })
       );
       dispatch(inputsActions.addGlobalLinkTo({ linkToId: 'timeline' }));
@@ -78,9 +78,10 @@ export const useCreateTimeline = ({ timelineId, timelineType, closeGearMenu }: P
       }
     },
     [
-      existingIndexNames,
       dispatch,
       globalTimeRange,
+      dataViewId,
+      selectedPatterns,
       setTimelineFullScreen,
       timelineFullScreen,
       timelineType,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/query_bar/eql/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/query_bar/eql/index.tsx
index b65e432126283..f045f735ae168 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/query_bar/eql/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/query_bar/eql/index.tsx
@@ -11,7 +11,7 @@ import { useDispatch } from 'react-redux';
 import styled from 'styled-components';
 
 import { FieldsEqlOptions } from '../../../../../../common/search_strategy';
-import { useSourcererScope } from '../../../../../common/containers/sourcerer';
+import { useSourcererDataView } from '../../../../../common/containers/sourcerer';
 import { useDeepEqualSelector } from '../../../../../common/hooks/use_selector';
 import { SourcererScopeName } from '../../../../../common/store/sourcerer/model';
 import { EqlQueryBar } from '../../../../../detections/components/rules/eql_query_bar';
@@ -71,7 +71,7 @@ export const EqlQueryBarTimeline = memo(({ timelineId }: { timelineId: string })
     loading: indexPatternsLoading,
     indexPattern,
     selectedPatterns,
-  } = useSourcererScope(SourcererScopeName.timeline);
+  } = useSourcererDataView(SourcererScopeName.timeline);
 
   const initialState = {
     ...defaultValues,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/query_bar/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/query_bar/index.tsx
index daafec3005eb8..450a43b43ef5f 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/query_bar/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/query_bar/index.tsx
@@ -11,7 +11,7 @@ import { useDispatch } from 'react-redux';
 import { Subscription } from 'rxjs';
 import deepEqual from 'fast-deep-equal';
 
-import { useSourcererScope } from '../../../../common/containers/sourcerer';
+import { useSourcererDataView } from '../../../../common/containers/sourcerer';
 import { SourcererScopeName } from '../../../../common/store/sourcerer/model';
 import {
   Query,
@@ -81,8 +81,7 @@ export const QueryBarTimeline = memo<QueryBarTimelineComponentProps>(
     const [dateRangeTo, setDateRangTo] = useState<string>(
       toStr != null ? toStr : new Date(to).toISOString()
     );
-    const { browserFields, indexPattern } = useSourcererScope(SourcererScopeName.timeline);
-
+    const { browserFields, indexPattern } = useSourcererDataView(SourcererScopeName.timeline);
     const [savedQuery, setSavedQuery] = useState<SavedQuery | undefined>(undefined);
     const [filterQueryConverted, setFilterQueryConverted] = useState<Query>({
       query: filterQuery != null ? filterQuery.expression : '',
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/query_tab_content/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/query_tab_content/index.test.tsx
index c9bb14dfc0c67..23f0fa0b9f289 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/query_tab_content/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/query_tab_content/index.test.tsx
@@ -22,7 +22,7 @@ import { useMountAppended } from '../../../../common/utils/use_mount_appended';
 import { TimelineId, TimelineStatus, TimelineTabs } from '../../../../../common/types/timeline';
 import { useTimelineEvents } from '../../../containers/index';
 import { useTimelineEventsDetails } from '../../../containers/details/index';
-import { useSourcererScope } from '../../../../common/containers/sourcerer';
+import { useSourcererDataView } from '../../../../common/containers/sourcerer';
 import { mockSourcererScope } from '../../../../common/containers/sourcerer/mocks';
 import { Direction } from '../../../../../common/search_strategy';
 import * as helpers from '../helpers';
@@ -102,7 +102,7 @@ describe('Timeline', () => {
     ]);
     (useTimelineEventsDetails as jest.Mock).mockReturnValue([false, {}]);
 
-    (useSourcererScope as jest.Mock).mockReturnValue(mockSourcererScope);
+    (useSourcererDataView as jest.Mock).mockReturnValue(mockSourcererScope);
 
     props = {
       columns: defaultHeaders,
@@ -187,7 +187,7 @@ describe('Timeline', () => {
     });
 
     test('it does render the timeline table when the source is loading with no events', () => {
-      (useSourcererScope as jest.Mock).mockReturnValue({
+      (useSourcererDataView as jest.Mock).mockReturnValue({
         browserFields: {},
         docValueFields: [],
         loading: true,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/query_tab_content/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/query_tab_content/index.tsx
index 2082e7f5b69bb..5f6f2796d4ba9 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/query_tab_content/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/query_tab_content/index.tsx
@@ -51,7 +51,7 @@ import { inputsModel, inputsSelectors, State } from '../../../../common/store';
 import { sourcererActions } from '../../../../common/store/sourcerer';
 import { SourcererScopeName } from '../../../../common/store/sourcerer/model';
 import { timelineDefaults } from '../../../../timelines/store/timeline/defaults';
-import { useSourcererScope } from '../../../../common/containers/sourcerer';
+import { useSourcererDataView } from '../../../../common/containers/sourcerer';
 import { useTimelineEventsCountPortal } from '../../../../common/hooks/use_timeline_events_count';
 import { TimelineModel } from '../../../../timelines/store/timeline/model';
 import { TimelineDatePickerLock } from '../date_picker_lock';
@@ -190,9 +190,9 @@ export const QueryTabContentComponent: React.FC<Props> = ({
     docValueFields,
     loading: loadingSourcerer,
     indexPattern,
+    runtimeMappings,
     selectedPatterns,
-  } = useSourcererScope(SourcererScopeName.timeline);
-
+  } = useSourcererDataView(SourcererScopeName.timeline);
   const { uiSettings } = useKibana().services;
 
   const getManageTimeline = useMemo(() => timelineSelectors.getManageTimelineById(), []);
@@ -282,6 +282,7 @@ export const QueryTabContentComponent: React.FC<Props> = ({
       language: kqlQuery.language,
       limit: itemsPerPage,
       filterQuery: combinedQueries?.filterQuery,
+      runtimeMappings,
       startDate: start,
       skip: !canQueryTimeline,
       sort: timelineQuerySortField,
@@ -429,6 +430,7 @@ export const QueryTabContentComponent: React.FC<Props> = ({
                 browserFields={browserFields}
                 docValueFields={docValueFields}
                 handleOnPanelClosed={handleOnPanelClosed}
+                runtimeMappings={runtimeMappings}
                 tabType={TimelineTabs.query}
                 timelineId={timelineId}
               />
@@ -502,13 +504,24 @@ const makeMapStateToProps = () => {
 };
 
 const mapDispatchToProps = (dispatch: Dispatch, { timelineId }: OwnProps) => ({
-  updateEventTypeAndIndexesName: (newEventType: TimelineEventsType, newIndexNames: string[]) => {
+  updateEventTypeAndIndexesName: (
+    newEventType: TimelineEventsType,
+    newIndexNames: string[],
+    newDataViewId: string
+  ) => {
     dispatch(timelineActions.updateEventType({ id: timelineId, eventType: newEventType }));
-    dispatch(timelineActions.updateIndexNames({ id: timelineId, indexNames: newIndexNames }));
     dispatch(
-      sourcererActions.setSelectedIndexPatterns({
+      timelineActions.updateDataView({
+        dataViewId: newDataViewId,
+        id: timelineId,
+        indexNames: newIndexNames,
+      })
+    );
+    dispatch(
+      sourcererActions.setSelectedDataView({
         id: SourcererScopeName.timeline,
         selectedPatterns: newIndexNames,
+        selectedDataViewId: newDataViewId,
       })
     );
   },
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/search_or_filter/pick_events.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/search_or_filter/pick_events.test.tsx
index e519cfcd204a7..47ea0f781f7c3 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/search_or_filter/pick_events.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/search_or_filter/pick_events.test.tsx
@@ -14,6 +14,7 @@ import {
   createSecuritySolutionStorageMock,
   kibanaObservable,
   mockGlobalState,
+  mockSourcererState,
   SUB_PLUGINS_REDUCER,
   TestProviders,
 } from '../../../../common/mock';
@@ -29,41 +30,59 @@ jest.mock('@elastic/eui', () => {
   };
 });
 
-describe('pick_events', () => {
+describe('Pick Events/Timeline Sourcerer', () => {
   const defaultProps = {
     eventType: 'all' as TimelineEventsType,
     onChangeEventTypeAndIndexesName: jest.fn(),
   };
   const initialPatterns = [
-    ...mockGlobalState.sourcerer.sourcererScopes[SourcererScopeName.timeline].selectedPatterns,
-    mockGlobalState.sourcerer.signalIndexName,
+    ...mockSourcererState.defaultDataView.patternList.filter(
+      (p) => p !== mockSourcererState.signalIndexName
+    ),
+    mockSourcererState.signalIndexName,
   ];
   const { storage } = createSecuritySolutionStorageMock();
+
+  // const state = {
+  //   ...mockGlobalState,
+  //   sourcerer: {
+  //     ...mockGlobalState.sourcerer,
+  //     kibanaIndexPatterns: [
+  //       { id: '1234', title: 'auditbeat-*' },
+  //       { id: '9100', title: 'filebeat-*' },
+  //       { id: '9100', title: 'auditbeat-*,filebeat-*' },
+  //       { id: '5678', title: 'auditbeat-*,.siem-signals-default' },
+  //     ],
+  //     configIndexPatterns:
+  //       mockGlobalState.sourcerer.sourcererScopes[SourcererScopeName.timeline].selectedPatterns,
+  //     signalIndexName: mockGlobalState.sourcerer.signalIndexName,
+  //     sourcererScopes: {
+  //       ...mockGlobalState.sourcerer.sourcererScopes,
+  //       [SourcererScopeName.timeline]: {
+  //         ...mockGlobalState.sourcerer.sourcererScopes[SourcererScopeName.timeline],
+  //         loading: false,
+  //         selectedPatterns: ['filebeat-*'],
+  //       },
+  //     },
+  //   },
+  // };
+  // const store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
   const state = {
     ...mockGlobalState,
     sourcerer: {
       ...mockGlobalState.sourcerer,
-      kibanaIndexPatterns: [
-        { id: '1234', title: 'auditbeat-*' },
-        { id: '9100', title: 'filebeat-*' },
-        { id: '9100', title: 'auditbeat-*,filebeat-*' },
-        { id: '5678', title: 'auditbeat-*,.siem-signals-default' },
-      ],
-      configIndexPatterns:
-        mockGlobalState.sourcerer.sourcererScopes[SourcererScopeName.timeline].selectedPatterns,
-      signalIndexName: mockGlobalState.sourcerer.signalIndexName,
       sourcererScopes: {
         ...mockGlobalState.sourcerer.sourcererScopes,
         [SourcererScopeName.timeline]: {
           ...mockGlobalState.sourcerer.sourcererScopes[SourcererScopeName.timeline],
           loading: false,
+          selectedDataViewId: mockGlobalState.sourcerer.defaultDataView.id,
           selectedPatterns: ['filebeat-*'],
         },
       },
     },
   };
   const store = createStore(state, SUB_PLUGINS_REDUCER, kibanaObservable, storage);
-
   const mockTooltip = ({
     tooltipContent,
     children,
@@ -94,6 +113,57 @@ describe('pick_events', () => {
     expect(wrapper.getByTestId('timeline-sourcerer').textContent).toEqual(
       initialPatterns.sort().join('')
     );
+    fireEvent.click(wrapper.getByTestId(`sourcerer-accordion`));
+    fireEvent.click(wrapper.getByTestId('comboBoxToggleListButton'));
+    const optionNodes = wrapper.getAllByTestId('sourcerer-option');
+    expect(optionNodes.length).toBe(1);
+  });
+  it('Removes duplicate options from options list', () => {
+    const store2 = createStore(
+      {
+        ...mockGlobalState,
+        sourcerer: {
+          ...mockGlobalState.sourcerer,
+          defaultDataView: {
+            ...mockGlobalState.sourcerer.defaultDataView,
+            id: '1234',
+            title: 'filebeat-*,auditbeat-*,auditbeat-*,auditbeat-*,auditbeat-*',
+            patternList: ['filebeat-*', 'auditbeat-*'],
+          },
+          kibanaDataViews: [
+            {
+              ...mockGlobalState.sourcerer.defaultDataView,
+              id: '1234',
+              title: 'filebeat-*,auditbeat-*,auditbeat-*,auditbeat-*,auditbeat-*',
+              patternList: ['filebeat-*', 'auditbeat-*'],
+            },
+          ],
+          sourcererScopes: {
+            ...mockGlobalState.sourcerer.sourcererScopes,
+            [SourcererScopeName.timeline]: {
+              ...mockGlobalState.sourcerer.sourcererScopes[SourcererScopeName.timeline],
+              loading: false,
+              selectedDataViewId: '1234',
+              selectedPatterns: ['filebeat-*'],
+            },
+          },
+        },
+      },
+      SUB_PLUGINS_REDUCER,
+      kibanaObservable,
+      storage
+    );
+    const wrapper = render(
+      <TestProviders store={store2}>
+        <PickEventType {...defaultProps} />
+      </TestProviders>
+    );
+    fireEvent.click(wrapper.getByTestId(`sourcerer-timeline-trigger`));
+    fireEvent.click(wrapper.getByTestId(`sourcerer-accordion`));
+    fireEvent.click(wrapper.getByTestId(`comboBoxToggleListButton`));
+    expect(
+      wrapper.getByTestId('comboBoxOptionsList timeline-sourcerer-optionsList').textContent
+    ).toEqual('auditbeat-*');
   });
 
   it('renders tooltip', () => {
@@ -129,6 +199,7 @@ describe('pick_events', () => {
     );
     fireEvent.click(wrapper.getByTestId('sourcerer-timeline-trigger'));
     fireEvent.click(wrapper.getByTestId('comboBoxToggleListButton'));
+    fireEvent.click(wrapper.getByTestId('sourcerer-accordion'));
     const optionNodes = wrapper.getAllByTestId('sourcerer-option');
     expect(optionNodes.length).toBe(9);
   });
@@ -145,8 +216,5 @@ describe('pick_events', () => {
     expect(wrapper.getByTestId('timeline-sourcerer').textContent).toEqual(
       initialPatterns.sort().join('')
     );
-    fireEvent.click(wrapper.getByTestId('comboBoxToggleListButton'));
-    const optionNodes = wrapper.getAllByTestId('sourcerer-option');
-    expect(optionNodes.length).toBe(2);
   });
 });
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/search_or_filter/pick_events.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/search_or_filter/pick_events.tsx
index 6d86d7c0f1330..791993d67135d 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/search_or_filter/pick_events.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/search_or_filter/pick_events.tsx
@@ -21,17 +21,19 @@ import {
   EuiSpacer,
   EuiText,
   EuiToolTip,
+  EuiSuperSelect,
 } from '@elastic/eui';
 import deepEqual from 'fast-deep-equal';
 import React, { memo, useCallback, useEffect, useMemo, useState } from 'react';
-import { useSelector } from 'react-redux';
 import styled from 'styled-components';
 
-import { State } from '../../../../common/store';
+import { sourcererSelectors } from '../../../../common/store';
 import { SourcererScopeName } from '../../../../common/store/sourcerer/model';
-import { TimelineEventsType } from '../../../../../common/types/timeline';
-import { getSourcererScopeSelector, SourcererScopeSelector } from './selectors';
+import { TimelineEventsType } from '../../../../../common';
 import * as i18n from './translations';
+import { getScopePatternListSelection } from '../../../../common/store/sourcerer/helpers';
+import { SIEM_DATA_VIEW_LABEL } from '../../../../common/components/sourcerer/translations';
+import { useDeepEqualSelector } from '../../../../common/hooks/use_selector';
 
 const PopoverContent = styled.div`
   width: 600px;
@@ -89,7 +91,7 @@ const PickEventContainer = styled.div`
   }
 `;
 
-const getEventTypeOptions = (isCustomDisabled: boolean = true) => [
+const getEventTypeOptions = (isCustomDisabled: boolean = true, isDefaultPattern: boolean) => [
   {
     id: 'all',
     label: (
@@ -101,10 +103,12 @@ const getEventTypeOptions = (isCustomDisabled: boolean = true) => [
   {
     id: 'raw',
     label: <EuiHealth color="subdued"> {i18n.RAW_EVENT}</EuiHealth>,
+    disabled: !isDefaultPattern,
   },
   {
     id: 'alert',
     label: <EuiHealth color="warning"> {i18n.DETECTION_ALERTS_EVENT}</EuiHealth>,
+    disabled: !isDefaultPattern,
   },
   {
     id: 'custom',
@@ -115,9 +119,14 @@ const getEventTypeOptions = (isCustomDisabled: boolean = true) => [
 
 interface PickEventTypeProps {
   eventType: TimelineEventsType;
-  onChangeEventTypeAndIndexesName: (value: TimelineEventsType, indexNames: string[]) => void;
+  onChangeEventTypeAndIndexesName: (
+    value: TimelineEventsType,
+    indexNames: string[],
+    dataViewId: string
+  ) => void;
 }
 
+// AKA TimelineSourcerer
 const PickEventTypeComponents: React.FC<PickEventTypeProps> = ({
   eventType = 'all',
   onChangeEventTypeAndIndexesName,
@@ -125,81 +134,63 @@ const PickEventTypeComponents: React.FC<PickEventTypeProps> = ({
   const [isPopoverOpen, setPopover] = useState(false);
   const [showAdvanceSettings, setAdvanceSettings] = useState(eventType === 'custom');
   const [filterEventType, setFilterEventType] = useState<TimelineEventsType>(eventType);
-  const sourcererScopeSelector = useMemo(getSourcererScopeSelector, []);
-  const { configIndexPatterns, kibanaIndexPatterns, signalIndexName, sourcererScope } = useSelector<
-    State,
-    SourcererScopeSelector
-  >((state) => sourcererScopeSelector(state, SourcererScopeName.timeline), deepEqual);
-  const [selectedOptions, setSelectedOptions] = useState<Array<EuiComboBoxOptionOption<string>>>(
-    sourcererScope.selectedPatterns.map((indexSelected) => ({
-      label: indexSelected,
-      value: indexSelected,
-    }))
+  const sourcererScopeSelector = useMemo(() => sourcererSelectors.getSourcererScopeSelector(), []);
+  const {
+    defaultDataView,
+    kibanaDataViews,
+    signalIndexName,
+    sourcererScope: { loading, selectedPatterns, selectedDataViewId },
+  }: sourcererSelectors.SourcererScopeSelector = useDeepEqualSelector((state) =>
+    sourcererScopeSelector(state, SourcererScopeName.timeline)
   );
 
-  const indexesPatternOptions = useMemo(
-    () =>
-      [
-        ...configIndexPatterns,
-        ...kibanaIndexPatterns.map((kip) => kip.title),
-        signalIndexName,
-      ].reduce<Array<EuiComboBoxOptionOption<string>>>((acc, index) => {
-        if (index != null && !acc.some((o) => o.label === index)) {
-          return [...acc, { label: index, value: index }];
+  const [dataViewId, setDataViewId] = useState<string>(selectedDataViewId ?? '');
+  const { patternList, selectablePatterns } = useMemo(() => {
+    const theDataView = kibanaDataViews.find((dataView) => dataView.id === dataViewId);
+    return theDataView != null
+      ? {
+          patternList: theDataView.title
+            .split(',')
+            // remove duplicates patterns from selector
+            .filter((pattern, i, self) => self.indexOf(pattern) === i),
+          selectablePatterns: theDataView.patternList,
         }
-        return acc;
-      }, []),
-    [configIndexPatterns, kibanaIndexPatterns, signalIndexName]
-  );
-
-  const renderOption = useCallback(
-    ({ value }) => {
-      if (kibanaIndexPatterns.some((kip) => kip.title === value)) {
-        return (
-          <span data-test-subj="sourcerer-option">
-            <EuiIcon type="logoKibana" size="s" /> {value}
-          </span>
-        );
-      }
-      return <span data-test-subj="sourcerer-option">{value}</span>;
-    },
-    [kibanaIndexPatterns]
+      : { patternList: [], selectablePatterns: [] };
+  }, [kibanaDataViews, dataViewId]);
+  const [selectedOptions, setSelectedOptions] = useState<Array<EuiComboBoxOptionOption<string>>>(
+    selectedPatterns.map((indexName) => ({
+      label: indexName,
+      value: indexName,
+    }))
   );
-
-  const onChangeCombo = useCallback(
-    (newSelectedOptions: Array<EuiComboBoxOptionOption<string>>) => {
-      const localSelectedPatterns = newSelectedOptions.map((nso) => nso.label);
-      if (
-        localSelectedPatterns.sort().join() ===
-        [...configIndexPatterns, signalIndexName].sort().join()
-      ) {
-        setFilterEventType('all');
-      } else if (localSelectedPatterns.sort().join() === configIndexPatterns.sort().join()) {
-        setFilterEventType('raw');
-      } else if (localSelectedPatterns.sort().join() === signalIndexName) {
-        setFilterEventType('alert');
-      } else {
-        setFilterEventType('custom');
-      }
-
-      setSelectedOptions(newSelectedOptions);
-    },
-    [configIndexPatterns, signalIndexName]
+  const isSavingDisabled = useMemo(() => selectedOptions.length === 0, [selectedOptions]);
+  const selectableOptions = useMemo(
+    () =>
+      patternList.map((indexName) => ({
+        label: indexName,
+        value: indexName,
+        'data-test-subj': 'sourcerer-option',
+        disabled: !selectablePatterns.includes(indexName),
+      })),
+    [selectablePatterns, patternList]
   );
 
   const onChangeFilter = useCallback(
     (filter) => {
       setFilterEventType(filter);
-      if (filter === 'all') {
+      if (filter === 'all' || filter === 'kibana') {
         setSelectedOptions(
-          [...configIndexPatterns.sort(), signalIndexName ?? ''].map((indexSelected) => ({
+          selectablePatterns.map((indexSelected) => ({
             label: indexSelected,
             value: indexSelected,
           }))
         );
       } else if (filter === 'raw') {
         setSelectedOptions(
-          configIndexPatterns.sort().map((indexSelected) => ({
+          (signalIndexName == null
+            ? selectablePatterns
+            : selectablePatterns.filter((index) => index !== signalIndexName)
+          ).map((indexSelected) => ({
             label: indexSelected,
             value: indexSelected,
           }))
@@ -211,16 +202,56 @@ const PickEventTypeComponents: React.FC<PickEventTypeProps> = ({
             value: signalIndexName ?? '',
           },
         ]);
-      } else if (filter === 'kibana') {
-        setSelectedOptions(
-          kibanaIndexPatterns.map((kip) => ({
-            label: kip.title,
-            value: kip.title,
-          }))
-        );
       }
     },
-    [configIndexPatterns, kibanaIndexPatterns, signalIndexName]
+    [selectablePatterns, signalIndexName]
+  );
+
+  const onChangeCombo = useCallback(
+    (newSelectedOptions: Array<EuiComboBoxOptionOption<string>>) => {
+      const localSelectedPatterns = newSelectedOptions
+        .map((nso) => nso.label)
+        .sort()
+        .join();
+      if (localSelectedPatterns === selectablePatterns.sort().join()) {
+        setFilterEventType('all');
+      } else if (
+        dataViewId === defaultDataView.id &&
+        localSelectedPatterns ===
+          selectablePatterns
+            .filter((index) => index !== signalIndexName)
+            .sort()
+            .join()
+      ) {
+        setFilterEventType('raw');
+      } else if (dataViewId === defaultDataView.id && localSelectedPatterns === signalIndexName) {
+        setFilterEventType('alert');
+      } else {
+        setFilterEventType('custom');
+      }
+
+      setSelectedOptions(newSelectedOptions);
+    },
+    [defaultDataView.id, dataViewId, selectablePatterns, signalIndexName]
+  );
+
+  const onChangeSuper = useCallback(
+    (newSelectedOption) => {
+      setFilterEventType('all');
+      setDataViewId(newSelectedOption);
+      setSelectedOptions(
+        getScopePatternListSelection(
+          kibanaDataViews.find((dataView) => dataView.id === newSelectedOption),
+          SourcererScopeName.timeline,
+          signalIndexName,
+          newSelectedOption === defaultDataView.id
+        ).map((indexSelected: string) => ({
+          label: indexSelected,
+          value: indexSelected,
+        }))
+      );
+    },
+    [defaultDataView.id, kibanaDataViews, signalIndexName]
   );
 
   const togglePopover = useCallback(
@@ -233,66 +264,69 @@ const PickEventTypeComponents: React.FC<PickEventTypeProps> = ({
   const handleSaveIndices = useCallback(() => {
     onChangeEventTypeAndIndexesName(
       filterEventType,
-      selectedOptions.map((so) => so.label)
+      selectedOptions.map((so) => so.label),
+      dataViewId
     );
     setPopover(false);
-  }, [filterEventType, onChangeEventTypeAndIndexesName, selectedOptions]);
+  }, [dataViewId, filterEventType, onChangeEventTypeAndIndexesName, selectedOptions]);
 
   const resetDataSources = useCallback(() => {
-    onChangeFilter('all');
-  }, [onChangeFilter]);
+    setDataViewId(defaultDataView.id);
+    setSelectedOptions(
+      getScopePatternListSelection(
+        defaultDataView,
+        SourcererScopeName.timeline,
+        signalIndexName,
+        true
+      ).map((indexSelected: string) => ({
+        label: indexSelected,
+        value: indexSelected,
+      }))
+    );
+    setFilterEventType(eventType);
+  }, [defaultDataView, eventType, signalIndexName]);
 
-  const comboBox = useMemo(
-    () => (
-      <EuiComboBox
-        data-test-subj="timeline-sourcerer"
-        fullWidth
-        onChange={onChangeCombo}
-        options={indexesPatternOptions}
-        placeholder={i18n.PICK_INDEX_PATTERNS}
-        renderOption={renderOption}
-        selectedOptions={selectedOptions}
-      />
-    ),
-    [onChangeCombo, indexesPatternOptions, renderOption, selectedOptions]
+  const dataViewSelectOptions = useMemo(
+    () =>
+      kibanaDataViews.map(({ title, id }) => ({
+        inputDisplay:
+          id === defaultDataView.id ? (
+            <span data-test-subj="dataView-option-super">
+              <EuiIcon type="logoSecurity" size="s" /> {SIEM_DATA_VIEW_LABEL}
+            </span>
+          ) : (
+            <span data-test-subj="dataView-option-super">
+              <EuiIcon type="logoKibana" size="s" /> {title}
+            </span>
+          ),
+        value: id,
+      })),
+    [defaultDataView.id, kibanaDataViews]
   );
 
   const filterOptions = useMemo(
-    () => getEventTypeOptions(filterEventType !== 'custom'),
-    [filterEventType]
-  );
-
-  const filter = useMemo(
-    () => (
-      <Filter
-        data-test-subj="timeline-sourcerer-radio"
-        options={filterOptions}
-        idSelected={filterEventType}
-        onChange={onChangeFilter}
-        name={i18n.SELECT_INDEX_PATTERNS}
-      />
-    ),
-    [filterEventType, filterOptions, onChangeFilter]
+    () => getEventTypeOptions(filterEventType !== 'custom', dataViewId === defaultDataView.id),
+    [defaultDataView.id, filterEventType, dataViewId]
   );
 
   const button = useMemo(() => {
-    const options = getEventTypeOptions();
+    const options = getEventTypeOptions(true, dataViewId === defaultDataView.id);
     return (
       <MyEuiButton
         data-test-subj="sourcerer-timeline-trigger"
         iconType="arrowDown"
         iconSide="right"
-        isLoading={sourcererScope.loading}
+        isLoading={loading}
         onClick={togglePopover}
       >
         {options.find((opt) => opt.id === eventType)?.label}
       </MyEuiButton>
     );
-  }, [eventType, sourcererScope.loading, togglePopover]);
+  }, [defaultDataView.id, eventType, dataViewId, loading, togglePopover]);
 
   const tooltipContent = useMemo(
-    () => (isPopoverOpen ? null : sourcererScope.selectedPatterns.sort().join(', ')),
-    [isPopoverOpen, sourcererScope.selectedPatterns]
+    () => (isPopoverOpen ? null : selectedPatterns.sort().join(', ')),
+    [isPopoverOpen, selectedPatterns]
   );
 
   const buttonWithTooptip = useMemo(() => {
@@ -321,7 +355,7 @@ const PickEventTypeComponents: React.FC<PickEventTypeProps> = ({
   );
 
   useEffect(() => {
-    const newSelectedOptions = sourcererScope.selectedPatterns.map((indexSelected) => ({
+    const newSelectedOptions = selectedPatterns.map((indexSelected) => ({
       label: indexSelected,
       value: indexSelected,
     }));
@@ -331,7 +365,7 @@ const PickEventTypeComponents: React.FC<PickEventTypeProps> = ({
       }
       return prevSelectedOptions;
     });
-  }, [sourcererScope.selectedPatterns]);
+  }, [selectedPatterns]);
 
   useEffect(() => {
     setFilterEventType((prevFilter) => (prevFilter !== eventType ? eventType : prevFilter));
@@ -352,9 +386,16 @@ const PickEventTypeComponents: React.FC<PickEventTypeProps> = ({
             <>{i18n.SELECT_INDEX_PATTERNS}</>
           </EuiPopoverTitle>
           <EuiSpacer size="s" />
-          {filter}
+          <Filter
+            data-test-subj="timeline-sourcerer-radio"
+            options={filterOptions}
+            idSelected={filterEventType}
+            onChange={onChangeFilter}
+            name={i18n.SELECT_INDEX_PATTERNS}
+          />
           <EuiSpacer size="m" />
           <EuiAccordion
+            data-test-subj="sourcerer-accordion"
             id="accordion1"
             forceState={showAdvanceSettings ? 'open' : 'closed'}
             buttonContent={ButtonContent}
@@ -362,7 +403,23 @@ const PickEventTypeComponents: React.FC<PickEventTypeProps> = ({
           >
             <>
               <EuiSpacer size="s" />
-              {comboBox}
+              <EuiSuperSelect
+                data-test-subj="sourcerer-select"
+                placeholder={i18n.PICK_INDEX_PATTERNS}
+                fullWidth
+                options={dataViewSelectOptions}
+                valueOfSelected={dataViewId}
+                onChange={onChangeSuper}
+              />
+              <EuiSpacer size="xs" />
+              <EuiComboBox
+                data-test-subj="timeline-sourcerer"
+                fullWidth
+                onChange={onChangeCombo}
+                options={selectableOptions}
+                placeholder={i18n.PICK_INDEX_PATTERNS}
+                selectedOptions={selectedOptions}
+              />
             </>
           </EuiAccordion>
           {!showAdvanceSettings && (
@@ -389,7 +446,8 @@ const PickEventTypeComponents: React.FC<PickEventTypeProps> = ({
             <EuiFlexItem grow={false}>
               <EuiButton
                 onClick={handleSaveIndices}
-                data-test-subj="add-index"
+                data-test-subj="sourcerer-save"
+                disabled={isSavingDisabled}
                 fill
                 fullWidth
                 size="s"
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/search_or_filter/selectors.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/search_or_filter/selectors.tsx
deleted file mode 100644
index 529d298cc7443..0000000000000
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/search_or_filter/selectors.tsx
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { State } from '../../../../common/store';
-import { sourcererSelectors } from '../../../../common/store/selectors';
-import {
-  KibanaIndexPatterns,
-  ManageScope,
-  SourcererScopeName,
-} from '../../../../common/store/sourcerer/model';
-
-export interface SourcererScopeSelector {
-  configIndexPatterns: string[];
-  kibanaIndexPatterns: KibanaIndexPatterns;
-  signalIndexName: string | null;
-  sourcererScope: ManageScope;
-}
-
-export const getSourcererScopeSelector = () => {
-  const getkibanaIndexPatternsSelector = sourcererSelectors.kibanaIndexPatternsSelector();
-  const getScopeIdSelector = sourcererSelectors.scopeIdSelector();
-  const getConfigIndexPatternsSelector = sourcererSelectors.configIndexPatternsSelector();
-  const getSignalIndexNameSelector = sourcererSelectors.signalIndexNameSelector();
-
-  const mapStateToProps = (state: State, scopeId: SourcererScopeName): SourcererScopeSelector => {
-    const kibanaIndexPatterns = getkibanaIndexPatternsSelector(state);
-    const scope = getScopeIdSelector(state, scopeId);
-    const configIndexPatterns = getConfigIndexPatternsSelector(state);
-    const signalIndexName = getSignalIndexNameSelector(state);
-
-    return {
-      kibanaIndexPatterns,
-      configIndexPatterns,
-      signalIndexName,
-      sourcererScope: scope,
-    };
-  };
-
-  return mapStateToProps;
-};
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/details/index.tsx b/x-pack/plugins/security_solution/public/timelines/containers/details/index.tsx
index f05966bd97870..ac96cc334f795 100644
--- a/x-pack/plugins/security_solution/public/timelines/containers/details/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/containers/details/index.tsx
@@ -10,6 +10,7 @@ import { useCallback, useEffect, useRef, useState } from 'react';
 import deepEqual from 'fast-deep-equal';
 import { Subscription } from 'rxjs';
 
+import { MappingRuntimeFields } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import { inputsModel } from '../../../common/store';
 import { useKibana } from '../../../common/lib/kibana';
 import {
@@ -33,6 +34,7 @@ export interface UseTimelineEventsDetailsProps {
   docValueFields: DocValueFields[];
   indexName: string;
   eventId: string;
+  runtimeMappings: MappingRuntimeFields;
   skip: boolean;
 }
 
@@ -41,6 +43,7 @@ export const useTimelineEventsDetails = ({
   docValueFields,
   indexName,
   eventId,
+  runtimeMappings,
   skip,
 }: UseTimelineEventsDetailsProps): [boolean, EventsArgs['detailsData'], object | undefined] => {
   const { data } = useKibana().services;
@@ -112,13 +115,14 @@ export const useTimelineEventsDetails = ({
         indexName,
         eventId,
         factoryQueryType: TimelineEventsQueries.details,
+        runtimeMappings,
       };
       if (!deepEqual(prevRequest, myRequest)) {
         return myRequest;
       }
       return prevRequest;
     });
-  }, [docValueFields, entityType, eventId, indexName]);
+  }, [docValueFields, entityType, eventId, indexName, runtimeMappings]);
 
   useEffect(() => {
     timelineDetailsSearch(timelineDetailsRequest);
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/containers/index.test.tsx
index 62846eb01e60f..c6ae5d50abd37 100644
--- a/x-pack/plugins/security_solution/public/timelines/containers/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/containers/index.test.tsx
@@ -113,6 +113,7 @@ describe('useTimelineEvents', () => {
     filterQuery: '',
     startDate: '',
     limit: 25,
+    runtimeMappings: {},
     sort: initSortDefault,
     skip: false,
   };
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/index.tsx b/x-pack/plugins/security_solution/public/timelines/containers/index.tsx
index 4ccb90b0ee5ae..c755159dd6b10 100644
--- a/x-pack/plugins/security_solution/public/timelines/containers/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/containers/index.tsx
@@ -11,6 +11,7 @@ import { useCallback, useEffect, useRef, useState } from 'react';
 import { useDispatch } from 'react-redux';
 import { Subscription } from 'rxjs';
 
+import { MappingRuntimeFields } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import { ESQuery } from '../../../common/typed_json';
 import { isCompleteResponse, isErrorResponse } from '../../../../../../src/plugins/data/public';
 import { useIsExperimentalFeatureEnabled } from '../../common/hooks/use_experimental_features';
@@ -74,15 +75,16 @@ type TimelineResponse<T extends KueryFilterQueryKind> = T extends 'kuery'
 
 export interface UseTimelineEventsProps {
   docValueFields?: DocValueFields[];
-  filterQuery?: ESQuery | string;
-  skip?: boolean;
   endDate: string;
   eqlOptions?: EqlOptionsSelected;
-  id: string;
   fields: string[];
+  filterQuery?: ESQuery | string;
+  id: string;
   indexNames: string[];
   language?: KueryFilterQueryKind;
   limit: number;
+  runtimeMappings: MappingRuntimeFields;
+  skip?: boolean;
   sort?: TimelineRequestSortField[];
   startDate: string;
   timerangeKind?: 'absolute' | 'relative';
@@ -131,6 +133,7 @@ export const useTimelineEvents = ({
   indexNames,
   fields,
   filterQuery,
+  runtimeMappings,
   startDate,
   language = 'kuery',
   limit,
@@ -341,6 +344,7 @@ export const useTimelineEvents = ({
         querySize: prevRequest?.pagination.querySize ?? 0,
         sort: prevRequest?.sort ?? initSortDefault,
         timerange: prevRequest?.timerange ?? {},
+        runtimeMappings: prevRequest?.runtimeMappings ?? {},
         ...deStructureEqlOptions(prevEqlRequest),
       };
 
@@ -354,6 +358,7 @@ export const useTimelineEvents = ({
           from: startDate,
           to: endDate,
         },
+        runtimeMappings,
         ...deStructureEqlOptions(eqlOptions),
       };
 
@@ -373,6 +378,7 @@ export const useTimelineEvents = ({
           querySize: limit,
         },
         language,
+        runtimeMappings,
         sort,
         timerange: {
           interval: '12h',
@@ -411,6 +417,7 @@ export const useTimelineEvents = ({
     startDate,
     sort,
     fields,
+    runtimeMappings,
   ]);
 
   useEffect(() => {
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/kpis/index.tsx b/x-pack/plugins/security_solution/public/timelines/containers/kpis/index.tsx
index f32b4df2c4684..3b13c261f970c 100644
--- a/x-pack/plugins/security_solution/public/timelines/containers/kpis/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/containers/kpis/index.tsx
@@ -15,7 +15,7 @@ import { useKibana } from '../../../common/lib/kibana';
 import {
   DocValueFields,
   TimelineEventsQueries,
-  TimelineRequestBasicOptions,
+  TimelineKpiStrategyRequest,
   TimelineKpiStrategyResponse,
   TimerangeInput,
 } from '../../../../common/search_strategy';
@@ -44,7 +44,7 @@ export const useTimelineKpis = ({
   const abortCtrl = useRef(new AbortController());
   const searchSubscription$ = useRef(new Subscription());
   const [loading, setLoading] = useState(false);
-  const [timelineKpiRequest, setTimelineKpiRequest] = useState<TimelineRequestBasicOptions | null>(
+  const [timelineKpiRequest, setTimelineKpiRequest] = useState<TimelineKpiStrategyRequest | null>(
     null
   );
   const [timelineKpiResponse, setTimelineKpiResponse] =
@@ -52,7 +52,7 @@ export const useTimelineKpis = ({
   const { addError, addWarning } = useAppToasts();
 
   const timelineKpiSearch = useCallback(
-    (request: TimelineRequestBasicOptions | null) => {
+    (request: TimelineKpiStrategyRequest | null) => {
       if (request == null) {
         return;
       }
@@ -61,7 +61,7 @@ export const useTimelineKpis = ({
         setLoading(true);
 
         searchSubscription$.current = data.search
-          .search<TimelineRequestBasicOptions, TimelineKpiStrategyResponse>(request, {
+          .search<TimelineKpiStrategyRequest, TimelineKpiStrategyResponse>(request, {
             strategy: 'timelineSearchStrategy',
             abortSignal: abortCtrl.current.signal,
           })
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/local_storage/index.tsx b/x-pack/plugins/security_solution/public/timelines/containers/local_storage/index.tsx
index dd60656933ba8..c44d1351b0830 100644
--- a/x-pack/plugins/security_solution/public/timelines/containers/local_storage/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/containers/local_storage/index.tsx
@@ -123,4 +123,4 @@ export const useTimelinesStorage = (): TimelinesStorage => {
   return { getAllTimelines, getTimelineById, addTimeline };
 };
 
-export { TimelinesStorage };
+export type { TimelinesStorage };
diff --git a/x-pack/plugins/security_solution/public/timelines/pages/timelines_page.test.tsx b/x-pack/plugins/security_solution/public/timelines/pages/timelines_page.test.tsx
index 597ff25246d94..7a36f7296eff3 100644
--- a/x-pack/plugins/security_solution/public/timelines/pages/timelines_page.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/pages/timelines_page.test.tsx
@@ -27,7 +27,7 @@ jest.mock('../../common/containers/sourcerer', () => {
 
   return {
     ...originalModule,
-    useSourcererScope: jest.fn().mockReturnValue({
+    useSourcererDataView: jest.fn().mockReturnValue({
       indicesExist: true,
     }),
   };
diff --git a/x-pack/plugins/security_solution/public/timelines/pages/timelines_page.tsx b/x-pack/plugins/security_solution/public/timelines/pages/timelines_page.tsx
index f79d513380349..3a9b9b0d2693e 100644
--- a/x-pack/plugins/security_solution/public/timelines/pages/timelines_page.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/pages/timelines_page.tsx
@@ -22,7 +22,7 @@ import { NewTemplateTimeline } from '../components/timeline/properties/new_templ
 import { NewTimeline } from '../components/timeline/properties/helpers';
 import * as i18n from './translations';
 import { SecurityPageName } from '../../app/types';
-import { useSourcererScope } from '../../common/containers/sourcerer';
+import { useSourcererDataView } from '../../common/containers/sourcerer';
 
 const TimelinesContainer = styled.div`
   width: 100%;
@@ -36,7 +36,7 @@ export const TimelinesPageComponent: React.FC = () => {
   const onImportTimelineBtnClick = useCallback(() => {
     setImportDataModalToggle(true);
   }, [setImportDataModalToggle]);
-  const { indicesExist } = useSourcererScope();
+  const { indicesExist } = useSourcererDataView();
 
   const capabilitiesCanUserCRUD: boolean =
     !!useKibana().services.application.capabilities.siem.crud;
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/actions.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/actions.ts
index f3a70bd1390ae..6002a7b2cf398 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/actions.ts
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/actions.ts
@@ -193,10 +193,11 @@ export const setExcludedRowRendererIds = actionCreator<{
   excludedRowRendererIds: RowRendererId[];
 }>('SET_TIMELINE_EXCLUDED_ROW_RENDERER_IDS');
 
-export const updateIndexNames = actionCreator<{
+export const updateDataView = actionCreator<{
   id: string;
+  dataViewId: string;
   indexNames: string[];
-}>('UPDATE_INDEXES_NAME');
+}>('UPDATE_DATA_VIEW');
 
 export const setActiveTabTimeline = actionCreator<{
   id: string;
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/defaults.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/defaults.ts
index 4c2b8d2992d3d..a7d87bc98c048 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/defaults.ts
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/defaults.ts
@@ -22,6 +22,7 @@ export const timelineDefaults: SubsetTimelineModel &
   documentType: '',
   defaultColumns: defaultHeaders,
   dataProviders: [],
+  dataViewId: '',
   dateRange: { start, end },
   deletedEventIds: [],
   description: '',
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/epic.test.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/epic.test.ts
index d45ba26c0e12a..175e6804c04a1 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/epic.test.ts
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/epic.test.ts
@@ -89,6 +89,7 @@ describe('Epic Timeline', () => {
             ],
           },
         ],
+        dataViewId: '',
         deletedEventIds: [],
         description: '',
         documentType: '',
@@ -238,6 +239,7 @@ describe('Epic Timeline', () => {
             },
           },
         ],
+        dataViewId: '',
         dateRange: {
           end: '2019-10-31T21:06:27.644Z',
           start: '2019-10-30T21:06:27.644Z',
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/epic.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/epic.ts
index 164f293edee65..c973cf9a5bbbf 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/epic.ts
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/epic.ts
@@ -65,7 +65,7 @@ import {
   updateRange,
   updateSort,
   upsertColumn,
-  updateIndexNames,
+  updateDataView,
   updateTimeline,
   updateTitleAndDescription,
   updateAutoSaveMsg,
@@ -109,7 +109,7 @@ const timelineActionsType = [
   updateProviders.type,
   updateTitleAndDescription.type,
 
-  updateIndexNames.type,
+  updateDataView.type,
   removeColumn.type,
   updateColumns.type,
   updateSort.type,
@@ -326,6 +326,7 @@ export const createTimelineEpic =
 const timelineInput: TimelineInput = {
   columns: null,
   dataProviders: null,
+  dataViewId: null,
   description: null,
   eqlOptions: null,
   eventType: null,
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/model.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/model.ts
index 29b49197ef797..18b6566b13b6c 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/model.ts
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/model.ts
@@ -85,6 +85,7 @@ export type SubsetTimelineModel = Readonly<
     | 'columns'
     | 'defaultColumns'
     | 'dataProviders'
+    | 'dataViewId'
     | 'deletedEventIds'
     | 'description'
     | 'documentType'
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/reducer.test.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/reducer.test.ts
index 639d1b1e4f489..50992cf7b21de 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/reducer.test.ts
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/reducer.test.ts
@@ -85,6 +85,7 @@ const basicTimeline: TimelineModel = {
   columns: [],
   defaultColumns: [],
   dataProviders: [{ ...basicDataProvider }],
+  dataViewId: '',
   dateRange: {
     start: '2020-07-07T08:20:18.966Z',
     end: '2020-07-08T08:20:18.966Z',
@@ -219,6 +220,7 @@ describe('Timeline', () => {
       const update = addNewTimeline({
         id: 'bar',
         columns: defaultHeaders,
+        dataViewId: '',
         indexNames: [],
         timelineById: timelineByIdMock,
         timelineType: TimelineType.default,
@@ -230,6 +232,7 @@ describe('Timeline', () => {
       const update = addNewTimeline({
         id: 'bar',
         columns: timelineDefaults.columns,
+        dataViewId: '',
         indexNames: [],
         timelineById: timelineByIdMock,
         timelineType: TimelineType.default,
@@ -247,6 +250,7 @@ describe('Timeline', () => {
       const update = addNewTimeline({
         id: 'bar',
         columns: defaultHeaders,
+        dataViewId: '',
         indexNames: [],
         timelineById: timelineByIdMock,
         timelineType: TimelineType.default,
diff --git a/x-pack/plugins/security_solution/public/timelines/store/timeline/reducer.ts b/x-pack/plugins/security_solution/public/timelines/store/timeline/reducer.ts
index e997bbd848d50..6a3aa68908bb5 100644
--- a/x-pack/plugins/security_solution/public/timelines/store/timeline/reducer.ts
+++ b/x-pack/plugins/security_solution/public/timelines/store/timeline/reducer.ts
@@ -34,7 +34,7 @@ import {
   updateDataProviderKqlQuery,
   updateDataProviderType,
   updateEventType,
-  updateIndexNames,
+  updateDataView,
   updateIsFavorite,
   updateIsLive,
   updateKqlMode,
@@ -326,12 +326,13 @@ export const timelineReducer = reducerWithInitialState(initialTimelineState)
     ...state,
     insertTimeline,
   }))
-  .case(updateIndexNames, (state, { id, indexNames }) => ({
+  .case(updateDataView, (state, { id, dataViewId, indexNames }) => ({
     ...state,
     timelineById: {
       ...state.timelineById,
       [id]: {
         ...state.timelineById[id],
+        dataViewId,
         indexNames,
       },
     },
diff --git a/x-pack/plugins/security_solution/public/ueba/pages/details/index.tsx b/x-pack/plugins/security_solution/public/ueba/pages/details/index.tsx
index b7a994ffa7ca8..72122aba3c4aa 100644
--- a/x-pack/plugins/security_solution/public/ueba/pages/details/index.tsx
+++ b/x-pack/plugins/security_solution/public/ueba/pages/details/index.tsx
@@ -39,7 +39,7 @@ import { Display } from '../display';
 import { timelineSelectors } from '../../../timelines/store/timeline';
 import { TimelineId } from '../../../../common/types/timeline';
 import { timelineDefaults } from '../../../timelines/store/timeline/defaults';
-import { useSourcererScope } from '../../../common/containers/sourcerer';
+import { useSourcererDataView } from '../../../common/containers/sourcerer';
 import { useDeepEqualSelector, useShallowEqualSelector } from '../../../common/hooks/use_selector';
 import { useInvalidFilterQuery } from '../../../common/hooks/use_invalid_filter_query';
 import { SourcererScopeName } from '../../../common/store/sourcerer/model';
@@ -69,7 +69,7 @@ const UebaDetailsComponent: React.FC<UebaDetailsProps> = ({ detailName, uebaDeta
   );
   const getFilters = () => [...uebaDetailsPageFilters, ...filters];
 
-  const { docValueFields, indicesExist, indexPattern, selectedPatterns } = useSourcererScope(
+  const { docValueFields, indicesExist, indexPattern, selectedPatterns } = useSourcererDataView(
     SourcererScopeName.detections
   );
 
diff --git a/x-pack/plugins/security_solution/public/ueba/pages/details/types.ts b/x-pack/plugins/security_solution/public/ueba/pages/details/types.ts
index 976b033db5f5a..e46a128e15f85 100644
--- a/x-pack/plugins/security_solution/public/ueba/pages/details/types.ts
+++ b/x-pack/plugins/security_solution/public/ueba/pages/details/types.ts
@@ -6,7 +6,7 @@
  */
 
 import { ActionCreator } from 'typescript-fsa';
-import { Query, IIndexPattern, Filter } from 'src/plugins/data/public';
+import { DataViewBase, Filter, Query } from '@kbn/es-query';
 import { InputsModelId } from '../../../common/store/inputs/constants';
 import { UebaTableType } from '../../store/model';
 import { UebaQueryProps } from '../types';
@@ -54,7 +54,7 @@ export type UebaDetailsTabsProps = HostBodyComponentDispatchProps &
     indexNames: string[];
     pageFilters?: Filter[];
     filterQuery?: string;
-    indexPattern: IIndexPattern;
+    indexPattern: DataViewBase;
     type: uebaModel.UebaType;
   };
 
diff --git a/x-pack/plugins/security_solution/public/ueba/pages/ueba.tsx b/x-pack/plugins/security_solution/public/ueba/pages/ueba.tsx
index 4e0041a98454c..93e22efdba3dd 100644
--- a/x-pack/plugins/security_solution/public/ueba/pages/ueba.tsx
+++ b/x-pack/plugins/security_solution/public/ueba/pages/ueba.tsx
@@ -43,7 +43,7 @@ import {
 } from '../../timelines/components/timeline/helpers';
 import { timelineSelectors } from '../../timelines/store/timeline';
 import { timelineDefaults } from '../../timelines/store/timeline/defaults';
-import { useSourcererScope } from '../../common/containers/sourcerer';
+import { useSourcererDataView } from '../../common/containers/sourcerer';
 import { useDeepEqualSelector, useShallowEqualSelector } from '../../common/hooks/use_selector';
 import { useInvalidFilterQuery } from '../../common/hooks/use_invalid_filter_query';
 
@@ -78,7 +78,7 @@ const UebaComponent = () => {
   const { uiSettings } = useKibana().services;
   const tabsFilters = filters;
 
-  const { docValueFields, indicesExist, indexPattern, selectedPatterns } = useSourcererScope();
+  const { docValueFields, indicesExist, indexPattern, selectedPatterns } = useSourcererDataView();
   const [filterQuery, kqlError] = useMemo(
     () =>
       convertToBuildEsQuery({
diff --git a/x-pack/plugins/security_solution/server/client/client.ts b/x-pack/plugins/security_solution/server/client/client.ts
index 12a13e06c2ffe..e697331944012 100644
--- a/x-pack/plugins/security_solution/server/client/client.ts
+++ b/x-pack/plugins/security_solution/server/client/client.ts
@@ -6,22 +6,25 @@
  */
 
 import { ConfigType } from '../config';
-import { DEFAULT_PREVIEW_INDEX } from '../../common/constants';
+import { DEFAULT_DATA_VIEW_ID, DEFAULT_PREVIEW_INDEX } from '../../common/constants';
 
 export class AppClient {
   private readonly signalsIndex: string;
   private readonly spaceId: string;
   private readonly previewIndex: string;
+  private readonly sourcererDataViewId: string;
 
   constructor(_spaceId: string, private config: ConfigType) {
     const configuredSignalsIndex = this.config.signalsIndex;
 
     this.signalsIndex = `${configuredSignalsIndex}-${_spaceId}`;
     this.previewIndex = `${DEFAULT_PREVIEW_INDEX}-${_spaceId}`;
+    this.sourcererDataViewId = `${DEFAULT_DATA_VIEW_ID}-${_spaceId}`;
     this.spaceId = _spaceId;
   }
 
   public getSignalsIndex = (): string => this.signalsIndex;
   public getPreviewIndex = (): string => this.previewIndex;
+  public getSourcererDataViewId = (): string => this.sourcererDataViewId;
   public getSpaceId = (): string => this.spaceId;
 }
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/actions/status.test.ts b/x-pack/plugins/security_solution/server/endpoint/routes/actions/status.test.ts
index a8592f02691aa..e4dc9b049e2ba 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/actions/status.test.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/actions/status.test.ts
@@ -87,7 +87,10 @@ describe('Endpoint Action Status', () => {
         logFactory: loggingSystemMock.create(),
         service: endpointAppContextService,
         config: () => Promise.resolve(createMockConfig()),
-        experimentalFeatures: parseExperimentalConfigValue(createMockConfig().enableExperimental),
+        experimentalFeatures: {
+          ...parseExperimentalConfigValue(createMockConfig().enableExperimental),
+          pendingActionResponsesWithAck: true,
+        },
       });
 
       getPendingStatus = async (reqParams?: any): Promise<jest.Mocked<KibanaResponseFactory>> => {
@@ -451,4 +454,321 @@ describe('Endpoint Action Status', () => {
       });
     });
   });
+
+  describe('response (when pendingActionResponsesWithAck is FALSE)', () => {
+    let endpointAppContextService: EndpointAppContextService;
+
+    // convenience for calling the route and handler for action status
+    let getPendingStatus: (reqParams?: any) => Promise<jest.Mocked<KibanaResponseFactory>>;
+    // convenience for injecting mock responses for actions index and responses
+    let havingActionsAndResponses: (
+      actions: MockAction[],
+      responses: MockResponse[],
+      endpointResponses?: MockEndpointResponse[]
+    ) => void;
+
+    beforeEach(() => {
+      const esClientMock = elasticsearchServiceMock.createScopedClusterClient();
+      const routerMock = httpServiceMock.createRouter();
+      endpointAppContextService = new EndpointAppContextService();
+      endpointAppContextService.setup(createMockEndpointAppContextServiceSetupContract());
+      endpointAppContextService.start(createMockEndpointAppContextServiceStartContract());
+
+      registerActionStatusRoutes(routerMock, {
+        logFactory: loggingSystemMock.create(),
+        service: endpointAppContextService,
+        config: () => Promise.resolve(createMockConfig()),
+        experimentalFeatures: {
+          ...parseExperimentalConfigValue(createMockConfig().enableExperimental),
+          pendingActionResponsesWithAck: false,
+        },
+      });
+
+      getPendingStatus = async (reqParams?: any): Promise<jest.Mocked<KibanaResponseFactory>> => {
+        const req = httpServerMock.createKibanaRequest(reqParams);
+        const mockResponse = httpServerMock.createResponseFactory();
+        const [, routeHandler]: [
+          RouteConfig<any, any, any, any>,
+          RequestHandler<any, any, any, any>
+        ] = routerMock.get.mock.calls.find(([{ path }]) => path.startsWith(ACTION_STATUS_ROUTE))!;
+        await routeHandler(
+          createRouteHandlerContext(esClientMock, savedObjectsClientMock.create()),
+          req,
+          mockResponse
+        );
+
+        return mockResponse;
+      };
+
+      havingActionsAndResponses = (
+        actions: MockAction[],
+        responses: MockResponse[],
+        endpointResponses?: MockEndpointResponse[]
+      ) => {
+        esClientMock.asCurrentUser.search = jest.fn().mockImplementation((req) => {
+          const size = req.size ? req.size : 10;
+          const items: any[] =
+            req.index === '.fleet-actions'
+              ? actions.splice(0, size)
+              : req.index === '.logs-endpoint.action.responses' && !!endpointResponses
+              ? endpointResponses
+              : responses.splice(0, size);
+
+          if (items.length > 0) {
+            return Promise.resolve(mockSearchResult(items.map((x) => x.build())));
+          } else {
+            return Promise.resolve(mockSearchResult());
+          }
+        });
+      };
+    });
+
+    afterEach(() => {
+      endpointAppContextService.stop();
+    });
+
+    it('should include total counts for large (more than a page) action counts', async () => {
+      const mockID = 'XYZABC-000';
+      const actions = [];
+      for (let i = 0; i < 1400; i++) {
+        // putting more than a single page of results in
+        actions.push(aMockAction().withAgent(mockID));
+      }
+      havingActionsAndResponses(actions, []);
+
+      const response = await getPendingStatus({
+        query: {
+          agent_ids: [mockID],
+        },
+      });
+
+      expect(response.ok).toBeCalled();
+      expect((response.ok.mock.calls[0][0]?.body as any)?.data).toHaveLength(1);
+      expect((response.ok.mock.calls[0][0]?.body as any)?.data[0].agent_id).toEqual(mockID);
+      expect((response.ok.mock.calls[0][0]?.body as any)?.data[0].pending_actions.isolate).toEqual(
+        0
+      );
+    });
+    it('should include a total count of a pending action', async () => {
+      const mockID = 'XYZABC-000';
+      havingActionsAndResponses(
+        [
+          aMockAction().withAgent(mockID).withAction('isolate'),
+          aMockAction().withAgent(mockID).withAction('isolate'),
+        ],
+        []
+      );
+      const response = await getPendingStatus({
+        query: {
+          agent_ids: [mockID],
+        },
+      });
+      expect(response.ok).toBeCalled();
+      expect((response.ok.mock.calls[0][0]?.body as any)?.data).toHaveLength(1);
+      expect((response.ok.mock.calls[0][0]?.body as any)?.data[0].agent_id).toEqual(mockID);
+      expect((response.ok.mock.calls[0][0]?.body as any)?.data[0].pending_actions.isolate).toEqual(
+        0
+      );
+    });
+    it('should show multiple pending actions, and their counts', async () => {
+      const mockID = 'XYZABC-000';
+      havingActionsAndResponses(
+        [
+          aMockAction().withAgent(mockID).withAction('isolate'),
+          aMockAction().withAgent(mockID).withAction('isolate'),
+          aMockAction().withAgent(mockID).withAction('isolate'),
+          aMockAction().withAgent(mockID).withAction('unisolate'),
+          aMockAction().withAgent(mockID).withAction('unisolate'),
+        ],
+        []
+      );
+      const response = await getPendingStatus({
+        query: {
+          agent_ids: [mockID],
+        },
+      });
+      expect(response.ok).toBeCalled();
+      expect((response.ok.mock.calls[0][0]?.body as any)?.data).toHaveLength(1);
+      expect((response.ok.mock.calls[0][0]?.body as any)?.data[0].agent_id).toEqual(mockID);
+      expect((response.ok.mock.calls[0][0]?.body as any)?.data[0].pending_actions.isolate).toEqual(
+        0
+      );
+      expect(
+        (response.ok.mock.calls[0][0]?.body as any)?.data[0].pending_actions.unisolate
+      ).toEqual(0);
+    });
+    it('should calculate correct pending counts from grouped/bulked actions', async () => {
+      const mockID = 'XYZABC-000';
+      havingActionsAndResponses(
+        [
+          aMockAction()
+            .withAgents([mockID, 'IRRELEVANT-OTHER-AGENT', 'ANOTHER-POSSIBLE-AGENT'])
+            .withAction('isolate'),
+          aMockAction().withAgents([mockID, 'YET-ANOTHER-AGENT-ID']).withAction('isolate'),
+          aMockAction().withAgents(['YET-ANOTHER-AGENT-ID']).withAction('isolate'), // one WITHOUT our agent-under-test
+        ],
+        []
+      );
+      const response = await getPendingStatus({
+        query: {
+          agent_ids: [mockID],
+        },
+      });
+      expect(response.ok).toBeCalled();
+      expect((response.ok.mock.calls[0][0]?.body as any)?.data).toHaveLength(1);
+      expect((response.ok.mock.calls[0][0]?.body as any)?.data[0].agent_id).toEqual(mockID);
+      expect((response.ok.mock.calls[0][0]?.body as any)?.data[0].pending_actions.isolate).toEqual(
+        0
+      );
+    });
+
+    it('should exclude actions that have responses from the pending count', async () => {
+      const mockAgentID = 'XYZABC-000';
+      const actionID = 'some-known-actionid';
+      havingActionsAndResponses(
+        [
+          aMockAction().withAgent(mockAgentID).withAction('isolate'),
+          aMockAction().withAgent(mockAgentID).withAction('isolate').withID(actionID),
+        ],
+        [aMockResponse(actionID, mockAgentID)]
+      );
+      (endpointAppContextService.getEndpointMetadataService as jest.Mock) = jest
+        .fn()
+        .mockReturnValue({
+          findHostMetadataForFleetAgents: jest.fn().mockResolvedValue([]),
+        });
+      const response = await getPendingStatus({
+        query: {
+          agent_ids: [mockAgentID],
+        },
+      });
+      expect(response.ok).toBeCalled();
+      expect((response.ok.mock.calls[0][0]?.body as any)?.data).toHaveLength(1);
+      expect((response.ok.mock.calls[0][0]?.body as any)?.data[0].agent_id).toEqual(mockAgentID);
+      expect((response.ok.mock.calls[0][0]?.body as any)?.data[0].pending_actions.isolate).toEqual(
+        0
+      );
+    });
+    it('should have accurate counts for multiple agents, bulk actions, and responses', async () => {
+      const agentOne = 'XYZABC-000';
+      const agentTwo = 'DEADBEEF';
+      const agentThree = 'IDIDIDID';
+
+      const actionTwoID = 'ID-TWO';
+      havingActionsAndResponses(
+        [
+          aMockAction().withAgents([agentOne, agentTwo, agentThree]).withAction('isolate'),
+          aMockAction()
+            .withAgents([agentTwo, agentThree])
+            .withAction('isolate')
+            .withID(actionTwoID),
+          aMockAction().withAgents([agentThree]).withAction('isolate'),
+        ],
+        [aMockResponse(actionTwoID, agentThree)]
+      );
+      (endpointAppContextService.getEndpointMetadataService as jest.Mock) = jest
+        .fn()
+        .mockReturnValue({
+          findHostMetadataForFleetAgents: jest.fn().mockResolvedValue([]),
+        });
+      const response = await getPendingStatus({
+        query: {
+          agent_ids: [agentOne, agentTwo, agentThree],
+        },
+      });
+      expect(response.ok).toBeCalled();
+      expect((response.ok.mock.calls[0][0]?.body as any)?.data).toHaveLength(3);
+      expect((response.ok.mock.calls[0][0]?.body as any)?.data).toContainEqual({
+        agent_id: agentOne,
+        pending_actions: {
+          isolate: 0,
+        },
+      });
+      expect((response.ok.mock.calls[0][0]?.body as any)?.data).toContainEqual({
+        agent_id: agentTwo,
+        pending_actions: {
+          isolate: 0,
+        },
+      });
+      expect((response.ok.mock.calls[0][0]?.body as any)?.data).toContainEqual({
+        agent_id: agentThree,
+        pending_actions: {
+          isolate: 0,
+        },
+      });
+    });
+
+    describe('with endpoint response index', () => {
+      it('should include a total count of a pending action response', async () => {
+        const mockAgentId = 'XYZABC-000';
+        const actionIds = ['action_id_0', 'action_id_1'];
+        havingActionsAndResponses(
+          [
+            aMockAction().withAgent(mockAgentId).withAction('isolate').withID(actionIds[0]),
+            aMockAction().withAgent(mockAgentId).withAction('isolate').withID(actionIds[1]),
+          ],
+          [
+            aMockResponse(actionIds[0], mockAgentId, true),
+            aMockResponse(actionIds[1], mockAgentId, true),
+          ]
+        );
+        (endpointAppContextService.getEndpointMetadataService as jest.Mock) = jest
+          .fn()
+          .mockReturnValue({
+            findHostMetadataForFleetAgents: jest.fn().mockResolvedValue([]),
+          });
+        const response = await getPendingStatus({
+          query: {
+            agent_ids: [mockAgentId],
+          },
+        });
+        expect(response.ok).toBeCalled();
+        expect((response.ok.mock.calls[0][0]?.body as any)?.data).toHaveLength(1);
+        expect((response.ok.mock.calls[0][0]?.body as any)?.data[0].agent_id).toEqual(mockAgentId);
+        expect(
+          (response.ok.mock.calls[0][0]?.body as any)?.data[0].pending_actions.isolate
+        ).toEqual(0);
+      });
+
+      it('should show multiple pending action responses, and their counts', async () => {
+        const mockAgentID = 'XYZABC-000';
+        const actionIds = ['ack_0', 'ack_1', 'ack_2', 'ack_3', 'ack_4'];
+        havingActionsAndResponses(
+          [
+            aMockAction().withAgent(mockAgentID).withAction('isolate').withID(actionIds[0]),
+            aMockAction().withAgent(mockAgentID).withAction('isolate').withID(actionIds[1]),
+            aMockAction().withAgent(mockAgentID).withAction('isolate').withID(actionIds[2]),
+            aMockAction().withAgent(mockAgentID).withAction('unisolate').withID(actionIds[3]),
+            aMockAction().withAgent(mockAgentID).withAction('unisolate').withID(actionIds[4]),
+          ],
+          [
+            aMockResponse(actionIds[0], mockAgentID, true),
+            aMockResponse(actionIds[1], mockAgentID, true),
+            aMockResponse(actionIds[2], mockAgentID, true),
+            aMockResponse(actionIds[3], mockAgentID, true),
+            aMockResponse(actionIds[4], mockAgentID, true),
+          ]
+        );
+        (endpointAppContextService.getEndpointMetadataService as jest.Mock) = jest
+          .fn()
+          .mockReturnValue({
+            findHostMetadataForFleetAgents: jest.fn().mockResolvedValue([]),
+          });
+        const response = await getPendingStatus({
+          query: {
+            agent_ids: [mockAgentID],
+          },
+        });
+        expect(response.ok).toBeCalled();
+        expect((response.ok.mock.calls[0][0]?.body as any)?.data).toHaveLength(1);
+        expect((response.ok.mock.calls[0][0]?.body as any)?.data[0].agent_id).toEqual(mockAgentID);
+        expect(
+          (response.ok.mock.calls[0][0]?.body as any)?.data[0].pending_actions.isolate
+        ).toEqual(0);
+        expect(
+          (response.ok.mock.calls[0][0]?.body as any)?.data[0].pending_actions.unisolate
+        ).toEqual(0);
+      });
+    });
+  });
 });
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/actions/status.ts b/x-pack/plugins/security_solution/server/endpoint/routes/actions/status.ts
index 4ba03bf220c21..32c709aef2b87 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/actions/status.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/actions/status.ts
@@ -50,7 +50,8 @@ export const actionStatusRequestHandler = function (
     const response = await getPendingActionCounts(
       esClient,
       endpointContext.service.getEndpointMetadataService(),
-      agentIDs
+      agentIDs,
+      endpointContext.experimentalFeatures.pendingActionResponsesWithAck
     );
 
     return res.ok({
diff --git a/x-pack/plugins/security_solution/server/endpoint/services/actions.ts b/x-pack/plugins/security_solution/server/endpoint/services/actions.ts
index 5dcaca6c2c4cc..4dbfd700496f5 100644
--- a/x-pack/plugins/security_solution/server/endpoint/services/actions.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/services/actions.ts
@@ -186,7 +186,8 @@ export const getPendingActionCounts = async (
   esClient: ElasticsearchClient,
   metadataService: EndpointMetadataService,
   /** The Fleet Agent IDs to be checked */
-  agentIDs: string[]
+  agentIDs: string[],
+  isPendingActionResponsesWithAckEnabled: boolean
 ): Promise<EndpointPendingActions[]> => {
   // retrieve the unexpired actions for the given hosts
   const recentActions = await esClient
@@ -254,11 +255,17 @@ export const getPendingActionCounts = async (
       pending_actions: pendingActions
         .map((a) => a.data.command)
         .reduce((acc, cur) => {
-          if (cur in acc) {
-            acc[cur] += 1;
+          if (!isPendingActionResponsesWithAckEnabled) {
+            acc[cur] = 0; // set pending counts to 0 when FF is disabled
           } else {
-            acc[cur] = 1;
+            // else do the usual counting
+            if (cur in acc) {
+              acc[cur] += 1;
+            } else {
+              acc[cur] = 1;
+            }
           }
+
           return acc;
         }, {} as EndpointPendingActions['pending_actions']),
     });
diff --git a/x-pack/plugins/security_solution/server/index.ts b/x-pack/plugins/security_solution/server/index.ts
index 0adcd25f5e246..16a4992e68698 100644
--- a/x-pack/plugins/security_solution/server/index.ts
+++ b/x-pack/plugins/security_solution/server/index.ts
@@ -45,7 +45,8 @@ export const config: PluginConfigDescriptor<ConfigSchema> = {
   ],
 };
 
-export { ConfigType, Plugin, PluginSetup, PluginStart };
+export type { ConfigType, PluginSetup, PluginStart };
+export { Plugin };
 export { AppClient };
 export type { SecuritySolutionApiRequestHandlerContext } from './types';
 export { EndpointError } from './endpoint/errors';
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/__mocks__/threshold.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/__mocks__/threshold.ts
index 73029689deb19..e7ab48e807d54 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/__mocks__/threshold.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/__mocks__/threshold.ts
@@ -27,12 +27,12 @@ import { TypeOfFieldMap } from '../../../../../../rule_registry/common/field_map
 import { SERVER_APP_ID } from '../../../../../common/constants';
 import { ANCHOR_DATE } from '../../../../../common/detection_engine/schemas/response/rules_schema.mocks';
 import { getListArrayMock } from '../../../../../common/detection_engine/schemas/types/lists.mock';
-import { RulesFieldMap } from '../field_maps';
+import { RulesFieldMap } from '../../../../../common/field_maps';
 import {
   ALERT_ANCESTORS,
   ALERT_ORIGINAL_TIME,
   ALERT_ORIGINAL_EVENT,
-} from '../field_maps/field_names';
+} from '../../../../../common/field_maps/field_names';
 import { WrappedRACAlert } from '../types';
 
 export const mockThresholdResults = {
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/build_alert.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/build_alert.test.ts
index 39ee8788d3ee0..d6bad86456493 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/build_alert.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/build_alert.test.ts
@@ -31,14 +31,14 @@ import {
   ANCHOR_DATE,
 } from '../../../../../../common/detection_engine/schemas/response/rules_schema.mocks';
 import { getListArrayMock } from '../../../../../../common/detection_engine/schemas/types/lists.mock';
+import { SERVER_APP_ID } from '../../../../../../common/constants';
+import { EVENT_DATASET } from '../../../../../../common/cti/constants';
 import {
   ALERT_ANCESTORS,
+  ALERT_ORIGINAL_TIME,
   ALERT_DEPTH,
   ALERT_ORIGINAL_EVENT,
-  ALERT_ORIGINAL_TIME,
-} from '../../field_maps/field_names';
-import { SERVER_APP_ID } from '../../../../../../common/constants';
-import { EVENT_DATASET } from '../../../../../../common/cti/constants';
+} from '../../../../../../common/field_maps/field_names';
 
 type SignalDoc = SignalSourceHit & {
   _source: Required<SignalSourceHit>['_source'] & { [TIMESTAMP]: string };
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/build_alert.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/build_alert.ts
index bfd79d67bb74d..bf07d2bb8515f 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/build_alert.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/build_alert.ts
@@ -29,14 +29,14 @@ import {
   isWrappedSignalHit,
 } from '../../../signals/utils';
 import { RACAlert } from '../../types';
+import { SERVER_APP_ID } from '../../../../../../common/constants';
+import { SearchTypes } from '../../../../telemetry/types';
 import {
   ALERT_ANCESTORS,
   ALERT_DEPTH,
-  ALERT_ORIGINAL_EVENT,
   ALERT_ORIGINAL_TIME,
-} from '../../field_maps/field_names';
-import { SERVER_APP_ID } from '../../../../../../common/constants';
-import { SearchTypes } from '../../../../telemetry/types';
+  ALERT_ORIGINAL_EVENT,
+} from '../../../../../../common/field_maps/field_names';
 
 export const generateAlertId = (alert: RACAlert) => {
   return createHash('sha256')
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/build_alert_group_from_sequence.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/build_alert_group_from_sequence.test.ts
index 3f6d419e6ddd0..86b57b1ed1698 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/build_alert_group_from_sequence.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/build_alert_group_from_sequence.test.ts
@@ -11,15 +11,15 @@ import { ALERT_RULE_CONSUMER } from '@kbn/rule-data-utils';
 
 import { sampleDocNoSortId, sampleRuleGuid } from '../../../signals/__mocks__/es_results';
 import { buildAlertGroupFromSequence } from './build_alert_group_from_sequence';
+import { SERVER_APP_ID } from '../../../../../../common/constants';
+import { getCompleteRuleMock, getQueryRuleParams } from '../../../schemas/rule_schemas.mock';
+import { QueryRuleParams } from '../../../schemas/rule_schemas';
 import {
   ALERT_ANCESTORS,
-  ALERT_BUILDING_BLOCK_TYPE,
   ALERT_DEPTH,
+  ALERT_BUILDING_BLOCK_TYPE,
   ALERT_GROUP_ID,
-} from '../../field_maps/field_names';
-import { SERVER_APP_ID } from '../../../../../../common/constants';
-import { getCompleteRuleMock, getQueryRuleParams } from '../../../schemas/rule_schemas.mock';
-import { QueryRuleParams } from '../../../schemas/rule_schemas';
+} from '../../../../../../common/field_maps/field_names';
 
 const SPACE_ID = 'space';
 
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/build_alert_group_from_sequence.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/build_alert_group_from_sequence.ts
index 451f322f72799..23958451800b0 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/build_alert_group_from_sequence.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/build_alert_group_from_sequence.ts
@@ -19,12 +19,12 @@ import { EqlSequence } from '../../../../../../common/detection_engine/types';
 import { generateBuildingBlockIds } from './generate_building_block_ids';
 import { objectArrayIntersection } from '../../../signals/build_bulk_body';
 import { BuildReasonMessage } from '../../../signals/reason_formatters';
+import { CompleteRule, RuleParams } from '../../../schemas/rule_schemas';
 import {
   ALERT_BUILDING_BLOCK_TYPE,
   ALERT_GROUP_ID,
   ALERT_GROUP_INDEX,
-} from '../../field_maps/field_names';
-import { CompleteRule, RuleParams } from '../../../schemas/rule_schemas';
+} from '../../../../../../common/field_maps/field_names';
 
 /**
  * Takes N raw documents from ES that form a sequence and builds them into N+1 signals ready to be indexed -
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/generate_building_block_ids.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/generate_building_block_ids.ts
index 84e7f9e3ecef2..a603946b03d3b 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/generate_building_block_ids.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/generate_building_block_ids.ts
@@ -7,8 +7,8 @@
 
 import { ALERT_RULE_UUID } from '@kbn/rule-data-utils';
 import { createHash } from 'crypto';
+import { ALERT_ANCESTORS } from '../../../../../../common/field_maps/field_names';
 import { Ancestor } from '../../../signals/types';
-import { ALERT_ANCESTORS } from '../../field_maps/field_names';
 import { RACAlert } from '../../types';
 
 /**
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/types.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/types.ts
index 89c01f65b4156..d5b4d1f1eec77 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/types.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/types.ts
@@ -33,9 +33,9 @@ import {
   WrapHits,
   WrapSequences,
 } from '../signals/types';
-import { AlertsFieldMap, RulesFieldMap } from './field_maps';
 import { ExperimentalFeatures } from '../../../../common/experimental_features';
 import { IEventLogService } from '../../../../../event_log/server';
+import { AlertsFieldMap, RulesFieldMap } from '../../../../common/field_maps';
 
 export interface SecurityAlertTypeReturnValue<TState extends AlertTypeState> {
   bulkCreateTimes: string[];
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/create_rules_stream_from_ndjson.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/create_rules_stream_from_ndjson.test.ts
index f56d1d83eb873..434da08791c06 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/create_rules_stream_from_ndjson.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/create_rules_stream_from_ndjson.test.ts
@@ -10,6 +10,10 @@ import { createPromiseFromStreams } from '@kbn/utils';
 import { createRulesStreamFromNdJson } from './create_rules_stream_from_ndjson';
 import { BadRequestError } from '@kbn/securitysolution-es-utils';
 import { ImportRulesSchemaDecoded } from '../../../../common/detection_engine/schemas/request/import_rules_schema';
+import {
+  getOutputDetailsSample,
+  getSampleDetailsAsNdjson,
+} from '../../../../common/detection_engine/schemas/response/export_rules_details_schema.mock';
 
 type PromiseFromStreams = ImportRulesSchemaDecoded | Error;
 
@@ -202,12 +206,13 @@ describe('create_rules_stream_from_ndjson', () => {
     test('filters the export details entry from the stream', async () => {
       const sample1 = getOutputSample();
       const sample2 = getOutputSample();
+      const details = getOutputDetailsSample({ totalCount: 1, rulesCount: 1 });
       sample2.rule_id = 'rule-2';
       const ndJsonStream = new Readable({
         read() {
           this.push(getSampleAsNdjson(sample1));
           this.push(getSampleAsNdjson(sample2));
-          this.push('{"exported_rules_count":1,"missing_rules":[],"missing_rules_count":0}\n');
+          this.push(getSampleDetailsAsNdjson(details));
           this.push(null);
         },
       });
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/create_rules_stream_from_ndjson.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/create_rules_stream_from_ndjson.ts
index 799412a33ffbc..00dc6fe428ac7 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/create_rules_stream_from_ndjson.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/create_rules_stream_from_ndjson.ts
@@ -21,7 +21,6 @@ import {
 } from '../../../../common/detection_engine/schemas/request/import_rules_schema';
 import {
   parseNdjsonStrings,
-  filterExportedRulesCounts,
   filterExceptions,
   createLimitStream,
   filterExportedCounts,
@@ -62,7 +61,6 @@ export const createRulesStreamFromNdJson = (ruleLimit: number) => {
     createSplitStream('\n'),
     parseNdjsonStrings(),
     filterExportedCounts(),
-    filterExportedRulesCounts(),
     filterExceptions(),
     validateRules(),
     createLimitStream(ruleLimit),
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_all.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_all.test.ts
index 99f5f76be1a7c..304582378c2f1 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_all.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_all.test.ts
@@ -15,6 +15,10 @@ import { rulesClientMock } from '../../../../../alerting/server/mocks';
 import { getExportAll } from './get_export_all';
 import { getListArrayMock } from '../../../../common/detection_engine/schemas/types/lists.mock';
 import { getThreatMock } from '../../../../common/detection_engine/schemas/types/threat.mock';
+import {
+  getOutputDetailsSampleWithExceptions,
+  getSampleDetailsAsNdjson,
+} from '../../../../common/detection_engine/schemas/response/export_rules_details_schema.mock';
 
 import { getQueryRuleParams } from '../schemas/rule_schemas.mock';
 import { getExceptionListClientMock } from '../../../../../lists/server/services/exception_lists/exception_list_client.mock';
@@ -103,6 +107,7 @@ describe.each([
     expect(detailsJson).toEqual({
       exported_exception_list_count: 1,
       exported_exception_list_item_count: 1,
+      exported_count: 3,
       exported_rules_count: 1,
       missing_exception_list_item_count: 0,
       missing_exception_list_items: [],
@@ -121,6 +126,7 @@ describe.each([
       total: 0,
       data: [],
     };
+    const details = getOutputDetailsSampleWithExceptions();
 
     rulesClient.find.mockResolvedValue(findResult);
 
@@ -133,8 +139,7 @@ describe.each([
     );
     expect(exports).toEqual({
       rulesNdjson: '',
-      exportDetails:
-        '{"exported_rules_count":0,"missing_rules":[],"missing_rules_count":0,"exported_exception_list_count":0,"exported_exception_list_item_count":0,"missing_exception_list_item_count":0,"missing_exception_list_items":[],"missing_exception_lists":[],"missing_exception_lists_count":0}\n',
+      exportDetails: getSampleDetailsAsNdjson(details),
       exceptionLists: '',
     });
   });
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_by_object_ids.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_by_object_ids.test.ts
index 7aa55a8163e1a..0e07ac4e56a9f 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_by_object_ids.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_by_object_ids.test.ts
@@ -15,6 +15,10 @@ import {
 import { rulesClientMock } from '../../../../../alerting/server/mocks';
 import { getListArrayMock } from '../../../../common/detection_engine/schemas/types/lists.mock';
 import { getThreatMock } from '../../../../common/detection_engine/schemas/types/threat.mock';
+import {
+  getSampleDetailsAsNdjson,
+  getOutputDetailsSampleWithExceptions,
+} from '../../../../common/detection_engine/schemas/response/export_rules_details_schema.mock';
 import { getQueryRuleParams } from '../schemas/rule_schemas.mock';
 import { getExceptionListClientMock } from '../../../../../lists/server/services/exception_lists/exception_list_client.mock';
 
@@ -100,6 +104,7 @@ describe.each([
         exportDetails: {
           exported_exception_list_count: 0,
           exported_exception_list_item_count: 0,
+          exported_count: 1,
           exported_rules_count: 1,
           missing_exception_list_item_count: 0,
           missing_exception_list_items: [],
@@ -135,10 +140,13 @@ describe.each([
         logger,
         isRuleRegistryEnabled
       );
+      const details = getOutputDetailsSampleWithExceptions({
+        missingRules: [{ rule_id: 'rule-1' }],
+        missingCount: 1,
+      });
       expect(exports).toEqual({
         rulesNdjson: '',
-        exportDetails:
-          '{"exported_rules_count":0,"missing_rules":[{"rule_id":"rule-1"}],"missing_rules_count":1,"exported_exception_list_count":0,"exported_exception_list_item_count":0,"missing_exception_list_item_count":0,"missing_exception_list_items":[],"missing_exception_lists":[],"missing_exception_lists_count":0}\n',
+        exportDetails: getSampleDetailsAsNdjson(details),
         exceptionLists: '',
       });
     });
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_by_object_ids.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_by_object_ids.ts
index 81295c9197644..b8f1467cffe87 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_by_object_ids.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_by_object_ids.ts
@@ -72,7 +72,11 @@ export const getExportByObjectIds = async (
     exceptionDetails
   );
 
-  return { rulesNdjson, exportDetails, exceptionLists };
+  return {
+    rulesNdjson,
+    exportDetails,
+    exceptionLists,
+  };
 };
 
 export const getRulesFromObjects = async (
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_details_ndjson.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_details_ndjson.test.ts
index 171233a861466..e58d1b5088fce 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_details_ndjson.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_details_ndjson.test.ts
@@ -20,6 +20,7 @@ describe('getExportDetailsNdjson', () => {
     const details = getExportDetailsNdjson([rule]);
     const reParsed = JSON.parse(details);
     expect(reParsed).toEqual({
+      exported_count: 1,
       exported_rules_count: 1,
       missing_rules: [],
       missing_rules_count: 0,
@@ -31,6 +32,7 @@ describe('getExportDetailsNdjson', () => {
     const details = getExportDetailsNdjson([], [missingRule]);
     const reParsed = JSON.parse(details);
     expect(reParsed).toEqual({
+      exported_count: 0,
       exported_rules_count: 0,
       missing_rules: [{ rule_id: 'rule-1' }],
       missing_rules_count: 1,
@@ -49,6 +51,7 @@ describe('getExportDetailsNdjson', () => {
     const details = getExportDetailsNdjson([rule1, rule2], [missingRule1, missingRule2]);
     const reParsed = JSON.parse(details);
     expect(reParsed).toEqual({
+      exported_count: 2,
       exported_rules_count: 2,
       missing_rules: [missingRule1, missingRule2],
       missing_rules_count: 2,
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_details_ndjson.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_details_ndjson.ts
index 429bf4f2926bf..ad6b55272a52b 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_details_ndjson.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/get_export_details_ndjson.ts
@@ -5,18 +5,27 @@
  * 2.0.
  */
 
+import type { ExportExceptionDetails } from '@kbn/securitysolution-io-ts-list-types';
+
+import { ExportRulesDetails } from '../../../../common/detection_engine/schemas/response/export_rules_details_schema';
 import { RulesSchema } from '../../../../common/detection_engine/schemas/response/rules_schema';
 
 export const getExportDetailsNdjson = (
   rules: Array<Partial<RulesSchema>>,
   missingRules: Array<{ rule_id: string }> = [],
-  extraMeta: Record<string, number | string | string[]> = {}
+  exceptionDetails?: ExportExceptionDetails
 ): string => {
-  const stringified = JSON.stringify({
+  const stringified: ExportRulesDetails = {
+    exported_count:
+      exceptionDetails == null
+        ? rules.length
+        : rules.length +
+          exceptionDetails.exported_exception_list_count +
+          exceptionDetails.exported_exception_list_item_count,
     exported_rules_count: rules.length,
     missing_rules: missingRules,
     missing_rules_count: missingRules.length,
-    ...extraMeta,
-  });
-  return `${stringified}\n`;
+    ...exceptionDetails,
+  };
+  return `${JSON.stringify(stringified)}\n`;
 };
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_timelines/index.ndjson b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_timelines/index.ndjson
index a02951e55580c..6922cacd17b68 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_timelines/index.ndjson
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_timelines/index.ndjson
@@ -11,4 +11,4 @@
 {"savedObjectId":null,"version":null,"columns":[{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"@timestamp","searchable":null},{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"signal.rule.description","searchable":null},{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"event.action","searchable":null},{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"process.name","searchable":null},{"indexes":null,"aggregatable":true,"name":null,"description":"The working directory of the process.","columnHeaderType":"not-filtered","id":"process.working_directory","category":"process","type":"string","searchable":null,"example":"/home/alice"},{"indexes":null,"aggregatable":true,"name":null,"description":"Array of process arguments, starting with the absolute path to\nthe executable.\n\nMay be filtered to protect sensitive information.","columnHeaderType":"not-filtered","id":"process.args","category":"process","type":"string","searchable":null,"example":"[\"/usr/bin/ssh\",\"-l\",\"user\",\"10.0.0.16\"]"},{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"process.pid","searchable":null},{"indexes":null,"aggregatable":true,"name":null,"description":"Absolute path to the process executable.","columnHeaderType":"not-filtered","id":"process.parent.executable","category":"process","type":"string","searchable":null,"example":"/usr/bin/ssh"},{"indexes":null,"aggregatable":true,"name":null,"description":"Array of process arguments.\n\nMay be filtered to protect sensitive information.","columnHeaderType":"not-filtered","id":"process.parent.args","category":"process","type":"string","searchable":null,"example":"[\"ssh\",\"-l\",\"user\",\"10.0.0.16\"]"},{"indexes":null,"aggregatable":true,"name":null,"description":"Process id.","columnHeaderType":"not-filtered","id":"process.parent.pid","category":"process","type":"number","searchable":null,"example":"4242"},{"indexes":null,"aggregatable":true,"name":null,"description":"Short name or login of the user.","columnHeaderType":"not-filtered","id":"user.name","category":"user","type":"string","searchable":null,"example":"albert"},{"indexes":null,"aggregatable":true,"name":null,"description":"Name of the host.\n\nIt can contain what `hostname` returns on Unix systems, the fully qualified\ndomain name, or a name specified by the user. The sender decides which value\nto use.","columnHeaderType":"not-filtered","id":"host.name","category":"host","type":"string","searchable":null}],"dataProviders":[{"excluded":false,"and":[],"kqlQuery":"","name":"","queryMatch":{"displayValue":"endpoint","field":"agent.type","displayField":"agent.type","value":"endpoint","operator":":"},"id":"timeline-1-4685da24-35c1-43f3-892d-1f926dbf5568","type":"default","enabled":true}],"description":"","eventType":"all","filters":[],"kqlMode":"filter","kqlQuery":{"filterQuery":{"kuery":{"kind":"kuery","expression":""},"serializedQuery":""}},"title":"Generic Endpoint Timeline","timelineType":"template","templateTimelineVersion":2,"templateTimelineId":"db366523-f1c6-4c1f-8731-6ce5ed9e5717","dateRange":{"start":1588161020848,"end":1588162280848},"savedQueryId":null,"sort":{"columnId":"@timestamp","sortDirection":"desc"},"created":1594735857110,"createdBy":"Elastic","updated":1611609999115,"updatedBy":"Elastic","eventNotes":[],"globalNotes":[],"pinnedEventIds":[],"status":"immutable"}
 {"savedObjectId":null,"version":null,"columns":[{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"@timestamp","searchable":null},{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"signal.rule.description","searchable":null},{"indexes":null,"aggregatable":true,"name":null,"description":"The action captured by the event.\n\nThis describes the information in the event. It is more specific than `event.category`.\nExamples are `group-add`, `process-started`, `file-created`. The value is\nnormally defined by the implementer.","columnHeaderType":"not-filtered","id":"event.action","category":"event","type":"string","searchable":null,"example":"user-password-change"},{"indexes":null,"aggregatable":true,"name":null,"description":"Array of process arguments, starting with the absolute path to\nthe executable.\n\nMay be filtered to protect sensitive information.","columnHeaderType":"not-filtered","id":"process.args","category":"process","type":"string","searchable":null,"example":"[\"/usr/bin/ssh\",\"-l\",\"user\",\"10.0.0.16\"]"},{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"process.pid","searchable":null},{"indexes":null,"aggregatable":true,"name":null,"description":"IP address of the source (IPv4 or IPv6).","columnHeaderType":"not-filtered","id":"source.ip","category":"source","type":"ip","searchable":null},{"indexes":null,"aggregatable":true,"name":null,"description":"Port of the source.","columnHeaderType":"not-filtered","id":"source.port","category":"source","type":"number","searchable":null},{"indexes":null,"aggregatable":true,"name":null,"description":"IP address of the destination (IPv4 or IPv6).","columnHeaderType":"not-filtered","id":"destination.ip","category":"destination","type":"ip","searchable":null},{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"destination.port","searchable":null},{"indexes":null,"aggregatable":true,"name":null,"description":"Short name or login of the user.","columnHeaderType":"not-filtered","id":"user.name","category":"user","type":"string","searchable":null,"example":"albert"},{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"host.name","searchable":null}],"dataProviders":[{"and":[{"enabled":true,"excluded":false,"id":"timeline-1-e37e37c5-a6e7-4338-af30-47bfbc3c0e1e","kqlQuery":"","name":"{destination.ip}","queryMatch":{"displayField":"destination.ip","displayValue":"{destination.ip}","field":"destination.ip","operator":":","value":"{destination.ip}"},"type":"template"}],"enabled":true,"excluded":false,"id":"timeline-1-ec778f01-1802-40f0-9dfb-ed8de1f656cb","kqlQuery":"","name":"{source.ip}","queryMatch":{"displayField":"source.ip","displayValue":"{source.ip}","field":"source.ip","operator":":","value":"{source.ip}"},"type":"template"}],"description":"","eventType":"all","filters":[],"kqlMode":"filter","kqlQuery":{"filterQuery":{"kuery":{"kind":"kuery","expression":""},"serializedQuery":""}},"title":"Generic Network Timeline","timelineType":"template","templateTimelineVersion":2,"templateTimelineId":"91832785-286d-4ebe-b884-1a208d111a70","dateRange":{"start":1588255858373,"end":1588256218373},"savedQueryId":null,"sort":{"columnId":"@timestamp","sortDirection":"desc"},"created":1594735573866,"createdBy":"Elastic","updated":1611609960850,"updatedBy":"Elastic","eventNotes":[],"globalNotes":[],"pinnedEventIds":[],"status":"immutable"}
 {"savedObjectId":null,"version":null,"columns":[{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"@timestamp","searchable":null},{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"signal.rule.description","searchable":null},{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"event.action","searchable":null},{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"process.name","searchable":null},{"indexes":null,"aggregatable":true,"name":null,"description":"The working directory of the process.","columnHeaderType":"not-filtered","id":"process.working_directory","category":"process","type":"string","searchable":null,"example":"/home/alice"},{"indexes":null,"aggregatable":true,"name":null,"description":"Array of process arguments, starting with the absolute path to\nthe executable.\n\nMay be filtered to protect sensitive information.","columnHeaderType":"not-filtered","id":"process.args","category":"process","type":"string","searchable":null,"example":"[\"/usr/bin/ssh\",\"-l\",\"user\",\"10.0.0.16\"]"},{"indexes":null,"name":null,"columnHeaderType":"not-filtered","id":"process.pid","searchable":null},{"indexes":null,"aggregatable":true,"name":null,"description":"Absolute path to the process executable.","columnHeaderType":"not-filtered","id":"process.parent.executable","category":"process","type":"string","searchable":null,"example":"/usr/bin/ssh"},{"indexes":null,"aggregatable":true,"name":null,"description":"Array of process arguments.\n\nMay be filtered to protect sensitive information.","columnHeaderType":"not-filtered","id":"process.parent.args","category":"process","type":"string","searchable":null,"example":"[\"ssh\",\"-l\",\"user\",\"10.0.0.16\"]"},{"indexes":null,"aggregatable":true,"name":null,"description":"Process id.","columnHeaderType":"not-filtered","id":"process.parent.pid","category":"process","type":"number","searchable":null,"example":"4242"},{"indexes":null,"aggregatable":true,"name":null,"description":"Short name or login of the user.","columnHeaderType":"not-filtered","id":"user.name","category":"user","type":"string","searchable":null,"example":"albert"},{"indexes":null,"aggregatable":true,"name":null,"description":"Name of the host.\n\nIt can contain what `hostname` returns on Unix systems, the fully qualified\ndomain name, or a name specified by the user. The sender decides which value\nto use.","columnHeaderType":"not-filtered","id":"host.name","category":"host","type":"string","searchable":null}],"dataProviders":[{"excluded":false,"and":[],"kqlQuery":"","name":"{process.name}","queryMatch":{"displayValue":null,"field":"process.name","displayField":null,"value":"{process.name}","operator":":"},"id":"timeline-1-8622010a-61fb-490d-b162-beac9c36a853","type":"template","enabled":true}],"description":"","eventType":"all","filters":[],"kqlMode":"filter","kqlQuery":{"filterQuery":{"kuery":{"kind":"kuery","expression":""},"serializedQuery":""}},"title":"Generic Process Timeline","timelineType":"template","templateTimelineVersion":2,"templateTimelineId":"76e52245-7519-4251-91ab-262fb1a1728c","dateRange":{"start":1588161020848,"end":1588162280848},"savedQueryId":null,"sort":{"columnId":"@timestamp","sortDirection":"desc"},"created":1594735629389,"createdBy":"Elastic","updated":1611609848602,"updatedBy":"Elastic","eventNotes":[],"globalNotes":[],"pinnedEventIds":[],"status":"immutable"}
-{"savedObjectId":null,"version":null,"columns":[{"columnHeaderType":"not-filtered","id":"@timestamp"},{"columnHeaderType":"not-filtered","id":"signal.rule.description"},{"aggregatable":true,"description":"The action captured by the event.\n\nThis describes the information in the event. It is more specific than `event.category`.\nExamples are `group-add`, `process-started`, `file-created`. The value is\nnormally defined by the implementer.","columnHeaderType":"not-filtered","id":"event.action","category":"event","type":"string","example":"user-password-change"},{"aggregatable":true,"description":"Array of process arguments, starting with the absolute path to\nthe executable.\n\nMay be filtered to protect sensitive information.","columnHeaderType":"not-filtered","id":"process.args","category":"process","type":"string","example":"[\"/usr/bin/ssh\",\"-l\",\"user\",\"10.0.0.16\"]"},{"columnHeaderType":"not-filtered","id":"process.pid"},{"aggregatable":true,"description":"IP address of the source (IPv4 or IPv6).","columnHeaderType":"not-filtered","id":"source.ip","category":"source","type":"ip"},{"aggregatable":true,"description":"Port of the source.","columnHeaderType":"not-filtered","id":"source.port","category":"source","type":"number"},{"aggregatable":true,"description":"IP address of the destination (IPv4 or IPv6).","columnHeaderType":"not-filtered","id":"destination.ip","category":"destination","type":"ip"},{"columnHeaderType":"not-filtered","id":"destination.port"},{"aggregatable":true,"description":"Short name or login of the user.","columnHeaderType":"not-filtered","id":"user.name","category":"user","type":"string","example":"albert"},{"columnHeaderType":"not-filtered","id":"host.name"}],"dataProviders":[{"excluded":false,"and":[{"excluded":false,"kqlQuery":"","name":"{threat.enrichments.matched.type}","queryMatch":{"displayValue":null,"field":"threat.enrichments.matched.type","displayField":null,"value":"{threat.enrichments.matched.type}","operator":":"},"id":"timeline-1-ae18ef4b-f690-4122-a24d-e13b6818fba8","type":"template","enabled":true},{"excluded":false,"kqlQuery":"","name":"{threat.enrichments.matched.field}","queryMatch":{"displayValue":null,"field":"threat.enrichments.matched.field","displayField":null,"value":"{threat.enrichments.matched.field}","operator":":"},"id":"timeline-1-7b4cf27e-6788-4d8e-9188-7687f0eba0f2","type":"template","enabled":true}],"kqlQuery":"","name":"{threat.enrichments.matched.atomic}","queryMatch":{"displayValue":null,"field":"threat.enrichments.matched.atomic","displayField":null,"value":"{threat.enrichments.matched.atomic}","operator":":"},"id":"timeline-1-7db7d278-a80a-4853-971a-904319c50777","type":"template","enabled":true}],"description":"This Timeline template is for alerts generated by Indicator Match detection rules.","eqlOptions":{"eventCategoryField":"event.category","tiebreakerField":"","timestampField":"@timestamp","query":"","size":100},"eventType":"alert","filters":[],"kqlMode":"filter","kqlQuery":{"filterQuery":{"kuery":{"kind":"kuery","expression":""},"serializedQuery":""}},"indexNames":[".siem-signals-default"],"title":"Generic Threat Match Timeline","timelineType":"template","templateTimelineVersion":2,"templateTimelineId":"495ad7a7-316e-4544-8a0f-9c098daee76e","dateRange":{"start":1588161020848,"end":1588162280848},"savedQueryId":null,"sort":[{"sortDirection":"desc","columnId":"@timestamp"}],"created":1616696609311,"createdBy":"elastic","updated":1616788372794,"updatedBy":"elastic","eventNotes":[],"globalNotes":[],"pinnedEventIds":[],"status":"immutable"}
+{"savedObjectId":null,"version":null,"columns":[{"columnHeaderType":"not-filtered","id":"@timestamp"},{"columnHeaderType":"not-filtered","id":"signal.rule.description"},{"aggregatable":true,"description":"The action captured by the event.\n\nThis describes the information in the event. It is more specific than `event.category`.\nExamples are `group-add`, `process-started`, `file-created`. The value is\nnormally defined by the implementer.","columnHeaderType":"not-filtered","id":"event.action","category":"event","type":"string","example":"user-password-change"},{"aggregatable":true,"description":"Array of process arguments, starting with the absolute path to\nthe executable.\n\nMay be filtered to protect sensitive information.","columnHeaderType":"not-filtered","id":"process.args","category":"process","type":"string","example":"[\"/usr/bin/ssh\",\"-l\",\"user\",\"10.0.0.16\"]"},{"columnHeaderType":"not-filtered","id":"process.pid"},{"aggregatable":true,"description":"IP address of the source (IPv4 or IPv6).","columnHeaderType":"not-filtered","id":"source.ip","category":"source","type":"ip"},{"aggregatable":true,"description":"Port of the source.","columnHeaderType":"not-filtered","id":"source.port","category":"source","type":"number"},{"aggregatable":true,"description":"IP address of the destination (IPv4 or IPv6).","columnHeaderType":"not-filtered","id":"destination.ip","category":"destination","type":"ip"},{"columnHeaderType":"not-filtered","id":"destination.port"},{"aggregatable":true,"description":"Short name or login of the user.","columnHeaderType":"not-filtered","id":"user.name","category":"user","type":"string","example":"albert"},{"columnHeaderType":"not-filtered","id":"host.name"}],"dataProviders":[{"excluded":false,"and":[{"excluded":false,"kqlQuery":"","name":"{threat.enrichments.matched.type}","queryMatch":{"displayValue":null,"field":"threat.enrichments.matched.type","displayField":null,"value":"{threat.enrichments.matched.type}","operator":":"},"id":"timeline-1-ae18ef4b-f690-4122-a24d-e13b6818fba8","type":"template","enabled":true},{"excluded":false,"kqlQuery":"","name":"{threat.enrichments.matched.field}","queryMatch":{"displayValue":null,"field":"threat.enrichments.matched.field","displayField":null,"value":"{threat.enrichments.matched.field}","operator":":"},"id":"timeline-1-7b4cf27e-6788-4d8e-9188-7687f0eba0f2","type":"template","enabled":true}],"kqlQuery":"","name":"{threat.enrichments.matched.atomic}","queryMatch":{"displayValue":null,"field":"threat.enrichments.matched.atomic","displayField":null,"value":"{threat.enrichments.matched.atomic}","operator":":"},"id":"timeline-1-7db7d278-a80a-4853-971a-904319c50777","type":"template","enabled":true}],"description":"This Timeline template is for alerts generated by Indicator Match detection rules.","eqlOptions":{"eventCategoryField":"event.category","tiebreakerField":"","timestampField":"@timestamp","query":"","size":100},"eventType":"alert","filters":[],"kqlMode":"filter","kqlQuery":{"filterQuery":{"kuery":{"kind":"kuery","expression":""},"serializedQuery":""}},"dataViewId": "security-solution","indexNames":[".siem-signals-default"],"title":"Generic Threat Match Timeline","timelineType":"template","templateTimelineVersion":2,"templateTimelineId":"495ad7a7-316e-4544-8a0f-9c098daee76e","dateRange":{"start":1588161020848,"end":1588162280848},"savedQueryId":null,"sort":[{"sortDirection":"desc","columnId":"@timestamp"}],"created":1616696609311,"createdBy":"elastic","updated":1616788372794,"updatedBy":"elastic","eventNotes":[],"globalNotes":[],"pinnedEventIds":[],"status":"immutable"}
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_timelines/threat.json b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_timelines/threat.json
index d777fdf17d657..0d74cc6e43619 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_timelines/threat.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_timelines/threat.json
@@ -1 +1 @@
-{"savedObjectId":null,"version":null,"columns":[{"columnHeaderType":"not-filtered","id":"@timestamp"},{"columnHeaderType":"not-filtered","id":"signal.rule.description"},{"aggregatable":true,"description":"The action captured by the event.\n\nThis describes the information in the event. It is more specific than `event.category`.\nExamples are `group-add`, `process-started`, `file-created`. The value is\nnormally defined by the implementer.","columnHeaderType":"not-filtered","id":"event.action","category":"event","type":"string","example":"user-password-change"},{"aggregatable":true,"description":"Array of process arguments, starting with the absolute path to\nthe executable.\n\nMay be filtered to protect sensitive information.","columnHeaderType":"not-filtered","id":"process.args","category":"process","type":"string","example":"[\"/usr/bin/ssh\",\"-l\",\"user\",\"10.0.0.16\"]"},{"columnHeaderType":"not-filtered","id":"process.pid"},{"aggregatable":true,"description":"IP address of the source (IPv4 or IPv6).","columnHeaderType":"not-filtered","id":"source.ip","category":"source","type":"ip"},{"aggregatable":true,"description":"Port of the source.","columnHeaderType":"not-filtered","id":"source.port","category":"source","type":"number"},{"aggregatable":true,"description":"IP address of the destination (IPv4 or IPv6).","columnHeaderType":"not-filtered","id":"destination.ip","category":"destination","type":"ip"},{"columnHeaderType":"not-filtered","id":"destination.port"},{"aggregatable":true,"description":"Short name or login of the user.","columnHeaderType":"not-filtered","id":"user.name","category":"user","type":"string","example":"albert"},{"columnHeaderType":"not-filtered","id":"host.name"}],"dataProviders":[{"excluded":false,"and":[{"excluded":false,"kqlQuery":"","name":"{threat.enrichments.matched.type}","queryMatch":{"displayValue":null,"field":"threat.enrichments.matched.type","displayField":null,"value":"{threat.enrichments.matched.type}","operator":":"},"id":"timeline-1-ae18ef4b-f690-4122-a24d-e13b6818fba8","type":"template","enabled":true},{"excluded":false,"kqlQuery":"","name":"{threat.enrichments.matched.field}","queryMatch":{"displayValue":null,"field":"threat.enrichments.matched.field","displayField":null,"value":"{threat.enrichments.matched.field}","operator":":"},"id":"timeline-1-7b4cf27e-6788-4d8e-9188-7687f0eba0f2","type":"template","enabled":true}],"kqlQuery":"","name":"{threat.enrichments.matched.atomic}","queryMatch":{"displayValue":null,"field":"threat.enrichments.matched.atomic","displayField":null,"value":"{threat.enrichments.matched.atomic}","operator":":"},"id":"timeline-1-7db7d278-a80a-4853-971a-904319c50777","type":"template","enabled":true}],"description":"This Timeline template is for alerts generated by Indicator Match detection rules.","eqlOptions":{"eventCategoryField":"event.category","tiebreakerField":"","timestampField":"@timestamp","query":"","size":100},"eventType":"alert","filters":[],"kqlMode":"filter","kqlQuery":{"filterQuery":{"kuery":{"kind":"kuery","expression":""},"serializedQuery":""}},"indexNames":[".siem-signals-default"],"title":"Generic Threat Match Timeline","timelineType":"template","templateTimelineVersion":2,"templateTimelineId":"495ad7a7-316e-4544-8a0f-9c098daee76e","dateRange":{"start":1588161020848,"end":1588162280848},"savedQueryId":null,"sort":[{"sortDirection":"desc","columnId":"@timestamp"}],"created":1616696609311,"createdBy":"elastic","updated":1616788372794,"updatedBy":"elastic","eventNotes":[],"globalNotes":[],"pinnedEventIds":[],"status":"immutable"}
+{"savedObjectId":null,"version":null,"columns":[{"columnHeaderType":"not-filtered","id":"@timestamp"},{"columnHeaderType":"not-filtered","id":"signal.rule.description"},{"aggregatable":true,"description":"The action captured by the event.\n\nThis describes the information in the event. It is more specific than `event.category`.\nExamples are `group-add`, `process-started`, `file-created`. The value is\nnormally defined by the implementer.","columnHeaderType":"not-filtered","id":"event.action","category":"event","type":"string","example":"user-password-change"},{"aggregatable":true,"description":"Array of process arguments, starting with the absolute path to\nthe executable.\n\nMay be filtered to protect sensitive information.","columnHeaderType":"not-filtered","id":"process.args","category":"process","type":"string","example":"[\"/usr/bin/ssh\",\"-l\",\"user\",\"10.0.0.16\"]"},{"columnHeaderType":"not-filtered","id":"process.pid"},{"aggregatable":true,"description":"IP address of the source (IPv4 or IPv6).","columnHeaderType":"not-filtered","id":"source.ip","category":"source","type":"ip"},{"aggregatable":true,"description":"Port of the source.","columnHeaderType":"not-filtered","id":"source.port","category":"source","type":"number"},{"aggregatable":true,"description":"IP address of the destination (IPv4 or IPv6).","columnHeaderType":"not-filtered","id":"destination.ip","category":"destination","type":"ip"},{"columnHeaderType":"not-filtered","id":"destination.port"},{"aggregatable":true,"description":"Short name or login of the user.","columnHeaderType":"not-filtered","id":"user.name","category":"user","type":"string","example":"albert"},{"columnHeaderType":"not-filtered","id":"host.name"}],"dataProviders":[{"excluded":false,"and":[{"excluded":false,"kqlQuery":"","name":"{threat.enrichments.matched.type}","queryMatch":{"displayValue":null,"field":"threat.enrichments.matched.type","displayField":null,"value":"{threat.enrichments.matched.type}","operator":":"},"id":"timeline-1-ae18ef4b-f690-4122-a24d-e13b6818fba8","type":"template","enabled":true},{"excluded":false,"kqlQuery":"","name":"{threat.enrichments.matched.field}","queryMatch":{"displayValue":null,"field":"threat.enrichments.matched.field","displayField":null,"value":"{threat.enrichments.matched.field}","operator":":"},"id":"timeline-1-7b4cf27e-6788-4d8e-9188-7687f0eba0f2","type":"template","enabled":true}],"kqlQuery":"","name":"{threat.enrichments.matched.atomic}","queryMatch":{"displayValue":null,"field":"threat.enrichments.matched.atomic","displayField":null,"value":"{threat.enrichments.matched.atomic}","operator":":"},"id":"timeline-1-7db7d278-a80a-4853-971a-904319c50777","type":"template","enabled":true}],"description":"This Timeline template is for alerts generated by Indicator Match detection rules.","eqlOptions":{"eventCategoryField":"event.category","tiebreakerField":"","timestampField":"@timestamp","query":"","size":100},"eventType":"alert","filters":[],"kqlMode":"filter","kqlQuery":{"filterQuery":{"kuery":{"kind":"kuery","expression":""},"serializedQuery":""}},"dataViewId": "security-solution","indexNames":[".siem-signals-default"],"title":"Generic Threat Match Timeline","timelineType":"template","templateTimelineVersion":2,"templateTimelineId":"495ad7a7-316e-4544-8a0f-9c098daee76e","dateRange":{"start":1588161020848,"end":1588162280848},"savedQueryId":null,"sort":[{"sortDirection":"desc","columnId":"@timestamp"}],"created":1616696609311,"createdBy":"elastic","updated":1616788372794,"updatedBy":"elastic","eventNotes":[],"globalNotes":[],"pinnedEventIds":[],"status":"immutable"}
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/detections_admin/detections_role.json b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/detections_admin/detections_role.json
index 7d81897708422..e6fbef08d25ee 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/detections_admin/detections_role.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/detections_admin/detections_role.json
@@ -34,6 +34,8 @@
         "ml": ["all"],
         "siem": ["all", "read_alerts", "crud_alerts"],
         "securitySolutionCases": ["all"],
+        "indexPatterns": ["all"],
+        "savedObjectsManagement": ["all"],
         "actions": ["read"],
         "builtInAlerts": ["all"],
         "dev_tools": ["all"]
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/hunter/detections_role.json b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/hunter/detections_role.json
index 34d8b7b4d4446..af12a2cb674d5 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/hunter/detections_role.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/hunter/detections_role.json
@@ -39,6 +39,8 @@
         "ml": ["read"],
         "siem": ["all", "read_alerts", "crud_alerts"],
         "securitySolutionCases": ["all"],
+        "indexPatterns": ["read"],
+        "savedObjectsManagement": ["read"],
         "actions": ["read"],
         "builtInAlerts": ["all"]
       },
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/index.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/index.ts
index bcdc472477531..c18e23b7a3cdf 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/index.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/index.ts
@@ -13,3 +13,8 @@ export * from './rule_author';
 export * from './soc_manager';
 export * from './t1_analyst';
 export * from './t2_analyst';
+
+// TODO: Steph/sourcerer remove from detections_role.json once we have our internal saved object client
+// https://github.com/elastic/security-team/issues/1978
+// "indexPatterns": ["read"],
+// "savedObjectsManagement": ["read"],
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/platform_engineer/detections_role.json b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/platform_engineer/detections_role.json
index f6b31d4b3ed81..18effae645c42 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/platform_engineer/detections_role.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/platform_engineer/detections_role.json
@@ -34,6 +34,8 @@
         "ml": ["all"],
         "siem": ["all", "read_alerts", "crud_alerts"],
         "securitySolutionCases": ["all"],
+        "indexPatterns": ["all"],
+        "savedObjectsManagement": ["all"],
         "actions": ["all"],
         "builtInAlerts": ["all"]
       },
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/reader/detections_role.json b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/reader/detections_role.json
index 4cfc6a3ec80ed..8f9434d9a3623 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/reader/detections_role.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/reader/detections_role.json
@@ -27,6 +27,8 @@
         "ml": ["read"],
         "siem": ["read", "read_alerts"],
         "securitySolutionCases": ["read"],
+        "indexPatterns": ["read"],
+        "savedObjectsManagement": ["read"],
         "actions": ["read"],
         "builtInAlerts": ["read"]
       },
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/rule_author/detections_role.json b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/rule_author/detections_role.json
index a23aec6d6e403..d6bee8ce9dc16 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/rule_author/detections_role.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/rule_author/detections_role.json
@@ -37,6 +37,8 @@
         "ml": ["read"],
         "siem": ["all", "read_alerts", "crud_alerts"],
         "securitySolutionCases": ["all"],
+        "indexPatterns": ["read"],
+        "savedObjectsManagement": ["read"],
         "actions": ["read"],
         "builtInAlerts": ["all"]
       },
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/soc_manager/detections_role.json b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/soc_manager/detections_role.json
index da855c6926438..46f7ca1d0067d 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/soc_manager/detections_role.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/soc_manager/detections_role.json
@@ -37,6 +37,8 @@
         "ml": ["read"],
         "siem": ["all", "read_alerts", "crud_alerts"],
         "securitySolutionCases": ["all"],
+        "indexPatterns": ["all"],
+        "savedObjectsManagement": ["all"],
         "actions": ["all"],
         "builtInAlerts": ["all"]
       },
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/t1_analyst/detections_role.json b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/t1_analyst/detections_role.json
index a63d0186a2a91..ea3bd7b97e3ca 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/t1_analyst/detections_role.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/t1_analyst/detections_role.json
@@ -27,6 +27,8 @@
         "ml": ["read"],
         "siem": ["read", "read_alerts"],
         "securitySolutionCases": ["read"],
+        "indexPatterns": ["read"],
+        "savedObjectsManagement": ["read"],
         "actions": ["read"],
         "builtInAlerts": ["read"]
       },
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/t2_analyst/detections_role.json b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/t2_analyst/detections_role.json
index de1ff5af99c1b..209e57eba2cfd 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/t2_analyst/detections_role.json
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/scripts/roles_users/t2_analyst/detections_role.json
@@ -29,6 +29,8 @@
         "ml": ["read"],
         "siem": ["read", "read_alerts"],
         "securitySolutionCases": ["read"],
+        "indexPatterns": ["read"],
+        "savedObjectsManagement": ["read"],
         "actions": ["read"],
         "builtInAlerts": ["read"]
       },
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threshold/build_signal_history.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threshold/build_signal_history.test.ts
index 8362942af15b9..dbf2fb7feac2a 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threshold/build_signal_history.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threshold/build_signal_history.test.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { ALERT_ORIGINAL_TIME } from '../../rule_types/field_maps/field_names';
+import { ALERT_ORIGINAL_TIME } from '../../../../../common/field_maps/field_names';
 import { sampleThresholdAlert } from '../../rule_types/__mocks__/threshold';
 import { buildThresholdSignalHistory } from './build_signal_history';
 
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threshold/build_signal_history.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threshold/build_signal_history.ts
index e5c21edbc9350..b959f3de47a8a 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threshold/build_signal_history.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threshold/build_signal_history.ts
@@ -7,9 +7,9 @@
 
 import { SearchHit } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import {
-  ALERT_ORIGINAL_TIME,
   ALERT_RULE_THRESHOLD_FIELD,
-} from '../../rule_types/field_maps/field_names';
+  ALERT_ORIGINAL_TIME,
+} from '../../../../../common/field_maps/field_names';
 
 import { SimpleHit, ThresholdSignalHistory } from '../types';
 import { getThresholdTermsHash, isWrappedRACAlert, isWrappedSignalHit } from '../utils';
diff --git a/x-pack/plugins/security_solution/server/lib/machine_learning/index.ts b/x-pack/plugins/security_solution/server/lib/machine_learning/index.ts
index f8d767a371d9a..b93e76c09282e 100644
--- a/x-pack/plugins/security_solution/server/lib/machine_learning/index.ts
+++ b/x-pack/plugins/security_solution/server/lib/machine_learning/index.ts
@@ -11,7 +11,7 @@ import type { ExceptionListItemSchema } from '@kbn/securitysolution-io-ts-list-t
 import { buildExceptionFilter } from '@kbn/securitysolution-list-utils';
 import { AnomalyRecordDoc as Anomaly } from '../../../../ml/server';
 
-export { Anomaly };
+export type { Anomaly };
 export type AnomalyResults = estypes.SearchResponse<Anomaly>;
 type MlAnomalySearch = <T>(
   searchParams: estypes.SearchRequest,
diff --git a/x-pack/plugins/security_solution/server/lib/sourcerer/routes/helpers.ts b/x-pack/plugins/security_solution/server/lib/sourcerer/routes/helpers.ts
new file mode 100644
index 0000000000000..47218f2731e78
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/sourcerer/routes/helpers.ts
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ElasticsearchClient } from 'kibana/server';
+
+export const findExistingIndices = async (
+  indices: string[],
+  esClient: ElasticsearchClient
+): Promise<boolean[]> =>
+  Promise.all(
+    indices
+      .map(async (index) => {
+        const searchResponse = await esClient.fieldCaps({
+          index,
+          fields: '_id',
+          ignore_unavailable: true,
+          allow_no_indices: false,
+        });
+        return searchResponse.body.indices.length > 0;
+      })
+      .map((p) => p.catch((e) => false))
+  );
diff --git a/x-pack/plugins/security_solution/server/lib/sourcerer/routes/index.test.ts b/x-pack/plugins/security_solution/server/lib/sourcerer/routes/index.test.ts
new file mode 100644
index 0000000000000..99b4f05abb1b1
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/sourcerer/routes/index.test.ts
@@ -0,0 +1,169 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { createSourcererDataViewRoute } from './';
+import {
+  requestMock,
+  serverMock,
+  requestContextMock,
+} from '../../detection_engine/routes/__mocks__';
+
+import { SOURCERER_API_URL } from '../../../../common/constants';
+import { StartServicesAccessor } from 'kibana/server';
+import { StartPlugins } from '../../../plugin';
+
+jest.mock('./helpers', () => {
+  const original = jest.requireActual('./helpers');
+
+  return {
+    ...original,
+    findExistingIndices: () => new Promise((resolve) => resolve([true, true])),
+  };
+});
+const mockPattern = {
+  id: 'security-solution',
+  title:
+    'apm-*-transaction*,traces-apm*,auditbeat-*,endgame-*,filebeat-*,logs-*,packetbeat-*,winlogbeat-*,ml_host_risk_score_*,.siem-signals-default',
+};
+const mockPatternList = [
+  'apm-*-transaction*',
+  'traces-apm*',
+  'auditbeat-*',
+  'endgame-*',
+  'filebeat-*',
+  'logs-*',
+  'packetbeat-*',
+  'winlogbeat-*',
+  'ml_host_risk_score_*',
+  '.siem-signals-default',
+];
+const mockDataViews = [
+  {
+    id: 'metrics-*',
+    title: 'metrics-*',
+  },
+  {
+    id: 'logs-*',
+    title: 'logs-*',
+  },
+  mockPattern,
+];
+const getStartServices = jest.fn().mockReturnValue([
+  null,
+  {
+    data: {
+      indexPatterns: {
+        indexPatternsServiceFactory: () => ({
+          getIdsWithTitle: () => new Promise((rs) => rs(mockDataViews)),
+          get: () => new Promise((rs) => rs(mockPattern)),
+          createAndSave: () => new Promise((rs) => rs(mockPattern)),
+          updateSavedObject: () => new Promise((rs) => rs(mockPattern)),
+        }),
+      },
+    },
+  },
+] as unknown) as StartServicesAccessor<StartPlugins>;
+
+const getStartServicesNotSiem = jest.fn().mockReturnValue([
+  null,
+  {
+    data: {
+      indexPatterns: {
+        indexPatternsServiceFactory: () => ({
+          getIdsWithTitle: () =>
+            new Promise((rs) => rs(mockDataViews.filter((v) => v.id !== mockPattern.id))),
+          get: () => new Promise((rs) => rs(mockPattern)),
+          createAndSave: () => new Promise((rs) => rs(mockPattern)),
+          updateSavedObject: () => new Promise((rs) => rs(mockPattern)),
+        }),
+      },
+    },
+  },
+] as unknown) as StartServicesAccessor<StartPlugins>;
+
+const mockDataViewsTransformed = {
+  defaultDataView: {
+    id: 'security-solution',
+    patternList: ['apm-*-transaction*', 'traces-apm*'],
+    title:
+      'apm-*-transaction*,traces-apm*,auditbeat-*,endgame-*,filebeat-*,logs-*,packetbeat-*,winlogbeat-*,ml_host_risk_score_*,.siem-signals-default',
+  },
+  kibanaDataViews: [
+    {
+      id: 'metrics-*',
+      patternList: ['metrics-*'],
+      title: 'metrics-*',
+    },
+    {
+      id: 'logs-*',
+      patternList: ['logs-*'],
+      title: 'logs-*',
+    },
+    {
+      id: 'security-solution',
+      patternList: ['apm-*-transaction*', 'traces-apm*'],
+      title:
+        'apm-*-transaction*,traces-apm*,auditbeat-*,endgame-*,filebeat-*,logs-*,packetbeat-*,winlogbeat-*,ml_host_risk_score_*,.siem-signals-default',
+    },
+  ],
+};
+
+export const getSourcererRequest = (patternList: string[]) =>
+  requestMock.create({
+    method: 'post',
+    path: SOURCERER_API_URL,
+    body: { patternList },
+  });
+
+describe('sourcerer route', () => {
+  let server: ReturnType<typeof serverMock.create>;
+  let { context } = requestContextMock.createTools();
+
+  beforeEach(() => {
+    server = serverMock.create();
+    ({ context } = requestContextMock.createTools());
+  });
+
+  test('returns sourcerer formatted Data Views when SIEM Data View does NOT exist', async () => {
+    createSourcererDataViewRoute(server.router, getStartServicesNotSiem);
+    const response = await server.inject(getSourcererRequest(mockPatternList), context);
+    expect(response.status).toEqual(200);
+    expect(response.body).toEqual(mockDataViewsTransformed);
+  });
+
+  test('returns sourcerer formatted Data Views when SIEM Data View exists', async () => {
+    createSourcererDataViewRoute(server.router, getStartServices);
+    const response = await server.inject(getSourcererRequest(mockPatternList), context);
+    expect(response.status).toEqual(200);
+    expect(response.body).toEqual(mockDataViewsTransformed);
+  });
+
+  test('returns sourcerer formatted Data Views when SIEM Data View exists and patternList input is changed', async () => {
+    createSourcererDataViewRoute(server.router, getStartServices);
+    mockPatternList.shift();
+    const response = await server.inject(getSourcererRequest(mockPatternList), context);
+    expect(response.status).toEqual(200);
+    expect(response.body).toEqual({
+      defaultDataView: {
+        id: 'security-solution',
+        patternList: ['traces-apm*', 'auditbeat-*'],
+        title:
+          'traces-apm*,auditbeat-*,endgame-*,filebeat-*,logs-*,packetbeat-*,winlogbeat-*,ml_host_risk_score_*,.siem-signals-default',
+      },
+      kibanaDataViews: [
+        mockDataViewsTransformed.kibanaDataViews[0],
+        mockDataViewsTransformed.kibanaDataViews[1],
+        {
+          id: 'security-solution',
+          patternList: ['traces-apm*', 'auditbeat-*'],
+          title:
+            'traces-apm*,auditbeat-*,endgame-*,filebeat-*,logs-*,packetbeat-*,winlogbeat-*,ml_host_risk_score_*,.siem-signals-default',
+        },
+      ],
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/server/lib/sourcerer/routes/index.ts b/x-pack/plugins/security_solution/server/lib/sourcerer/routes/index.ts
new file mode 100644
index 0000000000000..cdaaedf364eb6
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/sourcerer/routes/index.ts
@@ -0,0 +1,119 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { transformError } from '@kbn/securitysolution-es-utils';
+import { StartServicesAccessor } from 'kibana/server';
+import type { SecuritySolutionPluginRouter } from '../../../types';
+import { DEFAULT_TIME_FIELD, SOURCERER_API_URL } from '../../../../common/constants';
+import { buildSiemResponse } from '../../detection_engine/routes/utils';
+import { buildRouteValidation } from '../../../utils/build_validation/route_validation';
+import { sourcererSchema } from './schema';
+import { StartPlugins } from '../../../plugin';
+import { findExistingIndices } from './helpers';
+
+export const createSourcererDataViewRoute = (
+  router: SecuritySolutionPluginRouter,
+  getStartServices: StartServicesAccessor<StartPlugins>
+) => {
+  router.post(
+    {
+      path: SOURCERER_API_URL,
+      validate: {
+        body: buildRouteValidation(sourcererSchema),
+      },
+      options: {
+        tags: ['access:securitySolution'],
+      },
+    },
+    async (context, request, response) => {
+      const siemResponse = buildSiemResponse(response);
+      const siemClient = context.securitySolution?.getAppClient();
+      const dataViewId = siemClient.getSourcererDataViewId();
+      try {
+        const [
+          ,
+          {
+            data: { indexPatterns },
+          },
+        ] = await getStartServices();
+        const dataViewService = await indexPatterns.indexPatternsServiceFactory(
+          context.core.savedObjects.client,
+          context.core.elasticsearch.client.asInternalUser
+        );
+
+        let allDataViews = await dataViewService.getIdsWithTitle();
+        const { patternList } = request.body;
+        const siemDataView = allDataViews.find((v) => v.id === dataViewId);
+        const patternListAsTitle = patternList.join();
+
+        if (siemDataView == null) {
+          const defaultDataView = await dataViewService.createAndSave({
+            allowNoIndex: true,
+            id: dataViewId,
+            title: patternListAsTitle,
+            timeFieldName: DEFAULT_TIME_FIELD,
+          });
+          // ?? dataViewId -> type thing here, should never happen
+          allDataViews.push({ ...defaultDataView, id: defaultDataView.id ?? dataViewId });
+        } else if (patternListAsTitle !== siemDataView.title) {
+          const defaultDataView = { ...siemDataView, id: siemDataView.id ?? '' };
+          const wholeDataView = await dataViewService.get(defaultDataView.id);
+          wholeDataView.title = patternListAsTitle;
+          let didUpdate = true;
+          await dataViewService.updateSavedObject(wholeDataView).catch((err) => {
+            const error = transformError(err);
+            if (error.statusCode === 403) {
+              didUpdate = false;
+              // user doesnt have permissions to update, use existing pattern
+              wholeDataView.title = defaultDataView.title;
+              return;
+            }
+            throw err;
+          });
+
+          // update the data view in allDataViews
+          if (didUpdate) {
+            allDataViews = allDataViews.map((v) =>
+              v.id === dataViewId ? { ...v, title: patternListAsTitle } : v
+            );
+          }
+        }
+
+        const patternLists: string[][] = allDataViews.map(({ title }) => title.split(','));
+        const activePatternBools: boolean[][] = await Promise.all(
+          patternLists.map((pl) =>
+            findExistingIndices(pl, context.core.elasticsearch.client.asCurrentUser)
+          )
+        );
+
+        const activePatternLists = patternLists.map((pl, i) =>
+          // also remove duplicates from active
+          pl.filter((pattern, j, self) => self.indexOf(pattern) === j && activePatternBools[i][j])
+        );
+
+        const kibanaDataViews = allDataViews.map((kip, i) => ({
+          ...kip,
+          patternList: activePatternLists[i],
+        }));
+        const body = {
+          defaultDataView: kibanaDataViews.find((p) => p.id === dataViewId) ?? {},
+          kibanaDataViews,
+        };
+        return response.ok({ body });
+      } catch (err) {
+        const error = transformError(err);
+        return siemResponse.error({
+          body:
+            error.statusCode === 403
+              ? 'Users with write permissions need to access the Elastic Security app to initialize the app source data.'
+              : error.message,
+          statusCode: error.statusCode,
+        });
+      }
+    }
+  );
+};
diff --git a/x-pack/plugins/security_solution/server/lib/sourcerer/routes/schema.ts b/x-pack/plugins/security_solution/server/lib/sourcerer/routes/schema.ts
new file mode 100644
index 0000000000000..17f7f36a16341
--- /dev/null
+++ b/x-pack/plugins/security_solution/server/lib/sourcerer/routes/schema.ts
@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as t from 'io-ts';
+
+export const sourcererSchema = t.type({
+  patternList: t.array(t.string),
+});
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/__mocks__/create_timelines.ts b/x-pack/plugins/security_solution/server/lib/timeline/__mocks__/create_timelines.ts
index d03b445da26d0..72a4a0b3782ed 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/__mocks__/create_timelines.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/__mocks__/create_timelines.ts
@@ -163,6 +163,7 @@ export const mockTemplate = {
       and: [],
     },
   ],
+  dataViewId: '',
   description: '',
   eventType: 'all',
   excludedRowRendererIds: [],
@@ -192,6 +193,7 @@ export const mockTimeline = {
     { columnHeaderType: 'not-filtered', id: 'user.name' },
   ],
   dataProviders: [],
+  dataViewId: 'security-solution',
   description: '',
   eventType: 'all',
   excludedRowRendererIds: [],
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/constants.ts b/x-pack/plugins/security_solution/server/lib/timeline/constants.ts
index 916fe726210cd..bd9a827e768dc 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/constants.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/constants.ts
@@ -10,6 +10,11 @@
  */
 export const SAVED_QUERY_ID_REF_NAME = 'savedQueryId';
 
+/**
+ * The reference name for the saved query ID field within the timeline saved object definition
+ */
+export const DATA_VIEW_ID_REF_NAME = 'dataViewId';
+
 /**
  * This needs to match the type of the saved query saved object. That type is defined here:
  * https://github.com/elastic/kibana/blob/main/src/plugins/data/public/query/saved_query/saved_query_service.ts#L54
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/README.md b/x-pack/plugins/security_solution/server/lib/timeline/routes/README.md
index defbf8be8b7c3..6878e21e14452 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/README.md
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/README.md
@@ -713,6 +713,7 @@ api/timelines?page_size=10&page_index=1&sort_field=updated&sort_order=desc&timel
           "enabled": true
         }
       ],
+      "dataViewId": "security-solution",
       "description": "",
       "eqlOptions": {
         "tiebreakerField": "",
@@ -879,6 +880,7 @@ api/timelines?page_size=10&page_index=1&sort_field=updated&sort_order=desc&timel
           "enabled": true
         }
       ],
+      "dataViewId": "security-solution",
       "description": "",
       "eventType": "all",
       "filters": [],
@@ -1023,6 +1025,7 @@ kbn-version: 8.0.0
           "enabled": true
         }
       ],
+      "dataViewId": "security-solution",
       "description": "",
       "eventType": "all",
       "filters": [],
@@ -1214,6 +1217,7 @@ kbn-version: 8.0.0
           "enabled": true
         }
       ],
+      "dataViewId": "security-solution",
       "description": "",
       "eqlOptions": {
         "eventCategoryField": "event.category",
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/create_timelines/helpers.test.ts b/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/create_timelines/helpers.test.ts
index 8bf5213d6a47f..1d4d9b1e0f2ea 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/create_timelines/helpers.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/routes/timelines/create_timelines/helpers.test.ts
@@ -9,7 +9,7 @@ import * as module from './helpers';
 import { savePinnedEvents } from '../../../saved_object/pinned_events';
 import { getNote } from '../../../saved_object/notes';
 import { FrameworkRequest } from '../../../../framework';
-import { SavedTimeline } from '../../../../../../common/types/timeline';
+import { SavedTimeline } from '../../../../../../common';
 import { mockTemplate, mockTimeline } from '../../../__mocks__/create_timelines';
 import { buildFrameworkRequest } from '../../../utils/common';
 import { SecurityPluginSetup } from '../../../../../../../security/server';
@@ -32,13 +32,6 @@ const notes = [
 const existingNoteIds = undefined;
 const isImmutable = true;
 
-// System under test uses moment.js under the hood, so we need to mock time.
-// Mocking moment via jest.mock('moment') breaks imports of moment in other files.
-// Instead, we simply mock Date.now() via jest API and moment starts using it.
-// This affects all the tests in this file and doesn't affect tests in other files.
-// https://jestjs.io/docs/timer-mocks
-jest.useFakeTimers('modern').setSystemTime(new Date('2020-11-04T11:37:31.655Z'));
-
 jest.mock('../../../saved_object/timelines', () => ({
   persistTimeline: jest.fn().mockResolvedValue({
     timeline: {
@@ -77,6 +70,7 @@ describe('createTimelines', () => {
     const mockRequest = getCreateTimelinesRequest(createTimelineWithoutTimelineId);
 
     frameworkRequest = await buildFrameworkRequest(context, securitySetup, mockRequest);
+    Date.now = jest.fn().mockReturnValue(new Date('2020-11-04T11:37:31.655Z'));
   });
 
   describe('create timelines', () => {
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/saved_object/timelines/convert_saved_object_to_savedtimeline.ts b/x-pack/plugins/security_solution/server/lib/timeline/saved_object/timelines/convert_saved_object_to_savedtimeline.ts
index b49538a706e39..5ab971adfcb83 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/saved_object/timelines/convert_saved_object_to_savedtimeline.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/saved_object/timelines/convert_saved_object_to_savedtimeline.ts
@@ -51,8 +51,8 @@ const getTimelineTypeAndStatus = (
   };
 };
 
-export const convertSavedObjectToSavedTimeline = (savedObject: unknown): TimelineSavedObject => {
-  const timeline = pipe(
+export const convertSavedObjectToSavedTimeline = (savedObject: unknown): TimelineSavedObject =>
+  pipe(
     TimelineSavedObjectWithDraftRuntime.decode(savedObject),
     map((savedTimeline) => {
       const attributes = {
@@ -78,6 +78,3 @@ export const convertSavedObjectToSavedTimeline = (savedObject: unknown): Timelin
       throw new Error(failure(errors).join('\n'));
     }, identity)
   );
-
-  return timeline;
-};
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/saved_object/timelines/field_migrator.ts b/x-pack/plugins/security_solution/server/lib/timeline/saved_object/timelines/field_migrator.ts
index bb6667f81ed8f..87d3aa4c6f908 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/saved_object/timelines/field_migrator.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/saved_object/timelines/field_migrator.ts
@@ -5,13 +5,14 @@
  * 2.0.
  */
 
-import { SAVED_QUERY_ID_REF_NAME, SAVED_QUERY_TYPE } from '../../constants';
+import { DATA_VIEW_ID_REF_NAME, SAVED_QUERY_ID_REF_NAME, SAVED_QUERY_TYPE } from '../../constants';
 import { FieldMigrator } from '../../utils/migrator';
-
+import { DATA_VIEW_SAVED_OBJECT_TYPE } from '../../../../../../../../src/plugins/data/common';
 /**
  * A migrator to handle moving specific fields that reference other saved objects to the references field within a saved
  * object.
  */
 export const timelineFieldsMigrator = new FieldMigrator([
   { path: 'savedQueryId', type: SAVED_QUERY_TYPE, name: SAVED_QUERY_ID_REF_NAME },
+  { path: 'dataViewId', type: DATA_VIEW_SAVED_OBJECT_TYPE, name: DATA_VIEW_ID_REF_NAME },
 ]);
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/saved_object/timelines/index.test.ts b/x-pack/plugins/security_solution/server/lib/timeline/saved_object/timelines/index.test.ts
index 112796df527fa..8af3cf7cfb1cf 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/saved_object/timelines/index.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/saved_object/timelines/index.test.ts
@@ -26,6 +26,8 @@ import {
   mockResolvedTimeline,
   mockResolveTimelineResponse,
 } from '../../__mocks__/resolve_timeline';
+import { DATA_VIEW_ID_REF_NAME, SAVED_QUERY_ID_REF_NAME, SAVED_QUERY_TYPE } from '../../constants';
+import { DATA_VIEW_SAVED_OBJECT_TYPE } from '../../../../../../../../src/plugins/data_views/common';
 
 jest.mock('./convert_saved_object_to_savedtimeline', () => ({
   convertSavedObjectToSavedTimeline: jest.fn(),
@@ -309,4 +311,54 @@ describe('saved_object', () => {
       expect(result).toEqual(mockResolveTimelineResponse);
     });
   });
+  describe('field migrator', () => {
+    let mockResolveSavedObject: jest.Mock;
+    const convertSavedObjectToSavedTimelineMock: jest.Mock =
+      convertSavedObjectToSavedTimeline as jest.Mock;
+    let mockRequest: FrameworkRequest;
+    beforeEach(async () => {
+      jest.clearAllMocks();
+      convertSavedObjectToSavedTimelineMock.mockReturnValue(mockResolvedTimeline);
+      mockResolveSavedObject = jest.fn().mockReturnValue({
+        ...mockResolvedSavedObject,
+        saved_object: {
+          ...mockResolvedSavedObject.saved_object,
+          references: [
+            {
+              id: 'boo',
+              name: SAVED_QUERY_ID_REF_NAME,
+              type: SAVED_QUERY_TYPE,
+            },
+            {
+              id: 'also-boo',
+              name: DATA_VIEW_ID_REF_NAME,
+              type: DATA_VIEW_SAVED_OBJECT_TYPE,
+            },
+          ],
+        },
+      });
+      mockRequest = {
+        user: {
+          username: 'username',
+        },
+        context: {
+          core: {
+            savedObjects: {
+              client: {
+                resolve: mockResolveSavedObject,
+              },
+            },
+          },
+        },
+      } as unknown as FrameworkRequest;
+
+      await resolveTimelineOrNull(mockRequest, '760d3d20-2142-11ec-a46f-051cb8e3154c');
+    });
+
+    test('the fields we track in references are converted to attributes when SO is requested', () => {
+      const { attributes } = convertSavedObjectToSavedTimelineMock.mock.calls[0][0];
+      expect(attributes.dataViewId).toEqual('also-boo');
+      expect(attributes.savedQueryId).toEqual('boo');
+    });
+  });
 });
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/saved_object/timelines/pick_saved_timeline.test.ts b/x-pack/plugins/security_solution/server/lib/timeline/saved_object/timelines/pick_saved_timeline.test.ts
index 5aa7dd9c7ad46..39e05b267735d 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/saved_object/timelines/pick_saved_timeline.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/saved_object/timelines/pick_saved_timeline.test.ts
@@ -38,6 +38,7 @@ describe('pickSavedTimeline', () => {
       { columnHeaderType: 'not-filtered', id: 'destination.ip' },
       { columnHeaderType: 'not-filtered', id: 'user.name' },
     ],
+    dataViewId: 'security-solution',
     indexNames: [
       'auditbeat-*',
       'endgame-*',
diff --git a/x-pack/plugins/security_solution/server/lib/timeline/schemas/timelines/create_timelines_schema.ts b/x-pack/plugins/security_solution/server/lib/timeline/schemas/timelines/create_timelines_schema.ts
index 4cb21a27bacc8..bc959e512a471 100644
--- a/x-pack/plugins/security_solution/server/lib/timeline/schemas/timelines/create_timelines_schema.ts
+++ b/x-pack/plugins/security_solution/server/lib/timeline/schemas/timelines/create_timelines_schema.ts
@@ -27,3 +27,5 @@ export const createTimelineSchema = rt.intersection([
     version: unionWithNullType(rt.string),
   }),
 ]);
+
+export type CreateTimelineSchema = rt.TypeOf<typeof createTimelineSchema>;
diff --git a/x-pack/plugins/security_solution/server/lib/types.ts b/x-pack/plugins/security_solution/server/lib/types.ts
index 2a1452e7b2fd3..15f40fdbc3019 100644
--- a/x-pack/plugins/security_solution/server/lib/types.ts
+++ b/x-pack/plugins/security_solution/server/lib/types.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-export { ConfigType as Configuration } from '../config';
+export type { ConfigType as Configuration } from '../config';
 import { TotalValue, BaseHit, Explanation } from '../../common/detection_engine/types';
 
 export interface ShardsResponse {
diff --git a/x-pack/plugins/security_solution/server/mocks.ts b/x-pack/plugins/security_solution/server/mocks.ts
index cff68527af4b9..bc8183666c7f3 100644
--- a/x-pack/plugins/security_solution/server/mocks.ts
+++ b/x-pack/plugins/security_solution/server/mocks.ts
@@ -11,6 +11,7 @@ type AppClientMock = jest.Mocked<AppClient>;
 const createAppClientMock = (): AppClientMock =>
   ({
     getSignalsIndex: jest.fn(),
+    getSourcererDataViewId: jest.fn().mockReturnValue('security-solution'),
   } as unknown as AppClientMock);
 
 export const siemMock = {
diff --git a/x-pack/plugins/security_solution/server/plugin.ts b/x-pack/plugins/security_solution/server/plugin.ts
index 307ccf4cfc977..3c281d8384628 100644
--- a/x-pack/plugins/security_solution/server/plugin.ts
+++ b/x-pack/plugins/security_solution/server/plugin.ts
@@ -64,8 +64,6 @@ import { licenseService } from './lib/license';
 import { PolicyWatcher } from './endpoint/lib/policy/license_watch';
 import { migrateArtifactsToFleet } from './endpoint/lib/artifacts/migrate_artifacts_to_fleet';
 import aadFieldConversion from './lib/detection_engine/routes/index/signal_aad_mapping.json';
-import { alertsFieldMap } from './lib/detection_engine/rule_types/field_maps/alerts';
-import { rulesFieldMap } from './lib/detection_engine/rule_types/field_maps/rules';
 import { registerEventLogProvider } from './lib/detection_engine/rule_execution_log/event_log_adapter/register_event_log_provider';
 import { getKibanaPrivilegesFeaturePrivileges, getCasesKibanaFeature } from './features';
 import { EndpointMetadataService } from './endpoint/services/metadata';
@@ -88,8 +86,9 @@ import type {
   SecuritySolutionPluginStart,
   PluginInitializerContext,
 } from './plugin_contract';
+import { alertsFieldMap, rulesFieldMap } from '../common/field_maps';
 
-export { SetupPlugins, StartPlugins, PluginSetup, PluginStart } from './plugin_contract';
+export type { SetupPlugins, StartPlugins, PluginSetup, PluginStart } from './plugin_contract';
 
 export class Plugin implements ISecuritySolutionPlugin {
   private readonly pluginContext: PluginInitializerContext;
@@ -245,7 +244,8 @@ export class Plugin implements ISecuritySolutionPlugin {
       ruleDataService,
       logger,
       ruleDataClient,
-      ruleOptions
+      ruleOptions,
+      core.getStartServices
     );
     registerEndpointRoutes(router, endpointContext);
     registerLimitedConcurrencyRoutes(core);
diff --git a/x-pack/plugins/security_solution/server/routes/index.ts b/x-pack/plugins/security_solution/server/routes/index.ts
index 20fbf44e77a48..dd66a4333ad15 100644
--- a/x-pack/plugins/security_solution/server/routes/index.ts
+++ b/x-pack/plugins/security_solution/server/routes/index.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { StartServicesAccessor } from 'kibana/server';
 import { Logger } from 'src/core/server';
 import { IRuleDataClient, RuleDataPluginService } from '../../../rule_registry/server';
 
@@ -56,7 +57,7 @@ import { persistNoteRoute } from '../lib/timeline/routes/notes';
 
 import { persistPinnedEventRoute } from '../lib/timeline/routes/pinned_events';
 
-import { SetupPlugins } from '../plugin';
+import { SetupPlugins, StartPlugins } from '../plugin';
 import { ConfigType } from '../config';
 import { TelemetryEventsSender } from '../lib/telemetry/sender';
 import { installPrepackedTimelinesRoute } from '../lib/timeline/routes/prepackaged_timelines/install_prepackaged_timelines';
@@ -64,6 +65,7 @@ import { previewRulesRoute } from '../lib/detection_engine/routes/rules/preview_
 import { CreateRuleOptions } from '../lib/detection_engine/rule_types/types';
 // eslint-disable-next-line no-restricted-imports
 import { legacyCreateLegacyNotificationRoute } from '../lib/detection_engine/routes/rules/legacy_create_legacy_notification';
+import { createSourcererDataViewRoute } from '../lib/sourcerer/routes';
 import { createPreviewIndexRoute } from '../lib/detection_engine/routes/index/create_preview_index_route';
 
 export const initRoutes = (
@@ -76,7 +78,8 @@ export const initRoutes = (
   ruleDataService: RuleDataPluginService,
   logger: Logger,
   ruleDataClient: IRuleDataClient | null,
-  ruleOptions: CreateRuleOptions
+  ruleOptions: CreateRuleOptions,
+  getStartServices: StartServicesAccessor<StartPlugins>
 ) => {
   const isRuleRegistryEnabled = ruleDataClient != null;
   // Detection Engine Rule routes that have the REST endpoints of /api/detection_engine/rules
@@ -149,4 +152,7 @@ export const initRoutes = (
 
   // Privileges API to get the generic user privileges
   readPrivilegesRoute(router, hasEncryptionKey);
+
+  // Sourcerer API to generate default pattern
+  createSourcererDataViewRoute(router, getStartServices);
 };
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/helpers.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/helpers.ts
index fbc51aa0360ce..918d3aadfd6e8 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/helpers.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/helpers.ts
@@ -209,7 +209,8 @@ export const getHostEndpoint = async (
       ? getPendingActionCounts(
           esClient.asInternalUser,
           endpointContext.service.getEndpointMetadataService(),
-          [fleetAgentId]
+          [fleetAgentId],
+          endpointContext.experimentalFeatures.pendingActionResponsesWithAck
         )
           .then((results) => {
             return results[0].pending_actions;
diff --git a/x-pack/plugins/security_solution/server/utils/read_stream/create_stream_from_ndjson.ts b/x-pack/plugins/security_solution/server/utils/read_stream/create_stream_from_ndjson.ts
index 914c684fe8813..856d9b00dca7b 100644
--- a/x-pack/plugins/security_solution/server/utils/read_stream/create_stream_from_ndjson.ts
+++ b/x-pack/plugins/security_solution/server/utils/read_stream/create_stream_from_ndjson.ts
@@ -34,12 +34,6 @@ export const filterExportedCounts = (): Transform => {
   );
 };
 
-export const filterExportedRulesCounts = (): Transform => {
-  return createFilterStream<ImportRulesSchemaDecoded | RulesObjectsExportResultDetails>(
-    (obj) => obj != null && !has('exported_rules_count', obj)
-  );
-};
-
 export const filterExceptions = (): Transform => {
   return createFilterStream<ImportRulesSchemaDecoded | RulesObjectsExportResultDetails>(
     (obj) => obj != null && !has('list_id', obj)
diff --git a/x-pack/plugins/snapshot_restore/__jest__/client_integration/helpers/index.ts b/x-pack/plugins/snapshot_restore/__jest__/client_integration/helpers/index.ts
index 231b88c39aeb8..e28409871fb4d 100644
--- a/x-pack/plugins/snapshot_restore/__jest__/client_integration/helpers/index.ts
+++ b/x-pack/plugins/snapshot_restore/__jest__/client_integration/helpers/index.ts
@@ -13,7 +13,8 @@ import { setup as policyAddSetup } from './policy_add.helpers';
 import { setup as policyEditSetup } from './policy_edit.helpers';
 import { setup as restoreSnapshotSetup } from './restore_snapshot.helpers';
 
-export { nextTick, getRandomString, findTestSubject, TestBed, delay } from '@kbn/test/jest';
+export type { TestBed } from '@kbn/test/jest';
+export { nextTick, getRandomString, findTestSubject, delay } from '@kbn/test/jest';
 
 export { setupEnvironment } from './setup_environment';
 
diff --git a/x-pack/plugins/snapshot_restore/public/application/components/index.ts b/x-pack/plugins/snapshot_restore/public/application/components/index.ts
index 642f59d12c6f2..77f53a3533a16 100644
--- a/x-pack/plugins/snapshot_restore/public/application/components/index.ts
+++ b/x-pack/plugins/snapshot_restore/public/application/components/index.ts
@@ -17,12 +17,8 @@ export { RestoreSnapshotForm } from './restore_snapshot_form';
 export { PolicyExecuteProvider } from './policy_execute_provider';
 export { PolicyDeleteProvider } from './policy_delete_provider';
 export { CollapsibleIndicesList, CollapsibleDataStreamsList } from './collapsible_lists';
-export {
-  RetentionSettingsUpdateModalProvider,
-  UpdateRetentionSettings,
-} from './retention_update_modal_provider';
-export {
-  RetentionExecuteModalProvider,
-  ExecuteRetention,
-} from './retention_execute_modal_provider';
+export type { UpdateRetentionSettings } from './retention_update_modal_provider';
+export { RetentionSettingsUpdateModalProvider } from './retention_update_modal_provider';
+export type { ExecuteRetention } from './retention_execute_modal_provider';
+export { RetentionExecuteModalProvider } from './retention_execute_modal_provider';
 export { PolicyForm } from './policy_form';
diff --git a/x-pack/plugins/snapshot_restore/public/application/index.tsx b/x-pack/plugins/snapshot_restore/public/application/index.tsx
index c0b438e1761c6..69b4b2dab1b34 100644
--- a/x-pack/plugins/snapshot_restore/public/application/index.tsx
+++ b/x-pack/plugins/snapshot_restore/public/application/index.tsx
@@ -37,4 +37,4 @@ export const renderApp = (elem: Element, dependencies: AppDependencies) => {
   };
 };
 
-export { AppDependencies };
+export type { AppDependencies };
diff --git a/x-pack/plugins/snapshot_restore/public/application/lib/index.ts b/x-pack/plugins/snapshot_restore/public/application/lib/index.ts
index 19a42bef4cea4..1462728e756b8 100644
--- a/x-pack/plugins/snapshot_restore/public/application/lib/index.ts
+++ b/x-pack/plugins/snapshot_restore/public/application/lib/index.ts
@@ -7,10 +7,8 @@
 
 export { useDecodedParams } from './use_decoded_params';
 
+export type { SortField, SortDirection, SnapshotListParams } from './snapshot_list_params';
 export {
-  SortField,
-  SortDirection,
-  SnapshotListParams,
   getListParams,
   getQueryFromListParams,
   DEFAULT_SNAPSHOT_LIST_PARAMS,
diff --git a/x-pack/plugins/snapshot_restore/public/application/services/validation/index.ts b/x-pack/plugins/snapshot_restore/public/application/services/validation/index.ts
index 90eca1f9fd1dd..92d2e4117d067 100644
--- a/x-pack/plugins/snapshot_restore/public/application/services/validation/index.ts
+++ b/x-pack/plugins/snapshot_restore/public/application/services/validation/index.ts
@@ -5,12 +5,11 @@
  * 2.0.
  */
 
-export {
-  RepositoryValidation,
-  RepositorySettingsValidation,
-  validateRepository,
-} from './validate_repository';
+export type { RepositoryValidation, RepositorySettingsValidation } from './validate_repository';
+export { validateRepository } from './validate_repository';
 
-export { RestoreValidation, validateRestore } from './validate_restore';
+export type { RestoreValidation } from './validate_restore';
+export { validateRestore } from './validate_restore';
 
-export { PolicyValidation, validatePolicy, ValidatePolicyHelperData } from './validate_policy';
+export type { PolicyValidation, ValidatePolicyHelperData } from './validate_policy';
+export { validatePolicy } from './validate_policy';
diff --git a/x-pack/plugins/snapshot_restore/public/shared_imports.ts b/x-pack/plugins/snapshot_restore/public/shared_imports.ts
index a3cda90d26f2a..cc86117d1f84a 100644
--- a/x-pack/plugins/snapshot_restore/public/shared_imports.ts
+++ b/x-pack/plugins/snapshot_restore/public/shared_imports.ts
@@ -5,22 +5,24 @@
  * 2.0.
  */
 
+export type {
+  Error,
+  Frequency,
+  SendRequestConfig,
+  SendRequestResponse,
+  UseRequestResponse,
+  UseRequestConfig,
+} from '../../../../src/plugins/es_ui_shared/public';
 export {
   AuthorizationProvider,
   CronEditor,
-  Error,
-  Frequency,
   NotAuthorizedSection,
   SectionError,
   PageError,
   PageLoading,
   sendRequest,
-  SendRequestConfig,
-  SendRequestResponse,
-  UseRequestResponse,
   useAuthorizationContext,
   useRequest,
-  UseRequestConfig,
   WithPrivileges,
   EuiCodeEditor,
 } from '../../../../src/plugins/es_ui_shared/public';
diff --git a/x-pack/plugins/snapshot_restore/server/test/helpers/index.ts b/x-pack/plugins/snapshot_restore/server/test/helpers/index.ts
index 475d4d9a3e170..682b520c12b00 100644
--- a/x-pack/plugins/snapshot_restore/server/test/helpers/index.ts
+++ b/x-pack/plugins/snapshot_restore/server/test/helpers/index.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
-export { RouterMock, RequestMock } from './router_mock';
+export type { RequestMock } from './router_mock';
+export { RouterMock } from './router_mock';
 
 export { routeDependencies } from './route_dependencies';
diff --git a/x-pack/plugins/spaces/common/licensing/index.ts b/x-pack/plugins/spaces/common/licensing/index.ts
index f7dd998a7561c..5c23f035c84c5 100644
--- a/x-pack/plugins/spaces/common/licensing/index.ts
+++ b/x-pack/plugins/spaces/common/licensing/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { SpacesLicenseService, SpacesLicense } from './license_service';
+export type { SpacesLicense } from './license_service';
+export { SpacesLicenseService } from './license_service';
diff --git a/x-pack/plugins/spaces/public/index.ts b/x-pack/plugins/spaces/public/index.ts
index fe04358e30483..86f1afd234be3 100644
--- a/x-pack/plugins/spaces/public/index.ts
+++ b/x-pack/plugins/spaces/public/index.ts
@@ -9,7 +9,7 @@ import { SpacesPlugin } from './plugin';
 
 export { getSpaceColor, getSpaceImageUrl, getSpaceInitials } from './space_avatar';
 
-export { SpacesPluginSetup, SpacesPluginStart } from './plugin';
+export type { SpacesPluginSetup, SpacesPluginStart } from './plugin';
 
 export type { Space, GetAllSpacesPurpose, GetSpaceResult } from '../common';
 
diff --git a/x-pack/plugins/spaces/server/index.ts b/x-pack/plugins/spaces/server/index.ts
index ad27069759198..6628d75a36494 100644
--- a/x-pack/plugins/spaces/server/index.ts
+++ b/x-pack/plugins/spaces/server/index.ts
@@ -19,9 +19,13 @@ export { addSpaceIdToPath } from '../common';
 
 // end public contract exports
 
-export { SpacesPluginSetup, SpacesPluginStart } from './plugin';
-export { SpacesServiceSetup, SpacesServiceStart } from './spaces_service';
-export { ISpacesClient, SpacesClientRepositoryFactory, SpacesClientWrapper } from './spaces_client';
+export type { SpacesPluginSetup, SpacesPluginStart } from './plugin';
+export type { SpacesServiceSetup, SpacesServiceStart } from './spaces_service';
+export type {
+  ISpacesClient,
+  SpacesClientRepositoryFactory,
+  SpacesClientWrapper,
+} from './spaces_client';
 
 export type {
   Space,
diff --git a/x-pack/plugins/spaces/server/lib/copy_to_spaces/index.ts b/x-pack/plugins/spaces/server/lib/copy_to_spaces/index.ts
index a4283d9837085..a100056c57bcd 100644
--- a/x-pack/plugins/spaces/server/lib/copy_to_spaces/index.ts
+++ b/x-pack/plugins/spaces/server/lib/copy_to_spaces/index.ts
@@ -7,4 +7,4 @@
 
 export { copySavedObjectsToSpacesFactory } from './copy_to_spaces';
 export { resolveCopySavedObjectsToSpacesConflictsFactory } from './resolve_copy_conflicts';
-export { CopyResponse } from './types';
+export type { CopyResponse } from './types';
diff --git a/x-pack/plugins/spaces/server/spaces_client/index.ts b/x-pack/plugins/spaces/server/spaces_client/index.ts
index 124d94ba07f2f..b60d4fa2686f0 100644
--- a/x-pack/plugins/spaces/server/spaces_client/index.ts
+++ b/x-pack/plugins/spaces/server/spaces_client/index.ts
@@ -5,11 +5,12 @@
  * 2.0.
  */
 
-export { SpacesClient, ISpacesClient } from './spaces_client';
-export {
-  SpacesClientService,
+export type { ISpacesClient } from './spaces_client';
+export { SpacesClient } from './spaces_client';
+export type {
   SpacesClientServiceSetup,
   SpacesClientServiceStart,
   SpacesClientRepositoryFactory,
   SpacesClientWrapper,
 } from './spaces_client_service';
+export { SpacesClientService } from './spaces_client_service';
diff --git a/x-pack/plugins/spaces/server/spaces_service/index.ts b/x-pack/plugins/spaces/server/spaces_service/index.ts
index adb311c2048e9..1fd77f742866d 100644
--- a/x-pack/plugins/spaces/server/spaces_service/index.ts
+++ b/x-pack/plugins/spaces/server/spaces_service/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { SpacesService, SpacesServiceSetup, SpacesServiceStart } from './spaces_service';
+export type { SpacesServiceSetup, SpacesServiceStart } from './spaces_service';
+export { SpacesService } from './spaces_service';
diff --git a/x-pack/plugins/spaces/server/usage_stats/index.ts b/x-pack/plugins/spaces/server/usage_stats/index.ts
index e8cba8fb19884..d3e736e174166 100644
--- a/x-pack/plugins/spaces/server/usage_stats/index.ts
+++ b/x-pack/plugins/spaces/server/usage_stats/index.ts
@@ -6,5 +6,6 @@
  */
 
 export { SPACES_USAGE_STATS_TYPE } from './constants';
-export { UsageStatsService, UsageStatsServiceSetup } from './usage_stats_service';
-export { UsageStats } from './types';
+export type { UsageStatsServiceSetup } from './usage_stats_service';
+export { UsageStatsService } from './usage_stats_service';
+export type { UsageStats } from './types';
diff --git a/x-pack/plugins/stack_alerts/server/types.ts b/x-pack/plugins/stack_alerts/server/types.ts
index b78aa4e6432d5..a339e0b24921c 100644
--- a/x-pack/plugins/stack_alerts/server/types.ts
+++ b/x-pack/plugins/stack_alerts/server/types.ts
@@ -8,7 +8,7 @@
 import { PluginStartContract as TriggersActionsUiStartContract } from '../../triggers_actions_ui/server';
 import { PluginSetupContract as AlertingSetup } from '../../alerting/server';
 
-export {
+export type {
   PluginSetupContract as AlertingSetup,
   AlertType,
   RuleParamsAndRefs,
diff --git a/x-pack/plugins/task_manager/server/index.ts b/x-pack/plugins/task_manager/server/index.ts
index d078c7b78ad94..58fba0b6f68c7 100644
--- a/x-pack/plugins/task_manager/server/index.ts
+++ b/x-pack/plugins/task_manager/server/index.ts
@@ -30,7 +30,7 @@ export {
   throwUnrecoverableError,
   isEphemeralTaskRejectedDueToCapacityError,
 } from './task_running';
-export { RunNowResult } from './task_scheduling';
+export type { RunNowResult } from './task_scheduling';
 export { getOldestIdleActionTask } from './queries/oldest_idle_action_task';
 
 export type {
diff --git a/x-pack/plugins/task_manager/server/monitoring/index.ts b/x-pack/plugins/task_manager/server/monitoring/index.ts
index 99a4e31dbdb02..a352ec55f2dbc 100644
--- a/x-pack/plugins/task_manager/server/monitoring/index.ts
+++ b/x-pack/plugins/task_manager/server/monitoring/index.ts
@@ -18,10 +18,9 @@ import { TaskPollingLifecycle } from '../polling_lifecycle';
 import { ManagedConfiguration } from '../lib/create_managed_configuration';
 import { EphemeralTaskLifecycle } from '../ephemeral_task_lifecycle';
 
+export type { MonitoringStats, RawMonitoringStats } from './monitoring_stats_stream';
 export {
-  MonitoringStats,
   HealthStatus,
-  RawMonitoringStats,
   summarizeMonitoringStats,
   createAggregators,
   createMonitoringStatsStream,
diff --git a/x-pack/plugins/task_manager/server/monitoring/monitoring_stats_stream.ts b/x-pack/plugins/task_manager/server/monitoring/monitoring_stats_stream.ts
index 08badf8fe1c9d..5175525b15cf1 100644
--- a/x-pack/plugins/task_manager/server/monitoring/monitoring_stats_stream.ts
+++ b/x-pack/plugins/task_manager/server/monitoring/monitoring_stats_stream.ts
@@ -37,7 +37,7 @@ import { ManagedConfiguration } from '../lib/create_managed_configuration';
 import { EphemeralTaskLifecycle } from '../ephemeral_task_lifecycle';
 import { CapacityEstimationStat, withCapacityEstimate } from './capacity_estimation';
 
-export { AggregatedStatProvider, AggregatedStat } from './runtime_statistics_aggregator';
+export type { AggregatedStatProvider, AggregatedStat } from './runtime_statistics_aggregator';
 
 export interface MonitoringStats {
   last_update: string;
diff --git a/x-pack/plugins/timelines/common/constants.ts b/x-pack/plugins/timelines/common/constants.ts
index 262ab841492e3..bc22c761c24e0 100644
--- a/x-pack/plugins/timelines/common/constants.ts
+++ b/x-pack/plugins/timelines/common/constants.ts
@@ -22,3 +22,5 @@ export const FILTER_ACKNOWLEDGED: AlertStatus = 'acknowledged';
 
 export const RAC_ALERTS_BULK_UPDATE_URL = '/internal/rac/alerts/bulk_update';
 export const DETECTION_ENGINE_SIGNALS_STATUS_URL = '/api/detection_engine/signals/status';
+
+export const DELETED_SECURITY_SOLUTION_DATA_VIEW = 'DELETED_SECURITY_SOLUTION_DATA_VIEW';
diff --git a/x-pack/plugins/timelines/common/index.ts b/x-pack/plugins/timelines/common/index.ts
index 2242a6951c750..004742c3ee3d4 100644
--- a/x-pack/plugins/timelines/common/index.ts
+++ b/x-pack/plugins/timelines/common/index.ts
@@ -8,6 +8,8 @@
 // TODO: https://github.com/elastic/kibana/issues/110904
 /* eslint-disable @kbn/eslint/no_export_all */
 
+export { DELETED_SECURITY_SOLUTION_DATA_VIEW } from './constants';
+
 export * from './types';
 export * from './search_strategy';
 export * from './utils/accessibility';
diff --git a/x-pack/plugins/timelines/common/search_strategy/index_fields/index.ts b/x-pack/plugins/timelines/common/search_strategy/index_fields/index.ts
index d207cf21fcb36..3579a45d2fcbb 100644
--- a/x-pack/plugins/timelines/common/search_strategy/index_fields/index.ts
+++ b/x-pack/plugins/timelines/common/search_strategy/index_fields/index.ts
@@ -5,13 +5,18 @@
  * 2.0.
  */
 
-import { IFieldSubType, IndexPatternBase } from '@kbn/es-query';
-import { IEsSearchRequest, IEsSearchResponse } from '../../../../../../src/plugins/data/common';
-import { DocValueFields, Maybe } from '../common';
+import type { IFieldSubType } from '@kbn/es-query';
+import type { MappingRuntimeFields } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
+import type {
+  IEsSearchRequest,
+  IEsSearchResponse,
+} from '../../../../../../src/plugins/data/common';
+import type { DocValueFields, Maybe } from '../common';
+import { FieldSpec } from '../../../../../../src/plugins/data/common';
 
 export type BeatFieldsFactoryQueryType = 'beatFields';
 
-interface FieldInfo {
+export interface FieldInfo {
   category: string;
   description?: string;
   example?: string | number;
@@ -20,40 +25,37 @@ interface FieldInfo {
   type?: string;
 }
 
-export interface IndexField {
+export interface IndexField extends Omit<FieldSpec, 'format'> {
   /** Where the field belong */
   category: string;
   /** Example of field's value */
   example?: Maybe<string | number>;
   /** whether the field's belong to an alias index */
   indexes: Array<Maybe<string>>;
-  /** The name of the field */
-  name: string;
-  /** The type of the field's values as recognized by Kibana */
-  type: string;
-  /** Whether the field's values can be efficiently searched for */
-  searchable: boolean;
-  /** Whether the field's values can be aggregated */
-  aggregatable: boolean;
   /** Description of the field */
   description?: Maybe<string>;
   format?: Maybe<string>;
-  /** the elastic type as mapped in the index */
-  esTypes?: string[];
-  subType?: IFieldSubType;
-  readFromDocValues: boolean;
 }
 
 export type BeatFields = Record<string, FieldInfo>;
 
-export interface IndexFieldsStrategyRequest extends IEsSearchRequest {
+export interface IndexFieldsStrategyRequestByIndices extends IEsSearchRequest {
   indices: string[];
   onlyCheckIfIndicesExist: boolean;
 }
+export interface IndexFieldsStrategyRequestById extends IEsSearchRequest {
+  dataViewId: string;
+  onlyCheckIfIndicesExist: boolean;
+}
+
+export type IndexFieldsStrategyRequest<T extends 'indices' | 'dataView'> = T extends 'dataView'
+  ? IndexFieldsStrategyRequestById
+  : IndexFieldsStrategyRequestByIndices;
 
 export interface IndexFieldsStrategyResponse extends IEsSearchResponse {
   indexFields: IndexField[];
   indicesExist: string[];
+  runtimeMappings: MappingRuntimeFields;
 }
 
 export interface BrowserField {
@@ -68,13 +70,11 @@ export interface BrowserField {
   searchable: boolean;
   type: string;
   subType?: IFieldSubType;
+  readFromDocValues: boolean;
 }
 
 export type BrowserFields = Readonly<Record<string, Partial<BrowserField>>>;
 
 export const EMPTY_BROWSER_FIELDS = {};
 export const EMPTY_DOCVALUE_FIELD: DocValueFields[] = [];
-export const EMPTY_INDEX_PATTERN: IndexPatternBase = {
-  fields: [],
-  title: '',
-};
+export const EMPTY_INDEX_FIELDS: FieldSpec[] = [];
diff --git a/x-pack/plugins/timelines/common/search_strategy/timeline/events/all/index.ts b/x-pack/plugins/timelines/common/search_strategy/timeline/events/all/index.ts
index 4bb9928aa6b97..9ff370482ef08 100644
--- a/x-pack/plugins/timelines/common/search_strategy/timeline/events/all/index.ts
+++ b/x-pack/plugins/timelines/common/search_strategy/timeline/events/all/index.ts
@@ -7,6 +7,7 @@
 
 import { JsonObject } from '@kbn/utility-types';
 
+import { MappingRuntimeFields } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import type { IEsSearchResponse } from '../../../../../../../../src/plugins/data/common';
 import type { Ecs } from '../../../../ecs';
 import type { CursorType, Inspect, Maybe, PaginationInputPaginated } from '../../../common';
@@ -38,9 +39,10 @@ export interface TimelineEventsAllStrategyResponse extends IEsSearchResponse {
 }
 
 export interface TimelineEventsAllRequestOptions extends TimelineRequestOptionsPaginated {
-  fields: string[] | Array<{ field: string; include_unmapped: boolean }>;
+  authFilter?: JsonObject;
+  excludeEcsData?: boolean;
   fieldRequested: string[];
+  fields: string[] | Array<{ field: string; include_unmapped: boolean }>;
   language: 'eql' | 'kuery' | 'lucene';
-  excludeEcsData?: boolean;
-  authFilter?: JsonObject;
+  runtimeMappings: MappingRuntimeFields;
 }
diff --git a/x-pack/plugins/timelines/common/search_strategy/timeline/events/last_event_time/index.ts b/x-pack/plugins/timelines/common/search_strategy/timeline/events/last_event_time/index.ts
index 9a2d884af948f..8673359d230b4 100644
--- a/x-pack/plugins/timelines/common/search_strategy/timeline/events/last_event_time/index.ts
+++ b/x-pack/plugins/timelines/common/search_strategy/timeline/events/last_event_time/index.ts
@@ -26,6 +26,7 @@ export interface TimelineEventsLastEventTimeStrategyResponse extends IEsSearchRe
   lastSeen: Maybe<string>;
   inspect?: Maybe<Inspect>;
 }
+export type TimelineKpiStrategyRequest = Omit<TimelineRequestBasicOptions, 'runtimeMappings'>;
 
 export interface TimelineKpiStrategyResponse extends IEsSearchResponse {
   destinationIpCount: number;
@@ -37,7 +38,7 @@ export interface TimelineKpiStrategyResponse extends IEsSearchResponse {
 }
 
 export interface TimelineEventsLastEventTimeRequestOptions
-  extends Omit<TimelineRequestBasicOptions, 'filterQuery' | 'timerange'> {
+  extends Omit<TimelineRequestBasicOptions, 'filterQuery' | 'timerange' | 'runtimeMappings'> {
   indexKey: LastEventIndexKey;
   details: LastTimeDetails;
 }
diff --git a/x-pack/plugins/timelines/common/search_strategy/timeline/index.ts b/x-pack/plugins/timelines/common/search_strategy/timeline/index.ts
index 7cf5b6b22d163..f576392910495 100644
--- a/x-pack/plugins/timelines/common/search_strategy/timeline/index.ts
+++ b/x-pack/plugins/timelines/common/search_strategy/timeline/index.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { MappingRuntimeFields } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import { IEsSearchRequest } from '../../../../../../src/plugins/data/common';
 import { ESQuery } from '../../typed_json';
 import {
@@ -43,6 +44,7 @@ export interface TimelineRequestBasicOptions extends IEsSearchRequest {
   docValueFields?: DocValueFields[];
   factoryQueryType?: TimelineFactoryQueryTypes;
   entityType?: EntityType;
+  runtimeMappings: MappingRuntimeFields;
 }
 
 export interface TimelineRequestSortField<Field = string> extends SortField<Field> {
diff --git a/x-pack/plugins/timelines/common/types/timeline/cells/index.ts b/x-pack/plugins/timelines/common/types/timeline/cells/index.ts
index ce22d87c0a59a..e922fed97a4df 100644
--- a/x-pack/plugins/timelines/common/types/timeline/cells/index.ts
+++ b/x-pack/plugins/timelines/common/types/timeline/cells/index.ts
@@ -23,6 +23,7 @@ export type CellValueElementProps = EuiDataGridCellValueElementProps & {
   globalFilters?: Filter[];
   header: ColumnHeaderOptions;
   isDraggable: boolean;
+  isTimeline?: boolean; // Default cell renderer is used for both the alert table and timeline. This allows us to cheaply separate concerns
   linkValues: string[] | undefined;
   rowRenderers?: RowRenderer[];
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
diff --git a/x-pack/plugins/timelines/kibana.json b/x-pack/plugins/timelines/kibana.json
index 0239dcdd8f166..11adf42b3a6b4 100644
--- a/x-pack/plugins/timelines/kibana.json
+++ b/x-pack/plugins/timelines/kibana.json
@@ -11,5 +11,5 @@
   "server": true,
   "ui": true,
   "requiredPlugins": ["alerting", "cases", "data", "dataEnhanced", "kibanaReact", "kibanaUtils"],
-  "optionalPlugins": []
+  "optionalPlugins": ["security"]
 }
diff --git a/x-pack/plugins/timelines/public/components/clipboard/with_copy_to_clipboard.tsx b/x-pack/plugins/timelines/public/components/clipboard/with_copy_to_clipboard.tsx
index a62f52c27cf70..714e2c5fcb8fe 100644
--- a/x-pack/plugins/timelines/public/components/clipboard/with_copy_to_clipboard.tsx
+++ b/x-pack/plugins/timelines/public/components/clipboard/with_copy_to_clipboard.tsx
@@ -26,7 +26,7 @@ export const WithCopyToClipboard = React.memo<{
   showTooltip?: boolean;
   text: string;
   titleSummary?: string;
-}>(({ isHoverAction, keyboardShortcut = '', showTooltip = false, text, titleSummary }) => {
+}>(({ isHoverAction, keyboardShortcut = '', showTooltip = true, text, titleSummary }) => {
   return showTooltip ? (
     <EuiToolTip
       content={
diff --git a/x-pack/plugins/timelines/public/components/hover_actions/actions/filter_out_value.tsx b/x-pack/plugins/timelines/public/components/hover_actions/actions/filter_out_value.tsx
index 04fbbab76d850..b4867936588ef 100644
--- a/x-pack/plugins/timelines/public/components/hover_actions/actions/filter_out_value.tsx
+++ b/x-pack/plugins/timelines/public/components/hover_actions/actions/filter_out_value.tsx
@@ -36,7 +36,7 @@ const FilterOutValueButton: React.FC<HoverActionComponentProps & FilterValueFnAr
   }) => {
     const filterOutValueFn = useCallback(() => {
       const makeFilter = (currentVal: string | null | undefined) =>
-        currentVal?.length === 0
+        currentVal == null || currentVal?.length === 0
           ? createFilter(field, null, false)
           : createFilter(field, currentVal, true);
       const filters = Array.isArray(value)
diff --git a/x-pack/plugins/timelines/public/components/t_grid/body/sort/index.ts b/x-pack/plugins/timelines/public/components/t_grid/body/sort/index.ts
index e514e4f4e2618..9e653e1b2bb8e 100644
--- a/x-pack/plugins/timelines/public/components/t_grid/body/sort/index.ts
+++ b/x-pack/plugins/timelines/public/components/t_grid/body/sort/index.ts
@@ -9,7 +9,7 @@ import { SortDirection } from '../../../../../common/types/timeline';
 import type { SortColumnTimeline } from '../../../../../common/types/timeline';
 
 // TODO: Cleanup this type to match SortColumnTimeline
-export { SortDirection };
+export type { SortDirection };
 
 /** Specifies which column the timeline is sorted on */
 export type Sort = SortColumnTimeline;
diff --git a/x-pack/plugins/timelines/public/components/t_grid/helpers.tsx b/x-pack/plugins/timelines/public/components/t_grid/helpers.tsx
index e2eb1d4d04547..617c166c37384 100644
--- a/x-pack/plugins/timelines/public/components/t_grid/helpers.tsx
+++ b/x-pack/plugins/timelines/public/components/t_grid/helpers.tsx
@@ -6,7 +6,7 @@
  */
 
 import type { Filter, EsQueryConfig, Query } from '@kbn/es-query';
-import { FilterStateStore } from '@kbn/es-query';
+import { DataViewBase, FilterStateStore } from '@kbn/es-query';
 import { isEmpty, get } from 'lodash/fp';
 import memoizeOne from 'memoize-one';
 import { ALERT_WORKFLOW_STATUS } from '@kbn/rule-data-utils';
@@ -17,7 +17,6 @@ import {
   handleSkipFocus,
   stopPropagationAndPreventDefault,
 } from '../../../common';
-import { IIndexPattern } from '../../../../../../src/plugins/data/public';
 import type { BrowserFields } from '../../../common/search_strategy/index_fields';
 import { DataProviderType, EXISTS_OPERATOR } from '../../../common/types/timeline';
 import type { DataProvider, DataProvidersAnd } from '../../../common/types/timeline';
@@ -138,7 +137,7 @@ export const buildGlobalQuery = (dataProviders: DataProvider[], browserFields: B
 interface CombineQueries {
   config: EsQueryConfig;
   dataProviders: DataProvider[];
-  indexPattern: IIndexPattern;
+  indexPattern: DataViewBase;
   browserFields: BrowserFields;
   filters: Filter[];
   kqlQuery: Query;
diff --git a/x-pack/plugins/timelines/public/components/t_grid/integrated/index.tsx b/x-pack/plugins/timelines/public/components/t_grid/integrated/index.tsx
index e363297d04be5..614857c26cbb1 100644
--- a/x-pack/plugins/timelines/public/components/t_grid/integrated/index.tsx
+++ b/x-pack/plugins/timelines/public/components/t_grid/integrated/index.tsx
@@ -14,6 +14,8 @@ import React, { useEffect, useMemo, useRef, useState } from 'react';
 import styled from 'styled-components';
 import { useDispatch } from 'react-redux';
 
+import { MappingRuntimeFields } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
+import { DataViewBase, Filter, Query } from '@kbn/es-query';
 import { useKibana } from '../../../../../../../src/plugins/kibana_react/public';
 import { Direction, EntityType } from '../../../../common/search_strategy';
 import type { DocValueFields } from '../../../../common/search_strategy';
@@ -34,13 +36,7 @@ import type {
   RowRenderer,
   AlertStatus,
 } from '../../../../common/types/timeline';
-import {
-  esQuery,
-  Filter,
-  IIndexPattern,
-  Query,
-  DataPublicPluginStart,
-} from '../../../../../../../src/plugins/data/public';
+import { esQuery, DataPublicPluginStart } from '../../../../../../../src/plugins/data/public';
 import { useDeepEqualSelector } from '../../../hooks/use_selector';
 import { defaultHeaders } from '../body/column_headers/default_headers';
 import { buildCombinedQuery, getCombinedFilterQuery, resolverIsShowing } from '../helpers';
@@ -119,7 +115,7 @@ export interface TGridIntegratedProps {
   height?: number;
   id: TimelineId;
   indexNames: string[];
-  indexPattern: IIndexPattern;
+  indexPattern: DataViewBase;
   isLive: boolean;
   isLoadingIndexPattern: boolean;
   itemsPerPage: number;
@@ -130,6 +126,7 @@ export interface TGridIntegratedProps {
   query: Query;
   renderCellValue: (props: CellValueElementProps) => React.ReactNode;
   rowRenderers: RowRenderer[];
+  runtimeMappings: MappingRuntimeFields;
   setQuery: (inspect: InspectResponse, loading: boolean, refetch: Refetch) => void;
   sort: Sort[];
   start: string;
@@ -168,6 +165,7 @@ const TGridIntegratedComponent: React.FC<TGridIntegratedProps> = ({
   query,
   renderCellValue,
   rowRenderers,
+  runtimeMappings,
   setQuery,
   sort,
   start,
@@ -241,6 +239,7 @@ const TGridIntegratedComponent: React.FC<TGridIntegratedProps> = ({
       id,
       indexNames,
       limit: itemsPerPage,
+      runtimeMappings,
       skip: !canQueryTimeline,
       sort: sortField,
       startDate: start,
diff --git a/x-pack/plugins/timelines/public/components/t_grid/standalone/index.tsx b/x-pack/plugins/timelines/public/components/t_grid/standalone/index.tsx
index ae092d8634bb7..4ae8e1e191d80 100644
--- a/x-pack/plugins/timelines/public/components/t_grid/standalone/index.tsx
+++ b/x-pack/plugins/timelines/public/components/t_grid/standalone/index.tsx
@@ -9,6 +9,7 @@ import { isEmpty } from 'lodash/fp';
 import React, { useEffect, useMemo, useState, useRef } from 'react';
 import styled from 'styled-components';
 import { useDispatch, useSelector } from 'react-redux';
+import { MappingRuntimeFields } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import { useKibana } from '../../../../../../../src/plugins/kibana_react/public';
 import { Direction, EntityType } from '../../../../common/search_strategy';
 import type { CoreStart } from '../../../../../../../src/core/public';
@@ -107,6 +108,7 @@ export interface TGridStandaloneProps {
   onRuleChange?: () => void;
   renderCellValue: (props: CellValueElementProps) => React.ReactNode;
   rowRenderers: RowRenderer[];
+  runtimeMappings: MappingRuntimeFields;
   setRefetch: (ref: () => void) => void;
   start: string;
   sort: SortColumnTimeline[];
@@ -138,6 +140,7 @@ const TGridStandaloneComponent: React.FC<TGridStandaloneProps> = ({
   query,
   renderCellValue,
   rowRenderers,
+  runtimeMappings,
   setRefetch,
   start,
   sort,
@@ -221,6 +224,7 @@ const TGridStandaloneComponent: React.FC<TGridStandaloneProps> = ({
     id: STANDALONE_ID,
     indexNames,
     limit: itemsPerPageStore,
+    runtimeMappings,
     sort: sortField,
     startDate: start,
     endDate: end,
diff --git a/x-pack/plugins/timelines/public/components/utils/keury/index.ts b/x-pack/plugins/timelines/public/components/utils/keury/index.ts
index 3eb03cc63543e..776f5883a57d5 100644
--- a/x-pack/plugins/timelines/public/components/utils/keury/index.ts
+++ b/x-pack/plugins/timelines/public/components/utils/keury/index.ts
@@ -11,14 +11,14 @@ import {
   EsQueryConfig,
   Filter,
   fromKueryExpression,
-  IndexPatternBase,
+  DataViewBase,
   Query,
   toElasticsearchQuery,
 } from '@kbn/es-query';
 
 export const convertKueryToElasticSearchQuery = (
   kueryExpression: string,
-  indexPattern?: IndexPatternBase
+  indexPattern?: DataViewBase
 ) => {
   try {
     return kueryExpression
@@ -29,10 +29,7 @@ export const convertKueryToElasticSearchQuery = (
   }
 };
 
-export const convertKueryToDslFilter = (
-  kueryExpression: string,
-  indexPattern: IndexPatternBase
-) => {
+export const convertKueryToDslFilter = (kueryExpression: string, indexPattern: DataViewBase) => {
   try {
     return kueryExpression
       ? toElasticsearchQuery(fromKueryExpression(kueryExpression), indexPattern)
@@ -74,7 +71,7 @@ export const convertToBuildEsQuery = ({
   filters,
 }: {
   config: EsQueryConfig;
-  indexPattern: IndexPatternBase;
+  indexPattern: DataViewBase;
   queries: Query[];
   filters: Filter[];
 }) => {
diff --git a/x-pack/plugins/timelines/public/container/index.tsx b/x-pack/plugins/timelines/public/container/index.tsx
index 30245ea9f17af..fa27b8264a38e 100644
--- a/x-pack/plugins/timelines/public/container/index.tsx
+++ b/x-pack/plugins/timelines/public/container/index.tsx
@@ -11,6 +11,7 @@ import { isEmpty, isString, noop } from 'lodash/fp';
 import { useCallback, useEffect, useRef, useState } from 'react';
 import { useDispatch } from 'react-redux';
 import { Subscription } from 'rxjs';
+import { MappingRuntimeFields } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import { tGridActions } from '..';
 
 import {
@@ -69,22 +70,23 @@ type TimelineRequest<T extends KueryFilterQueryKind> = TimelineEventsAllRequestO
 type TimelineResponse<T extends KueryFilterQueryKind> = TimelineEventsAllStrategyResponse;
 
 export interface UseTimelineEventsProps {
+  alertConsumers?: AlertConsumers[];
+  data?: DataPublicPluginStart;
   docValueFields?: DocValueFields[];
-  filterQuery?: ESQuery | string;
-  skip?: boolean;
   endDate: string;
   entityType: EntityType;
   excludeEcsData?: boolean;
-  id: string;
   fields: string[];
+  filterQuery?: ESQuery | string;
+  id: string;
   indexNames: string[];
   language?: KueryFilterQueryKind;
   limit: number;
+  runtimeMappings: MappingRuntimeFields;
+  skip?: boolean;
   sort?: TimelineRequestSortField[];
   startDate: string;
   timerangeKind?: 'absolute' | 'relative';
-  data?: DataPublicPluginStart;
-  alertConsumers?: AlertConsumers[];
 }
 
 const createFilter = (filterQuery: ESQuery | string | undefined) =>
@@ -125,6 +127,7 @@ export const useTimelineEvents = ({
   startDate,
   language = 'kuery',
   limit,
+  runtimeMappings,
   sort = initSortDefault,
   skip = false,
   timerangeKind,
@@ -267,6 +270,7 @@ export const useTimelineEvents = ({
         querySize: prevRequest?.pagination.querySize ?? 0,
         sort: prevRequest?.sort ?? initSortDefault,
         timerange: prevRequest?.timerange ?? {},
+        runtimeMappings: prevRequest?.runtimeMappings ?? {},
       };
 
       const currentSearchParameters = {
@@ -299,6 +303,7 @@ export const useTimelineEvents = ({
           querySize: limit,
         },
         language,
+        runtimeMappings,
         sort,
         timerange: {
           interval: '12h',
@@ -330,6 +335,7 @@ export const useTimelineEvents = ({
     startDate,
     sort,
     fields,
+    runtimeMappings,
   ]);
 
   useEffect(() => {
diff --git a/x-pack/plugins/timelines/public/container/source/index.tsx b/x-pack/plugins/timelines/public/container/source/index.tsx
index 1948da0974438..f66eedb94f881 100644
--- a/x-pack/plugins/timelines/public/container/source/index.tsx
+++ b/x-pack/plugins/timelines/public/container/source/index.tsx
@@ -10,6 +10,7 @@ import { isEmpty, isEqual, pick } from 'lodash/fp';
 import { Subscription } from 'rxjs/internal/Subscription';
 
 import memoizeOne from 'memoize-one';
+import { DataViewBase } from '@kbn/es-query';
 import {
   BrowserField,
   BrowserFields,
@@ -21,7 +22,6 @@ import {
 import * as i18n from './translations';
 
 import {
-  IIndexPattern,
   DataPublicPluginStart,
   isCompleteResponse,
   isErrorResponse,
@@ -37,7 +37,7 @@ interface FetchIndexReturn {
   docValueFields: DocValueFields[];
   indexes: string[];
   indexExists: boolean;
-  indexPatterns: IIndexPattern;
+  indexPatterns: DataViewBase;
 }
 
 /**
@@ -90,7 +90,7 @@ export const getDocValueFields = memoizeOne(
 );
 
 export const getIndexFields = memoizeOne(
-  (title: string, fields: IndexField[]): IIndexPattern =>
+  (title: string, fields: IndexField[]): DataViewBase =>
     fields && fields.length > 0
       ? {
           fields: fields.map((field) =>
@@ -127,7 +127,7 @@ export const useFetchIndex = (
         abortCtrl.current = new AbortController();
         setLoading(true);
         searchSubscription$.current = data.search
-          .search<IndexFieldsStrategyRequest, IndexFieldsStrategyResponse>(
+          .search<IndexFieldsStrategyRequest<'indices'>, IndexFieldsStrategyResponse>(
             { indices: iNames, onlyCheckIfIndicesExist },
             {
               abortSignal: abortCtrl.current.signal,
diff --git a/x-pack/plugins/timelines/public/hooks/use_add_to_case.ts b/x-pack/plugins/timelines/public/hooks/use_add_to_case.ts
index d15b4e6980767..34622423781f9 100644
--- a/x-pack/plugins/timelines/public/hooks/use_add_to_case.ts
+++ b/x-pack/plugins/timelines/public/hooks/use_add_to_case.ts
@@ -126,7 +126,7 @@ export const useAddToCase = ({
     }
   }, [event]);
   const isSecurityAlert = useMemo(() => {
-    return !isEmpty(event?.ecs.signal?.rule?.id);
+    return !isEmpty(event?.ecs.signal?.rule?.id ?? event?.ecs.kibana?.alert?.rule?.uuid);
   }, [event]);
   const isEventSupported = isSecurityAlert || isAlert;
   const userCanCrud = casePermissions?.crud ?? false;
diff --git a/x-pack/plugins/timelines/public/index.ts b/x-pack/plugins/timelines/public/index.ts
index 70f7185e9c486..040137a9ea545 100644
--- a/x-pack/plugins/timelines/public/index.ts
+++ b/x-pack/plugins/timelines/public/index.ts
@@ -26,14 +26,14 @@ export type {
 export { Direction } from '../common/search_strategy/common';
 export { tGridReducer } from './store/t_grid/reducer';
 export type { TGridModelForTimeline, TimelineState, TimelinesUIStart } from './types';
-export { TGridType, SortDirection } from './types';
+export type { TGridType, SortDirection } from './types';
+export type { OnColumnFocused } from '../common/utils/accessibility';
 export {
   ARIA_COLINDEX_ATTRIBUTE,
   ARIA_ROWINDEX_ATTRIBUTE,
   DATA_COLINDEX_ATTRIBUTE,
   DATA_ROWINDEX_ATTRIBUTE,
   FIRST_ARIA_INDEX,
-  OnColumnFocused,
   arrayIndexToAriaIndex,
   elementOrChildrenHasFocus,
   isArrowDownOrArrowUp,
diff --git a/x-pack/plugins/timelines/public/mock/browser_fields.ts b/x-pack/plugins/timelines/public/mock/browser_fields.ts
index 6ab06e1be018a..dd7d211058bad 100644
--- a/x-pack/plugins/timelines/public/mock/browser_fields.ts
+++ b/x-pack/plugins/timelines/public/mock/browser_fields.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { MappingRuntimeFields } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import type { DocValueFields } from '../../common/search_strategy';
 import type { BrowserFields } from '../../common/search_strategy/index_fields';
 
@@ -736,3 +737,12 @@ export const mockDocValueFields: DocValueFields[] = [
     format: 'date_time',
   },
 ];
+
+export const mockRuntimeMappings: MappingRuntimeFields = {
+  '@a.runtime.field': {
+    script: {
+      source: 'emit("Radical dude: " + doc[\'host.name\'].value)',
+    },
+    type: 'keyword',
+  },
+};
diff --git a/x-pack/plugins/timelines/public/mock/global_state.ts b/x-pack/plugins/timelines/public/mock/global_state.ts
index f83110eeb3135..8bdd190cc8519 100644
--- a/x-pack/plugins/timelines/public/mock/global_state.ts
+++ b/x-pack/plugins/timelines/public/mock/global_state.ts
@@ -18,6 +18,7 @@ export const mockGlobalState: TimelineState = {
         end: '2020-07-08T08:20:18.966Z',
       },
       dataProviders: [],
+      dataViewId: '',
       deletedEventIds: [],
       excludedRowRendererIds: [],
       expandedDetail: {},
diff --git a/x-pack/plugins/timelines/public/mock/index_pattern.ts b/x-pack/plugins/timelines/public/mock/index_pattern.ts
index 361dbf71bd6f4..893ed1e889925 100644
--- a/x-pack/plugins/timelines/public/mock/index_pattern.ts
+++ b/x-pack/plugins/timelines/public/mock/index_pattern.ts
@@ -5,105 +5,73 @@
  * 2.0.
  */
 
-import { IIndexPattern } from '../../../../../src/plugins/data/public';
+import { DataViewBase } from '@kbn/es-query';
 
-export const mockIndexPattern: IIndexPattern = {
+export const mockIndexPattern: DataViewBase = {
   fields: [
     {
       name: '@timestamp',
-      searchable: true,
       type: 'date',
-      aggregatable: true,
     },
     {
       name: '@version',
-      searchable: true,
       type: 'string',
-      aggregatable: true,
     },
     {
       name: 'agent.ephemeral_id',
-      searchable: true,
       type: 'string',
-      aggregatable: true,
     },
     {
       name: 'agent.hostname',
-      searchable: true,
       type: 'string',
-      aggregatable: true,
     },
     {
       name: 'agent.id',
-      searchable: true,
       type: 'string',
-      aggregatable: true,
     },
     {
       name: 'agent.test1',
-      searchable: true,
       type: 'string',
-      aggregatable: true,
     },
     {
       name: 'agent.test2',
-      searchable: true,
       type: 'string',
-      aggregatable: true,
     },
     {
       name: 'agent.test3',
-      searchable: true,
       type: 'string',
-      aggregatable: true,
     },
     {
       name: 'agent.test4',
-      searchable: true,
       type: 'string',
-      aggregatable: true,
     },
     {
       name: 'agent.test5',
-      searchable: true,
       type: 'string',
-      aggregatable: true,
     },
     {
       name: 'agent.test6',
-      searchable: true,
       type: 'string',
-      aggregatable: true,
     },
     {
       name: 'agent.test7',
-      searchable: true,
       type: 'string',
-      aggregatable: true,
     },
     {
       name: 'agent.test8',
-      searchable: true,
       type: 'string',
-      aggregatable: true,
     },
     {
       name: 'host.name',
-      searchable: true,
       type: 'string',
-      aggregatable: true,
     },
     {
       name: 'nestedField.firstAttributes',
-      searchable: true,
       type: 'string',
-      aggregatable: false,
     },
     {
       name: 'nestedField.secondAttributes',
-      searchable: true,
       type: 'string',
-      aggregatable: false,
     },
   ],
   title: 'filebeat-*,auditbeat-*,packetbeat-*',
diff --git a/x-pack/plugins/timelines/public/mock/mock_timeline_data.ts b/x-pack/plugins/timelines/public/mock/mock_timeline_data.ts
index c6f13f83812c5..e24d9d5c45768 100644
--- a/x-pack/plugins/timelines/public/mock/mock_timeline_data.ts
+++ b/x-pack/plugins/timelines/public/mock/mock_timeline_data.ts
@@ -1549,6 +1549,7 @@ export const mockTgridModel: TGridModel = {
     },
   ],
   dataProviders: [],
+  dataViewId: '',
   defaultColumns: [],
   queryFields: [],
   dateRange: {
diff --git a/x-pack/plugins/timelines/public/mock/t_grid.tsx b/x-pack/plugins/timelines/public/mock/t_grid.tsx
index 3ae1a1d53c207..c79d0f406ec62 100644
--- a/x-pack/plugins/timelines/public/mock/t_grid.tsx
+++ b/x-pack/plugins/timelines/public/mock/t_grid.tsx
@@ -8,7 +8,7 @@
 import React from 'react';
 import { ALERT_START, ALERT_STATUS } from '@kbn/rule-data-utils';
 import { TGridIntegratedProps } from '../components/t_grid/integrated';
-import { mockBrowserFields, mockDocValueFields } from './browser_fields';
+import { mockBrowserFields, mockDocValueFields, mockRuntimeMappings } from './browser_fields';
 import { mockDataProviders } from './mock_data_providers';
 import { mockTimelineData } from './mock_timeline_data';
 import { ColumnHeaderOptions, TimelineId } from '../../common';
@@ -114,6 +114,7 @@ export const tGridIntegratedProps: TGridIntegratedProps = {
   },
   renderCellValue: () => null,
   rowRenderers: [],
+  runtimeMappings: mockRuntimeMappings,
   setQuery: () => null,
   sort: [
     {
diff --git a/x-pack/plugins/timelines/public/store/t_grid/defaults.ts b/x-pack/plugins/timelines/public/store/t_grid/defaults.ts
index efb8a8c9b3b72..87a129afbd499 100644
--- a/x-pack/plugins/timelines/public/store/t_grid/defaults.ts
+++ b/x-pack/plugins/timelines/public/store/t_grid/defaults.ts
@@ -63,6 +63,7 @@ export const defaultHeaders: ColumnHeaderOptions[] = [
 export const tGridDefaults: SubsetTGridModel = {
   columns: defaultHeaders,
   defaultColumns: defaultHeaders,
+  dataViewId: '',
   dateRange: { start: '', end: '' },
   deletedEventIds: [],
   excludedRowRendererIds: [],
diff --git a/x-pack/plugins/timelines/public/store/t_grid/model.ts b/x-pack/plugins/timelines/public/store/t_grid/model.ts
index dc6945d3fe3ad..739bcbef3e20c 100644
--- a/x-pack/plugins/timelines/public/store/t_grid/model.ts
+++ b/x-pack/plugins/timelines/public/store/t_grid/model.ts
@@ -48,6 +48,8 @@ export interface TGridModel extends TGridModelSettings {
     start: string;
     end: string;
   };
+  /** Kibana data view id **/
+  dataViewId: string;
   /** Events to not be rendered **/
   deletedEventIds: string[];
   /** This holds the view information for the flyout when viewing timeline in a consuming view (i.e. hosts page) or the side panel in the primary timeline view */
@@ -91,6 +93,7 @@ export type TGridModelForTimeline = Pick<
   | 'defaultColumns'
   | 'dataProviders'
   | 'dateRange'
+  | 'dataViewId'
   | 'deletedEventIds'
   | 'documentType'
   | 'excludedRowRendererIds'
@@ -124,6 +127,7 @@ export type SubsetTGridModel = Readonly<
     TGridModel,
     | 'columns'
     | 'defaultColumns'
+    | 'dataViewId'
     | 'dateRange'
     | 'deletedEventIds'
     | 'excludedRowRendererIds'
diff --git a/x-pack/plugins/timelines/server/index.ts b/x-pack/plugins/timelines/server/index.ts
index ef18226a0e60c..e14ac343ed815 100644
--- a/x-pack/plugins/timelines/server/index.ts
+++ b/x-pack/plugins/timelines/server/index.ts
@@ -12,4 +12,4 @@ export function plugin(initializerContext: PluginInitializerContext) {
   return new TimelinesPlugin(initializerContext);
 }
 
-export { TimelinesPluginUI, TimelinesPluginStart } from './types';
+export type { TimelinesPluginUI, TimelinesPluginStart } from './types';
diff --git a/x-pack/plugins/timelines/server/plugin.ts b/x-pack/plugins/timelines/server/plugin.ts
index 79d35e53fada1..eb172b7d27bd6 100644
--- a/x-pack/plugins/timelines/server/plugin.ts
+++ b/x-pack/plugins/timelines/server/plugin.ts
@@ -18,11 +18,13 @@ import { defineRoutes } from './routes';
 import { timelineSearchStrategyProvider } from './search_strategy/timeline';
 import { timelineEqlSearchStrategyProvider } from './search_strategy/timeline/eql';
 import { indexFieldsProvider } from './search_strategy/index_fields';
+import { SecurityPluginSetup } from '../../security/server';
 
 export class TimelinesPlugin
   implements Plugin<TimelinesPluginUI, TimelinesPluginStart, SetupPlugins, StartPlugins>
 {
   private readonly logger: Logger;
+  private security?: SecurityPluginSetup;
 
   constructor(initializerContext: PluginInitializerContext) {
     this.logger = initializerContext.logger.get();
@@ -30,19 +32,22 @@ export class TimelinesPlugin
 
   public setup(core: CoreSetup<StartPlugins, TimelinesPluginStart>, plugins: SetupPlugins) {
     this.logger.debug('timelines: Setup');
+    this.security = plugins.security;
+
     const router = core.http.createRouter();
 
     // Register server side APIs
     defineRoutes(router);
 
+    const IndexFields = indexFieldsProvider(core.getStartServices);
     // Register search strategy
     core.getStartServices().then(([_, depsStart]) => {
       const TimelineSearchStrategy = timelineSearchStrategyProvider(
         depsStart.data,
-        depsStart.alerting
+        depsStart.alerting,
+        this.security
       );
       const TimelineEqlSearchStrategy = timelineEqlSearchStrategyProvider(depsStart.data);
-      const IndexFields = indexFieldsProvider();
 
       plugins.data.search.registerSearchStrategy('indexFields', IndexFields);
       plugins.data.search.registerSearchStrategy('timelineSearchStrategy', TimelineSearchStrategy);
diff --git a/x-pack/plugins/timelines/server/search_strategy/index_fields/index.test.ts b/x-pack/plugins/timelines/server/search_strategy/index_fields/index.test.ts
index e8df6200351ea..be5bff2e30ddf 100644
--- a/x-pack/plugins/timelines/server/search_strategy/index_fields/index.test.ts
+++ b/x-pack/plugins/timelines/server/search_strategy/index_fields/index.test.ts
@@ -795,19 +795,56 @@ describe('Fields Provider', () => {
   describe('search', () => {
     const getFieldsForWildcardMock = jest.fn();
     const esClientSearchMock = jest.fn();
+    const esClientFieldCapsMock = jest.fn();
+    const mockPattern = {
+      title: 'coolbro',
+      fields: {
+        toSpec: () => ({
+          coolio: {
+            name: 'nameio',
+            type: 'typeio',
+            searchable: true,
+            aggregatable: true,
+          },
+        }),
+      },
+      toSpec: () => ({
+        runtimeFieldMap: { runtimeField: { type: 'keyword' } },
+      }),
+    };
+    const getStartServices = jest.fn().mockReturnValue([
+      null,
+      {
+        data: {
+          indexPatterns: {
+            indexPatternsServiceFactory: () => ({
+              get: jest.fn().mockReturnValue(mockPattern),
+            }),
+          },
+        },
+      },
+    ]);
 
     const deps = {
-      esClient: { asCurrentUser: { search: esClientSearchMock } },
+      esClient: { asCurrentUser: { search: esClientSearchMock, fieldCaps: esClientFieldCapsMock } },
     } as unknown as SearchStrategyDependencies;
 
     beforeAll(() => {
       getFieldsForWildcardMock.mockResolvedValue([]);
+
+      esClientSearchMock.mockResolvedValue({
+        body: { hits: { total: { value: 123 } } },
+      });
+      esClientFieldCapsMock.mockResolvedValue({
+        body: { indices: ['value'] },
+      });
       IndexPatternsFetcher.prototype.getFieldsForWildcard = getFieldsForWildcardMock;
     });
 
     beforeEach(() => {
       getFieldsForWildcardMock.mockClear();
       esClientSearchMock.mockClear();
+      esClientFieldCapsMock.mockClear();
     });
 
     afterAll(() => {
@@ -821,10 +858,7 @@ describe('Fields Provider', () => {
         onlyCheckIfIndicesExist: true,
       };
 
-      const response = await requestIndexFieldSearch(request, deps, beatFields);
-
-      expect(getFieldsForWildcardMock).toHaveBeenCalledWith({ pattern: indices[0] });
-
+      const response = await requestIndexFieldSearch(request, deps, beatFields, getStartServices);
       expect(response.indexFields).toHaveLength(0);
       expect(response.indicesExist).toEqual(indices);
     });
@@ -836,7 +870,7 @@ describe('Fields Provider', () => {
         onlyCheckIfIndicesExist: false,
       };
 
-      const response = await requestIndexFieldSearch(request, deps, beatFields);
+      const response = await requestIndexFieldSearch(request, deps, beatFields, getStartServices);
 
       expect(getFieldsForWildcardMock).toHaveBeenCalledWith({ pattern: indices[0] });
 
@@ -844,6 +878,34 @@ describe('Fields Provider', () => {
       expect(response.indicesExist).toEqual(indices);
     });
 
+    it('should search index fields by data view id', async () => {
+      const dataViewId = 'id';
+      const request = {
+        dataViewId,
+        onlyCheckIfIndicesExist: false,
+      };
+
+      const response = await requestIndexFieldSearch(request, deps, beatFields, getStartServices);
+
+      expect(getFieldsForWildcardMock).not.toHaveBeenCalled();
+
+      expect(response.indexFields).not.toHaveLength(0);
+      expect(response.indicesExist).toEqual(['coolbro']);
+    });
+
+    it('onlyCheckIfIndicesExist by data view id', async () => {
+      const dataViewId = 'id';
+      const request = {
+        dataViewId,
+        onlyCheckIfIndicesExist: true,
+      };
+
+      const response = await requestIndexFieldSearch(request, deps, beatFields, getStartServices);
+
+      expect(response.indexFields).toHaveLength(0);
+      expect(response.indicesExist).toEqual(['coolbro']);
+    });
+
     it('should search apm index fields', async () => {
       const indices = ['apm-*-transaction*', 'traces-apm*'];
       const request = {
@@ -851,11 +913,9 @@ describe('Fields Provider', () => {
         onlyCheckIfIndicesExist: false,
       };
 
-      const response = await requestIndexFieldSearch(request, deps, beatFields);
+      const response = await requestIndexFieldSearch(request, deps, beatFields, getStartServices);
 
       expect(getFieldsForWildcardMock).toHaveBeenCalledWith({ pattern: indices[0] });
-      expect(esClientSearchMock).not.toHaveBeenCalled();
-
       expect(response.indexFields).not.toHaveLength(0);
       expect(response.indicesExist).toEqual(indices);
     });
@@ -870,7 +930,7 @@ describe('Fields Provider', () => {
       esClientSearchMock.mockResolvedValue({
         body: { hits: { total: { value: 1 } } },
       });
-      const response = await requestIndexFieldSearch(request, deps, beatFields);
+      const response = await requestIndexFieldSearch(request, deps, beatFields, getStartServices);
 
       expect(esClientSearchMock).toHaveBeenCalledWith({
         index: indices[0],
@@ -897,7 +957,7 @@ describe('Fields Provider', () => {
         body: { hits: { total: { value: 0 } } },
       });
 
-      const response = await requestIndexFieldSearch(request, deps, beatFields);
+      const response = await requestIndexFieldSearch(request, deps, beatFields, getStartServices);
 
       expect(esClientSearchMock).toHaveBeenCalledWith({
         index: indices[0],
diff --git a/x-pack/plugins/timelines/server/search_strategy/index_fields/index.ts b/x-pack/plugins/timelines/server/search_strategy/index_fields/index.ts
index 8670b709494f0..2427ec8bb6071 100644
--- a/x-pack/plugins/timelines/server/search_strategy/index_fields/index.ts
+++ b/x-pack/plugins/timelines/server/search_strategy/index_fields/index.ts
@@ -8,11 +8,11 @@
 import { from } from 'rxjs';
 import isEmpty from 'lodash/isEmpty';
 import get from 'lodash/get';
+import { ElasticsearchClient, StartServicesAccessor } from 'kibana/server';
 import {
   IndexPatternsFetcher,
   ISearchStrategy,
   SearchStrategyDependencies,
-  FieldDescriptor,
 } from '../../../../../../src/plugins/data/server';
 
 // TODO cleanup path
@@ -21,13 +21,18 @@ import {
   IndexField,
   IndexFieldsStrategyRequest,
   BeatFields,
-} from '../../../common/search_strategy/index_fields';
+  DELETED_SECURITY_SOLUTION_DATA_VIEW,
+} from '../../../common';
+import { StartPlugins } from '../../types';
+import { FieldSpec } from '../../../../../../src/plugins/data_views/common';
 
 const apmIndexPattern = 'apm-*-transaction*';
 const apmDataStreamsPattern = 'traces-apm*';
 
-export const indexFieldsProvider = (): ISearchStrategy<
-  IndexFieldsStrategyRequest,
+export const indexFieldsProvider = (
+  getStartServices: StartServicesAccessor<StartPlugins>
+): ISearchStrategy<
+  IndexFieldsStrategyRequest<'indices' | 'dataView'>,
   IndexFieldsStrategyResponse
 > => {
   // require the fields once we actually need them, rather than ahead of time, and pass
@@ -36,61 +41,118 @@ export const indexFieldsProvider = (): ISearchStrategy<
   const beatFields: BeatFields = require('../../utils/beat_schema/fields').fieldsBeat;
 
   return {
-    search: (request, options, deps) => from(requestIndexFieldSearch(request, deps, beatFields)),
+    search: (request, options, deps) =>
+      from(requestIndexFieldSearch(request, deps, beatFields, getStartServices)),
   };
 };
 
-export const requestIndexFieldSearch = async (
-  request: IndexFieldsStrategyRequest,
-  { esClient }: SearchStrategyDependencies,
-  beatFields: BeatFields
-): Promise<IndexFieldsStrategyResponse> => {
-  const indexPatternsFetcherAsCurrentUser = new IndexPatternsFetcher(esClient.asCurrentUser);
-  const indexPatternsFetcherAsInternalUser = new IndexPatternsFetcher(esClient.asInternalUser);
-
-  const dedupeIndices = dedupeIndexName(request.indices);
-
-  const responsesIndexFields = await Promise.all(
-    dedupeIndices
+export const findExistingIndices = async (
+  indices: string[],
+  esClient: ElasticsearchClient
+): Promise<boolean[]> =>
+  Promise.all(
+    indices
       .map(async (index) => {
-        if (
-          request.onlyCheckIfIndicesExist &&
-          (index.includes(apmIndexPattern) || index.includes(apmDataStreamsPattern))
-        ) {
-          // for apm index pattern check also if there's data https://github.com/elastic/kibana/issues/90661
-          const searchResponse = await esClient.asCurrentUser.search({
+        if ([apmIndexPattern, apmDataStreamsPattern].includes(index)) {
+          const searchResponse = await esClient.search({
             index,
             body: { query: { match_all: {} }, size: 0 },
           });
           return get(searchResponse, 'body.hits.total.value', 0) > 0;
-        } else {
-          if (index.startsWith('.alerts-observability')) {
-            return indexPatternsFetcherAsInternalUser.getFieldsForWildcard({
-              pattern: index,
-            });
-          } else {
-            return indexPatternsFetcherAsCurrentUser.getFieldsForWildcard({
-              pattern: index,
-            });
-          }
         }
+        const searchResponse = await esClient.fieldCaps({
+          index,
+          fields: '_id',
+          ignore_unavailable: true,
+          allow_no_indices: false,
+        });
+        return searchResponse.body.indices.length > 0;
       })
       .map((p) => p.catch((e) => false))
   );
 
+export const requestIndexFieldSearch = async (
+  request: IndexFieldsStrategyRequest<'indices' | 'dataView'>,
+  { savedObjectsClient, esClient }: SearchStrategyDependencies,
+  beatFields: BeatFields,
+  getStartServices: StartServicesAccessor<StartPlugins>
+): Promise<IndexFieldsStrategyResponse> => {
+  const indexPatternsFetcherAsCurrentUser = new IndexPatternsFetcher(esClient.asCurrentUser);
+  const indexPatternsFetcherAsInternalUser = new IndexPatternsFetcher(esClient.asInternalUser);
+  if ('dataViewId' in request && 'indices' in request) {
+    throw new Error('Provide index field search with either `dataViewId` or `indices`, not both');
+  }
+  const [
+    ,
+    {
+      data: { indexPatterns },
+    },
+  ] = await getStartServices();
+  const dataViewService = await indexPatterns.indexPatternsServiceFactory(
+    savedObjectsClient,
+    esClient.asCurrentUser
+  );
+
+  let indicesExist: string[] = [];
   let indexFields: IndexField[] = [];
+  let runtimeMappings = {};
 
-  if (!request.onlyCheckIfIndicesExist) {
-    indexFields = await formatIndexFields(
-      beatFields,
-      responsesIndexFields.filter((rif) => rif !== false) as FieldDescriptor[][],
-      dedupeIndices
+  // if dataViewId is provided, get fields and indices from the Kibana Data View
+  if ('dataViewId' in request) {
+    let dataView;
+    try {
+      dataView = await dataViewService.get(request.dataViewId);
+    } catch (r) {
+      if (
+        r.output.payload.statusCode === 404 &&
+        // this is the only place this id is hard coded as there are no security_solution dependencies in timeline
+        // needs to match value in DEFAULT_DATA_VIEW_ID security_solution/common/constants.ts
+        r.output.payload.message.indexOf('security-solution') > -1
+      ) {
+        throw new Error(DELETED_SECURITY_SOLUTION_DATA_VIEW);
+      } else {
+        throw r;
+      }
+    }
+
+    const patternList = dataView.title.split(',');
+    indicesExist = (await findExistingIndices(patternList, esClient.asCurrentUser)).reduce(
+      (acc: string[], doesIndexExist, i) => (doesIndexExist ? [...acc, patternList[i]] : acc),
+      []
+    );
+    if (!request.onlyCheckIfIndicesExist) {
+      const dataViewSpec = dataView.toSpec();
+      const fieldDescriptor = [Object.values(dataViewSpec.fields ?? {})];
+      runtimeMappings = dataViewSpec.runtimeFieldMap ?? {};
+      indexFields = await formatIndexFields(beatFields, fieldDescriptor, patternList);
+    }
+  } else if ('indices' in request) {
+    const patternList = dedupeIndexName(request.indices);
+    indicesExist = (await findExistingIndices(patternList, esClient.asCurrentUser)).reduce(
+      (acc: string[], doesIndexExist, i) => (doesIndexExist ? [...acc, patternList[i]] : acc),
+      []
     );
+    if (!request.onlyCheckIfIndicesExist) {
+      const fieldDescriptor = await Promise.all(
+        indicesExist.map(async (index, n) => {
+          if (index.startsWith('.alerts-observability')) {
+            return indexPatternsFetcherAsInternalUser.getFieldsForWildcard({
+              pattern: index,
+            });
+          }
+          return indexPatternsFetcherAsCurrentUser.getFieldsForWildcard({
+            pattern: index,
+          });
+        })
+      );
+      indexFields = await formatIndexFields(beatFields, fieldDescriptor, patternList);
+    }
   }
 
   return {
     indexFields,
-    indicesExist: dedupeIndices.filter((index, i) => responsesIndexFields[i] !== false),
+    runtimeMappings,
+    indicesExist,
     rawResponse: {
       timed_out: false,
       took: -1,
@@ -125,7 +187,7 @@ export const dedupeIndexName = (indices: string[]) =>
     return acc;
   }, []);
 
-const missingFields: FieldDescriptor[] = [
+const missingFields: FieldSpec[] = [
   {
     name: '_id',
     type: 'string',
@@ -158,7 +220,7 @@ const missingFields: FieldDescriptor[] = [
 export const createFieldItem = (
   beatFields: BeatFields,
   indexesAlias: string[],
-  index: FieldDescriptor,
+  index: FieldSpec,
   indexesAliasIdx: number
 ): IndexField => {
   const alias = indexesAlias[indexesAliasIdx];
@@ -174,6 +236,9 @@ export const createFieldItem = (
   return {
     ...beatIndex,
     ...index,
+    // the format type on FieldSpec is SerializedFieldFormat
+    // and is a string on beatIndex
+    format: index.format?.id ?? beatIndex.format,
     indexes: [alias],
   };
 };
@@ -188,24 +253,24 @@ export const createFieldItem = (
  * This intentionally waits for the next tick on the event loop to process as the large 4.7 megs
  * has already consumed a lot of the event loop processing up to this function and we want to give
  * I/O opportunity to occur by scheduling this on the next loop.
- * @param responsesIndexFields The response index fields to loop over
+ * @param responsesFieldSpec The response index fields to loop over
  * @param indexesAlias The index aliases such as filebeat-*
  */
 export const formatFirstFields = async (
   beatFields: BeatFields,
-  responsesIndexFields: FieldDescriptor[][],
+  responsesFieldSpec: FieldSpec[][],
   indexesAlias: string[]
 ): Promise<IndexField[]> => {
   return new Promise((resolve) => {
     setTimeout(() => {
       resolve(
-        responsesIndexFields.reduce(
-          (accumulator: IndexField[], indexFields: FieldDescriptor[], indexesAliasIdx: number) => {
+        responsesFieldSpec.reduce(
+          (accumulator: IndexField[], fieldSpec: FieldSpec[], indexesAliasIdx: number) => {
             missingFields.forEach((index) => {
               const item = createFieldItem(beatFields, indexesAlias, index, indexesAliasIdx);
               accumulator.push(item);
             });
-            indexFields.forEach((index) => {
+            fieldSpec.forEach((index) => {
               const item = createFieldItem(beatFields, indexesAlias, index, indexesAliasIdx);
               accumulator.push(item);
             });
@@ -262,15 +327,15 @@ export const formatSecondFields = async (fields: IndexField[]): Promise<IndexFie
  * NOTE: This will have array sizes up to 4.7 megs in size at a time when being called.
  * This function should be as optimized as possible and should avoid any and all creation
  * of new arrays, iterating over the arrays or performing any n^2 operations.
- * @param responsesIndexFields  The response index fields to format
+ * @param responsesFieldSpec  The response index fields to format
  * @param indexesAlias The index alias
  */
 export const formatIndexFields = async (
   beatFields: BeatFields,
-  responsesIndexFields: FieldDescriptor[][],
+  responsesFieldSpec: FieldSpec[][],
   indexesAlias: string[]
 ): Promise<IndexField[]> => {
-  const fields = await formatFirstFields(beatFields, responsesIndexFields, indexesAlias);
+  const fields = await formatFirstFields(beatFields, responsesFieldSpec, indexesAlias);
   const secondFields = await formatSecondFields(fields);
   return secondFields;
 };
diff --git a/x-pack/plugins/timelines/server/search_strategy/timeline/eql/helpers.test.ts b/x-pack/plugins/timelines/server/search_strategy/timeline/eql/helpers.test.ts
index 5e56af40aebae..1b58e63ec8752 100644
--- a/x-pack/plugins/timelines/server/search_strategy/timeline/eql/helpers.test.ts
+++ b/x-pack/plugins/timelines/server/search_strategy/timeline/eql/helpers.test.ts
@@ -5,30 +5,33 @@
  * 2.0.
  */
 
-import { Direction } from '../../../../common/search_strategy';
+import { Direction, TimelineEqlRequestOptions } from '../../../../common/search_strategy';
 import { buildEqlDsl, parseEqlResponse } from './helpers';
 import { eventsResponse, sequenceResponse } from './__mocks__';
-
+const defaultArgs = {
+  defaultIndex: ['logs-endpoint.events*'],
+  docValueFields: [],
+  runtimeMappings: {},
+  fieldRequested: [
+    '@timestamp',
+    'message',
+    'event.category',
+    'event.action',
+    'host.name',
+    'source.ip',
+    'destination.ip',
+  ],
+  fields: [],
+  filterQuery: 'sequence by host.name↵[any where true]↵[any where true]↵[any where true]',
+  id: 'FkgzdTM3YXEtUmN1cVI3VS1wZ1lrdkEgVW1GSWZEX2lRZmVwQmw2c1V5RWsyZzoyMzA1MjAzMDM=',
+  language: 'eql' as TimelineEqlRequestOptions['language'],
+};
 describe('Search Strategy EQL helper', () => {
   describe('#buildEqlDsl', () => {
     it('happy path with no options', () => {
       expect(
         buildEqlDsl({
-          defaultIndex: ['logs-endpoint.events*'],
-          docValueFields: [],
-          fieldRequested: [
-            '@timestamp',
-            'message',
-            'event.category',
-            'event.action',
-            'host.name',
-            'source.ip',
-            'destination.ip',
-          ],
-          fields: [],
-          filterQuery: 'sequence by host.name↵[any where true]↵[any where true]↵[any where true]',
-          id: 'FkgzdTM3YXEtUmN1cVI3VS1wZ1lrdkEgVW1GSWZEX2lRZmVwQmw2c1V5RWsyZzoyMzA1MjAzMDM=',
-          language: 'eql',
+          ...defaultArgs,
           pagination: { activePage: 0, querySize: 25 },
           sort: [
             {
@@ -78,21 +81,7 @@ describe('Search Strategy EQL helper', () => {
     it('happy path with EQL options', () => {
       expect(
         buildEqlDsl({
-          defaultIndex: ['logs-endpoint.events*'],
-          docValueFields: [],
-          fieldRequested: [
-            '@timestamp',
-            'message',
-            'event.category',
-            'event.action',
-            'host.name',
-            'source.ip',
-            'destination.ip',
-          ],
-          fields: [],
-          filterQuery: 'sequence by host.name↵[any where true]↵[any where true]↵[any where true]',
-          id: 'FkgzdTM3YXEtUmN1cVI3VS1wZ1lrdkEgVW1GSWZEX2lRZmVwQmw2c1V5RWsyZzoyMzA1MjAzMDM=',
-          language: 'eql',
+          ...defaultArgs,
           pagination: { activePage: 1, querySize: 2 },
           sort: [
             {
@@ -148,21 +137,7 @@ describe('Search Strategy EQL helper', () => {
     it('format events', async () => {
       const result = await parseEqlResponse(
         {
-          defaultIndex: ['logs-endpoint.events*'],
-          docValueFields: [],
-          fieldRequested: [
-            '@timestamp',
-            'message',
-            'event.category',
-            'event.action',
-            'host.name',
-            'source.ip',
-            'destination.ip',
-          ],
-          fields: [],
-          filterQuery: 'sequence by host.name↵[any where true]↵[any where true]↵[any where true]',
-          id: 'FkgzdTM3YXEtUmN1cVI3VS1wZ1lrdkEgVW1GSWZEX2lRZmVwQmw2c1V5RWsyZzoyMzA1MjAzMDM=',
-          language: 'eql',
+          ...defaultArgs,
           pagination: { activePage: 0, querySize: 2 },
           sort: [
             {
@@ -439,21 +414,7 @@ describe('Search Strategy EQL helper', () => {
     it('sequence events', async () => {
       const result = await parseEqlResponse(
         {
-          defaultIndex: ['logs-endpoint.events*'],
-          docValueFields: [],
-          fieldRequested: [
-            '@timestamp',
-            'message',
-            'event.category',
-            'event.action',
-            'host.name',
-            'source.ip',
-            'destination.ip',
-          ],
-          fields: [],
-          filterQuery: 'sequence by host.name↵[any where true]↵[any where true]↵[any where true]',
-          id: 'FkgzdTM3YXEtUmN1cVI3VS1wZ1lrdkEgVW1GSWZEX2lRZmVwQmw2c1V5RWsyZzoyMzA1MjAzMDM=',
-          language: 'eql',
+          ...defaultArgs,
           pagination: { activePage: 3, querySize: 2 },
           sort: [
             {
diff --git a/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/all/query.events_all.dsl.ts b/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/all/query.events_all.dsl.ts
index 3653cb60d3653..8c4f34e930f8d 100644
--- a/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/all/query.events_all.dsl.ts
+++ b/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/all/query.events_all.dsl.ts
@@ -17,14 +17,15 @@ import {
 import { createQueryFilterClauses } from '../../../../../../server/utils/build_query';
 
 export const buildTimelineEventsAllQuery = ({
+  authFilter,
   defaultIndex,
   docValueFields,
   fields,
   filterQuery,
   pagination: { activePage, querySize },
+  runtimeMappings,
   sort,
   timerange,
-  authFilter,
 }: Omit<TimelineEventsAllRequestOptions, 'fieldRequested'>) => {
   const filterClause = [...createQueryFilterClauses(filterQuery)];
 
@@ -78,6 +79,7 @@ export const buildTimelineEventsAllQuery = ({
           filter,
         },
       },
+      runtime_mappings: runtimeMappings,
       from: activePage * querySize,
       size: querySize,
       track_total_hits: true,
diff --git a/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/details/index.ts b/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/details/index.ts
index b60add2515ec9..e2491c403945e 100644
--- a/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/details/index.ts
+++ b/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/details/index.ts
@@ -27,17 +27,27 @@ import {
 
 export const timelineEventsDetails: TimelineFactory<TimelineEventsQueries.details> = {
   buildDsl: ({ authFilter, ...options }: TimelineEventsDetailsRequestOptions) => {
-    const { indexName, eventId, docValueFields = [] } = options;
-    return buildTimelineDetailsQuery(indexName, eventId, docValueFields, authFilter);
+    const { indexName, eventId, docValueFields = [], runtimeMappings = {} } = options;
+    return buildTimelineDetailsQuery({
+      indexName,
+      id: eventId,
+      docValueFields,
+      runtimeMappings,
+      authFilter,
+    });
   },
   parse: async (
     options: TimelineEventsDetailsRequestOptions,
     response: IEsSearchResponse<EventHit>
   ): Promise<TimelineEventsDetailsStrategyResponse> => {
-    const { indexName, eventId, docValueFields = [] } = options;
+    const { indexName, eventId, docValueFields = [], runtimeMappings = {} } = options;
     const { _source, fields, ...hitsData } = cloneDeep(response.rawResponse.hits.hits[0] ?? {});
     const inspect = {
-      dsl: [inspectStringifyObject(buildTimelineDetailsQuery(indexName, eventId, docValueFields))],
+      dsl: [
+        inspectStringifyObject(
+          buildTimelineDetailsQuery({ indexName, id: eventId, docValueFields, runtimeMappings })
+        ),
+      ],
     };
     if (response.isRunning) {
       return {
diff --git a/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/details/query.events_details.dsl.test.ts b/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/details/query.events_details.dsl.test.ts
index 9066861cdb818..f34b54f3029a5 100644
--- a/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/details/query.events_details.dsl.test.ts
+++ b/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/details/query.events_details.dsl.test.ts
@@ -18,7 +18,12 @@ describe('buildTimelineDetailsQuery', () => {
       { field: 'agent.name' },
     ];
 
-    const query = buildTimelineDetailsQuery(indexName, eventId, docValueFields);
+    const query = buildTimelineDetailsQuery({
+      indexName,
+      id: eventId,
+      docValueFields,
+      runtimeMappings: {},
+    });
 
     expect(query).toMatchInlineSnapshot(`
       Object {
@@ -52,6 +57,7 @@ describe('buildTimelineDetailsQuery', () => {
               ],
             },
           },
+          "runtime_mappings": Object {},
         },
         "ignore_unavailable": true,
         "index": ".siem-signals-default",
diff --git a/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/details/query.events_details.dsl.ts b/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/details/query.events_details.dsl.ts
index 70b592440468e..5baa471e5c526 100644
--- a/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/details/query.events_details.dsl.ts
+++ b/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/details/query.events_details.dsl.ts
@@ -6,14 +6,22 @@
  */
 
 import { JsonObject } from '@kbn/utility-types';
+import { MappingRuntimeFields } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import { DocValueFields } from '../../../../../../common/search_strategy';
 
-export const buildTimelineDetailsQuery = (
-  indexName: string,
-  id: string,
-  docValueFields: DocValueFields[],
-  authFilter?: JsonObject
-) => {
+export const buildTimelineDetailsQuery = ({
+  authFilter,
+  docValueFields,
+  id,
+  indexName,
+  runtimeMappings,
+}: {
+  authFilter?: JsonObject;
+  docValueFields: DocValueFields[];
+  id: string;
+  indexName: string;
+  runtimeMappings: MappingRuntimeFields;
+}) => {
   const basicFilter = {
     terms: {
       _id: [id],
@@ -40,6 +48,8 @@ export const buildTimelineDetailsQuery = (
       docvalue_fields: docValueFields,
       query,
       fields: [{ field: '*', include_unmapped: true }],
+      // Remove and instead pass index_pattern.id once issue resolved: https://github.com/elastic/kibana/issues/111762
+      runtime_mappings: runtimeMappings,
       _source: true,
     },
     size: 1,
diff --git a/x-pack/plugins/timelines/server/search_strategy/timeline/index.ts b/x-pack/plugins/timelines/server/search_strategy/timeline/index.ts
index b2e073d3ecf59..24e0edb5ddcc0 100644
--- a/x-pack/plugins/timelines/server/search_strategy/timeline/index.ts
+++ b/x-pack/plugins/timelines/server/search_strategy/timeline/index.ts
@@ -32,16 +32,19 @@ import {
   ENHANCED_ES_SEARCH_STRATEGY,
   ISearchOptions,
 } from '../../../../../../src/plugins/data/common';
+import { AuditLogger, SecurityPluginSetup } from '../../../../security/server';
+import { AlertAuditAction, alertAuditEvent } from '../../../../rule_registry/server';
 
 export const timelineSearchStrategyProvider = <T extends TimelineFactoryQueryTypes>(
   data: PluginStart,
-  alerting: AlertingPluginStartContract
+  alerting: AlertingPluginStartContract,
+  security?: SecurityPluginSetup
 ): ISearchStrategy<TimelineStrategyRequestType<T>, TimelineStrategyResponseType<T>> => {
   const esAsInternal = data.search.searchAsInternalUser;
   const es = data.search.getSearchStrategy(ENHANCED_ES_SEARCH_STRATEGY);
-
   return {
     search: (request, options, deps) => {
+      const securityAuditLogger = security?.audit.asScoped(deps.request);
       const factoryQueryType = request.factoryQueryType;
       const entityType = request.entityType;
 
@@ -59,6 +62,7 @@ export const timelineSearchStrategyProvider = <T extends TimelineFactoryQueryTyp
           deps,
           queryFactory,
           alerting,
+          auditLogger: securityAuditLogger,
         });
       } else {
         return timelineSearchStrategy({ es, request, options, deps, queryFactory });
@@ -104,6 +108,7 @@ const timelineAlertsSearchStrategy = <T extends TimelineFactoryQueryTypes>({
   deps,
   queryFactory,
   alerting,
+  auditLogger,
 }: {
   es: ISearchStrategy;
   request: TimelineStrategyRequestType<T>;
@@ -111,9 +116,8 @@ const timelineAlertsSearchStrategy = <T extends TimelineFactoryQueryTypes>({
   deps: SearchStrategyDependencies;
   alerting: AlertingPluginStartContract;
   queryFactory: TimelineFactory<T>;
+  auditLogger: AuditLogger | undefined;
 }) => {
-  // Based on what solution alerts you want to see, figures out what corresponding
-  // index to query (ex: siem --> .alerts-security.alerts)
   const indices = request.defaultIndex ?? request.indexType;
   const requestWithAlertsIndices = { ...request, defaultIndex: indices, indexName: indices };
 
@@ -133,17 +137,46 @@ const timelineAlertsSearchStrategy = <T extends TimelineFactoryQueryTypes>({
 
   return from(getAuthFilter()).pipe(
     mergeMap(({ filter }) => {
-      const dsl = queryFactory.buildDsl({ ...requestWithAlertsIndices, authFilter: filter });
+      const dsl = queryFactory.buildDsl({
+        ...requestWithAlertsIndices,
+        authFilter: filter,
+      });
       return es.search({ ...requestWithAlertsIndices, params: dsl }, options, deps);
     }),
     map((response) => {
+      const rawResponse = shimHitsTotal(response.rawResponse, options);
+      // Do we have to loop over each hit? Yes.
+      // ecs auditLogger requires that we log each alert independently
+      if (auditLogger != null) {
+        rawResponse.hits?.hits?.forEach((hit) => {
+          auditLogger.log(
+            alertAuditEvent({
+              action: AlertAuditAction.FIND,
+              id: hit._id,
+              outcome: 'success',
+            })
+          );
+        });
+      }
+
       return {
         ...response,
-        rawResponse: shimHitsTotal(response.rawResponse, options),
+        rawResponse,
       };
     }),
     mergeMap((esSearchRes) => queryFactory.parse(requestWithAlertsIndices, esSearchRes)),
     catchError((err) => {
+      // check if auth error, if yes, write to ecs logger
+      if (auditLogger != null && err?.output?.statusCode === 403) {
+        auditLogger.log(
+          alertAuditEvent({
+            action: AlertAuditAction.FIND,
+            outcome: 'failure',
+            error: err,
+          })
+        );
+      }
+
       throw err;
     })
   );
diff --git a/x-pack/plugins/timelines/server/types.ts b/x-pack/plugins/timelines/server/types.ts
index 26748c37fa1e1..f9a80908fbc71 100644
--- a/x-pack/plugins/timelines/server/types.ts
+++ b/x-pack/plugins/timelines/server/types.ts
@@ -8,6 +8,7 @@
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import { DataPluginSetup, DataPluginStart } from '../../../../src/plugins/data/server/plugin';
 import { PluginStartContract as AlertingPluginStartContract } from '../../alerting/server';
+import { SecurityPluginSetup } from '../../security/server';
 
 // eslint-disable-next-line @typescript-eslint/no-empty-interface
 export interface TimelinesPluginUI {}
@@ -16,6 +17,7 @@ export interface TimelinesPluginStart {}
 
 export interface SetupPlugins {
   data: DataPluginSetup;
+  security?: SecurityPluginSetup;
 }
 
 export interface StartPlugins {
diff --git a/x-pack/plugins/transform/common/shared_imports.ts b/x-pack/plugins/transform/common/shared_imports.ts
index 42e77938d9cec..22201cf7c0757 100644
--- a/x-pack/plugins/transform/common/shared_imports.ts
+++ b/x-pack/plugins/transform/common/shared_imports.ts
@@ -5,12 +5,12 @@
  * 2.0.
  */
 
+export type { ChartData } from '../../ml/common';
 export {
   composeValidators,
   isPopulatedObject,
   isRuntimeMappings,
   patternValidator,
-  ChartData,
 } from '../../ml/common';
 
 export { RUNTIME_FIELD_TYPES } from '../../../../src/plugins/data/common';
diff --git a/x-pack/plugins/transform/public/app/common/index.ts b/x-pack/plugins/transform/public/app/common/index.ts
index ccd90f8759358..7081b6db2fe40 100644
--- a/x-pack/plugins/transform/public/app/common/index.ts
+++ b/x-pack/plugins/transform/public/app/common/index.ts
@@ -11,35 +11,46 @@ export {
   getPivotPreviewDevConsoleStatement,
   INIT_MAX_COLUMNS,
 } from './data_grid';
+export type { EsDoc, EsDocSource } from './fields';
 export {
   getDefaultSelectableFields,
   getFlattenedFields,
   getSelectableFields,
   toggleSelectedField,
-  EsDoc,
-  EsDocSource,
 } from './fields';
-export { DropDownLabel, DropDownOption, Label } from './dropdown';
+export type { DropDownLabel, DropDownOption, Label } from './dropdown';
 export {
   isTransformIdValid,
   refreshTransformList$,
   useRefreshTransformList,
   REFRESH_TRANSFORM_LIST_STATE,
 } from './transform';
-export { TRANSFORM_LIST_COLUMN, TransformListAction, TransformListRow } from './transform_list';
+export type { TransformListAction, TransformListRow } from './transform_list';
+export { TRANSFORM_LIST_COLUMN } from './transform_list';
 export { getTransformProgress, isCompletedBatchTransform } from './transform_stats';
-export {
-  getEsAggFromAggConfig,
-  isPivotAggsConfigWithUiSupport,
-  isPivotAggsConfigPercentiles,
-  PERCENTILES_AGG_DEFAULT_PERCENTS,
+export type {
   PivotAggsConfig,
   PivotAggsConfigDict,
   PivotAggsConfigBase,
   PivotAggsConfigWithUiSupport,
   PivotAggsConfigWithUiSupportDict,
+} from './pivot_aggs';
+export {
+  getEsAggFromAggConfig,
+  isPivotAggsConfigWithUiSupport,
+  isPivotAggsConfigPercentiles,
+  PERCENTILES_AGG_DEFAULT_PERCENTS,
   pivotAggsFieldSupport,
 } from './pivot_aggs';
+export type {
+  GroupByConfigWithInterval,
+  GroupByConfigWithUiSupport,
+  PivotGroupByConfig,
+  PivotGroupByConfigDict,
+  PivotGroupByConfigWithUiSupportDict,
+  PivotSupportedGroupByAggs,
+  PivotSupportedGroupByAggsWithInterval,
+} from './pivot_group_by';
 export {
   dateHistogramIntervalFormatRegex,
   getEsAggFromGroupByConfig,
@@ -49,15 +60,9 @@ export {
   isGroupByHistogram,
   isGroupByTerms,
   pivotGroupByFieldSupport,
-  GroupByConfigWithInterval,
-  GroupByConfigWithUiSupport,
-  PivotGroupByConfig,
-  PivotGroupByConfigDict,
-  PivotGroupByConfigWithUiSupportDict,
-  PivotSupportedGroupByAggs,
-  PivotSupportedGroupByAggsWithInterval,
   PIVOT_SUPPORTED_GROUP_BY_AGGS,
 } from './pivot_group_by';
+export type { PivotQuery, SimpleQuery } from './request';
 export {
   defaultQuery,
   getPreviewTransformRequestBody,
@@ -68,6 +73,4 @@ export {
   isMatchAllQuery,
   isSimpleQuery,
   matchAllQuery,
-  PivotQuery,
-  SimpleQuery,
 } from './request';
diff --git a/x-pack/plugins/transform/public/app/hooks/use_search_items/index.ts b/x-pack/plugins/transform/public/app/hooks/use_search_items/index.ts
index eacfa20f3f073..14f2dde8a3fa7 100644
--- a/x-pack/plugins/transform/public/app/hooks/use_search_items/index.ts
+++ b/x-pack/plugins/transform/public/app/hooks/use_search_items/index.ts
@@ -5,5 +5,5 @@
  * 2.0.
  */
 
-export { SavedSearchQuery, SearchItems } from './common';
+export type { SavedSearchQuery, SearchItems } from './common';
 export { useSearchItems } from './use_search_items';
diff --git a/x-pack/plugins/transform/public/app/sections/create_transform/components/aggregation_list/index.ts b/x-pack/plugins/transform/public/app/sections/create_transform/components/aggregation_list/index.ts
index ac1f427d6bf97..df038845bc260 100644
--- a/x-pack/plugins/transform/public/app/sections/create_transform/components/aggregation_list/index.ts
+++ b/x-pack/plugins/transform/public/app/sections/create_transform/components/aggregation_list/index.ts
@@ -5,5 +5,7 @@
  * 2.0.
  */
 
-export { AggListForm, AggListProps } from './list_form';
-export { AggListSummary, AggListSummaryProps } from './list_summary';
+export type { AggListProps } from './list_form';
+export { AggListForm } from './list_form';
+export type { AggListSummaryProps } from './list_summary';
+export { AggListSummary } from './list_summary';
diff --git a/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/common/filter_agg/index.ts b/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/common/filter_agg/index.ts
index b7461f63f2adb..c2bd23974c892 100644
--- a/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/common/filter_agg/index.ts
+++ b/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/common/filter_agg/index.ts
@@ -6,4 +6,4 @@
  */
 
 export { filterAggsFieldSupport, FILTERS } from './constants';
-export { FilterAggType } from './types';
+export type { FilterAggType } from './types';
diff --git a/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/common/index.ts b/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/common/index.ts
index 5014b8a4c80fc..775401decef35 100644
--- a/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/common/index.ts
+++ b/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/common/index.ts
@@ -5,16 +5,12 @@
  * 2.0.
  */
 
-export {
-  defaultSearch,
-  QUERY_LANGUAGE,
-  QUERY_LANGUAGE_KUERY,
-  QUERY_LANGUAGE_LUCENE,
-} from './constants';
+export type { QUERY_LANGUAGE } from './constants';
+export { defaultSearch, QUERY_LANGUAGE_KUERY, QUERY_LANGUAGE_LUCENE } from './constants';
 export { applyTransformConfigToDefineState } from './apply_transform_config_to_define_state';
 export { getAggNameConflictToastMessages } from './get_agg_name_conflict_toast_messages';
 export { getDefaultAggregationConfig } from './get_default_aggregation_config';
 export { getDefaultGroupByConfig } from './get_default_group_by_config';
 export { getDefaultStepDefineState } from './get_default_step_define_state';
 export { getPivotDropdownOptions } from './get_pivot_dropdown_options';
-export { ErrorMessage, Field, StepDefineExposedState } from './types';
+export type { ErrorMessage, Field, StepDefineExposedState } from './types';
diff --git a/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/index.ts b/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/index.ts
index 3c0ce70bd0995..5646e420a8ec7 100644
--- a/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/index.ts
+++ b/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/index.ts
@@ -5,13 +5,13 @@
  * 2.0.
  */
 
+export type { StepDefineExposedState } from './common';
 export {
   defaultSearch,
   applyTransformConfigToDefineState,
   getDefaultStepDefineState,
-  StepDefineExposedState,
   QUERY_LANGUAGE_KUERY,
 } from './common';
-export { StepDefineFormHook } from './hooks/use_step_define_form';
+export type { StepDefineFormHook } from './hooks/use_step_define_form';
 export { StepDefineForm } from './step_define_form';
 export { StepDefineSummary } from './step_define_summary';
diff --git a/x-pack/plugins/transform/public/app/sections/create_transform/components/step_details/index.ts b/x-pack/plugins/transform/public/app/sections/create_transform/components/step_details/index.ts
index bbc4b42e1b236..6045005dd4a0a 100644
--- a/x-pack/plugins/transform/public/app/sections/create_transform/components/step_details/index.ts
+++ b/x-pack/plugins/transform/public/app/sections/create_transform/components/step_details/index.ts
@@ -5,10 +5,7 @@
  * 2.0.
  */
 
-export {
-  applyTransformConfigToDetailsState,
-  getDefaultStepDetailsState,
-  StepDetailsExposedState,
-} from './common';
+export type { StepDetailsExposedState } from './common';
+export { applyTransformConfigToDetailsState, getDefaultStepDetailsState } from './common';
 export { StepDetailsForm } from './step_details_form';
 export { StepDetailsSummary } from './step_details_summary';
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/stats_bar/index.ts b/x-pack/plugins/transform/public/app/sections/transform_management/components/stats_bar/index.ts
index 8d28d175943ca..a656966fa8330 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/stats_bar/index.ts
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/stats_bar/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { StatsBar, TransformStatsBarStats } from './stats_bar';
+export type { TransformStatsBarStats } from './stats_bar';
+export { StatsBar } from './stats_bar';
diff --git a/x-pack/plugins/transform/public/shared_imports.ts b/x-pack/plugins/transform/public/shared_imports.ts
index b8f5d88205858..c8375af88a213 100644
--- a/x-pack/plugins/transform/public/shared_imports.ts
+++ b/x-pack/plugins/transform/public/shared_imports.ts
@@ -6,20 +6,20 @@
  */
 
 export { XJsonMode } from '@kbn/ace';
-export { UseRequestConfig, useRequest } from '../../../../src/plugins/es_ui_shared/public';
+export type { UseRequestConfig } from '../../../../src/plugins/es_ui_shared/public';
+export { useRequest } from '../../../../src/plugins/es_ui_shared/public';
 export {
   getSavedSearch,
   getSavedSearchUrlConflictMessage,
 } from '../../../../src/plugins/discover/public';
 
-export {
-  getMlSharedImports,
+export type {
   GetMlSharedImportsReturnType,
   UseIndexDataReturnType,
   EsSorting,
   RenderCellValue,
-  ES_CLIENT_TOTAL_HITS_RELATION,
 } from '../../ml/public';
+export { getMlSharedImports, ES_CLIENT_TOTAL_HITS_RELATION } from '../../ml/public';
 
 import { XJson } from '../../../../src/plugins/es_ui_shared/public';
 const { expandLiteralStrings, collapseLiteralStrings } = XJson;
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index 47876265894ec..c8ad3bad75ef3 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -1311,8 +1311,6 @@
     "core.ui_settings.params.defaultRoute.defaultRouteTitle": "デフォルトのルート",
     "core.ui_settings.params.disableAnimationsText": "Kibana UIの不要なアニメーションをオフにします。変更を適用するにはページを更新してください。",
     "core.ui_settings.params.disableAnimationsTitle": "アニメーションを無効にする",
-    "core.ui_settings.params.maxCellHeightText": "表のセルが使用する高さの上限です。この切り捨てを無効にするには0に設定します",
-    "core.ui_settings.params.maxCellHeightTitle": "表のセルの高さの上限",
     "core.ui_settings.params.notifications.banner.markdownLinkText": "マークダウン対応",
     "core.ui_settings.params.notifications.bannerLifetimeText": "バナー通知が画面に表示される時間（ミリ秒単位）です。",
     "core.ui_settings.params.notifications.bannerLifetimeTitle": "バナー通知時間",
@@ -2315,6 +2313,8 @@
     "discover.advancedSettings.sortDefaultOrderTitle": "デフォルトの並べ替え方向",
     "discover.advancedSettings.sortOrderAsc": "昇順",
     "discover.advancedSettings.sortOrderDesc": "降順",
+    "discover.advancedSettings.params.maxCellHeightTitle": "表のセルの高さの上限",
+    "discover.advancedSettings.params.maxCellHeightText": "表のセルが使用する高さの上限です。この切り捨てを無効にするには0に設定します",
     "discover.backToTopLinkText": "最上部へ戻る。",
     "discover.badge.readOnly.text": "読み取り専用",
     "discover.badge.readOnly.tooltip": "検索を保存できません",
@@ -4391,7 +4391,6 @@
     "share.contextMenu.permalinksLabel": "パーマリンク",
     "share.contextMenuTitle": "この {objectType} を共有",
     "share.urlGenerators.error.createUrlFnProvided": "このジェネレーターは非推奨とマークされています。createUrl fn を付けないでください。",
-    "share.urlGenerators.error.migrateCalledNotDeprecated": "非推奨以外のジェネレーターで migrate を呼び出すことはできません。",
     "share.urlGenerators.error.migrationFnGivenNotDeprecated": "移行機能を提供する場合、このジェネレーターに非推奨マークを付ける必要があります",
     "share.urlGenerators.error.noCreateUrlFnProvided": "このジェネレーターには非推奨のマークがありません。createUrl fn を付けてください。",
     "share.urlGenerators.error.noMigrationFnProvided": "アクセスリンクジェネレーターに非推奨マークが付いている場合、移行機能を提供する必要があります。",
@@ -6234,7 +6233,6 @@
     "xpack.apm.fleet_integration.settings.apm.defaultServiceEnvironmentTitle": "サービス構成",
     "xpack.apm.fleet_integration.settings.apm.expvarEnabledDescription": "/debug/varsの下に公開されます",
     "xpack.apm.fleet_integration.settings.apm.expvarEnabledTitle": "APM Server Golang expvarサポートを有効にする",
-    "xpack.apm.fleet_integration.settings.apm.hostDescription": "この統合の使用方法を識別できるように、名前と説明を選択してください。",
     "xpack.apm.fleet_integration.settings.apm.hostLabel": "ホスト",
     "xpack.apm.fleet_integration.settings.apm.hostTitle": "サーバー構成",
     "xpack.apm.fleet_integration.settings.apm.idleTimeoutLabel": "基本接続が終了するまでのアイドル時間",
@@ -6244,7 +6242,6 @@
     "xpack.apm.fleet_integration.settings.apm.maxHeaderBytesLabel": "リクエストヘッダーの最大サイズ（バイト）",
     "xpack.apm.fleet_integration.settings.apm.maxHeaderBytesTitle": "上限",
     "xpack.apm.fleet_integration.settings.apm.readTimeoutLabel": "リクエスト全体を読み取る最大期間",
-    "xpack.apm.fleet_integration.settings.apm.responseHeadersDescription": "リクエストヘッダーサイズおよびタイミング構成の上限を設定します。",
     "xpack.apm.fleet_integration.settings.apm.responseHeadersHelpText": "セキュリティポリシー遵守目的で使用できます。",
     "xpack.apm.fleet_integration.settings.apm.responseHeadersLabel": "HTTP応答に追加されたカスタムHTTPヘッダー",
     "xpack.apm.fleet_integration.settings.apm.responseHeadersTitle": "カスタムヘッダー",
@@ -20623,8 +20620,6 @@
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.fieldThresholdLabel": "しきい値",
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.importTimelineModalTitle": "保存されたタイムラインからクエリをインポート",
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.importTimelineQueryButton": "保存されたタイムラインからクエリをインポート",
-    "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.indicesCustomDescription": "インデックスのカスタムリストを入力します",
-    "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.indicesFromConfigDescription": "セキュリティソリューション詳細設定からElasticsearchインデックスを使用します",
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.indicesHelperDescription": "このルールを実行するElasticsearchインデックスのパターンを入力します。デフォルトでは、セキュリティソリューション詳細設定で定義されたインデックスパターンが含まれます。",
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.machineLearningJobIdHelpText": "手始めに使えるように、一般的なジョブがいくつか提供されています。独自のカスタムジョブを追加するには、{machineLearning} アプリケーションでジョブに「security」のグループを割り当て、ここに表示されるようにします。",
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.machineLearningJobIdRequired": "機械学習ジョブが必要です。",
@@ -22105,7 +22100,6 @@
     "xpack.securitySolution.hostsTable.osTitle": "オペレーティングシステム",
     "xpack.securitySolution.hostsTable.versionTitle": "バージョン",
     "xpack.securitySolution.hoverActions.showTopTooltip": "上位の{fieldName}を表示",
-    "xpack.securitySolution.indexPatterns.allDefault": "すべてのデフォルト",
     "xpack.securitySolution.indexPatterns.dataSourcesLabel": "データソース",
     "xpack.securitySolution.indexPatterns.disabled": "このページでは無効なインデックスパターンが推奨されますが、最初にKibanaインデックスパターン設定で構成する必要があります。",
     "xpack.securitySolution.indexPatterns.help": "データソース選択",
@@ -22414,9 +22408,6 @@
     "xpack.securitySolution.overview.endpointNotice.tryButton": "Endpoint Securityを試す",
     "xpack.securitySolution.overview.errorFetchingEvents": "イベントの取得エラー",
     "xpack.securitySolution.overview.eventsTitle": "イベント数",
-    "xpack.securitySolution.overview.feedbackText": "Elastic SIEM に関するご意見やご提案は、お気軽に {feedback}",
-    "xpack.securitySolution.overview.feedbackText.feedbackLinkText": "フィードバックをオンラインで送信",
-    "xpack.securitySolution.overview.feedbackTitle": "フィードバック",
     "xpack.securitySolution.overview.filebeatCiscoTitle": "Cisco",
     "xpack.securitySolution.overview.filebeatNetflowTitle": "Netflow",
     "xpack.securitySolution.overview.filebeatPanwTitle": "Palo Alto Networks",
@@ -22443,11 +22434,6 @@
     "xpack.securitySolution.overview.recentTimelinesSidebarTitle": "最近のタイムライン",
     "xpack.securitySolution.overview.showTopTooltip": "上位の{fieldName}を表示",
     "xpack.securitySolution.overview.signalCountTitle": "検出アラート傾向",
-    "xpack.securitySolution.overview.startedText": "セキュリティ情報およびイベント管理（SIEM）へようこそ。はじめに{docs}や{data}をご参照ください。今後の機能に関する情報やチュートリアルは、{siemSolution}ページをご覧ください。",
-    "xpack.securitySolution.overview.startedText.dataLinkText": "投入データ",
-    "xpack.securitySolution.overview.startedText.docsLinkText": "ドキュメンテーション",
-    "xpack.securitySolution.overview.startedText.siemSolutionLinkText": "SIEM ソリューション",
-    "xpack.securitySolution.overview.startedTitle": "はじめて使う",
     "xpack.securitySolution.overview.topNLabel": "トップ{fieldName}",
     "xpack.securitySolution.overview.viewAlertsButtonLabel": "アラートを表示",
     "xpack.securitySolution.overview.viewEventsButtonLabel": "イベントを表示",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index 0fd4fea956a11..2787d971d3f1d 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -1327,8 +1327,6 @@
     "core.ui_settings.params.defaultRoute.defaultRouteTitle": "默认路由",
     "core.ui_settings.params.disableAnimationsText": "在 Kibana UI 中关闭所有不必要的动画。刷新页面可应用所做的更改。",
     "core.ui_settings.params.disableAnimationsTitle": "禁用动画",
-    "core.ui_settings.params.maxCellHeightText": "表单元格应占用的最大高度。设置为 0 可禁用截断",
-    "core.ui_settings.params.maxCellHeightTitle": "最大表单元格高度",
     "core.ui_settings.params.notifications.banner.markdownLinkText": "Markdown 受支持",
     "core.ui_settings.params.notifications.bannerLifetimeText": "在屏幕上显示横幅通知的时间（毫秒）。",
     "core.ui_settings.params.notifications.bannerLifetimeTitle": "横幅通知生存时间",
@@ -2337,6 +2335,8 @@
     "discover.advancedSettings.sortDefaultOrderTitle": "默认排序方向",
     "discover.advancedSettings.sortOrderAsc": "升序",
     "discover.advancedSettings.sortOrderDesc": "降序",
+    "discover.advancedSettings.params.maxCellHeightTitle": "最大表单元格高度",
+    "discover.advancedSettings.params.maxCellHeightText": "表单元格应占用的最大高度。设置为 0 可禁用截断",
     "discover.backToTopLinkText": "返回顶部。",
     "discover.badge.readOnly.text": "只读",
     "discover.badge.readOnly.tooltip": "无法保存搜索",
@@ -4434,7 +4434,6 @@
     "share.contextMenu.permalinksLabel": "固定链接",
     "share.contextMenuTitle": "共享此 {objectType}",
     "share.urlGenerators.error.createUrlFnProvided": "此生成器标记为已过时。切勿提供 createUrl 函数。",
-    "share.urlGenerators.error.migrateCalledNotDeprecated": "无法在非过时的生成器上调用迁移。",
     "share.urlGenerators.error.migrationFnGivenNotDeprecated": "如果提供了迁移函数，则必须将此生成器标记为已过时",
     "share.urlGenerators.error.noCreateUrlFnProvided": "此生成器未标记为已过时。请提供 createUrl 函数。",
     "share.urlGenerators.error.noMigrationFnProvided": "如果访问链接生成器标记为已过时，则必须提供迁移函数。",
@@ -6283,7 +6282,6 @@
     "xpack.apm.fleet_integration.settings.apm.defaultServiceEnvironmentTitle": "服务配置",
     "xpack.apm.fleet_integration.settings.apm.expvarEnabledDescription": "在 /debug/vars 下公开",
     "xpack.apm.fleet_integration.settings.apm.expvarEnabledTitle": "启用 APM Server Golang expvar 支持",
-    "xpack.apm.fleet_integration.settings.apm.hostDescription": "选择有助于确定如何使用此集成的名称和描述。",
     "xpack.apm.fleet_integration.settings.apm.hostLabel": "主机",
     "xpack.apm.fleet_integration.settings.apm.hostTitle": "服务器配置",
     "xpack.apm.fleet_integration.settings.apm.idleTimeoutLabel": "基础连接关闭前的空闲时间",
@@ -6293,7 +6291,6 @@
     "xpack.apm.fleet_integration.settings.apm.maxHeaderBytesLabel": "请求标头的最大大小（字节）",
     "xpack.apm.fleet_integration.settings.apm.maxHeaderBytesTitle": "限制",
     "xpack.apm.fleet_integration.settings.apm.readTimeoutLabel": "读取整个请求的最大持续时间",
-    "xpack.apm.fleet_integration.settings.apm.responseHeadersDescription": "设置请求标头大小限制和计时配置。",
     "xpack.apm.fleet_integration.settings.apm.responseHeadersHelpText": "可能会用于安全策略合规。",
     "xpack.apm.fleet_integration.settings.apm.responseHeadersLabel": "添加到 HTTP 响应的定制 HTTP 标头",
     "xpack.apm.fleet_integration.settings.apm.responseHeadersTitle": "定制标头",
@@ -20939,8 +20936,6 @@
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.fieldThresholdLabel": "阈值",
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.importTimelineModalTitle": "从已保存时间线导入查询",
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.importTimelineQueryButton": "从已保存时间线导入查询",
-    "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.indicesCustomDescription": "提供定制的索引列表",
-    "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.indicesFromConfigDescription": "使用 Security Solution 高级设置中的 Elasticsearch 索引",
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.indicesHelperDescription": "输入要运行此规则的 Elasticsearch 索引的模式。默认情况下，将包括 Security Solution 高级设置中定义的索引模式。",
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.machineLearningJobIdHelpText": "我们提供了一些常见作业来帮助您入门。要添加自己的定制作业，请在 {machineLearning} 应用程序中将一个“security”组分配给这些作业，以使它们显示在此处。",
     "xpack.securitySolution.detectionEngine.createRule.stepDefineRule.machineLearningJobIdRequired": "Machine Learning 作业必填。",
@@ -22455,7 +22450,6 @@
     "xpack.securitySolution.hostsTable.unit": "{totalCount, plural, other {个主机}}",
     "xpack.securitySolution.hostsTable.versionTitle": "版本",
     "xpack.securitySolution.hoverActions.showTopTooltip": "显示排名靠前的{fieldName}",
-    "xpack.securitySolution.indexPatterns.allDefault": "所有默认值",
     "xpack.securitySolution.indexPatterns.dataSourcesLabel": "数据源",
     "xpack.securitySolution.indexPatterns.disabled": "在此页面上建议使用已禁用的索引模式，但是首先需要在 Kibana 索引模式设置中配置这些模式",
     "xpack.securitySolution.indexPatterns.help": "数据源的选择",
@@ -22782,9 +22776,6 @@
     "xpack.securitySolution.overview.endpointNotice.tryButton": "试用 Endpoint Security",
     "xpack.securitySolution.overview.errorFetchingEvents": "提取事件时出错",
     "xpack.securitySolution.overview.eventsTitle": "事件计数",
-    "xpack.securitySolution.overview.feedbackText": "如果您对 Elastic SIEM 体验有任何建议，请随时{feedback}。",
-    "xpack.securitySolution.overview.feedbackText.feedbackLinkText": "在线提交反馈",
-    "xpack.securitySolution.overview.feedbackTitle": "反馈",
     "xpack.securitySolution.overview.filebeatCiscoTitle": "Cisco",
     "xpack.securitySolution.overview.filebeatNetflowTitle": "NetFlow",
     "xpack.securitySolution.overview.filebeatPanwTitle": "Palo Alto Networks",
@@ -22813,11 +22804,6 @@
     "xpack.securitySolution.overview.recentTimelinesSidebarTitle": "最近的时间线",
     "xpack.securitySolution.overview.showTopTooltip": "显示排名靠前的{fieldName}",
     "xpack.securitySolution.overview.signalCountTitle": "检测告警趋势",
-    "xpack.securitySolution.overview.startedText": "欢迎使用安全信息和事件管理 (SIEM)。首先阅读我们的{docs}或{data}。要了解即将推出的功能和教程，请访问我们的 {siemSolution}页面。",
-    "xpack.securitySolution.overview.startedText.dataLinkText": "正在采集数据",
-    "xpack.securitySolution.overview.startedText.docsLinkText": "文档",
-    "xpack.securitySolution.overview.startedText.siemSolutionLinkText": "SIEM 解决方案",
-    "xpack.securitySolution.overview.startedTitle": "入门",
     "xpack.securitySolution.overview.topNLabel": "排名靠前的{fieldName}",
     "xpack.securitySolution.overview.viewAlertsButtonLabel": "查看告警",
     "xpack.securitySolution.overview.viewEventsButtonLabel": "查看事件",
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/execution_duration_chart.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/execution_duration_chart.test.tsx
index 672cd75f0cd13..1f758de1912c4 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/execution_duration_chart.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/execution_duration_chart.test.tsx
@@ -48,7 +48,18 @@ describe('padOrTruncateDurations', () => {
   });
 
   it('pads execution duration values when there are fewer than display desires', () => {
-    expect(padOrTruncateDurations([1, 2, 3], 10)).toEqual([1, 2, 3, 0, 0, 0, 0, 0, 0, 0]);
+    expect(padOrTruncateDurations([1, 2, 3], 10)).toEqual([
+      1,
+      2,
+      3,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+    ]);
   });
 
   it('truncates execution duration values when there are more than display desires', () => {
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/execution_duration_chart.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/execution_duration_chart.tsx
index ca20af9cea0fd..ea8c16d03cc04 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/execution_duration_chart.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/execution_duration_chart.tsx
@@ -82,19 +82,35 @@ export const ExecutionDurationChart: React.FunctionComponent<ComponentOpts> = ({
             />
             <BarSeries
               id="executionDuration"
+              name={i18n.translate(
+                'xpack.triggersActionsUI.sections.executionDurationChart.durationLabel',
+                {
+                  defaultMessage: `Duration`,
+                }
+              )}
               xScaleType="linear"
               yScaleType="linear"
               xAccessor={0}
               yAccessors={[1]}
               data={paddedExecutionDurations.map((val, ndx) => [ndx, val])}
+              minBarHeight={2}
             />
             <LineSeries
               id="rule_duration_avg"
+              name={i18n.translate(
+                'xpack.triggersActionsUI.sections.executionDurationChart.avgDurationLabel',
+                {
+                  defaultMessage: `Avg Duration`,
+                }
+              )}
               xScaleType="linear"
               yScaleType="linear"
               xAccessor={0}
               yAccessors={[1]}
-              data={paddedExecutionDurations.map((val, ndx) => [ndx, executionDuration.average])}
+              data={paddedExecutionDurations.map((val, ndx) => [
+                ndx,
+                val ? executionDuration.average : null,
+              ])}
               curve={CurveType.CURVE_NATURAL}
             />
             <Axis id="left-axis" position="left" tickFormat={(d) => formatMillisForDisplay(d)} />
@@ -125,7 +141,7 @@ export function padOrTruncateDurations(values: number[], desiredSize: number) {
   if (values.length === desiredSize) {
     return values;
   } else if (values.length < desiredSize) {
-    return assign(fill(new Array(desiredSize), 0), values);
+    return assign(fill(new Array(desiredSize), null), values);
   } else {
     // oldest durations are at the start of the array, so take the last {desiredSize} values
     return values.slice(-desiredSize);
diff --git a/x-pack/plugins/triggers_actions_ui/public/types.ts b/x-pack/plugins/triggers_actions_ui/public/types.ts
index 8085f9245f4e9..0b35317cad9b3 100644
--- a/x-pack/plugins/triggers_actions_ui/public/types.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/types.ts
@@ -43,7 +43,7 @@ import {
 type Alert = SanitizedAlert<AlertTypeParams>;
 type ResolvedRule = ResolvedSanitizedRule<AlertTypeParams>;
 
-export {
+export type {
   Alert,
   AlertAction,
   AlertAggregations,
@@ -56,13 +56,12 @@ export {
   AlertTypeParams,
   ResolvedRule,
 };
+export type { ActionType, AsApiContract };
 export {
-  ActionType,
   AlertHistoryEsIndexConnectorId,
   AlertHistoryDocumentTemplate,
   AlertHistoryDefaultIndexName,
   ALERT_HISTORY_PREFIX,
-  AsApiContract,
 };
 
 export type ActionTypeIndex = Record<string, ActionType>;
diff --git a/x-pack/plugins/triggers_actions_ui/server/data/index.ts b/x-pack/plugins/triggers_actions_ui/server/data/index.ts
index 7bc14d0619d79..1f6f39a57cbc8 100644
--- a/x-pack/plugins/triggers_actions_ui/server/data/index.ts
+++ b/x-pack/plugins/triggers_actions_ui/server/data/index.ts
@@ -9,9 +9,8 @@ import { Logger, IRouter } from '../../../../../src/core/server';
 import { timeSeriesQuery } from './lib/time_series_query';
 import { registerRoutes } from './routes';
 
+export type { TimeSeriesQuery, CoreQueryParams } from './lib';
 export {
-  TimeSeriesQuery,
-  CoreQueryParams,
   CoreQueryParamsSchemaProperties,
   validateCoreQueryBody,
   validateTimeWindowUnits,
diff --git a/x-pack/plugins/triggers_actions_ui/server/data/lib/index.ts b/x-pack/plugins/triggers_actions_ui/server/data/lib/index.ts
index aeaee61935449..c76eb1cafa867 100644
--- a/x-pack/plugins/triggers_actions_ui/server/data/lib/index.ts
+++ b/x-pack/plugins/triggers_actions_ui/server/data/lib/index.ts
@@ -5,9 +5,9 @@
  * 2.0.
  */
 
-export { TimeSeriesQuery } from './time_series_query';
+export type { TimeSeriesQuery } from './time_series_query';
+export type { CoreQueryParams } from './core_query_types';
 export {
-  CoreQueryParams,
   CoreQueryParamsSchemaProperties,
   validateCoreQueryBody,
   validateTimeWindowUnits,
diff --git a/x-pack/plugins/triggers_actions_ui/server/data/lib/time_series_query.ts b/x-pack/plugins/triggers_actions_ui/server/data/lib/time_series_query.ts
index 0be981661f565..ca4c7c8acc5dc 100644
--- a/x-pack/plugins/triggers_actions_ui/server/data/lib/time_series_query.ts
+++ b/x-pack/plugins/triggers_actions_ui/server/data/lib/time_series_query.ts
@@ -12,7 +12,7 @@ import { DEFAULT_GROUPS } from '../index';
 import { getDateRangeInfo } from './date_range_info';
 
 import { TimeSeriesQuery, TimeSeriesResult, TimeSeriesResultRow } from './time_series_types';
-export { TimeSeriesQuery, TimeSeriesResult } from './time_series_types';
+export type { TimeSeriesQuery, TimeSeriesResult } from './time_series_types';
 
 export interface TimeSeriesQueryParameters {
   logger: Logger;
diff --git a/x-pack/plugins/triggers_actions_ui/server/data/lib/time_series_types.ts b/x-pack/plugins/triggers_actions_ui/server/data/lib/time_series_types.ts
index f6a1950c0fd97..125bdaa487fd2 100644
--- a/x-pack/plugins/triggers_actions_ui/server/data/lib/time_series_types.ts
+++ b/x-pack/plugins/triggers_actions_ui/server/data/lib/time_series_types.ts
@@ -19,7 +19,7 @@ import {
   getDateStartAfterDateEndErrorMessage,
 } from './date_range_info';
 
-export { TimeSeriesResult, TimeSeriesResultRow, MetricResult } from '../../../common/data';
+export type { TimeSeriesResult, TimeSeriesResultRow, MetricResult } from '../../../common/data';
 
 // The parameters here are very similar to the alert parameters.
 // Missing are `comparator` and `threshold`, which aren't needed to generate
diff --git a/x-pack/plugins/triggers_actions_ui/server/data/routes/time_series_query.ts b/x-pack/plugins/triggers_actions_ui/server/data/routes/time_series_query.ts
index da6638db2e457..8b618b3ae3d49 100644
--- a/x-pack/plugins/triggers_actions_ui/server/data/routes/time_series_query.ts
+++ b/x-pack/plugins/triggers_actions_ui/server/data/routes/time_series_query.ts
@@ -16,7 +16,7 @@ import { Logger } from '../../../../../../src/core/server';
 import { TimeSeriesQueryParameters } from '../lib/time_series_query';
 
 import { TimeSeriesQuery, TimeSeriesQuerySchema, TimeSeriesResult } from '../lib/time_series_types';
-export { TimeSeriesQuery, TimeSeriesResult } from '../lib/time_series_types';
+export type { TimeSeriesQuery, TimeSeriesResult } from '../lib/time_series_types';
 
 export function createTimeSeriesQueryRoute(
   logger: Logger,
diff --git a/x-pack/plugins/triggers_actions_ui/server/index.ts b/x-pack/plugins/triggers_actions_ui/server/index.ts
index 89c17ea0d4189..2f33f3bd77cc0 100644
--- a/x-pack/plugins/triggers_actions_ui/server/index.ts
+++ b/x-pack/plugins/triggers_actions_ui/server/index.ts
@@ -8,10 +8,9 @@ import { PluginConfigDescriptor, PluginInitializerContext } from 'kibana/server'
 import { configSchema, ConfigSchema } from '../config';
 import { TriggersActionsPlugin } from './plugin';
 
-export { PluginStartContract } from './plugin';
+export type { PluginStartContract } from './plugin';
+export type { TimeSeriesQuery, CoreQueryParams } from './data';
 export {
-  TimeSeriesQuery,
-  CoreQueryParams,
   CoreQueryParamsSchemaProperties,
   validateCoreQueryBody,
   validateTimeWindowUnits,
diff --git a/x-pack/plugins/ui_actions_enhanced/public/components/presentable_picker/presentable_picker.tsx b/x-pack/plugins/ui_actions_enhanced/public/components/presentable_picker/presentable_picker.tsx
index 72f9e5aa0bd4a..9667a78df9a4e 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/components/presentable_picker/presentable_picker.tsx
+++ b/x-pack/plugins/ui_actions_enhanced/public/components/presentable_picker/presentable_picker.tsx
@@ -9,7 +9,7 @@ import React from 'react';
 import { EuiFlexGroup } from '@elastic/eui';
 import { PresentablePickerItem, Item } from './presentable_picker_item';
 
-export { Item } from './presentable_picker_item';
+export type { Item } from './presentable_picker_item';
 
 export interface PresentablePickerProps {
   items: Item[];
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/trigger_picker/index.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/trigger_picker/index.ts
index cdb6fbe54698d..4a30a0494e8f7 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/trigger_picker/index.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/trigger_picker/index.ts
@@ -5,5 +5,5 @@
  * 2.0.
  */
 
-export { TriggerPickerItemDescription } from './trigger_picker_item';
+export type { TriggerPickerItemDescription } from './trigger_picker_item';
 export * from './trigger_picker';
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/types.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/types.ts
index 4d6e5354604a1..052211d523896 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/types.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/components/types.ts
@@ -5,4 +5,4 @@
  * 2.0.
  */
 
-export { ActionFactoryPlaceContext } from '../types';
+export type { ActionFactoryPlaceContext } from '../types';
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/index.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/index.ts
index 85ee586367406..cb1e6099c9b53 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/index.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/containers/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { createPublicDrilldownManager, PublicDrilldownManagerComponent } from './drilldown_manager';
+export type { PublicDrilldownManagerComponent } from './drilldown_manager';
+export { createPublicDrilldownManager } from './drilldown_manager';
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/state/drilldown_manager_state.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/state/drilldown_manager_state.ts
index 5a34a002bf4c3..e363d154dc141 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/state/drilldown_manager_state.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/state/drilldown_manager_state.ts
@@ -468,7 +468,6 @@ export class DrilldownManagerState {
   // Below are convenience React hooks for consuming observables in connected
   // React components.
 
-  /* eslint-disable react-hooks/rules-of-hooks */
   public readonly useTitle = () => useObservable(this.title$, this.title$.getValue());
   public readonly useFooter = () => useObservable(this.footer$, this.footer$.getValue());
   public readonly useRoute = () => useObservable(this.route$, this.route$.getValue());
@@ -477,5 +476,4 @@ export class DrilldownManagerState {
   public readonly useActionFactory = () =>
     useObservable(this.actionFactory$, this.actionFactory$.getValue());
   public readonly useEvents = () => useObservable(this.events$, this.events$.getValue());
-  /* eslint-enable react-hooks/rules-of-hooks */
 }
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/state/drilldown_state.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/state/drilldown_state.ts
index f80ad30d34bb8..d16a9a93930dd 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/state/drilldown_state.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/drilldown_manager/state/drilldown_state.ts
@@ -233,10 +233,8 @@ export class DrilldownState {
   // Below are convenience React hooks for consuming observables in connected
   // React components.
 
-  /* eslint-disable react-hooks/rules-of-hooks */
   public readonly useName = () => useObservable(this.name$, this.name$.getValue());
   public readonly useTriggers = () => useObservable(this.triggers$, this.triggers$.getValue());
   public readonly useConfig = () => useObservable(this.config$, this.config$.getValue());
   public readonly useError = () => useSyncObservable(this.error$);
-  /* eslint-enable react-hooks/rules-of-hooks */
 }
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/components/url_drilldown_collect_config/index.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/components/url_drilldown_collect_config/index.ts
index 7922158c62e7f..5aa1dddd64f8c 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/components/url_drilldown_collect_config/index.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/components/url_drilldown_collect_config/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { UrlDrilldownCollectConfig, UrlDrilldownCollectConfigProps } from './lazy';
+export type { UrlDrilldownCollectConfigProps } from './lazy';
+export { UrlDrilldownCollectConfig } from './lazy';
diff --git a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/index.ts b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/index.ts
index cc0ce30eb4f43..db76a54cc8d5b 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/index.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/drilldowns/url_drilldown/index.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-export { UrlDrilldownConfig, UrlDrilldownGlobalScope, UrlDrilldownScope } from './types';
+export type { UrlDrilldownConfig, UrlDrilldownGlobalScope, UrlDrilldownScope } from './types';
 export { UrlDrilldownCollectConfig } from './components';
 export {
   validateUrlTemplate as urlDrilldownValidateUrlTemplate,
diff --git a/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/types.ts b/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/types.ts
index b400f9bd97231..2512753c07f4a 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/types.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/dynamic_actions/types.ts
@@ -7,7 +7,7 @@
 
 import { SerializedAction, SerializedEvent, BaseActionConfig } from '../../common/types';
 
-export { SerializedAction, SerializedEvent, BaseActionConfig };
+export type { SerializedAction, SerializedEvent, BaseActionConfig };
 
 /**
  * Action factory context passed into ActionFactories' CollectConfig, getDisplayName, getIconType
diff --git a/x-pack/plugins/ui_actions_enhanced/public/index.ts b/x-pack/plugins/ui_actions_enhanced/public/index.ts
index 3135cf44a7aa9..453a633e851af 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/index.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/index.ts
@@ -13,38 +13,42 @@ export function plugin(initializerContext: PluginInitializerContext) {
 }
 
 export { AdvancedUiActionsPublicPlugin as Plugin };
-export {
+export type {
   SetupContract as AdvancedUiActionsSetup,
   StartContract as AdvancedUiActionsStart,
 } from './plugin';
 
-export {
+export type {
   ActionFactoryDefinition as UiActionsEnhancedActionFactoryDefinition,
-  ActionFactory as UiActionsEnhancedActionFactory,
   SerializedAction as UiActionsEnhancedSerializedAction,
   SerializedEvent as UiActionsEnhancedSerializedEvent,
-  AbstractActionStorage as UiActionsEnhancedAbstractActionStorage,
-  DynamicActionManager as UiActionsEnhancedDynamicActionManager,
   DynamicActionManagerParams as UiActionsEnhancedDynamicActionManagerParams,
   DynamicActionManagerState as UiActionsEnhancedDynamicActionManagerState,
-  MemoryActionStorage as UiActionsEnhancedMemoryActionStorage,
   BaseActionFactoryContext as UiActionsEnhancedBaseActionFactoryContext,
   BaseActionConfig as UiActionsEnhancedBaseActionConfig,
 } from './dynamic_actions';
+export {
+  ActionFactory as UiActionsEnhancedActionFactory,
+  AbstractActionStorage as UiActionsEnhancedAbstractActionStorage,
+  DynamicActionManager as UiActionsEnhancedDynamicActionManager,
+  MemoryActionStorage as UiActionsEnhancedMemoryActionStorage,
+} from './dynamic_actions';
 
-export { DynamicActionsState } from './services/ui_actions_service_enhancements';
+export type { DynamicActionsState } from './services/ui_actions_service_enhancements';
 
-export {
+export type {
   DrilldownDefinition as UiActionsEnhancedDrilldownDefinition,
   DrilldownTemplate as UiActionsEnhancedDrilldownTemplate,
 } from './drilldowns';
+export type {
+  UrlDrilldownConfig,
+  UrlDrilldownGlobalScope,
+  UrlDrilldownScope,
+} from './drilldowns/url_drilldown';
 export {
   urlDrilldownCompileUrl,
   UrlDrilldownCollectConfig,
-  UrlDrilldownConfig,
-  UrlDrilldownGlobalScope,
   urlDrilldownGlobalScopeProvider,
-  UrlDrilldownScope,
   urlDrilldownValidateUrl,
   urlDrilldownValidateUrlTemplate,
 } from './drilldowns/url_drilldown';
diff --git a/x-pack/plugins/ui_actions_enhanced/public/services/ui_actions_service_enhancements.ts b/x-pack/plugins/ui_actions_enhanced/public/services/ui_actions_service_enhancements.ts
index 8da9e62766cc3..40155617b22e0 100644
--- a/x-pack/plugins/ui_actions_enhanced/public/services/ui_actions_service_enhancements.ts
+++ b/x-pack/plugins/ui_actions_enhanced/public/services/ui_actions_service_enhancements.ts
@@ -22,7 +22,7 @@ import { PersistableStateDefinition } from '../../../../../src/plugins/kibana_ut
 
 import { DynamicActionsState } from '../../common/types';
 
-export { DynamicActionsState };
+export type { DynamicActionsState };
 
 export interface UiActionsServiceEnhancementsParams {
   readonly actionFactories?: ActionFactoryRegistry;
diff --git a/x-pack/plugins/ui_actions_enhanced/server/index.ts b/x-pack/plugins/ui_actions_enhanced/server/index.ts
index ef6cc4015c8e0..a1d70d3ea4a83 100644
--- a/x-pack/plugins/ui_actions_enhanced/server/index.ts
+++ b/x-pack/plugins/ui_actions_enhanced/server/index.ts
@@ -12,17 +12,17 @@ export function plugin() {
 }
 
 export { AdvancedUiActionsServerPlugin as Plugin };
-export {
+export type {
   SetupContract as AdvancedUiActionsSetup,
   StartContract as AdvancedUiActionsStart,
 } from './plugin';
 
-export {
+export type {
   ActionFactoryDefinition as UiActionsEnhancedActionFactoryDefinition,
   ActionFactory as UiActionsEnhancedActionFactory,
 } from './types';
 
-export {
+export type {
   DynamicActionsState,
   BaseActionConfig as UiActionsEnhancedBaseActionConfig,
   SerializedAction as UiActionsEnhancedSerializedAction,
diff --git a/x-pack/plugins/ui_actions_enhanced/server/types.ts b/x-pack/plugins/ui_actions_enhanced/server/types.ts
index 24d30d74661bd..e0734e31486b5 100644
--- a/x-pack/plugins/ui_actions_enhanced/server/types.ts
+++ b/x-pack/plugins/ui_actions_enhanced/server/types.ts
@@ -24,4 +24,4 @@ export interface ActionFactory<P extends SerializedEvent = SerializedEvent>
   id: string;
 }
 
-export { SerializedEvent, SerializedAction, DynamicActionsState };
+export type { SerializedEvent, SerializedAction, DynamicActionsState };
diff --git a/x-pack/plugins/upgrade_assistant/__jest__/client_integration/helpers/index.ts b/x-pack/plugins/upgrade_assistant/__jest__/client_integration/helpers/index.ts
index b2a1c4e80ec7d..2d3fff9d43e2c 100644
--- a/x-pack/plugins/upgrade_assistant/__jest__/client_integration/helpers/index.ts
+++ b/x-pack/plugins/upgrade_assistant/__jest__/client_integration/helpers/index.ts
@@ -5,8 +5,11 @@
  * 2.0.
  */
 
-export { setup as setupOverviewPage, OverviewTestBed } from './overview.helpers';
-export { setup as setupElasticsearchPage, ElasticsearchTestBed } from './elasticsearch.helpers';
-export { setup as setupKibanaPage, KibanaTestBed } from './kibana.helpers';
+export type { OverviewTestBed } from './overview.helpers';
+export { setup as setupOverviewPage } from './overview.helpers';
+export type { ElasticsearchTestBed } from './elasticsearch.helpers';
+export { setup as setupElasticsearchPage } from './elasticsearch.helpers';
+export type { KibanaTestBed } from './kibana.helpers';
+export { setup as setupKibanaPage } from './kibana.helpers';
 
 export { setupEnvironment, kibanaVersion } from './setup_environment';
diff --git a/x-pack/plugins/upgrade_assistant/public/application/components/es_deprecations/deprecation_types/reindex/flyout/index.tsx b/x-pack/plugins/upgrade_assistant/public/application/components/es_deprecations/deprecation_types/reindex/flyout/index.tsx
index 6b9eee80acb57..dad239ddb81b3 100644
--- a/x-pack/plugins/upgrade_assistant/public/application/components/es_deprecations/deprecation_types/reindex/flyout/index.tsx
+++ b/x-pack/plugins/upgrade_assistant/public/application/components/es_deprecations/deprecation_types/reindex/flyout/index.tsx
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { ReindexFlyout, ReindexFlyoutProps } from './container';
+export type { ReindexFlyoutProps } from './container';
+export { ReindexFlyout } from './container';
diff --git a/x-pack/plugins/upgrade_assistant/public/shared_imports.ts b/x-pack/plugins/upgrade_assistant/public/shared_imports.ts
index 64b52065f63e6..06816daac428b 100644
--- a/x-pack/plugins/upgrade_assistant/public/shared_imports.ts
+++ b/x-pack/plugins/upgrade_assistant/public/shared_imports.ts
@@ -8,18 +8,20 @@
 import { useKibana as _useKibana } from '../../../../src/plugins/kibana_react/public';
 import { AppServicesContext } from './types';
 
-export {
-  sendRequest,
+export type {
   SendRequestConfig,
   SendRequestResponse,
-  useRequest,
   UseRequestConfig,
+} from '../../../../src/plugins/es_ui_shared/public/';
+export {
+  sendRequest,
+  useRequest,
   SectionLoading,
   GlobalFlyout,
 } from '../../../../src/plugins/es_ui_shared/public/';
 
 export { KibanaContextProvider } from '../../../../src/plugins/kibana_react/public';
 
-export { DataPublicPluginStart } from '../../../../src/plugins/data/public';
+export type { DataPublicPluginStart } from '../../../../src/plugins/data/public';
 
 export const useKibana = () => _useKibana<AppServicesContext>();
diff --git a/x-pack/plugins/uptime/common/runtime_types/ping/synthetics.ts b/x-pack/plugins/uptime/common/runtime_types/ping/synthetics.ts
index 040f0a83e84ab..59e15f2d9e9c3 100644
--- a/x-pack/plugins/uptime/common/runtime_types/ping/synthetics.ts
+++ b/x-pack/plugins/uptime/common/runtime_types/ping/synthetics.ts
@@ -27,7 +27,7 @@ export const JourneyStepType = t.intersection([
         lt: t.string,
       }),
     }),
-    observer: t.type({
+    observer: t.partial({
       geo: t.type({
         name: t.string,
       }),
diff --git a/x-pack/plugins/uptime/common/runtime_types/snapshot/index.ts b/x-pack/plugins/uptime/common/runtime_types/snapshot/index.ts
index a09e5455015a1..15f190a0dacd2 100644
--- a/x-pack/plugins/uptime/common/runtime_types/snapshot/index.ts
+++ b/x-pack/plugins/uptime/common/runtime_types/snapshot/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { Snapshot, SnapshotType } from './snapshot_count';
+export type { Snapshot } from './snapshot_count';
+export { SnapshotType } from './snapshot_count';
diff --git a/x-pack/plugins/uptime/public/components/common/higher_order/index.ts b/x-pack/plugins/uptime/public/components/common/higher_order/index.ts
index d1d95b7cb099f..403f942a3d7c5 100644
--- a/x-pack/plugins/uptime/public/components/common/higher_order/index.ts
+++ b/x-pack/plugins/uptime/public/components/common/higher_order/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { ResponsiveWrapperProps, withResponsiveWrapper } from './responsive_wrapper';
+export type { ResponsiveWrapperProps } from './responsive_wrapper';
+export { withResponsiveWrapper } from './responsive_wrapper';
diff --git a/x-pack/plugins/uptime/public/components/common/uptime_date_picker.test.tsx b/x-pack/plugins/uptime/public/components/common/uptime_date_picker.test.tsx
index cd122eb5d5fc5..1510fe28f1721 100644
--- a/x-pack/plugins/uptime/public/components/common/uptime_date_picker.test.tsx
+++ b/x-pack/plugins/uptime/public/components/common/uptime_date_picker.test.tsx
@@ -12,8 +12,13 @@ import { createMemoryHistory } from 'history';
 import { render } from '../../lib/helper/rtl_helpers';
 import { fireEvent } from '@testing-library/dom';
 
-// FLAKY: https://github.com/elastic/kibana/issues/114396
-describe.skip('UptimeDatePicker component', () => {
+describe('UptimeDatePicker component', () => {
+  jest.setTimeout(10_000);
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
   it('renders properly with mock data', async () => {
     const { findByText } = render(<UptimeDatePicker />);
     expect(await findByText('Last 15 minutes')).toBeInTheDocument();
@@ -86,7 +91,7 @@ describe.skip('UptimeDatePicker component', () => {
 
     // it should update shared state
 
-    expect(startPlugins.data.query.timefilter.timefilter.setTime).toHaveBeenCalledTimes(3);
+    expect(startPlugins.data.query.timefilter.timefilter.setTime).toHaveBeenCalledTimes(2);
 
     expect(startPlugins.data.query.timefilter.timefilter.setTime).toHaveBeenCalledWith({
       from: 'now-10m',
diff --git a/x-pack/plugins/uptime/public/components/monitor/synthetics/waterfall/index.tsx b/x-pack/plugins/uptime/public/components/monitor/synthetics/waterfall/index.tsx
index 0de1b50ecce8f..b83cb630aaa79 100644
--- a/x-pack/plugins/uptime/public/components/monitor/synthetics/waterfall/index.tsx
+++ b/x-pack/plugins/uptime/public/components/monitor/synthetics/waterfall/index.tsx
@@ -5,11 +5,12 @@
  * 2.0.
  */
 
-export { WaterfallChart, RenderItem, WaterfallChartProps } from './components/waterfall_chart';
+export type { RenderItem, WaterfallChartProps } from './components/waterfall_chart';
+export { WaterfallChart } from './components/waterfall_chart';
 export { WaterfallProvider, useWaterfallContext } from './context/waterfall_chart';
 export { MiddleTruncatedText } from './components/middle_truncated_text';
 export { useFlyout } from './components/use_flyout';
-export {
+export type {
   WaterfallData,
   WaterfallDataEntry,
   WaterfallMetadata,
diff --git a/x-pack/plugins/uptime/public/components/overview/alerts/alerts_containers/index.ts b/x-pack/plugins/uptime/public/components/overview/alerts/alerts_containers/index.ts
index 05223cc367c70..db1ca00c36ba4 100644
--- a/x-pack/plugins/uptime/public/components/overview/alerts/alerts_containers/index.ts
+++ b/x-pack/plugins/uptime/public/components/overview/alerts/alerts_containers/index.ts
@@ -5,8 +5,6 @@
  * 2.0.
  */
 
-export {
-  ToggleAlertFlyoutButton,
-  ToggleAlertFlyoutButtonProps,
-} from './toggle_alert_flyout_button';
+export type { ToggleAlertFlyoutButtonProps } from './toggle_alert_flyout_button';
+export { ToggleAlertFlyoutButton } from './toggle_alert_flyout_button';
 export { UptimeAlertsFlyoutWrapper } from './uptime_alerts_flyout_wrapper';
diff --git a/x-pack/plugins/uptime/public/components/overview/alerts/monitor_status_alert/alert_monitor_status.test.tsx b/x-pack/plugins/uptime/public/components/overview/alerts/monitor_status_alert/alert_monitor_status.test.tsx
index b339410ef2409..aa5e2a7db6461 100644
--- a/x-pack/plugins/uptime/public/components/overview/alerts/monitor_status_alert/alert_monitor_status.test.tsx
+++ b/x-pack/plugins/uptime/public/components/overview/alerts/monitor_status_alert/alert_monitor_status.test.tsx
@@ -15,6 +15,8 @@ import {
 import { render } from '../../../../lib/helper/rtl_helpers';
 
 describe('alert monitor status component', () => {
+  jest.setTimeout(10_000);
+
   describe('hasFilters', () => {
     const EMPTY_FILTERS = {
       tags: [],
diff --git a/x-pack/plugins/uptime/public/components/overview/monitor_list/index.ts b/x-pack/plugins/uptime/public/components/overview/monitor_list/index.ts
index 4d54668b6e24b..86e4c6907b7d1 100644
--- a/x-pack/plugins/uptime/public/components/overview/monitor_list/index.ts
+++ b/x-pack/plugins/uptime/public/components/overview/monitor_list/index.ts
@@ -6,7 +6,7 @@
  */
 
 export { MonitorListComponent } from './monitor_list';
-export { Criteria, Pagination } from './types';
+export type { Criteria, Pagination } from './types';
 export { LocationLink } from './monitor_list_drawer';
 export { MonitorListDrawer } from './monitor_list_drawer/list_drawer_container';
 export { ActionsPopover } from './monitor_list_drawer/actions_popover/actions_popover_container';
diff --git a/x-pack/plugins/uptime/public/contexts/index.ts b/x-pack/plugins/uptime/public/contexts/index.ts
index 0a5d3441bfe2c..8467691064bff 100644
--- a/x-pack/plugins/uptime/public/contexts/index.ts
+++ b/x-pack/plugins/uptime/public/contexts/index.ts
@@ -6,11 +6,8 @@
  */
 
 export { UptimeRefreshContext, UptimeRefreshContextProvider } from './uptime_refresh_context';
-export {
-  UptimeSettingsContextValues,
-  UptimeSettingsContext,
-  UptimeSettingsContextProvider,
-} from './uptime_settings_context';
+export type { UptimeSettingsContextValues } from './uptime_settings_context';
+export { UptimeSettingsContext, UptimeSettingsContextProvider } from './uptime_settings_context';
 export { UptimeThemeContextProvider, UptimeThemeContext } from './uptime_theme_context';
 export {
   UptimeStartupPluginsContext,
diff --git a/x-pack/plugins/uptime/public/lib/helper/index.ts b/x-pack/plugins/uptime/public/lib/helper/index.ts
index 2fce3cc0e54dc..c06e1efc38137 100644
--- a/x-pack/plugins/uptime/public/lib/helper/index.ts
+++ b/x-pack/plugins/uptime/public/lib/helper/index.ts
@@ -9,5 +9,6 @@ export { convertMicrosecondsToMilliseconds } from './convert_measurements';
 export * from './observability_integration';
 export { getChartDateLabel } from './charts';
 export { seriesHasDownValues } from './series_has_down_values';
-export { UptimeUrlParams, getSupportedUrlParams } from './url_params';
+export type { UptimeUrlParams } from './url_params';
+export { getSupportedUrlParams } from './url_params';
 export { MountWithReduxProvider } from './helper_with_redux';
diff --git a/x-pack/plugins/uptime/public/lib/helper/url_params/index.ts b/x-pack/plugins/uptime/public/lib/helper/url_params/index.ts
index 958a7b904da92..8b1ff815c1c1f 100644
--- a/x-pack/plugins/uptime/public/lib/helper/url_params/index.ts
+++ b/x-pack/plugins/uptime/public/lib/helper/url_params/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { UptimeUrlParams, getSupportedUrlParams } from './get_supported_url_params';
+export type { UptimeUrlParams } from './get_supported_url_params';
+export { getSupportedUrlParams } from './get_supported_url_params';
diff --git a/x-pack/plugins/uptime/server/lib/domains/index.ts b/x-pack/plugins/uptime/server/lib/domains/index.ts
index e0252e7d4a3eb..ed459d39e246e 100644
--- a/x-pack/plugins/uptime/server/lib/domains/index.ts
+++ b/x-pack/plugins/uptime/server/lib/domains/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { licenseCheck, UMLicenseCheck } from './license';
+export type { UMLicenseCheck } from './license';
+export { licenseCheck } from './license';
diff --git a/x-pack/plugins/watcher/__jest__/client_integration/helpers/index.ts b/x-pack/plugins/watcher/__jest__/client_integration/helpers/index.ts
index 09a841ff147a4..37fe71d143988 100644
--- a/x-pack/plugins/watcher/__jest__/client_integration/helpers/index.ts
+++ b/x-pack/plugins/watcher/__jest__/client_integration/helpers/index.ts
@@ -11,7 +11,8 @@ import { setup as watchCreateJsonSetup } from './watch_create_json.helpers';
 import { setup as watchCreateThresholdSetup } from './watch_create_threshold.helpers';
 import { setup as watchEditSetup } from './watch_edit.helpers';
 
-export { getRandomString, findTestSubject, TestBed } from '@kbn/test/jest';
+export type { TestBed } from '@kbn/test/jest';
+export { getRandomString, findTestSubject } from '@kbn/test/jest';
 export { wrapBodyResponse, unwrapBodyResponse } from './body_response';
 export { setupEnvironment } from './setup_environment';
 
diff --git a/x-pack/plugins/watcher/public/application/components/index.ts b/x-pack/plugins/watcher/public/application/components/index.ts
index f70c15bda18b2..f10dfe9b1e281 100644
--- a/x-pack/plugins/watcher/public/application/components/index.ts
+++ b/x-pack/plugins/watcher/public/application/components/index.ts
@@ -11,4 +11,5 @@ export { DeleteWatchesModal } from './delete_watches_modal';
 export { ErrableFormRow } from './form_errors';
 export { WatchStatus } from './watch_status';
 export { SectionLoading } from './section_loading';
-export { SectionError, Error } from './section_error';
+export type { Error } from './section_error';
+export { SectionError } from './section_error';
diff --git a/x-pack/plugins/watcher/public/application/shared_imports.ts b/x-pack/plugins/watcher/public/application/shared_imports.ts
index 977204c627e5c..a076fed8be58f 100644
--- a/x-pack/plugins/watcher/public/application/shared_imports.ts
+++ b/x-pack/plugins/watcher/public/application/shared_imports.ts
@@ -5,10 +5,12 @@
  * 2.0.
  */
 
-export {
+export type {
   SendRequestConfig,
   SendRequestResponse,
   UseRequestConfig,
+} from '../../../../../src/plugins/es_ui_shared/public';
+export {
   sendRequest,
   useRequest,
   XJson,
diff --git a/x-pack/plugins/watcher/public/legacy/parse_es_interval/index.ts b/x-pack/plugins/watcher/public/legacy/parse_es_interval/index.ts
index 0af13b3abbf5e..b172a0b217c55 100644
--- a/x-pack/plugins/watcher/public/legacy/parse_es_interval/index.ts
+++ b/x-pack/plugins/watcher/public/legacy/parse_es_interval/index.ts
@@ -5,7 +5,8 @@
  * 2.0.
  */
 
-export { parseEsInterval, ParsedInterval } from './parse_es_interval';
+export type { ParsedInterval } from './parse_es_interval';
+export { parseEsInterval } from './parse_es_interval';
 export { InvalidEsCalendarIntervalError } from './invalid_es_calendar_interval_error';
 export { InvalidEsIntervalFormatError } from './invalid_es_interval_format_error';
 export { isValidEsInterval } from './is_valid_es_interval';
diff --git a/x-pack/scripts/functional_tests.js b/x-pack/scripts/functional_tests.js
index e31b12cd0115d..77212274b6ade 100644
--- a/x-pack/scripts/functional_tests.js
+++ b/x-pack/scripts/functional_tests.js
@@ -71,6 +71,10 @@ const onlyNotInCoverageTests = [
   require.resolve('../test/saved_object_api_integration/security_and_spaces/config_trial.ts'),
   require.resolve('../test/saved_object_api_integration/security_and_spaces/config_basic.ts'),
   require.resolve('../test/saved_object_api_integration/spaces_only/config.ts'),
+  // TODO: Enable once RBAC timeline search strategy
+  // tests updated
+  // require.resolve('../test/timeline/security_and_spaces/config_basic.ts'),
+  require.resolve('../test/timeline/security_and_spaces/config_trial.ts'),
   require.resolve('../test/ui_capabilities/security_and_spaces/config.ts'),
   require.resolve('../test/ui_capabilities/spaces_only/config.ts'),
   require.resolve('../test/upgrade_assistant_integration/config.js'),
diff --git a/x-pack/test/accessibility/apps/lens.ts b/x-pack/test/accessibility/apps/lens.ts
index b8ddd774741b6..e97dc869af48b 100644
--- a/x-pack/test/accessibility/apps/lens.ts
+++ b/x-pack/test/accessibility/apps/lens.ts
@@ -13,13 +13,16 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const testSubjects = getService('testSubjects');
   const esArchiver = getService('esArchiver');
   const listingTable = getService('listingTable');
+  const kibanaServer = getService('kibanaServer');
 
   // Failing: See https://github.com/elastic/kibana/issues/115614
   describe.skip('Lens', () => {
     const lensChartName = 'MyLensChart';
     before(async () => {
-      await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/logstash_functional');
-      await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/lens/basic');
+      await esArchiver.load('x-pack/test/functional/es_archives/logstash_functional');
+      await kibanaServer.importExport.load(
+        'x-pack/test/functional/fixtures/kbn_archiver/lens/lens_basic.json'
+      );
     });
 
     after(async () => {
@@ -29,7 +32,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await listingTable.clickDeleteSelected();
       await PageObjects.common.clickConfirmOnModal();
       await esArchiver.unload('x-pack/test/functional/es_archives/logstash_functional');
-      await esArchiver.unload('x-pack/test/functional/es_archives/lens/basic');
+      await kibanaServer.importExport.unload(
+        'x-pack/test/functional/fixtures/kbn_archiver/lens/lens_basic.json'
+      );
     });
 
     it('lens', async () => {
diff --git a/x-pack/test/accessibility/apps/ml_embeddables_in_dashboard.ts b/x-pack/test/accessibility/apps/ml_embeddables_in_dashboard.ts
index 48224ebcf7353..c9088c650c033 100644
--- a/x-pack/test/accessibility/apps/ml_embeddables_in_dashboard.ts
+++ b/x-pack/test/accessibility/apps/ml_embeddables_in_dashboard.ts
@@ -95,7 +95,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         it('can open job selection flyout', async () => {
           await PageObjects.dashboard.clickCreateDashboardPrompt();
           await ml.dashboardEmbeddables.assertDashboardIsEmpty();
-          await ml.dashboardEmbeddables.openJobSelectionFlyout();
+          await ml.dashboardEmbeddables.openAnomalyJobSelectionFlyout('ml_anomaly_charts');
           await a11y.testAppSnapshot();
         });
 
diff --git a/x-pack/test/alerting_api_integration/common/lib/index.ts b/x-pack/test/alerting_api_integration/common/lib/index.ts
index eeb9c88269667..305c42b5c1d64 100644
--- a/x-pack/test/alerting_api_integration/common/lib/index.ts
+++ b/x-pack/test/alerting_api_integration/common/lib/index.ts
@@ -14,7 +14,8 @@ export {
   getConsumerUnauthorizedErrorMessage,
   getProducerUnauthorizedErrorMessage,
 } from './alert_utils';
-export { TaskManagerUtils, TaskManagerDoc } from './task_manager_utils';
+export type { TaskManagerDoc } from './task_manager_utils';
+export { TaskManagerUtils } from './task_manager_utils';
 export * from './test_assertions';
 export { checkAAD } from './check_aad';
 export { getEventLog } from './get_event_log';
diff --git a/x-pack/test/api_integration/apis/lens/telemetry.ts b/x-pack/test/api_integration/apis/lens/telemetry.ts
index 1c0c67a5203d6..f29df1c358d37 100644
--- a/x-pack/test/api_integration/apis/lens/telemetry.ts
+++ b/x-pack/test/api_integration/apis/lens/telemetry.ts
@@ -21,6 +21,7 @@ const COMMON_HEADERS = {
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const es = getService('es');
+  const kibanaServer = getService('kibanaServer');
 
   async function assertExpectedSavedObjects(num: number) {
     // Make sure that new/deleted docs are available to search
@@ -172,9 +173,10 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     it('should collect telemetry on saved visualization types with a painless script', async () => {
-      const esArchiver = getService('esArchiver');
+      await kibanaServer.importExport.load(
+        'x-pack/test/functional/fixtures/kbn_archiver/lens/lens_basic.json'
+      );
 
-      await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/lens/basic');
       const kibanaClient = convertToKibanaClient(es);
       const results = await getVisualizationCounts(() => Promise.resolve(kibanaClient), '.kibana');
 
@@ -194,7 +196,9 @@ export default ({ getService }: FtrProviderContext) => {
       });
       expect(results.saved_overall_total).to.eql(3);
 
-      await esArchiver.unload('x-pack/test/functional/es_archives/lens/basic');
+      await kibanaServer.importExport.unload(
+        'x-pack/test/functional/fixtures/kbn_archiver/lens/lens_basic.json'
+      );
     });
   });
 };
diff --git a/x-pack/test/api_integration/apis/management/snapshot_restore/lib/index.ts b/x-pack/test/api_integration/apis/management/snapshot_restore/lib/index.ts
index a9721c5856598..469ee43e4bef1 100644
--- a/x-pack/test/api_integration/apis/management/snapshot_restore/lib/index.ts
+++ b/x-pack/test/api_integration/apis/management/snapshot_restore/lib/index.ts
@@ -5,4 +5,5 @@
  * 2.0.
  */
 
-export { registerEsHelpers, SlmPolicy } from './elasticsearch';
+export type { SlmPolicy } from './elasticsearch';
+export { registerEsHelpers } from './elasticsearch';
diff --git a/x-pack/test/api_integration/apis/metrics_ui/http_source.ts b/x-pack/test/api_integration/apis/metrics_ui/http_source.ts
index 65a350c523ee3..f0eba78f90a02 100644
--- a/x-pack/test/api_integration/apis/metrics_ui/http_source.ts
+++ b/x-pack/test/api_integration/apis/metrics_ui/http_source.ts
@@ -42,13 +42,6 @@ export default function ({ getService }: FtrProviderContext) {
           return resp.then((data) => {
             expect(data).to.have.property('source');
             expect(data?.source.configuration.metricAlias).to.equal('metrics-*,metricbeat-*');
-            expect(data?.source.configuration.fields).to.eql({
-              container: 'container.id',
-              host: 'host.name',
-              pod: 'kubernetes.pod.uid',
-              tiebreaker: '_doc',
-              timestamp: '@timestamp',
-            });
             expect(data?.source).to.have.property('status');
             expect(data?.source.status?.metricIndicesExist).to.equal(true);
           });
diff --git a/x-pack/test/api_integration/apis/metrics_ui/log_sources.ts b/x-pack/test/api_integration/apis/metrics_ui/log_sources.ts
index 5b615c4b18916..516c262429299 100644
--- a/x-pack/test/api_integration/apis/metrics_ui/log_sources.ts
+++ b/x-pack/test/api_integration/apis/metrics_ui/log_sources.ts
@@ -40,8 +40,6 @@ export default function ({ getService }: FtrProviderContext) {
           type: 'index_name',
           indexName: 'logs-*,filebeat-*,kibana_sample_data_logs*',
         });
-        expect(configuration.fields.timestamp).to.be('@timestamp');
-        expect(configuration.fields.tiebreaker).to.be('_doc');
         expect(configuration.logColumns[0]).to.have.key('timestampColumn');
         expect(configuration.logColumns[1]).to.have.key('fieldColumn');
         expect(configuration.logColumns[2]).to.have.key('messageColumn');
@@ -58,10 +56,6 @@ export default function ({ getService }: FtrProviderContext) {
               type: 'index_pattern',
               indexPatternId: 'kip-id',
             },
-            fields: {
-              tiebreaker: 'TIEBREAKER',
-              timestamp: 'TIMESTAMP',
-            },
             logColumns: [
               {
                 messageColumn: {
@@ -83,8 +77,6 @@ export default function ({ getService }: FtrProviderContext) {
           type: 'index_pattern',
           indexPatternId: 'kip-id',
         });
-        expect(configuration.fields.timestamp).to.be('TIMESTAMP');
-        expect(configuration.fields.tiebreaker).to.be('TIEBREAKER');
         expect(configuration.logColumns).to.have.length(1);
         expect(configuration.logColumns[0]).to.have.key('messageColumn');
 
@@ -111,8 +103,6 @@ export default function ({ getService }: FtrProviderContext) {
           type: 'index_name',
           indexName: 'logs-*,filebeat-*,kibana_sample_data_logs*',
         });
-        expect(configuration.fields.timestamp).to.be('@timestamp');
-        expect(configuration.fields.tiebreaker).to.be('_doc');
         expect(configuration.logColumns).to.have.length(3);
         expect(configuration.logColumns[0]).to.have.key('timestampColumn');
         expect(configuration.logColumns[1]).to.have.key('fieldColumn');
@@ -142,10 +132,6 @@ export default function ({ getService }: FtrProviderContext) {
               type: 'index_pattern',
               indexPatternId: 'kip-id',
             },
-            fields: {
-              tiebreaker: 'TIEBREAKER',
-              timestamp: 'TIMESTAMP',
-            },
             logColumns: [
               {
                 messageColumn: {
@@ -166,8 +152,6 @@ export default function ({ getService }: FtrProviderContext) {
           type: 'index_pattern',
           indexPatternId: 'kip-id',
         });
-        expect(configuration.fields.timestamp).to.be('TIMESTAMP');
-        expect(configuration.fields.tiebreaker).to.be('TIEBREAKER');
         expect(configuration.logColumns).to.have.length(1);
         expect(configuration.logColumns[0]).to.have.key('messageColumn');
       });
@@ -189,8 +173,6 @@ export default function ({ getService }: FtrProviderContext) {
           type: 'index_name',
           indexName: 'logs-*,filebeat-*,kibana_sample_data_logs*',
         });
-        expect(configuration.fields.timestamp).to.be('@timestamp');
-        expect(configuration.fields.tiebreaker).to.be('_doc');
         expect(configuration.logColumns).to.have.length(3);
         expect(configuration.logColumns[0]).to.have.key('timestampColumn');
         expect(configuration.logColumns[1]).to.have.key('fieldColumn');
diff --git a/x-pack/test/api_integration/apis/metrics_ui/metric_threshold_alert.ts b/x-pack/test/api_integration/apis/metrics_ui/metric_threshold_alert.ts
index bf5e9532edf25..4467afb7585ad 100644
--- a/x-pack/test/api_integration/apis/metrics_ui/metric_threshold_alert.ts
+++ b/x-pack/test/api_integration/apis/metrics_ui/metric_threshold_alert.ts
@@ -54,11 +54,6 @@ export default function ({ getService }: FtrProviderContext) {
     metricsExplorerDefaultView: 'default',
     anomalyThreshold: 70,
     fields: {
-      container: 'container.id',
-      host: 'host.name',
-      pod: 'kubernetes.od.uid',
-      tiebreaker: '_doc',
-      timestamp: '@timestamp',
       message: ['message'],
     },
     logColumns: [
diff --git a/x-pack/test/api_integration/apis/metrics_ui/metrics_alerting.ts b/x-pack/test/api_integration/apis/metrics_ui/metrics_alerting.ts
index f2c9d48ad4652..eb8888a613dc3 100644
--- a/x-pack/test/api_integration/apis/metrics_ui/metrics_alerting.ts
+++ b/x-pack/test/api_integration/apis/metrics_ui/metrics_alerting.ts
@@ -37,11 +37,7 @@ export default function ({ getService }: FtrProviderContext) {
             start: moment().subtract(25, 'minutes').valueOf(),
             end: moment().valueOf(),
           };
-          const searchBody = getElasticsearchMetricQuery(
-            getSearchParams(aggType),
-            '@timestamp',
-            timeframe
-          );
+          const searchBody = getElasticsearchMetricQuery(getSearchParams(aggType), timeframe);
           const result = await client.search({
             index,
             // @ts-expect-error @elastic/elasticsearch AggregationsBucketsPath is not valid
@@ -61,7 +57,6 @@ export default function ({ getService }: FtrProviderContext) {
         };
         const searchBody = getElasticsearchMetricQuery(
           getSearchParams('avg'),
-          '@timestamp',
           timeframe,
           undefined,
           '{"bool":{"should":[{"match_phrase":{"agent.hostname":"foo"}}],"minimum_should_match":1}}'
@@ -85,7 +80,6 @@ export default function ({ getService }: FtrProviderContext) {
           };
           const searchBody = getElasticsearchMetricQuery(
             getSearchParams(aggType),
-            '@timestamp',
             timeframe,
             'agent.id'
           );
@@ -106,7 +100,6 @@ export default function ({ getService }: FtrProviderContext) {
         };
         const searchBody = getElasticsearchMetricQuery(
           getSearchParams('avg'),
-          '@timestamp',
           timeframe,
           'agent.id',
           '{"bool":{"should":[{"match_phrase":{"agent.hostname":"foo"}}],"minimum_should_match":1}}'
diff --git a/x-pack/test/api_integration/apis/metrics_ui/sources.ts b/x-pack/test/api_integration/apis/metrics_ui/sources.ts
index 8c43a05f5eeb6..e9ea8f725073f 100644
--- a/x-pack/test/api_integration/apis/metrics_ui/sources.ts
+++ b/x-pack/test/api_integration/apis/metrics_ui/sources.ts
@@ -66,11 +66,6 @@ export default function ({ getService }: FtrProviderContext) {
         expect(configuration?.name).to.be('UPDATED_NAME');
         expect(configuration?.description).to.be('UPDATED_DESCRIPTION');
         expect(configuration?.metricAlias).to.be('metricbeat-**');
-        expect(configuration?.fields.host).to.be('host.name');
-        expect(configuration?.fields.pod).to.be('kubernetes.pod.uid');
-        expect(configuration?.fields.tiebreaker).to.be('_doc');
-        expect(configuration?.fields.timestamp).to.be('@timestamp');
-        expect(configuration?.fields.container).to.be('container.id');
         expect(configuration?.anomalyThreshold).to.be(50);
         expect(status?.metricIndicesExist).to.be(true);
       });
@@ -104,40 +99,6 @@ export default function ({ getService }: FtrProviderContext) {
         expect(status?.metricIndicesExist).to.be(true);
       });
 
-      it('applies a single nested field update to an existing source', async () => {
-        const creationResponse = await patchRequest({
-          name: 'NAME',
-          fields: {
-            host: 'HOST',
-          },
-        });
-
-        const initialVersion = creationResponse?.source.version;
-        const createdAt = creationResponse?.source.updatedAt;
-
-        expect(initialVersion).to.be.a('string');
-        expect(createdAt).to.be.greaterThan(0);
-
-        const updateResponse = await patchRequest({
-          fields: {
-            container: 'UPDATED_CONTAINER',
-          },
-        });
-
-        const version = updateResponse?.source.version;
-        const updatedAt = updateResponse?.source.updatedAt;
-        const configuration = updateResponse?.source.configuration;
-
-        expect(version).to.be.a('string');
-        expect(version).to.not.be(initialVersion);
-        expect(updatedAt).to.be.greaterThan(createdAt || 0);
-        expect(configuration?.fields.container).to.be('UPDATED_CONTAINER');
-        expect(configuration?.fields.host).to.be('HOST');
-        expect(configuration?.fields.pod).to.be('kubernetes.pod.uid');
-        expect(configuration?.fields.tiebreaker).to.be('_doc');
-        expect(configuration?.fields.timestamp).to.be('@timestamp');
-      });
-
       it('validates anomalyThreshold is between range 1-100', async () => {
         // create config with bad request
         await supertest
diff --git a/x-pack/test/api_integration/apis/security_solution/timeline_migrations.ts b/x-pack/test/api_integration/apis/security_solution/timeline_migrations.ts
index 72607cbe8bf79..c5ea6e2aeaa63 100644
--- a/x-pack/test/api_integration/apis/security_solution/timeline_migrations.ts
+++ b/x-pack/test/api_integration/apis/security_solution/timeline_migrations.ts
@@ -199,7 +199,6 @@ export default function ({ getService }: FtrProviderContext) {
           expect(resp.body.data.getOneTimeline.savedQueryId).to.be("It's me");
         });
       });
-
       describe('pinned events timelineId', () => {
         it('removes the timelineId in the saved object', async () => {
           const timelines = await getSavedObjectFromES<PinnedEventWithoutTimelineId>(
diff --git a/x-pack/test/apm_api_integration/common/ftr_provider_context.ts b/x-pack/test/apm_api_integration/common/ftr_provider_context.ts
index cac4304696431..b5f2a4a42d91a 100644
--- a/x-pack/test/apm_api_integration/common/ftr_provider_context.ts
+++ b/x-pack/test/apm_api_integration/common/ftr_provider_context.ts
@@ -16,5 +16,5 @@ export type InheritedServices = InheritedFtrProviderContext extends GenericFtrPr
   ? TServices
   : {};
 
-export { InheritedFtrProviderContext };
+export type { InheritedFtrProviderContext };
 export type FtrProviderContext = GenericFtrProviderContext<ApmServices, {}>;
diff --git a/x-pack/test/apm_api_integration/tests/dependencies/top_dependencies.ts b/x-pack/test/apm_api_integration/tests/dependencies/top_dependencies.ts
index 1b8219b4a39c6..6d32defed460d 100644
--- a/x-pack/test/apm_api_integration/tests/dependencies/top_dependencies.ts
+++ b/x-pack/test/apm_api_integration/tests/dependencies/top_dependencies.ts
@@ -53,7 +53,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
     'Top dependencies',
     { config: 'basic', archives: ['apm_mappings_only_8.0.0'] },
     () => {
-      describe('when data is generated', () => {
+      describe.skip('when data is generated', () => {
         let topDependencies: TopDependencies;
 
         before(async () => {
diff --git a/x-pack/test/apm_api_integration/tests/service_maps/service_maps.ts b/x-pack/test/apm_api_integration/tests/service_maps/service_maps.ts
index 2da57c0a25779..d4733785c62b8 100644
--- a/x-pack/test/apm_api_integration/tests/service_maps/service_maps.ts
+++ b/x-pack/test/apm_api_integration/tests/service_maps/service_maps.ts
@@ -298,8 +298,8 @@ export default function serviceMapsApiTests({ getService }: FtrProviderContext)
             "avgErrorRate": 0,
             "avgMemoryUsage": 0.202572668763642,
             "transactionStats": Object {
-              "avgRequestsPerMinute": 7.13333333333333,
-              "avgTransactionDuration": 53147.5747663551,
+              "avgRequestsPerMinute": 5.2,
+              "avgTransactionDuration": 53906.6603773585,
             },
           }
         `);
diff --git a/x-pack/test/apm_api_integration/tests/service_overview/__snapshots__/instance_details.snap b/x-pack/test/apm_api_integration/tests/service_overview/__snapshots__/instance_details.snap
index 91b0b7f2da6e4..8eb8ad2adb164 100644
--- a/x-pack/test/apm_api_integration/tests/service_overview/__snapshots__/instance_details.snap
+++ b/x-pack/test/apm_api_integration/tests/service_overview/__snapshots__/instance_details.snap
@@ -2,7 +2,7 @@
 
 exports[`APM API tests basic apm_8.0.0 Instance details when data is loaded fetch instance details return the correct data 1`] = `
 Object {
-  "@timestamp": "2021-08-03T06:50:20.205Z",
+  "@timestamp": "2021-08-03T06:57:50.204Z",
   "agent": Object {
     "ephemeral_id": "2745d454-f57f-4473-a09b-fe6bef295860",
     "name": "java",
diff --git a/x-pack/test/apm_api_integration/tests/service_overview/__snapshots__/instances_detailed_statistics.snap b/x-pack/test/apm_api_integration/tests/service_overview/__snapshots__/instances_detailed_statistics.snap
index 971c14262f0b0..b8a57f26d85bc 100644
--- a/x-pack/test/apm_api_integration/tests/service_overview/__snapshots__/instances_detailed_statistics.snap
+++ b/x-pack/test/apm_api_integration/tests/service_overview/__snapshots__/instances_detailed_statistics.snap
@@ -73,11 +73,11 @@ Object {
       "errorRate": Array [
         Object {
           "x": 1627974300000,
-          "y": null,
+          "y": 0,
         },
         Object {
           "x": 1627974360000,
-          "y": 0,
+          "y": null,
         },
         Object {
           "x": 1627974420000,
@@ -93,15 +93,15 @@ Object {
         },
         Object {
           "x": 1627974600000,
-          "y": 0.5,
+          "y": 0.125,
         },
         Object {
           "x": 1627974660000,
-          "y": 0.4,
+          "y": 0.6,
         },
         Object {
           "x": 1627974720000,
-          "y": 0,
+          "y": 0.2,
         },
         Object {
           "x": 1627974780000,
@@ -109,11 +109,11 @@ Object {
         },
         Object {
           "x": 1627974840000,
-          "y": 0.166666666666667,
+          "y": 0,
         },
         Object {
           "x": 1627974900000,
-          "y": 0,
+          "y": 0.0666666666666667,
         },
         Object {
           "x": 1627974960000,
@@ -125,11 +125,11 @@ Object {
         },
         Object {
           "x": 1627975080000,
-          "y": 0.142857142857143,
+          "y": 0,
         },
         Object {
           "x": 1627975140000,
-          "y": 0.2,
+          "y": 0.181818181818182,
         },
         Object {
           "x": 1627975200000,
@@ -139,63 +139,63 @@ Object {
       "latency": Array [
         Object {
           "x": 1627974300000,
-          "y": null,
+          "y": 34887.8888888889,
         },
         Object {
           "x": 1627974360000,
-          "y": 5578,
+          "y": null,
         },
         Object {
           "x": 1627974420000,
-          "y": 34851.1666666667,
+          "y": 4983,
         },
         Object {
           "x": 1627974480000,
-          "y": 15896.4,
+          "y": 41285.4,
         },
         Object {
           "x": 1627974540000,
-          "y": 15174.1666666667,
+          "y": 13820.3333333333,
         },
         Object {
           "x": 1627974600000,
-          "y": 9185.16666666667,
+          "y": 13782,
         },
         Object {
           "x": 1627974660000,
-          "y": 12363.2,
+          "y": 13392.6,
         },
         Object {
           "x": 1627974720000,
-          "y": 6206.44444444444,
+          "y": 6991,
         },
         Object {
           "x": 1627974780000,
-          "y": 6707,
+          "y": 6885.85714285714,
         },
         Object {
           "x": 1627974840000,
-          "y": 12409.1666666667,
+          "y": 7935,
         },
         Object {
           "x": 1627974900000,
-          "y": 9188.36363636364,
+          "y": 10828.3333333333,
         },
         Object {
           "x": 1627974960000,
-          "y": 4279.6,
+          "y": 6079,
         },
         Object {
           "x": 1627975020000,
-          "y": 6827.3,
+          "y": 5217,
         },
         Object {
           "x": 1627975080000,
-          "y": 7445.78571428571,
+          "y": 8477.76923076923,
         },
         Object {
           "x": 1627975140000,
-          "y": 563288.6,
+          "y": 5937.18181818182,
         },
         Object {
           "x": 1627975200000,
@@ -272,15 +272,15 @@ Object {
       "throughput": Array [
         Object {
           "x": 1627974300000,
-          "y": 0,
+          "y": 9,
         },
         Object {
           "x": 1627974360000,
-          "y": 2,
+          "y": 0,
         },
         Object {
           "x": 1627974420000,
-          "y": 6,
+          "y": 4,
         },
         Object {
           "x": 1627974480000,
@@ -292,7 +292,7 @@ Object {
         },
         Object {
           "x": 1627974600000,
-          "y": 6,
+          "y": 8,
         },
         Object {
           "x": 1627974660000,
@@ -300,35 +300,35 @@ Object {
         },
         Object {
           "x": 1627974720000,
-          "y": 9,
+          "y": 5,
         },
         Object {
           "x": 1627974780000,
-          "y": 3,
+          "y": 7,
         },
         Object {
           "x": 1627974840000,
-          "y": 6,
+          "y": 2,
         },
         Object {
           "x": 1627974900000,
-          "y": 11,
+          "y": 15,
         },
         Object {
           "x": 1627974960000,
-          "y": 5,
+          "y": 3,
         },
         Object {
           "x": 1627975020000,
-          "y": 10,
+          "y": 8,
         },
         Object {
           "x": 1627975080000,
-          "y": 14,
+          "y": 13,
         },
         Object {
           "x": 1627975140000,
-          "y": 10,
+          "y": 11,
         },
         Object {
           "x": 1627975200000,
@@ -412,15 +412,15 @@ Object {
         },
         Object {
           "x": 1627974360000,
-          "y": 0.25,
+          "y": 0,
         },
         Object {
           "x": 1627974420000,
-          "y": 0.111111111111111,
+          "y": 0.333333333333333,
         },
         Object {
           "x": 1627974480000,
-          "y": 0.2,
+          "y": 0.181818181818182,
         },
         Object {
           "x": 1627974540000,
@@ -428,15 +428,15 @@ Object {
         },
         Object {
           "x": 1627974600000,
-          "y": 0.142857142857143,
+          "y": 0,
         },
         Object {
           "x": 1627974660000,
-          "y": 0.1,
+          "y": 0.166666666666667,
         },
         Object {
           "x": 1627974720000,
-          "y": 0.125,
+          "y": 0.181818181818182,
         },
         Object {
           "x": 1627974780000,
@@ -444,15 +444,15 @@ Object {
         },
         Object {
           "x": 1627974840000,
-          "y": 0.111111111111111,
+          "y": 0,
         },
         Object {
           "x": 1627974900000,
-          "y": 0,
+          "y": 0.0833333333333333,
         },
         Object {
           "x": 1627974960000,
-          "y": 0.333333333333333,
+          "y": 0.0769230769230769,
         },
         Object {
           "x": 1627975020000,
@@ -460,81 +460,81 @@ Object {
         },
         Object {
           "x": 1627975080000,
-          "y": 0.0833333333333333,
+          "y": 0.1,
         },
         Object {
           "x": 1627975140000,
-          "y": 0.1,
+          "y": 0.153846153846154,
         },
         Object {
           "x": 1627975200000,
-          "y": 0,
+          "y": null,
         },
       ],
       "latency": Array [
         Object {
           "x": 1627974300000,
-          "y": 5372.5,
+          "y": 11839,
         },
         Object {
           "x": 1627974360000,
-          "y": 1441598.25,
+          "y": 7407,
         },
         Object {
           "x": 1627974420000,
-          "y": 9380.22222222222,
+          "y": 1925569.66666667,
         },
         Object {
           "x": 1627974480000,
-          "y": 10949.4,
+          "y": 9017.18181818182,
         },
         Object {
           "x": 1627974540000,
-          "y": 77148.6666666667,
+          "y": 63575,
         },
         Object {
           "x": 1627974600000,
-          "y": 6461,
+          "y": 7577.66666666667,
         },
         Object {
           "x": 1627974660000,
-          "y": 549308.4,
+          "y": 6844.33333333333,
         },
         Object {
           "x": 1627974720000,
-          "y": 10797.75,
+          "y": 503471,
         },
         Object {
           "x": 1627974780000,
-          "y": 9758.53846153846,
+          "y": 6247.8,
         },
         Object {
           "x": 1627974840000,
-          "y": 1281052.66666667,
+          "y": 1137247,
         },
         Object {
           "x": 1627974900000,
-          "y": 9511.0625,
+          "y": 27951.6666666667,
         },
         Object {
           "x": 1627974960000,
-          "y": 11151203.3333333,
+          "y": 10248.8461538462,
         },
         Object {
           "x": 1627975020000,
-          "y": 8647.2,
+          "y": 13529,
         },
         Object {
           "x": 1627975080000,
-          "y": 9048.33333333333,
+          "y": 6691247.8,
         },
         Object {
           "x": 1627975140000,
-          "y": 12671.6,
+          "y": 12098.6923076923,
         },
         Object {
           "x": 1627975200000,
-          "y": 57275.4,
+          "y": null,
         },
       ],
       "memoryUsage": Array [
@@ -607,67 +607,67 @@ Object {
       "throughput": Array [
         Object {
           "x": 1627974300000,
-          "y": 2,
+          "y": 4,
         },
         Object {
           "x": 1627974360000,
-          "y": 4,
+          "y": 2,
         },
         Object {
           "x": 1627974420000,
-          "y": 9,
+          "y": 3,
         },
         Object {
           "x": 1627974480000,
-          "y": 5,
+          "y": 11,
         },
         Object {
           "x": 1627974540000,
-          "y": 3,
+          "y": 4,
         },
         Object {
           "x": 1627974600000,
-          "y": 7,
+          "y": 6,
         },
         Object {
           "x": 1627974660000,
-          "y": 10,
+          "y": 6,
         },
         Object {
           "x": 1627974720000,
-          "y": 8,
+          "y": 11,
         },
         Object {
           "x": 1627974780000,
-          "y": 13,
+          "y": 10,
         },
         Object {
           "x": 1627974840000,
-          "y": 9,
+          "y": 10,
         },
         Object {
           "x": 1627974900000,
-          "y": 16,
+          "y": 12,
         },
         Object {
           "x": 1627974960000,
-          "y": 6,
+          "y": 13,
         },
         Object {
           "x": 1627975020000,
-          "y": 10,
+          "y": 8,
         },
         Object {
           "x": 1627975080000,
-          "y": 12,
+          "y": 10,
         },
         Object {
           "x": 1627975140000,
-          "y": 10,
+          "y": 13,
         },
         Object {
           "x": 1627975200000,
-          "y": 5,
+          "y": 0,
         },
       ],
     },
@@ -812,15 +812,15 @@ Object {
         },
         Object {
           "x": 1627973460000,
-          "y": 0.25,
+          "y": 0,
         },
         Object {
           "x": 1627973520000,
-          "y": 0.111111111111111,
+          "y": 0.333333333333333,
         },
         Object {
           "x": 1627973580000,
-          "y": 0.2,
+          "y": 0.181818181818182,
         },
         Object {
           "x": 1627973640000,
@@ -828,15 +828,15 @@ Object {
         },
         Object {
           "x": 1627973700000,
-          "y": 0.142857142857143,
+          "y": 0,
         },
         Object {
           "x": 1627973760000,
-          "y": 0.1,
+          "y": 0.166666666666667,
         },
         Object {
           "x": 1627973820000,
-          "y": 0.125,
+          "y": 0.181818181818182,
         },
         Object {
           "x": 1627973880000,
@@ -844,15 +844,15 @@ Object {
         },
         Object {
           "x": 1627973940000,
-          "y": 0.111111111111111,
+          "y": 0,
         },
         Object {
           "x": 1627974000000,
-          "y": 0,
+          "y": 0.0833333333333333,
         },
         Object {
           "x": 1627974060000,
-          "y": 0.333333333333333,
+          "y": 0.0769230769230769,
         },
         Object {
           "x": 1627974120000,
@@ -860,11 +860,11 @@ Object {
         },
         Object {
           "x": 1627974180000,
-          "y": 0.0833333333333333,
+          "y": 0.1,
         },
         Object {
           "x": 1627974240000,
-          "y": 0.1,
+          "y": 0.153846153846154,
         },
         Object {
           "x": 1627974300000,
@@ -872,7 +872,7 @@ Object {
         },
         Object {
           "x": 1627974360000,
-          "y": 0,
+          "y": null,
         },
         Object {
           "x": 1627974420000,
@@ -888,15 +888,15 @@ Object {
         },
         Object {
           "x": 1627974600000,
-          "y": 0.5,
+          "y": 0.125,
         },
         Object {
           "x": 1627974660000,
-          "y": 0.4,
+          "y": 0.6,
         },
         Object {
           "x": 1627974720000,
-          "y": 0,
+          "y": 0.2,
         },
         Object {
           "x": 1627974780000,
@@ -904,11 +904,11 @@ Object {
         },
         Object {
           "x": 1627974840000,
-          "y": 0.166666666666667,
+          "y": 0,
         },
         Object {
           "x": 1627974900000,
-          "y": 0,
+          "y": 0.0666666666666667,
         },
         Object {
           "x": 1627974960000,
@@ -920,11 +920,11 @@ Object {
         },
         Object {
           "x": 1627975080000,
-          "y": 0.142857142857143,
+          "y": 0,
         },
         Object {
           "x": 1627975140000,
-          "y": 0.2,
+          "y": 0.181818181818182,
         },
         Object {
           "x": 1627975200000,
@@ -934,123 +934,123 @@ Object {
       "latency": Array [
         Object {
           "x": 1627973400000,
-          "y": 5372.5,
+          "y": 11839,
         },
         Object {
           "x": 1627973460000,
-          "y": 1441598.25,
+          "y": 7407,
         },
         Object {
           "x": 1627973520000,
-          "y": 9380.22222222222,
+          "y": 1925569.66666667,
         },
         Object {
           "x": 1627973580000,
-          "y": 10949.4,
+          "y": 9017.18181818182,
         },
         Object {
           "x": 1627973640000,
-          "y": 77148.6666666667,
+          "y": 63575,
         },
         Object {
           "x": 1627973700000,
-          "y": 6461,
+          "y": 7577.66666666667,
         },
         Object {
           "x": 1627973760000,
-          "y": 549308.4,
+          "y": 6844.33333333333,
         },
         Object {
           "x": 1627973820000,
-          "y": 10797.75,
+          "y": 503471,
         },
         Object {
           "x": 1627973880000,
-          "y": 9758.53846153846,
+          "y": 6247.8,
         },
         Object {
           "x": 1627973940000,
-          "y": 1281052.66666667,
+          "y": 1137247,
         },
         Object {
           "x": 1627974000000,
-          "y": 9511.0625,
+          "y": 27951.6666666667,
         },
         Object {
           "x": 1627974060000,
-          "y": 11151203.3333333,
+          "y": 10248.8461538462,
         },
         Object {
           "x": 1627974120000,
-          "y": 8647.2,
+          "y": 13529,
         },
         Object {
           "x": 1627974180000,
-          "y": 9048.33333333333,
+          "y": 6691247.8,
         },
         Object {
           "x": 1627974240000,
-          "y": 12671.6,
+          "y": 12098.6923076923,
         },
         Object {
           "x": 1627974300000,
-          "y": 57275.4,
+          "y": 34887.8888888889,
         },
         Object {
           "x": 1627974360000,
-          "y": 5578,
+          "y": null,
         },
         Object {
           "x": 1627974420000,
-          "y": 34851.1666666667,
+          "y": 4983,
         },
         Object {
           "x": 1627974480000,
-          "y": 15896.4,
+          "y": 41285.4,
         },
         Object {
           "x": 1627974540000,
-          "y": 15174.1666666667,
+          "y": 13820.3333333333,
         },
         Object {
           "x": 1627974600000,
-          "y": 9185.16666666667,
+          "y": 13782,
         },
         Object {
           "x": 1627974660000,
-          "y": 12363.2,
+          "y": 13392.6,
         },
         Object {
           "x": 1627974720000,
-          "y": 6206.44444444444,
+          "y": 6991,
         },
         Object {
           "x": 1627974780000,
-          "y": 6707,
+          "y": 6885.85714285714,
         },
         Object {
           "x": 1627974840000,
-          "y": 12409.1666666667,
+          "y": 7935,
         },
         Object {
           "x": 1627974900000,
-          "y": 9188.36363636364,
+          "y": 10828.3333333333,
         },
         Object {
           "x": 1627974960000,
-          "y": 4279.6,
+          "y": 6079,
         },
         Object {
           "x": 1627975020000,
-          "y": 6827.3,
+          "y": 5217,
         },
         Object {
           "x": 1627975080000,
-          "y": 7445.78571428571,
+          "y": 8477.76923076923,
         },
         Object {
           "x": 1627975140000,
-          "y": 563288.6,
+          "y": 5937.18181818182,
         },
         Object {
           "x": 1627975200000,
@@ -1187,75 +1187,75 @@ Object {
       "throughput": Array [
         Object {
           "x": 1627973400000,
-          "y": 2,
+          "y": 4,
         },
         Object {
           "x": 1627973460000,
-          "y": 4,
+          "y": 2,
         },
         Object {
           "x": 1627973520000,
-          "y": 9,
+          "y": 3,
         },
         Object {
           "x": 1627973580000,
-          "y": 5,
+          "y": 11,
         },
         Object {
           "x": 1627973640000,
-          "y": 3,
+          "y": 4,
         },
         Object {
           "x": 1627973700000,
-          "y": 7,
+          "y": 6,
         },
         Object {
           "x": 1627973760000,
-          "y": 10,
+          "y": 6,
         },
         Object {
           "x": 1627973820000,
-          "y": 8,
+          "y": 11,
         },
         Object {
           "x": 1627973880000,
-          "y": 13,
+          "y": 10,
         },
         Object {
           "x": 1627973940000,
-          "y": 9,
+          "y": 10,
         },
         Object {
           "x": 1627974000000,
-          "y": 16,
+          "y": 12,
         },
         Object {
           "x": 1627974060000,
-          "y": 6,
+          "y": 13,
         },
         Object {
           "x": 1627974120000,
-          "y": 10,
+          "y": 8,
         },
         Object {
           "x": 1627974180000,
-          "y": 12,
+          "y": 10,
         },
         Object {
           "x": 1627974240000,
-          "y": 10,
+          "y": 13,
         },
         Object {
           "x": 1627974300000,
-          "y": 5,
+          "y": 9,
         },
         Object {
           "x": 1627974360000,
-          "y": 2,
+          "y": 0,
         },
         Object {
           "x": 1627974420000,
-          "y": 6,
+          "y": 4,
         },
         Object {
           "x": 1627974480000,
@@ -1267,7 +1267,7 @@ Object {
         },
         Object {
           "x": 1627974600000,
-          "y": 6,
+          "y": 8,
         },
         Object {
           "x": 1627974660000,
@@ -1275,35 +1275,35 @@ Object {
         },
         Object {
           "x": 1627974720000,
-          "y": 9,
+          "y": 5,
         },
         Object {
           "x": 1627974780000,
-          "y": 3,
+          "y": 7,
         },
         Object {
           "x": 1627974840000,
-          "y": 6,
+          "y": 2,
         },
         Object {
           "x": 1627974900000,
-          "y": 11,
+          "y": 15,
         },
         Object {
           "x": 1627974960000,
-          "y": 5,
+          "y": 3,
         },
         Object {
           "x": 1627975020000,
-          "y": 10,
+          "y": 8,
         },
         Object {
           "x": 1627975080000,
-          "y": 14,
+          "y": 13,
         },
         Object {
           "x": 1627975140000,
-          "y": 10,
+          "y": 11,
         },
         Object {
           "x": 1627975200000,
diff --git a/x-pack/test/apm_api_integration/tests/service_overview/instances_main_statistics.ts b/x-pack/test/apm_api_integration/tests/service_overview/instances_main_statistics.ts
index 7d4efa14b2d85..909e58a5566a5 100644
--- a/x-pack/test/apm_api_integration/tests/service_overview/instances_main_statistics.ts
+++ b/x-pack/test/apm_api_integration/tests/service_overview/instances_main_statistics.ts
@@ -122,10 +122,10 @@ export default function ApiTest({ getService }: FtrProviderContext) {
           expectSnapshot(values).toMatchInline(`
             Object {
               "cpuUsage": 0.002,
-              "errorRate": 0.092511013215859,
-              "latency": 430318.696035242,
+              "errorRate": 0.0848214285714286,
+              "latency": 411589.785714286,
               "memoryUsage": 0.786029688517253,
-              "throughput": 7.56666666666667,
+              "throughput": 7.46666666666667,
             }
           `);
         });
@@ -183,9 +183,9 @@ export default function ApiTest({ getService }: FtrProviderContext) {
           expectSnapshot(values).toMatchInline(`
             Object {
               "cpuUsage": 0.001,
-              "errorRate": 0.00343642611683849,
-              "latency": 21520.4776632302,
-              "throughput": 9.7,
+              "errorRate": 0.00341296928327645,
+              "latency": 40989.5802047782,
+              "throughput": 9.76666666666667,
             }
           `);
 
@@ -272,10 +272,10 @@ export default function ApiTest({ getService }: FtrProviderContext) {
           expectSnapshot(values).toMatchInline(`
             Object {
               "cpuUsage": 0.00223333333333333,
-              "errorRate": 0.0852713178294574,
-              "latency": 706173.046511628,
+              "errorRate": 0.0894308943089431,
+              "latency": 739013.634146341,
               "memoryUsage": 0.783296203613281,
-              "throughput": 8.6,
+              "throughput": 8.2,
             }
           `);
         });
diff --git a/x-pack/test/apm_api_integration/tests/services/top_services.ts b/x-pack/test/apm_api_integration/tests/services/top_services.ts
index d85331b8be45d..42d98f38e4e4a 100644
--- a/x-pack/test/apm_api_integration/tests/services/top_services.ts
+++ b/x-pack/test/apm_api_integration/tests/services/top_services.ts
@@ -6,30 +6,39 @@
  */
 
 import expect from '@kbn/expect';
-import { sortBy, pick, isEmpty } from 'lodash';
+import { sortBy } from 'lodash';
+import { service, timerange } from '@elastic/apm-synthtrace';
 import { APIReturnType } from '../../../../plugins/apm/public/services/rest/createCallApmApi';
 import { PromiseReturnType } from '../../../../plugins/observability/typings/common';
 import { FtrProviderContext } from '../../common/ftr_provider_context';
 import archives_metadata from '../../common/fixtures/es_archiver/archives_metadata';
 import { registry } from '../../common/registry';
+import { ENVIRONMENT_ALL } from '../../../../plugins/apm/common/environment_filter_values';
 
 export default function ApiTest({ getService }: FtrProviderContext) {
   const supertest = getService('legacySupertestAsApmReadUser');
+
+  const apmApiClient = getService('apmApiClient');
+  const synthtrace = getService('synthtraceEsClient');
+
   const supertestAsApmReadUserWithoutMlAccess = getService(
     'legacySupertestAsApmReadUserWithoutMlAccess'
   );
 
   const archiveName = 'apm_8.0.0';
 
-  const range = archives_metadata[archiveName];
+  const archiveRange = archives_metadata[archiveName];
 
   // url parameters
-  const start = encodeURIComponent(range.start);
-  const end = encodeURIComponent(range.end);
+  const archiveStart = encodeURIComponent(archiveRange.start);
+  const archiveEnd = encodeURIComponent(archiveRange.end);
+
+  const start = '2021-10-01T00:00:00.000Z';
+  const end = '2021-10-01T00:05:00.000Z';
 
   registry.when(
-    'APM Services Overview with a basic license when data is not loaded',
-    { config: 'basic', archives: [] },
+    'APM Services Overview with a basic license when data is not generated',
+    { config: 'basic', archives: ['apm_mappings_only_8.0.0'] },
     () => {
       it('handles the empty state', async () => {
         const response = await supertest.get(
@@ -44,187 +53,242 @@ export default function ApiTest({ getService }: FtrProviderContext) {
   );
 
   registry.when(
-    'APM Services Overview with a basic license when data is loaded',
-    { config: 'basic', archives: [archiveName] },
+    'APM Services Overview with a basic license when data is generated',
+    { config: 'basic', archives: ['apm_mappings_only_8.0.0'] },
     () => {
       let response: {
         status: number;
         body: APIReturnType<'GET /internal/apm/services'>;
       };
 
-      let sortedItems: typeof response.body.items;
+      const range = timerange(new Date(start).getTime(), new Date(end).getTime());
+      const transactionInterval = range.interval('1s');
+      const metricInterval = range.interval('30s');
+
+      const multipleEnvServiceProdInstance = service(
+        'multiple-env-service',
+        'production',
+        'go'
+      ).instance('multiple-env-service-production');
+
+      const multipleEnvServiceDevInstance = service(
+        'multiple-env-service',
+        'development',
+        'go'
+      ).instance('multiple-env-service-development');
+
+      const metricOnlyInstance = service('metric-only-service', 'production', 'java').instance(
+        'metric-only-production'
+      );
+
+      const config = {
+        multiple: {
+          prod: {
+            rps: 4,
+            duration: 1000,
+          },
+          dev: {
+            rps: 1,
+            duration: 500,
+          },
+        },
+      };
 
       before(async () => {
-        response = await supertest.get(
-          `/internal/apm/services?start=${start}&end=${end}&environment=ENVIRONMENT_ALL&kuery=`
-        );
-        sortedItems = sortBy(response.body.items, 'serviceName');
-      });
-
-      it('the response is successful', () => {
-        expect(response.status).to.eql(200);
-      });
-
-      it('returns hasLegacyData: false', () => {
-        expect(response.body.hasLegacyData).to.be(false);
+        return synthtrace.index([
+          ...transactionInterval
+            .rate(config.multiple.prod.rps)
+            .flatMap((timestamp) => [
+              ...multipleEnvServiceProdInstance
+                .transaction('GET /api')
+                .timestamp(timestamp)
+                .duration(config.multiple.prod.duration)
+                .success()
+                .serialize(),
+            ]),
+          ...transactionInterval
+            .rate(config.multiple.dev.rps)
+            .flatMap((timestamp) => [
+              ...multipleEnvServiceDevInstance
+                .transaction('GET /api')
+                .timestamp(timestamp)
+                .duration(config.multiple.dev.duration)
+                .failure()
+                .serialize(),
+            ]),
+          ...transactionInterval
+            .rate(config.multiple.prod.rps)
+            .flatMap((timestamp) => [
+              ...multipleEnvServiceDevInstance
+                .transaction('non-request', 'rpc')
+                .timestamp(timestamp)
+                .duration(config.multiple.prod.duration)
+                .success()
+                .serialize(),
+            ]),
+          ...metricInterval.rate(1).flatMap((timestamp) => [
+            ...metricOnlyInstance
+              .appMetrics({
+                'system.memory.actual.free': 1,
+                'system.cpu.total.norm.pct': 1,
+                'system.memory.total': 1,
+                'system.process.cpu.total.norm.pct': 1,
+              })
+              .timestamp(timestamp)
+              .serialize(),
+          ]),
+        ]);
       });
 
-      it('returns the correct service names', () => {
-        expectSnapshot(sortedItems.map((item) => item.serviceName)).toMatchInline(`
-          Array [
-            "auditbeat",
-            "opbeans-dotnet",
-            "opbeans-go",
-            "opbeans-java",
-            "opbeans-node",
-            "opbeans-python",
-            "opbeans-ruby",
-            "opbeans-rum",
-          ]
-        `);
+      after(() => {
+        return synthtrace.clean();
       });
 
-      it('returns the correct metrics averages', () => {
-        expectSnapshot(
-          sortedItems.map((item) => pick(item, 'transactionErrorRate', 'latency', 'throughput'))
-        ).toMatchInline(`
-          Array [
-            Object {},
-            Object {
-              "latency": 496794.054441261,
-              "throughput": 11.6333333333333,
-              "transactionErrorRate": 0.0315186246418338,
-            },
-            Object {
-              "latency": 83395.638576779,
-              "throughput": 17.8,
-              "transactionErrorRate": 0.00936329588014981,
-            },
-            Object {
-              "latency": 430318.696035242,
-              "throughput": 7.56666666666667,
-              "transactionErrorRate": 0.092511013215859,
-            },
-            Object {
-              "latency": 53147.5747663551,
-              "throughput": 7.13333333333333,
-              "transactionErrorRate": 0,
-            },
-            Object {
-              "latency": 419826.24375,
-              "throughput": 5.33333333333333,
-              "transactionErrorRate": 0.025,
-            },
-            Object {
-              "latency": 21520.4776632302,
-              "throughput": 9.7,
-              "transactionErrorRate": 0.00343642611683849,
-            },
-            Object {
-              "latency": 1040388.88888889,
-              "throughput": 2.4,
-              "transactionErrorRate": null,
+      describe('when no additional filters are applied', () => {
+        before(async () => {
+          response = await apmApiClient.readUser({
+            endpoint: 'GET /internal/apm/services',
+            params: {
+              query: {
+                start,
+                end,
+                environment: ENVIRONMENT_ALL.value,
+                kuery: '',
+              },
             },
-          ]
-        `);
-      });
+          });
+        });
 
-      it('returns environments', () => {
-        expectSnapshot(sortedItems.map((item) => item.environments ?? [])).toMatchInline(`
-          Array [
-            Array [
-              "production",
-            ],
-            Array [
-              "production",
-            ],
-            Array [
-              "testing",
-            ],
-            Array [
-              "production",
-            ],
-            Array [
-              "testing",
-            ],
-            Array [
-              "production",
-            ],
-            Array [
-              "production",
-            ],
-            Array [
-              "testing",
-            ],
-          ]
-        `);
-      });
+        it('returns a successful response', () => {
+          expect(response.status).to.be(200);
+        });
 
-      it(`RUM services don't report any transaction error rates`, () => {
-        // RUM transactions don't have event.outcome set,
-        // so they should not have an error rate
+        it('returns the correct statistics', () => {
+          const multipleEnvService = response.body.items.find(
+            (item) => item.serviceName === 'multiple-env-service'
+          );
 
-        const rumServices = sortedItems.filter((item) => item.agentName === 'rum-js');
+          const totalRps = config.multiple.prod.rps + config.multiple.dev.rps;
+
+          expect(multipleEnvService).to.eql({
+            serviceName: 'multiple-env-service',
+            transactionType: 'request',
+            environments: ['production', 'development'],
+            agentName: 'go',
+            latency:
+              1000 *
+              ((config.multiple.prod.duration * config.multiple.prod.rps +
+                config.multiple.dev.duration * config.multiple.dev.rps) /
+                totalRps),
+            throughput: totalRps * 60,
+            transactionErrorRate:
+              config.multiple.dev.rps / (config.multiple.prod.rps + config.multiple.dev.rps),
+          });
+        });
 
-        expect(rumServices.length).to.be.greaterThan(0);
+        it('returns services without transaction data', () => {
+          const serviceNames = response.body.items.map((item) => item.serviceName);
 
-        expect(rumServices.every((item) => isEmpty(item.transactionErrorRate)));
+          expect(serviceNames).to.contain('metric-only-service');
+        });
       });
 
-      it('non-RUM services all report transaction error rates', () => {
-        const nonRumServices = sortedItems.filter(
-          (item) => item.agentName !== 'rum-js' && item.serviceName !== 'auditbeat'
-        );
+      describe('when applying an environment filter', () => {
+        before(async () => {
+          response = await apmApiClient.readUser({
+            endpoint: 'GET /internal/apm/services',
+            params: {
+              query: {
+                start,
+                end,
+                environment: 'production',
+                kuery: '',
+              },
+            },
+          });
+        });
 
-        expect(
-          nonRumServices.every((item) => {
-            return typeof item.transactionErrorRate === 'number';
-          })
-        ).to.be(true);
+        it('returns data only for that environment', () => {
+          const multipleEnvService = response.body.items.find(
+            (item) => item.serviceName === 'multiple-env-service'
+          );
+
+          const totalRps = config.multiple.prod.rps;
+
+          expect(multipleEnvService).to.eql({
+            serviceName: 'multiple-env-service',
+            transactionType: 'request',
+            environments: ['production'],
+            agentName: 'go',
+            latency: 1000 * ((config.multiple.prod.duration * config.multiple.prod.rps) / totalRps),
+            throughput: totalRps * 60,
+            transactionErrorRate: 0,
+          });
+        });
       });
-    }
-  );
 
-  registry.when(
-    'APM Services Overview with a basic license when data is loaded excluding transaction events',
-    { config: 'basic', archives: [archiveName] },
-    () => {
-      it('includes services that only report metric data', async () => {
-        interface Response {
-          status: number;
-          body: APIReturnType<'GET /internal/apm/services'>;
-        }
-
-        const [unfilteredResponse, filteredResponse] = await Promise.all([
-          supertest.get(
-            `/internal/apm/services?start=${start}&end=${end}&environment=ENVIRONMENT_ALL&kuery=`
-          ) as Promise<Response>,
-          supertest.get(
-            `/internal/apm/services?start=${start}&end=${end}&environment=ENVIRONMENT_ALL&kuery=${encodeURIComponent(
-              'not (processor.event:transaction)'
-            )}`
-          ) as Promise<Response>,
-        ]);
+      describe('when applying a kuery filter', () => {
+        before(async () => {
+          response = await apmApiClient.readUser({
+            endpoint: 'GET /internal/apm/services',
+            params: {
+              query: {
+                start,
+                end,
+                environment: ENVIRONMENT_ALL.value,
+                kuery: 'service.node.name:"multiple-env-service-development"',
+              },
+            },
+          });
+        });
 
-        expect(unfilteredResponse.body.items.length).to.be.greaterThan(0);
+        it('returns data for that kuery filter only', () => {
+          const multipleEnvService = response.body.items.find(
+            (item) => item.serviceName === 'multiple-env-service'
+          );
 
-        const unfilteredServiceNames = unfilteredResponse.body.items
-          .map((item) => item.serviceName)
-          .sort();
+          const totalRps = config.multiple.dev.rps;
 
-        const filteredServiceNames = filteredResponse.body.items
-          .map((item) => item.serviceName)
-          .sort();
+          expect(multipleEnvService).to.eql({
+            serviceName: 'multiple-env-service',
+            transactionType: 'request',
+            environments: ['development'],
+            agentName: 'go',
+            latency: 1000 * ((config.multiple.dev.duration * config.multiple.dev.rps) / totalRps),
+            throughput: totalRps * 60,
+            transactionErrorRate: 1,
+          });
+        });
+      });
 
-        expect(unfilteredServiceNames).to.eql(filteredServiceNames);
+      describe('when excluding default transaction types', () => {
+        before(async () => {
+          response = await apmApiClient.readUser({
+            endpoint: 'GET /internal/apm/services',
+            params: {
+              query: {
+                start,
+                end,
+                environment: ENVIRONMENT_ALL.value,
+                kuery: 'not (transaction.type:request)',
+              },
+            },
+          });
+        });
 
-        expect(filteredResponse.body.items.every((item) => !!item.agentName)).to.be(true);
+        it('returns data for the top transaction type that is not a default', () => {
+          const multipleEnvService = response.body.items.find(
+            (item) => item.serviceName === 'multiple-env-service'
+          );
+
+          expect(multipleEnvService?.transactionType).to.eql('rpc');
+        });
       });
     }
   );
 
   registry.when(
-    'APM Services overview with a trial license when data is loaded',
+    'APM Services Overview with a trial license when data is loaded',
     { config: 'trial', archives: [archiveName] },
     () => {
       describe('with the default APM read user', () => {
@@ -236,7 +300,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
 
           before(async () => {
             response = await supertest.get(
-              `/internal/apm/services?start=${start}&end=${end}&environment=ENVIRONMENT_ALL&kuery=`
+              `/internal/apm/services?start=${archiveStart}&end=${archiveEnd}&environment=ENVIRONMENT_ALL&kuery=`
             );
           });
 
@@ -282,7 +346,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
         let response: PromiseReturnType<typeof supertest.get>;
         before(async () => {
           response = await supertestAsApmReadUserWithoutMlAccess.get(
-            `/internal/apm/services?start=${start}&end=${end}&environment=ENVIRONMENT_ALL&kuery=`
+            `/internal/apm/services?start=${archiveStart}&end=${archiveEnd}&environment=ENVIRONMENT_ALL&kuery=`
           );
         });
 
@@ -307,7 +371,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
         let response: PromiseReturnType<typeof supertest.get>;
         before(async () => {
           response = await supertest.get(
-            `/internal/apm/services?environment=ENVIRONMENT_ALL&start=${start}&end=${end}&kuery=${encodeURIComponent(
+            `/internal/apm/services?environment=ENVIRONMENT_ALL&start=${archiveStart}&end=${archiveEnd}&kuery=${encodeURIComponent(
               'service.name:opbeans-java'
             )}`
           );
diff --git a/x-pack/test/apm_api_integration/tests/traces/__snapshots__/top_traces.snap b/x-pack/test/apm_api_integration/tests/traces/__snapshots__/top_traces.snap
index 64e1754c9570f..604348355f38c 100644
--- a/x-pack/test/apm_api_integration/tests/traces/__snapshots__/top_traces.snap
+++ b/x-pack/test/apm_api_integration/tests/traces/__snapshots__/top_traces.snap
@@ -3,7 +3,7 @@
 exports[`APM API tests basic apm_8.0.0 Top traces when data is loaded returns the correct buckets 1`] = `
 Array [
   Object {
-    "averageResponseTime": 1638,
+    "averageResponseTime": 1639,
     "impact": 0,
     "key": Object {
       "service.name": "opbeans-java",
@@ -15,8 +15,8 @@ Array [
     "transactionsPerMinute": 0.0333333333333333,
   },
   Object {
-    "averageResponseTime": 3278,
-    "impact": 0.00153950779720334,
+    "averageResponseTime": 3279,
+    "impact": 0.00144735571024101,
     "key": Object {
       "service.name": "opbeans-node",
       "transaction.name": "POST /api/orders",
@@ -27,8 +27,8 @@ Array [
     "transactionsPerMinute": 0.0333333333333333,
   },
   Object {
-    "averageResponseTime": 6169,
-    "impact": 0.00425335965190752,
+    "averageResponseTime": 6175,
+    "impact": 0.00400317408637392,
     "key": Object {
       "service.name": "opbeans-node",
       "transaction.name": "GET /api/products/:id",
@@ -39,8 +39,8 @@ Array [
     "transactionsPerMinute": 0.0333333333333333,
   },
   Object {
-    "averageResponseTime": 3486,
-    "impact": 0.00500715523797721,
+    "averageResponseTime": 3495,
+    "impact": 0.00472243927164613,
     "key": Object {
       "service.name": "opbeans-dotnet",
       "transaction.name": "POST Orders/Post",
@@ -51,8 +51,8 @@ Array [
     "transactionsPerMinute": 0.0666666666666667,
   },
   Object {
-    "averageResponseTime": 7022,
-    "impact": 0.00505409145130658,
+    "averageResponseTime": 7039,
+    "impact": 0.00476568343615943,
     "key": Object {
       "service.name": "opbeans-python",
       "transaction.name": "GET opbeans.views.product",
@@ -63,8 +63,8 @@ Array [
     "transactionsPerMinute": 0.0333333333333333,
   },
   Object {
-    "averageResponseTime": 6279,
-    "impact": 0.0102508689911344,
+    "averageResponseTime": 6303,
+    "impact": 0.00967875004525193,
     "key": Object {
       "service.name": "opbeans-ruby",
       "transaction.name": "Api::OrdersController#create",
@@ -75,8 +75,8 @@ Array [
     "transactionsPerMinute": 0.0666666666666667,
   },
   Object {
-    "averageResponseTime": 7959,
-    "impact": 0.0134049825268681,
+    "averageResponseTime": 7209.66666666667,
+    "impact": 0.0176418540534865,
     "key": Object {
       "service.name": "opbeans-java",
       "transaction.name": "APIRestController#products",
@@ -84,35 +84,11 @@ Array [
     "serviceName": "opbeans-java",
     "transactionName": "APIRestController#products",
     "transactionType": "request",
-    "transactionsPerMinute": 0.0666666666666667,
-  },
-  Object {
-    "averageResponseTime": 7411.33333333333,
-    "impact": 0.0193339649946342,
-    "key": Object {
-      "service.name": "opbeans-python",
-      "transaction.name": "GET opbeans.views.order",
-    },
-    "serviceName": "opbeans-python",
-    "transactionName": "GET opbeans.views.order",
-    "transactionType": "request",
     "transactionsPerMinute": 0.1,
   },
   Object {
-    "averageResponseTime": 11729,
-    "impact": 0.0204829634969371,
-    "key": Object {
-      "service.name": "opbeans-ruby",
-      "transaction.name": "Api::OrdersController#show",
-    },
-    "serviceName": "opbeans-ruby",
-    "transactionName": "Api::OrdersController#show",
-    "transactionType": "request",
-    "transactionsPerMinute": 0.0666666666666667,
-  },
-  Object {
-    "averageResponseTime": 4499.16666666667,
-    "impact": 0.0238032312278568,
+    "averageResponseTime": 4511,
+    "impact": 0.0224401912465233,
     "key": Object {
       "service.name": "opbeans-java",
       "transaction.name": "APIRestController#orders",
@@ -123,8 +99,20 @@ Array [
     "transactionsPerMinute": 0.2,
   },
   Object {
-    "averageResponseTime": 10126.3333333333,
-    "impact": 0.0269798741459886,
+    "averageResponseTime": 7607,
+    "impact": 0.0254072704525173,
+    "key": Object {
+      "service.name": "opbeans-python",
+      "transaction.name": "GET opbeans.views.order",
+    },
+    "serviceName": "opbeans-python",
+    "transactionName": "GET opbeans.views.order",
+    "transactionType": "request",
+    "transactionsPerMinute": 0.133333333333333,
+  },
+  Object {
+    "averageResponseTime": 10143,
+    "impact": 0.025408152986487,
     "key": Object {
       "service.name": "opbeans-node",
       "transaction.name": "GET /api/types",
@@ -135,32 +123,32 @@ Array [
     "transactionsPerMinute": 0.1,
   },
   Object {
-    "averageResponseTime": 6089.83333333333,
-    "impact": 0.032762415628167,
+    "averageResponseTime": 6105.66666666667,
+    "impact": 0.0308842762682221,
     "key": Object {
-      "service.name": "opbeans-java",
-      "transaction.name": "APIRestController#customerWhoBought",
+      "service.name": "opbeans-ruby",
+      "transaction.name": "Api::TypesController#index",
     },
-    "serviceName": "opbeans-java",
-    "transactionName": "APIRestController#customerWhoBought",
+    "serviceName": "opbeans-ruby",
+    "transactionName": "Api::TypesController#index",
     "transactionType": "request",
     "transactionsPerMinute": 0.2,
   },
   Object {
-    "averageResponseTime": 6094.83333333333,
-    "impact": 0.0327905773561646,
+    "averageResponseTime": 6116.33333333333,
+    "impact": 0.0309407584422802,
     "key": Object {
-      "service.name": "opbeans-ruby",
-      "transaction.name": "Api::TypesController#index",
+      "service.name": "opbeans-java",
+      "transaction.name": "APIRestController#customerWhoBought",
     },
-    "serviceName": "opbeans-ruby",
-    "transactionName": "Api::TypesController#index",
+    "serviceName": "opbeans-java",
+    "transactionName": "APIRestController#customerWhoBought",
     "transactionType": "request",
     "transactionsPerMinute": 0.2,
   },
   Object {
-    "averageResponseTime": 12527.3333333333,
-    "impact": 0.0337415050382176,
+    "averageResponseTime": 12543,
+    "impact": 0.0317623975680329,
     "key": Object {
       "service.name": "opbeans-java",
       "transaction.name": "APIRestController#customers",
@@ -171,8 +159,8 @@ Array [
     "transactionsPerMinute": 0.1,
   },
   Object {
-    "averageResponseTime": 5534.85714285714,
-    "impact": 0.0348323026359922,
+    "averageResponseTime": 5551,
+    "impact": 0.0328461492827744,
     "key": Object {
       "service.name": "opbeans-node",
       "transaction.name": "GET /api/orders/:id",
@@ -183,8 +171,8 @@ Array [
     "transactionsPerMinute": 0.233333333333333,
   },
   Object {
-    "averageResponseTime": 13149.3333333333,
-    "impact": 0.0354931645196697,
+    "averageResponseTime": 13183,
+    "impact": 0.0334568627897785,
     "key": Object {
       "service.name": "opbeans-java",
       "transaction.name": "APIRestController#stats",
@@ -195,8 +183,8 @@ Array [
     "transactionsPerMinute": 0.1,
   },
   Object {
-    "averageResponseTime": 8025.8,
-    "impact": 0.0361324357452157,
+    "averageResponseTime": 8050.2,
+    "impact": 0.0340764016364792,
     "key": Object {
       "service.name": "opbeans-go",
       "transaction.name": "POST /api/orders",
@@ -207,8 +195,20 @@ Array [
     "transactionsPerMinute": 0.166666666666667,
   },
   Object {
-    "averageResponseTime": 8432.8,
-    "impact": 0.0380427396277211,
+    "averageResponseTime": 10079,
+    "impact": 0.0341337663445071,
+    "key": Object {
+      "service.name": "opbeans-ruby",
+      "transaction.name": "Api::OrdersController#show",
+    },
+    "serviceName": "opbeans-ruby",
+    "transactionName": "Api::OrdersController#show",
+    "transactionType": "request",
+    "transactionsPerMinute": 0.133333333333333,
+  },
+  Object {
+    "averageResponseTime": 8463,
+    "impact": 0.0358979517498557,
     "key": Object {
       "service.name": "opbeans-node",
       "transaction.name": "GET /api/products/:id/customers",
@@ -219,32 +219,32 @@ Array [
     "transactionsPerMinute": 0.166666666666667,
   },
   Object {
-    "averageResponseTime": 7408,
-    "impact": 0.0401867858526067,
+    "averageResponseTime": 10799,
+    "impact": 0.0366754641771254,
     "key": Object {
       "service.name": "opbeans-ruby",
-      "transaction.name": "Api::TypesController#show",
+      "transaction.name": "Api::ProductsController#show",
     },
     "serviceName": "opbeans-ruby",
-    "transactionName": "Api::TypesController#show",
+    "transactionName": "Api::ProductsController#show",
     "transactionType": "request",
-    "transactionsPerMinute": 0.2,
+    "transactionsPerMinute": 0.133333333333333,
   },
   Object {
-    "averageResponseTime": 6869.42857142857,
-    "impact": 0.0436018647344517,
+    "averageResponseTime": 7428.33333333333,
+    "impact": 0.0378880658514371,
     "key": Object {
-      "service.name": "opbeans-java",
-      "transaction.name": "APIRestController#order",
+      "service.name": "opbeans-ruby",
+      "transaction.name": "Api::TypesController#show",
     },
-    "serviceName": "opbeans-java",
-    "transactionName": "APIRestController#order",
+    "serviceName": "opbeans-ruby",
+    "transactionName": "Api::TypesController#show",
     "transactionType": "request",
-    "transactionsPerMinute": 0.233333333333333,
+    "transactionsPerMinute": 0.2,
   },
   Object {
-    "averageResponseTime": 3050,
-    "impact": 0.0442721138607951,
+    "averageResponseTime": 3105.13333333333,
+    "impact": 0.039659311528543,
     "key": Object {
       "service.name": "opbeans-java",
       "transaction.name": "ResourceHttpRequestHandler",
@@ -252,23 +252,23 @@ Array [
     "serviceName": "opbeans-java",
     "transactionName": "ResourceHttpRequestHandler",
     "transactionType": "request",
-    "transactionsPerMinute": 0.533333333333333,
+    "transactionsPerMinute": 0.5,
   },
   Object {
-    "averageResponseTime": 10786.2,
-    "impact": 0.0490887080726551,
+    "averageResponseTime": 6883.57142857143,
+    "impact": 0.0410784261517549,
     "key": Object {
-      "service.name": "opbeans-ruby",
-      "transaction.name": "Api::ProductsController#show",
+      "service.name": "opbeans-java",
+      "transaction.name": "APIRestController#order",
     },
-    "serviceName": "opbeans-ruby",
-    "transactionName": "Api::ProductsController#show",
+    "serviceName": "opbeans-java",
+    "transactionName": "APIRestController#order",
     "transactionType": "request",
-    "transactionsPerMinute": 0.166666666666667,
+    "transactionsPerMinute": 0.233333333333333,
   },
   Object {
-    "averageResponseTime": 3497.6875,
-    "impact": 0.0509961957823607,
+    "averageResponseTime": 3505,
+    "impact": 0.0480460318422139,
     "key": Object {
       "service.name": "opbeans-dotnet",
       "transaction.name": "GET Products/Get",
@@ -279,8 +279,8 @@ Array [
     "transactionsPerMinute": 0.533333333333333,
   },
   Object {
-    "averageResponseTime": 5604.9,
-    "impact": 0.0510769260692872,
+    "averageResponseTime": 5621.4,
+    "impact": 0.0481642913941483,
     "key": Object {
       "service.name": "opbeans-java",
       "transaction.name": "APIRestController#topProducts",
@@ -291,44 +291,44 @@ Array [
     "transactionsPerMinute": 0.333333333333333,
   },
   Object {
-    "averageResponseTime": 8500.57142857143,
-    "impact": 0.0543202184103467,
+    "averageResponseTime": 8428.71428571429,
+    "impact": 0.0506239135675883,
     "key": Object {
       "service.name": "opbeans-node",
-      "transaction.name": "GET /api/customers/:id",
+      "transaction.name": "GET /api/orders",
     },
     "serviceName": "opbeans-node",
-    "transactionName": "GET /api/customers/:id",
+    "transactionName": "GET /api/orders",
     "transactionType": "request",
     "transactionsPerMinute": 0.233333333333333,
   },
   Object {
-    "averageResponseTime": 6658.88888888889,
-    "impact": 0.0547201149479129,
+    "averageResponseTime": 8520.14285714286,
+    "impact": 0.0511887353081702,
     "key": Object {
       "service.name": "opbeans-node",
-      "transaction.name": "GET /api/products/top",
+      "transaction.name": "GET /api/customers/:id",
     },
     "serviceName": "opbeans-node",
-    "transactionName": "GET /api/products/top",
+    "transactionName": "GET /api/customers/:id",
     "transactionType": "request",
-    "transactionsPerMinute": 0.3,
+    "transactionsPerMinute": 0.233333333333333,
   },
   Object {
-    "averageResponseTime": 8141.125,
-    "impact": 0.0596005424099008,
+    "averageResponseTime": 6683.44444444444,
+    "impact": 0.0516388276326964,
     "key": Object {
       "service.name": "opbeans-node",
-      "transaction.name": "GET /api/orders",
+      "transaction.name": "GET /api/products/top",
     },
     "serviceName": "opbeans-node",
-    "transactionName": "GET /api/orders",
+    "transactionName": "GET /api/products/top",
     "transactionType": "request",
-    "transactionsPerMinute": 0.266666666666667,
+    "transactionsPerMinute": 0.3,
   },
   Object {
-    "averageResponseTime": 3473.52631578947,
-    "impact": 0.0604153550732987,
+    "averageResponseTime": 3482.78947368421,
+    "impact": 0.0569534471979838,
     "key": Object {
       "service.name": "opbeans-dotnet",
       "transaction.name": "GET Types/Get",
@@ -339,20 +339,20 @@ Array [
     "transactionsPerMinute": 0.633333333333333,
   },
   Object {
-    "averageResponseTime": 7875,
-    "impact": 0.064994452045712,
+    "averageResponseTime": 16703,
+    "impact": 0.057517386404596,
     "key": Object {
-      "service.name": "opbeans-node",
-      "transaction.name": "GET /api/types/:id",
+      "service.name": "opbeans-python",
+      "transaction.name": "GET opbeans.views.product_type",
     },
-    "serviceName": "opbeans-node",
-    "transactionName": "GET /api/types/:id",
+    "serviceName": "opbeans-python",
+    "transactionName": "GET opbeans.views.product_type",
     "transactionType": "request",
-    "transactionsPerMinute": 0.3,
+    "transactionsPerMinute": 0.133333333333333,
   },
   Object {
-    "averageResponseTime": 4889,
-    "impact": 0.0673037137415171,
+    "averageResponseTime": 4943,
+    "impact": 0.0596266425920813,
     "key": Object {
       "service.name": "opbeans-dotnet",
       "transaction.name": "GET Products/Get {id}",
@@ -360,23 +360,23 @@ Array [
     "serviceName": "opbeans-dotnet",
     "transactionName": "GET Products/Get {id}",
     "transactionType": "request",
-    "transactionsPerMinute": 0.5,
+    "transactionsPerMinute": 0.466666666666667,
   },
   Object {
-    "averageResponseTime": 14902.4,
-    "impact": 0.0684085922032904,
+    "averageResponseTime": 7892.33333333333,
+    "impact": 0.0612407972225879,
     "key": Object {
-      "service.name": "opbeans-python",
-      "transaction.name": "GET opbeans.views.product_type",
+      "service.name": "opbeans-node",
+      "transaction.name": "GET /api/types/:id",
     },
-    "serviceName": "opbeans-python",
-    "transactionName": "GET opbeans.views.product_type",
+    "serviceName": "opbeans-node",
+    "transactionName": "GET /api/types/:id",
     "transactionType": "request",
-    "transactionsPerMinute": 0.166666666666667,
+    "transactionsPerMinute": 0.3,
   },
   Object {
-    "averageResponseTime": 6329.35714285714,
-    "impact": 0.0816436656379062,
+    "averageResponseTime": 6346.42857142857,
+    "impact": 0.0769666700279444,
     "key": Object {
       "service.name": "opbeans-dotnet",
       "transaction.name": "GET Orders/Get {id}",
@@ -387,8 +387,8 @@ Array [
     "transactionsPerMinute": 0.466666666666667,
   },
   Object {
-    "averageResponseTime": 6627.42857142857,
-    "impact": 0.0855609620023755,
+    "averageResponseTime": 7052.84615384615,
+    "impact": 0.0794704188998674,
     "key": Object {
       "service.name": "opbeans-go",
       "transaction.name": "GET /api/products",
@@ -396,11 +396,11 @@ Array [
     "serviceName": "opbeans-go",
     "transactionName": "GET /api/products",
     "transactionType": "request",
-    "transactionsPerMinute": 0.466666666666667,
+    "transactionsPerMinute": 0.433333333333333,
   },
   Object {
-    "averageResponseTime": 10459,
-    "impact": 0.0868254235894687,
+    "averageResponseTime": 10484.3333333333,
+    "impact": 0.0818285496667966,
     "key": Object {
       "service.name": "opbeans-java",
       "transaction.name": "APIRestController#product",
@@ -411,8 +411,8 @@ Array [
     "transactionsPerMinute": 0.3,
   },
   Object {
-    "averageResponseTime": 23652.5,
-    "impact": 0.087275072513164,
+    "averageResponseTime": 23711,
+    "impact": 0.0822565786420813,
     "key": Object {
       "service.name": "opbeans-node",
       "transaction.name": "GET /api/stats",
@@ -423,8 +423,8 @@ Array [
     "transactionsPerMinute": 0.133333333333333,
   },
   Object {
-    "averageResponseTime": 4480.95454545455,
-    "impact": 0.0910027465757826,
+    "averageResponseTime": 4491.36363636364,
+    "impact": 0.0857567083657495,
     "key": Object {
       "service.name": "opbeans-dotnet",
       "transaction.name": "GET Types/Get {id}",
@@ -435,8 +435,8 @@ Array [
     "transactionsPerMinute": 0.733333333333333,
   },
   Object {
-    "averageResponseTime": 20677.4,
-    "impact": 0.0955142554010017,
+    "averageResponseTime": 20715.8,
+    "impact": 0.089965512867054,
     "key": Object {
       "service.name": "opbeans-python",
       "transaction.name": "GET opbeans.views.stats",
@@ -447,8 +447,8 @@ Array [
     "transactionsPerMinute": 0.166666666666667,
   },
   Object {
-    "averageResponseTime": 9015.33333333333,
-    "impact": 0.100017315707821,
+    "averageResponseTime": 9036.33333333333,
+    "impact": 0.0942519803576885,
     "key": Object {
       "service.name": "opbeans-node",
       "transaction.name": "GET /api/products",
@@ -459,20 +459,8 @@ Array [
     "transactionsPerMinute": 0.4,
   },
   Object {
-    "averageResponseTime": 12096.8888888889,
-    "impact": 0.100663158003234,
-    "key": Object {
-      "service.name": "opbeans-go",
-      "transaction.name": "GET /api/customers",
-    },
-    "serviceName": "opbeans-go",
-    "transactionName": "GET /api/customers",
-    "transactionType": "request",
-    "transactionsPerMinute": 0.3,
-  },
-  Object {
-    "averageResponseTime": 7361.46666666667,
-    "impact": 0.102118180616444,
+    "averageResponseTime": 7504.06666666667,
+    "impact": 0.0978924329825326,
     "key": Object {
       "service.name": "opbeans-java",
       "transaction.name": "APIRestController#customer",
@@ -483,8 +471,8 @@ Array [
     "transactionsPerMinute": 0.5,
   },
   Object {
-    "averageResponseTime": 4141.07142857143,
-    "impact": 0.107307448362139,
+    "averageResponseTime": 4250.55555555556,
+    "impact": 0.0998375378516613,
     "key": Object {
       "service.name": "opbeans-go",
       "transaction.name": "GET /api/types/:id",
@@ -492,11 +480,11 @@ Array [
     "serviceName": "opbeans-go",
     "transactionName": "GET /api/types/:id",
     "transactionType": "request",
-    "transactionsPerMinute": 0.933333333333333,
+    "transactionsPerMinute": 0.9,
   },
   Object {
-    "averageResponseTime": 21277,
-    "impact": 0.118301786972411,
+    "averageResponseTime": 21343,
+    "impact": 0.11156906191034,
     "key": Object {
       "service.name": "opbeans-node",
       "transaction.name": "GET /api/customers",
@@ -507,8 +495,8 @@ Array [
     "transactionsPerMinute": 0.2,
   },
   Object {
-    "averageResponseTime": 16602.25,
-    "impact": 0.123141849290936,
+    "averageResponseTime": 16655,
+    "impact": 0.116142352941114,
     "key": Object {
       "service.name": "opbeans-ruby",
       "transaction.name": "Api::ProductsController#top",
@@ -519,8 +507,20 @@ Array [
     "transactionsPerMinute": 0.266666666666667,
   },
   Object {
-    "averageResponseTime": 9924.07142857143,
-    "impact": 0.128885903078184,
+    "averageResponseTime": 5749,
+    "impact": 0.12032203382142,
+    "key": Object {
+      "service.name": "opbeans-go",
+      "transaction.name": "GET /api/types",
+    },
+    "serviceName": "opbeans-go",
+    "transactionName": "GET /api/types",
+    "transactionType": "request",
+    "transactionsPerMinute": 0.8,
+  },
+  Object {
+    "averageResponseTime": 9951,
+    "impact": 0.121502864272824,
     "key": Object {
       "service.name": "opbeans-ruby",
       "transaction.name": "Api::StatsController#index",
@@ -531,20 +531,20 @@ Array [
     "transactionsPerMinute": 0.466666666666667,
   },
   Object {
-    "averageResponseTime": 5444.5,
-    "impact": 0.131345360656643,
+    "averageResponseTime": 14040.6,
+    "impact": 0.122466591367692,
     "key": Object {
       "service.name": "opbeans-go",
-      "transaction.name": "GET /api/types",
+      "transaction.name": "GET /api/customers",
     },
     "serviceName": "opbeans-go",
-    "transactionName": "GET /api/types",
+    "transactionName": "GET /api/customers",
     "transactionType": "request",
-    "transactionsPerMinute": 0.866666666666667,
+    "transactionsPerMinute": 0.333333333333333,
   },
   Object {
-    "averageResponseTime": 20932.4285714286,
-    "impact": 0.136010820261582,
+    "averageResponseTime": 20963.5714285714,
+    "impact": 0.128060974201361,
     "key": Object {
       "service.name": "opbeans-ruby",
       "transaction.name": "Api::OrdersController#index",
@@ -555,20 +555,8 @@ Array [
     "transactionsPerMinute": 0.233333333333333,
   },
   Object {
-    "averageResponseTime": 12301.3333333333,
-    "impact": 0.137033090987896,
-    "key": Object {
-      "service.name": "opbeans-ruby",
-      "transaction.name": "Api::ProductsController#index",
-    },
-    "serviceName": "opbeans-ruby",
-    "transactionName": "Api::ProductsController#index",
-    "transactionType": "request",
-    "transactionsPerMinute": 0.4,
-  },
-  Object {
-    "averageResponseTime": 22818.7142857143,
-    "impact": 0.148405735477602,
+    "averageResponseTime": 22874.4285714286,
+    "impact": 0.139865748579522,
     "key": Object {
       "service.name": "opbeans-python",
       "transaction.name": "GET opbeans.views.customer",
@@ -579,8 +567,8 @@ Array [
     "transactionsPerMinute": 0.233333333333333,
   },
   Object {
-    "averageResponseTime": 32098.4,
-    "impact": 0.149120104644475,
+    "averageResponseTime": 32203.8,
+    "impact": 0.140658264084276,
     "key": Object {
       "service.name": "opbeans-python",
       "transaction.name": "GET opbeans.views.customers",
@@ -591,8 +579,8 @@ Array [
     "transactionsPerMinute": 0.166666666666667,
   },
   Object {
-    "averageResponseTime": 4585.91428571429,
-    "impact": 0.149134185508474,
+    "averageResponseTime": 4482.11111111111,
+    "impact": 0.140955678032051,
     "key": Object {
       "service.name": "opbeans-go",
       "transaction.name": "GET /api/customers/:id",
@@ -600,23 +588,23 @@ Array [
     "serviceName": "opbeans-go",
     "transactionName": "GET /api/customers/:id",
     "transactionType": "request",
-    "transactionsPerMinute": 1.16666666666667,
+    "transactionsPerMinute": 1.2,
   },
   Object {
-    "averageResponseTime": 20449.3333333333,
-    "impact": 0.171228938571142,
+    "averageResponseTime": 12582.3846153846,
+    "impact": 0.142910490774846,
     "key": Object {
-      "service.name": "opbeans-python",
-      "transaction.name": "GET opbeans.views.orders",
+      "service.name": "opbeans-ruby",
+      "transaction.name": "Api::ProductsController#index",
     },
-    "serviceName": "opbeans-python",
-    "transactionName": "GET opbeans.views.orders",
+    "serviceName": "opbeans-ruby",
+    "transactionName": "Api::ProductsController#index",
     "transactionType": "request",
-    "transactionsPerMinute": 0.3,
+    "transactionsPerMinute": 0.433333333333333,
   },
   Object {
-    "averageResponseTime": 9981.1052631579,
-    "impact": 0.176482978291232,
+    "averageResponseTime": 10009.9473684211,
+    "impact": 0.166401779979233,
     "key": Object {
       "service.name": "opbeans-ruby",
       "transaction.name": "Api::CustomersController#show",
@@ -627,8 +615,8 @@ Array [
     "transactionsPerMinute": 0.633333333333333,
   },
   Object {
-    "averageResponseTime": 27758.7142857143,
-    "impact": 0.180866820616195,
+    "averageResponseTime": 27825.2857142857,
+    "impact": 0.170450845832029,
     "key": Object {
       "service.name": "opbeans-python",
       "transaction.name": "GET opbeans.views.product_types",
@@ -639,20 +627,20 @@ Array [
     "transactionsPerMinute": 0.233333333333333,
   },
   Object {
-    "averageResponseTime": 8332.06896551724,
-    "impact": 0.225286314186844,
+    "averageResponseTime": 20562.2,
+    "impact": 0.180021926732983,
     "key": Object {
-      "service.name": "opbeans-go",
-      "transaction.name": "GET /api/orders/:id",
+      "service.name": "opbeans-python",
+      "transaction.name": "GET opbeans.views.orders",
     },
-    "serviceName": "opbeans-go",
-    "transactionName": "GET /api/orders/:id",
+    "serviceName": "opbeans-python",
+    "transactionName": "GET opbeans.views.orders",
     "transactionType": "request",
-    "transactionsPerMinute": 0.966666666666667,
+    "transactionsPerMinute": 0.333333333333333,
   },
   Object {
-    "averageResponseTime": 6976.62857142857,
-    "impact": 0.227681938515175,
+    "averageResponseTime": 7106.76470588235,
+    "impact": 0.21180020991247,
     "key": Object {
       "service.name": "opbeans-dotnet",
       "transaction.name": "GET Customers/Get {id}",
@@ -660,11 +648,23 @@ Array [
     "serviceName": "opbeans-dotnet",
     "transactionName": "GET Customers/Get {id}",
     "transactionType": "request",
-    "transactionsPerMinute": 1.16666666666667,
+    "transactionsPerMinute": 1.13333333333333,
+  },
+  Object {
+    "averageResponseTime": 8612.51724137931,
+    "impact": 0.218977858687708,
+    "key": Object {
+      "service.name": "opbeans-go",
+      "transaction.name": "GET /api/orders/:id",
+    },
+    "serviceName": "opbeans-go",
+    "transactionName": "GET /api/orders/:id",
+    "transactionType": "request",
+    "transactionsPerMinute": 0.966666666666667,
   },
   Object {
-    "averageResponseTime": 11321.7777777778,
-    "impact": 0.2854191132559,
+    "averageResponseTime": 11295,
+    "impact": 0.277663720068132,
     "key": Object {
       "service.name": "opbeans-ruby",
       "transaction.name": "Api::CustomersController#index",
@@ -672,11 +672,11 @@ Array [
     "serviceName": "opbeans-ruby",
     "transactionName": "Api::CustomersController#index",
     "transactionType": "request",
-    "transactionsPerMinute": 0.9,
+    "transactionsPerMinute": 0.933333333333333,
   },
   Object {
-    "averageResponseTime": 64824.2,
-    "impact": 0.302722617661906,
+    "averageResponseTime": 65035.8,
+    "impact": 0.285535040543522,
     "key": Object {
       "service.name": "opbeans-python",
       "transaction.name": "GET opbeans.views.product_customers",
@@ -687,8 +687,8 @@ Array [
     "transactionsPerMinute": 0.166666666666667,
   },
   Object {
-    "averageResponseTime": 32155.5625,
-    "impact": 0.481425678843616,
+    "averageResponseTime": 30999.4705882353,
+    "impact": 0.463640986028375,
     "key": Object {
       "service.name": "opbeans-go",
       "transaction.name": "GET /api/stats",
@@ -696,23 +696,11 @@ Array [
     "serviceName": "opbeans-go",
     "transactionName": "GET /api/stats",
     "transactionType": "request",
-    "transactionsPerMinute": 0.533333333333333,
+    "transactionsPerMinute": 0.566666666666667,
   },
   Object {
-    "averageResponseTime": 32890.5714285714,
-    "impact": 0.646841098031782,
-    "key": Object {
-      "service.name": "opbeans-dotnet",
-      "transaction.name": "GET Customers/Get",
-    },
-    "serviceName": "opbeans-dotnet",
-    "transactionName": "GET Customers/Get",
-    "transactionType": "request",
-    "transactionsPerMinute": 0.7,
-  },
-  Object {
-    "averageResponseTime": 20133.0571428571,
-    "impact": 0.65994099517201,
+    "averageResponseTime": 20197.4,
+    "impact": 0.622424732781511,
     "key": Object {
       "service.name": "opbeans-go",
       "transaction.name": "GET /api/products/:id/customers",
@@ -723,8 +711,8 @@ Array [
     "transactionsPerMinute": 1.16666666666667,
   },
   Object {
-    "averageResponseTime": 64534,
-    "impact": 0.725417951490748,
+    "averageResponseTime": 64681.6666666667,
+    "impact": 0.68355874339377,
     "key": Object {
       "service.name": "opbeans-python",
       "transaction.name": "GET opbeans.views.top_products",
@@ -735,8 +723,20 @@ Array [
     "transactionsPerMinute": 0.4,
   },
   Object {
-    "averageResponseTime": 19259.8775510204,
-    "impact": 0.884368376654926,
+    "averageResponseTime": 41416.1428571429,
+    "impact": 0.766127739061111,
+    "key": Object {
+      "service.name": "opbeans-dotnet",
+      "transaction.name": "GET Customers/Get",
+    },
+    "serviceName": "opbeans-dotnet",
+    "transactionName": "GET Customers/Get",
+    "transactionType": "request",
+    "transactionsPerMinute": 0.7,
+  },
+  Object {
+    "averageResponseTime": 19429,
+    "impact": 0.821597646656097,
     "key": Object {
       "service.name": "opbeans-go",
       "transaction.name": "GET /api/products/:id",
@@ -744,11 +744,11 @@ Array [
     "serviceName": "opbeans-go",
     "transactionName": "GET /api/products/:id",
     "transactionType": "request",
-    "transactionsPerMinute": 1.63333333333333,
+    "transactionsPerMinute": 1.6,
   },
   Object {
-    "averageResponseTime": 62237.5652173913,
-    "impact": 1.3422123631976,
+    "averageResponseTime": 62390.652173913,
+    "impact": 1.26497653527507,
     "key": Object {
       "service.name": "opbeans-dotnet",
       "transaction.name": "GET Products/Customerwhobought {id}",
@@ -759,8 +759,8 @@ Array [
     "transactionsPerMinute": 0.766666666666667,
   },
   Object {
-    "averageResponseTime": 33203.5666666667,
-    "impact": 1.86860199568649,
+    "averageResponseTime": 33266.2,
+    "impact": 1.76006661931225,
     "key": Object {
       "service.name": "opbeans-python",
       "transaction.name": "opbeans.tasks.sync_orders",
@@ -771,8 +771,8 @@ Array [
     "transactionsPerMinute": 2,
   },
   Object {
-    "averageResponseTime": 37042.1607142857,
-    "impact": 1.94571537801384,
+    "averageResponseTime": 38491.4444444444,
+    "impact": 1.83293391905112,
     "key": Object {
       "service.name": "opbeans-node",
       "transaction.name": "GET /api",
@@ -780,11 +780,11 @@ Array [
     "serviceName": "opbeans-node",
     "transactionName": "GET /api",
     "transactionType": "request",
-    "transactionsPerMinute": 1.86666666666667,
+    "transactionsPerMinute": 1.8,
   },
   Object {
-    "averageResponseTime": 116654.571428571,
-    "impact": 2.29809838682675,
+    "averageResponseTime": 118488.6,
+    "impact": 2.08995781717084,
     "key": Object {
       "service.name": "opbeans-dotnet",
       "transaction.name": "GET Stats/Get",
@@ -792,35 +792,47 @@ Array [
     "serviceName": "opbeans-dotnet",
     "transactionName": "GET Stats/Get",
     "transactionType": "request",
-    "transactionsPerMinute": 0.7,
+    "transactionsPerMinute": 0.666666666666667,
   },
   Object {
-    "averageResponseTime": 28741.0333333333,
-    "impact": 2.4266538589631,
+    "averageResponseTime": 250440.142857143,
+    "impact": 4.64001412901584,
     "key": Object {
-      "service.name": "opbeans-ruby",
-      "transaction.name": "Rack",
+      "service.name": "opbeans-dotnet",
+      "transaction.name": "GET Products/Top",
     },
-    "serviceName": "opbeans-ruby",
-    "transactionName": "Rack",
+    "serviceName": "opbeans-dotnet",
+    "transactionName": "GET Products/Top",
     "transactionType": "request",
-    "transactionsPerMinute": 3,
+    "transactionsPerMinute": 0.7,
   },
   Object {
-    "averageResponseTime": 249714.952380952,
-    "impact": 4.9211455657754,
+    "averageResponseTime": 312096.523809524,
+    "impact": 5.782704992387,
     "key": Object {
-      "service.name": "opbeans-dotnet",
-      "transaction.name": "GET Products/Top",
+      "service.name": "opbeans-java",
+      "transaction.name": "DispatcherServlet#doGet",
     },
-    "serviceName": "opbeans-dotnet",
-    "transactionName": "GET Products/Top",
+    "serviceName": "opbeans-java",
+    "transactionName": "DispatcherServlet#doGet",
     "transactionType": "request",
     "transactionsPerMinute": 0.7,
   },
   Object {
-    "averageResponseTime": 653461.538461538,
-    "impact": 7.97292501431132,
+    "averageResponseTime": 91519.7032967033,
+    "impact": 7.34855500859826,
+    "key": Object {
+      "service.name": "opbeans-ruby",
+      "transaction.name": "Rack",
+    },
+    "serviceName": "opbeans-ruby",
+    "transactionName": "Rack",
+    "transactionType": "request",
+    "transactionsPerMinute": 3.03333333333333,
+  },
+  Object {
+    "averageResponseTime": 648269.769230769,
+    "impact": 7.43611473386403,
     "key": Object {
       "service.name": "opbeans-rum",
       "transaction.name": "/customers",
@@ -831,20 +843,8 @@ Array [
     "transactionsPerMinute": 0.433333333333333,
   },
   Object {
-    "averageResponseTime": 575328.095238095,
-    "impact": 11.340025698891,
-    "key": Object {
-      "service.name": "opbeans-java",
-      "transaction.name": "DispatcherServlet#doGet",
-    },
-    "serviceName": "opbeans-java",
-    "transactionName": "DispatcherServlet#doGet",
-    "transactionType": "request",
-    "transactionsPerMinute": 0.7,
-  },
-  Object {
-    "averageResponseTime": 1534606.6,
-    "impact": 14.4041869205032,
+    "averageResponseTime": 1398919.72727273,
+    "impact": 13.5790895084132,
     "key": Object {
       "service.name": "opbeans-python",
       "transaction.name": "GET opbeans.views.products",
@@ -852,11 +852,11 @@ Array [
     "serviceName": "opbeans-python",
     "transactionName": "GET opbeans.views.products",
     "transactionType": "request",
-    "transactionsPerMinute": 0.333333333333333,
+    "transactionsPerMinute": 0.366666666666667,
   },
   Object {
-    "averageResponseTime": 1197500,
-    "impact": 15.7361746989891,
+    "averageResponseTime": 1199907.57142857,
+    "impact": 14.8239822181408,
     "key": Object {
       "service.name": "opbeans-rum",
       "transaction.name": "/orders",
@@ -867,8 +867,8 @@ Array [
     "transactionsPerMinute": 0.466666666666667,
   },
   Object {
-    "averageResponseTime": 953684.210526316,
-    "impact": 17.0081460802151,
+    "averageResponseTime": 955876.052631579,
+    "impact": 16.026822184214,
     "key": Object {
       "service.name": "opbeans-rum",
       "transaction.name": "/products",
@@ -879,8 +879,8 @@ Array [
     "transactionsPerMinute": 0.633333333333333,
   },
   Object {
-    "averageResponseTime": 962252.473684211,
-    "impact": 17.1609675746427,
+    "averageResponseTime": 965009.526315789,
+    "impact": 16.1799735991728,
     "key": Object {
       "service.name": "opbeans-go",
       "transaction.name": "GET /api/orders",
@@ -891,8 +891,8 @@ Array [
     "transactionsPerMinute": 0.633333333333333,
   },
   Object {
-    "averageResponseTime": 1212615.38461538,
-    "impact": 29.594561046619,
+    "averageResponseTime": 1213675.30769231,
+    "impact": 27.8474053933734,
     "key": Object {
       "service.name": "opbeans-rum",
       "transaction.name": "/dashboard",
@@ -903,8 +903,8 @@ Array [
     "transactionsPerMinute": 0.866666666666667,
   },
   Object {
-    "averageResponseTime": 896783.309523809,
-    "impact": 35.3554170595149,
+    "averageResponseTime": 924019.363636364,
+    "impact": 35.8796065162284,
     "key": Object {
       "service.name": "opbeans-node",
       "transaction.name": "Update shipping status",
@@ -912,11 +912,23 @@ Array [
     "serviceName": "opbeans-node",
     "transactionName": "Update shipping status",
     "transactionType": "Worker",
-    "transactionsPerMinute": 1.4,
+    "transactionsPerMinute": 1.46666666666667,
+  },
+  Object {
+    "averageResponseTime": 1060469.15384615,
+    "impact": 36.498655556576,
+    "key": Object {
+      "service.name": "opbeans-node",
+      "transaction.name": "Process payment",
+    },
+    "serviceName": "opbeans-node",
+    "transactionName": "Process payment",
+    "transactionType": "Worker",
+    "transactionsPerMinute": 1.3,
   },
   Object {
-    "averageResponseTime": 119062.672222222,
-    "impact": 40.2345894471584,
+    "averageResponseTime": 118686.822222222,
+    "impact": 37.7068083771466,
     "key": Object {
       "service.name": "opbeans-python",
       "transaction.name": "opbeans.tasks.update_stats",
@@ -927,20 +939,8 @@ Array [
     "transactionsPerMinute": 12,
   },
   Object {
-    "averageResponseTime": 1078328.675,
-    "impact": 40.488594152833,
-    "key": Object {
-      "service.name": "opbeans-node",
-      "transaction.name": "Process payment",
-    },
-    "serviceName": "opbeans-node",
-    "transactionName": "Process payment",
-    "transactionType": "Worker",
-    "transactionsPerMinute": 1.33333333333333,
-  },
-  Object {
-    "averageResponseTime": 1057995.65957447,
-    "impact": 46.6772737502262,
+    "averageResponseTime": 1039228.27659574,
+    "impact": 43.1048035741496,
     "key": Object {
       "service.name": "opbeans-node",
       "transaction.name": "Process completed order",
@@ -951,8 +951,8 @@ Array [
     "transactionsPerMinute": 1.56666666666667,
   },
   Object {
-    "averageResponseTime": 1947354.08333333,
-    "impact": 65.8074895815218,
+    "averageResponseTime": 1949922.55555556,
+    "impact": 61.9499776921889,
     "key": Object {
       "service.name": "opbeans-python",
       "transaction.name": "opbeans.tasks.sync_customers",
@@ -963,7 +963,7 @@ Array [
     "transactionsPerMinute": 1.2,
   },
   Object {
-    "averageResponseTime": 5918288.44444444,
+    "averageResponseTime": 5963775,
     "impact": 100,
     "key": Object {
       "service.name": "opbeans-dotnet",
@@ -972,7 +972,7 @@ Array [
     "serviceName": "opbeans-dotnet",
     "transactionName": "GET Orders/Get",
     "transactionType": "request",
-    "transactionsPerMinute": 0.6,
+    "transactionsPerMinute": 0.633333333333333,
   },
 ]
 `;
diff --git a/x-pack/test/apm_api_integration/tests/traces/top_traces.ts b/x-pack/test/apm_api_integration/tests/traces/top_traces.ts
index e67c2cb66df69..4968732f82203 100644
--- a/x-pack/test/apm_api_integration/tests/traces/top_traces.ts
+++ b/x-pack/test/apm_api_integration/tests/traces/top_traces.ts
@@ -63,7 +63,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
 
         expectSnapshot(firstItem).toMatchInline(`
           Object {
-            "averageResponseTime": 1638,
+            "averageResponseTime": 1639,
             "impact": 0,
             "key": Object {
               "service.name": "opbeans-java",
@@ -78,7 +78,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
 
         expectSnapshot(lastItem).toMatchInline(`
           Object {
-            "averageResponseTime": 5918288.44444444,
+            "averageResponseTime": 5963775,
             "impact": 100,
             "key": Object {
               "service.name": "opbeans-dotnet",
@@ -87,7 +87,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
             "serviceName": "opbeans-dotnet",
             "transactionName": "GET Orders/Get",
             "transactionType": "request",
-            "transactionsPerMinute": 0.6,
+            "transactionsPerMinute": 0.633333333333333,
           }
         `);
 
diff --git a/x-pack/test/apm_api_integration/tests/transactions/__snapshots__/error_rate.snap b/x-pack/test/apm_api_integration/tests/transactions/__snapshots__/error_rate.snap
index 878e5775c4ef5..c4dfaf346d015 100644
--- a/x-pack/test/apm_api_integration/tests/transactions/__snapshots__/error_rate.snap
+++ b/x-pack/test/apm_api_integration/tests/transactions/__snapshots__/error_rate.snap
@@ -6,241 +6,121 @@ Array [
     "x": 1627973400000,
     "y": 0,
   },
-  Object {
-    "x": 1627973430000,
-    "y": 0,
-  },
   Object {
     "x": 1627973460000,
     "y": 0,
   },
-  Object {
-    "x": 1627973490000,
-    "y": 0.333333333333333,
-  },
   Object {
     "x": 1627973520000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627973550000,
-    "y": 0.125,
+    "y": 0.333333333333333,
   },
   Object {
     "x": 1627973580000,
-    "y": 0.25,
-  },
-  Object {
-    "x": 1627973610000,
-    "y": 0,
+    "y": 0.181818181818182,
   },
   Object {
     "x": 1627973640000,
     "y": 0,
   },
-  Object {
-    "x": 1627973670000,
-    "y": 0,
-  },
   Object {
     "x": 1627973700000,
     "y": 0,
   },
-  Object {
-    "x": 1627973730000,
-    "y": 0.333333333333333,
-  },
   Object {
     "x": 1627973760000,
     "y": 0.166666666666667,
   },
-  Object {
-    "x": 1627973790000,
-    "y": 0,
-  },
   Object {
     "x": 1627973820000,
-    "y": 0.2,
-  },
-  Object {
-    "x": 1627973850000,
-    "y": 0,
+    "y": 0.181818181818182,
   },
   Object {
     "x": 1627973880000,
     "y": 0,
   },
-  Object {
-    "x": 1627973910000,
-    "y": 0,
-  },
   Object {
     "x": 1627973940000,
     "y": 0,
   },
-  Object {
-    "x": 1627973970000,
-    "y": 0.166666666666667,
-  },
   Object {
     "x": 1627974000000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974030000,
-    "y": 0,
+    "y": 0.0833333333333333,
   },
   Object {
     "x": 1627974060000,
-    "y": 0.25,
-  },
-  Object {
-    "x": 1627974090000,
-    "y": 0.5,
+    "y": 0.0769230769230769,
   },
   Object {
     "x": 1627974120000,
     "y": 0,
   },
-  Object {
-    "x": 1627974150000,
-    "y": 0,
-  },
   Object {
     "x": 1627974180000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974210000,
-    "y": 0.2,
+    "y": 0.1,
   },
   Object {
     "x": 1627974240000,
-    "y": 0.142857142857143,
-  },
-  Object {
-    "x": 1627974270000,
-    "y": 0,
+    "y": 0.153846153846154,
   },
   Object {
     "x": 1627974300000,
     "y": 0,
   },
-  Object {
-    "x": 1627974330000,
-    "y": null,
-  },
   Object {
     "x": 1627974360000,
     "y": null,
   },
-  Object {
-    "x": 1627974390000,
-    "y": 0,
-  },
   Object {
     "x": 1627974420000,
     "y": 0,
   },
-  Object {
-    "x": 1627974450000,
-    "y": 0,
-  },
   Object {
     "x": 1627974480000,
     "y": 0,
   },
-  Object {
-    "x": 1627974510000,
-    "y": 0,
-  },
   Object {
     "x": 1627974540000,
     "y": 0,
   },
-  Object {
-    "x": 1627974570000,
-    "y": 0,
-  },
   Object {
     "x": 1627974600000,
-    "y": 0.4,
-  },
-  Object {
-    "x": 1627974630000,
-    "y": 1,
+    "y": 0.125,
   },
   Object {
     "x": 1627974660000,
-    "y": 0.333333333333333,
-  },
-  Object {
-    "x": 1627974690000,
-    "y": 0.5,
+    "y": 0.6,
   },
   Object {
     "x": 1627974720000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974750000,
-    "y": 0,
+    "y": 0.2,
   },
   Object {
     "x": 1627974780000,
     "y": 0,
   },
-  Object {
-    "x": 1627974810000,
-    "y": 0,
-  },
   Object {
     "x": 1627974840000,
-    "y": 0.333333333333333,
-  },
-  Object {
-    "x": 1627974870000,
     "y": 0,
   },
   Object {
     "x": 1627974900000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974930000,
-    "y": 0,
+    "y": 0.0666666666666667,
   },
   Object {
     "x": 1627974960000,
     "y": 0,
   },
-  Object {
-    "x": 1627974990000,
-    "y": 0,
-  },
   Object {
     "x": 1627975020000,
     "y": 0,
   },
-  Object {
-    "x": 1627975050000,
-    "y": 0,
-  },
   Object {
     "x": 1627975080000,
     "y": 0,
   },
-  Object {
-    "x": 1627975110000,
-    "y": 0.4,
-  },
   Object {
     "x": 1627975140000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627975170000,
-    "y": 0.333333333333333,
+    "y": 0.181818181818182,
   },
   Object {
     "x": 1627975200000,
@@ -252,736 +132,136 @@ Array [
 exports[`APM API tests basic apm_8.0.0 Error rate when data is loaded returns the transaction error rate with comparison data has the correct error rate 1`] = `
 Array [
   Object {
-    "x": 1627974310000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974320000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974330000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974340000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974350000,
-    "y": null,
+    "x": 1627974300000,
+    "y": 0,
   },
   Object {
     "x": 1627974360000,
     "y": null,
   },
-  Object {
-    "x": 1627974370000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974380000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974390000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974400000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974410000,
-    "y": 0,
-  },
   Object {
     "x": 1627974420000,
     "y": 0,
   },
-  Object {
-    "x": 1627974430000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974440000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974450000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974460000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974470000,
-    "y": null,
-  },
   Object {
     "x": 1627974480000,
     "y": 0,
   },
   Object {
-    "x": 1627974490000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974500000,
+    "x": 1627974540000,
     "y": 0,
   },
   Object {
-    "x": 1627974510000,
-    "y": null,
+    "x": 1627974600000,
+    "y": 0.125,
   },
   Object {
-    "x": 1627974520000,
-    "y": 0,
+    "x": 1627974660000,
+    "y": 0.6,
   },
   Object {
-    "x": 1627974530000,
-    "y": null,
+    "x": 1627974720000,
+    "y": 0.2,
   },
   Object {
-    "x": 1627974540000,
+    "x": 1627974780000,
     "y": 0,
   },
   Object {
-    "x": 1627974550000,
+    "x": 1627974840000,
     "y": 0,
   },
   Object {
-    "x": 1627974560000,
-    "y": null,
+    "x": 1627974900000,
+    "y": 0.0666666666666667,
   },
   Object {
-    "x": 1627974570000,
+    "x": 1627974960000,
     "y": 0,
   },
   Object {
-    "x": 1627974580000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974590000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974600000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974610000,
+    "x": 1627975020000,
     "y": 0,
   },
   Object {
-    "x": 1627974620000,
-    "y": 1,
-  },
-  Object {
-    "x": 1627974630000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974640000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974650000,
-    "y": 1,
-  },
-  Object {
-    "x": 1627974660000,
+    "x": 1627975080000,
     "y": 0,
   },
   Object {
-    "x": 1627974670000,
-    "y": 0.5,
-  },
-  Object {
-    "x": 1627974680000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974690000,
-    "y": 1,
-  },
-  Object {
-    "x": 1627974700000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974710000,
-    "y": 0,
+    "x": 1627975140000,
+    "y": 0.181818181818182,
   },
   Object {
-    "x": 1627974720000,
+    "x": 1627975200000,
     "y": null,
   },
+]
+`;
+
+exports[`APM API tests basic apm_8.0.0 Error rate when data is loaded returns the transaction error rate with comparison data has the correct error rate 2`] = `
+Array [
   Object {
-    "x": 1627974730000,
+    "x": 1627974300000,
     "y": 0,
   },
   Object {
-    "x": 1627974740000,
+    "x": 1627974360000,
     "y": 0,
   },
   Object {
-    "x": 1627974750000,
-    "y": 0,
+    "x": 1627974420000,
+    "y": 0.333333333333333,
   },
   Object {
-    "x": 1627974760000,
-    "y": null,
+    "x": 1627974480000,
+    "y": 0.181818181818182,
   },
   Object {
-    "x": 1627974770000,
+    "x": 1627974540000,
     "y": 0,
   },
   Object {
-    "x": 1627974780000,
+    "x": 1627974600000,
     "y": 0,
   },
   Object {
-    "x": 1627974790000,
-    "y": 0,
+    "x": 1627974660000,
+    "y": 0.166666666666667,
   },
   Object {
-    "x": 1627974800000,
-    "y": null,
+    "x": 1627974720000,
+    "y": 0.181818181818182,
   },
   Object {
-    "x": 1627974810000,
+    "x": 1627974780000,
     "y": 0,
   },
-  Object {
-    "x": 1627974820000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974830000,
-    "y": null,
-  },
   Object {
     "x": 1627974840000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974850000,
-    "y": 0.5,
-  },
-  Object {
-    "x": 1627974860000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974870000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974880000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974890000,
     "y": 0,
   },
   Object {
     "x": 1627974900000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974910000,
-    "y": 0,
+    "y": 0.0833333333333333,
   },
   Object {
-    "x": 1627974920000,
-    "y": null,
+    "x": 1627974960000,
+    "y": 0.0769230769230769,
   },
   Object {
-    "x": 1627974930000,
+    "x": 1627975020000,
     "y": 0,
   },
   Object {
-    "x": 1627974940000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974950000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974960000,
-    "y": null,
+    "x": 1627975080000,
+    "y": 0.1,
   },
   Object {
-    "x": 1627974970000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974980000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974990000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627975000000,
-    "y": null,
-  },
-  Object {
-    "x": 1627975010000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627975020000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627975030000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627975040000,
-    "y": null,
-  },
-  Object {
-    "x": 1627975050000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627975060000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627975070000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627975080000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627975090000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627975100000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627975110000,
-    "y": 0.333333333333333,
-  },
-  Object {
-    "x": 1627975120000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627975130000,
-    "y": 1,
-  },
-  Object {
-    "x": 1627975140000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627975150000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627975160000,
-    "y": null,
-  },
-  Object {
-    "x": 1627975170000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627975180000,
-    "y": 0.25,
-  },
-  Object {
-    "x": 1627975190000,
-    "y": 1,
-  },
-  Object {
-    "x": 1627975200000,
-    "y": null,
-  },
-  Object {
-    "x": 1627975210000,
-    "y": null,
-  },
-]
-`;
-
-exports[`APM API tests basic apm_8.0.0 Error rate when data is loaded returns the transaction error rate with comparison data has the correct error rate 2`] = `
-Array [
-  Object {
-    "x": 1627974310000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974320000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974330000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974340000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974350000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974360000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974370000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974380000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974390000,
-    "y": 0.5,
-  },
-  Object {
-    "x": 1627974400000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974410000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974420000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974430000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974440000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974450000,
-    "y": 0.142857142857143,
-  },
-  Object {
-    "x": 1627974460000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974470000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974480000,
-    "y": 0.5,
-  },
-  Object {
-    "x": 1627974490000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974500000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974510000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974520000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974530000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974540000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974550000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974560000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974570000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974580000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974590000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974600000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974610000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974620000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974630000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974640000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974650000,
-    "y": 0.5,
-  },
-  Object {
-    "x": 1627974660000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974670000,
-    "y": 0.5,
-  },
-  Object {
-    "x": 1627974680000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974690000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974700000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974710000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974720000,
-    "y": 0.25,
-  },
-  Object {
-    "x": 1627974730000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974740000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974750000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974760000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974770000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974780000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974790000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974800000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974810000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974820000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974830000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974840000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974850000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974860000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974870000,
-    "y": 0.5,
-  },
-  Object {
-    "x": 1627974880000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974890000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974900000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974910000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974920000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974930000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974940000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974950000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974960000,
-    "y": 0.333333333333333,
-  },
-  Object {
-    "x": 1627974970000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627974980000,
-    "y": null,
-  },
-  Object {
-    "x": 1627974990000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627975000000,
-    "y": 1,
-  },
-  Object {
-    "x": 1627975010000,
-    "y": null,
-  },
-  Object {
-    "x": 1627975020000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627975030000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627975040000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627975050000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627975060000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627975070000,
-    "y": null,
-  },
-  Object {
-    "x": 1627975080000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627975090000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627975100000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627975110000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627975120000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627975130000,
-    "y": 0.333333333333333,
-  },
-  Object {
-    "x": 1627975140000,
-    "y": 0.333333333333333,
-  },
-  Object {
-    "x": 1627975150000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627975160000,
-    "y": null,
-  },
-  Object {
-    "x": 1627975170000,
-    "y": null,
-  },
-  Object {
-    "x": 1627975180000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627975190000,
-    "y": 0,
+    "x": 1627975140000,
+    "y": 0.153846153846154,
   },
   Object {
     "x": 1627975200000,
-    "y": 0,
-  },
-  Object {
-    "x": 1627975210000,
     "y": null,
   },
 ]
diff --git a/x-pack/test/apm_api_integration/tests/transactions/__snapshots__/latency.snap b/x-pack/test/apm_api_integration/tests/transactions/__snapshots__/latency.snap
index 25b995acb87f1..ff9e52b57aeaa 100644
--- a/x-pack/test/apm_api_integration/tests/transactions/__snapshots__/latency.snap
+++ b/x-pack/test/apm_api_integration/tests/transactions/__snapshots__/latency.snap
@@ -3,196 +3,64 @@
 exports[`APM API tests basic apm_8.0.0 Latency with a basic license when data is loaded time comparison returns some data 1`] = `
 Array [
   Object {
-    "x": 1627974350000,
-    "y": 32153,
+    "x": 1627974300000,
+    "y": 22799,
   },
   Object {
-    "x": 1627974390000,
-    "y": 15341.3333333333,
-  },
-  Object {
-    "x": 1627974410000,
-    "y": 15170.5,
+    "x": 1627974360000,
+    "y": 3227391,
   },
   Object {
     "x": 1627974420000,
-    "y": 17329,
-  },
-  Object {
-    "x": 1627974460000,
-    "y": 50039,
+    "y": 15565.2222222222,
   },
   Object {
     "x": 1627974480000,
-    "y": 55816.6,
-  },
-  Object {
-    "x": 1627974490000,
-    "y": 17533,
-  },
-  Object {
-    "x": 1627974510000,
-    "y": 14888,
+    "y": 54307.5714285714,
   },
   Object {
     "x": 1627974540000,
-    "y": 12191.5,
-  },
-  Object {
-    "x": 1627974550000,
-    "y": 20445.5,
-  },
-  Object {
-    "x": 1627974590000,
-    "y": 9859,
+    "y": 16655,
   },
   Object {
     "x": 1627974600000,
-    "y": 11796,
-  },
-  Object {
-    "x": 1627974610000,
-    "y": 8774.4,
-  },
-  Object {
-    "x": 1627974620000,
-    "y": 42225.6666666667,
-  },
-  Object {
-    "x": 1627974630000,
-    "y": 16168,
-  },
-  Object {
-    "x": 1627974640000,
-    "y": 7851.33333333333,
+    "y": 9453,
   },
   Object {
     "x": 1627974660000,
-    "y": 45852,
-  },
-  Object {
-    "x": 1627974700000,
-    "y": 21823,
-  },
-  Object {
-    "x": 1627974710000,
-    "y": 4156,
-  },
-  Object {
-    "x": 1627974730000,
-    "y": 14191.5,
-  },
-  Object {
-    "x": 1627974740000,
-    "y": 3997,
-  },
-  Object {
-    "x": 1627974750000,
-    "y": 21823.75,
-  },
-  Object {
-    "x": 1627974760000,
-    "y": 58178.5,
+    "y": 31119,
   },
   Object {
-    "x": 1627974770000,
-    "y": 24291.5,
+    "x": 1627974720000,
+    "y": 15282.2,
   },
   Object {
     "x": 1627974780000,
-    "y": 7527.75,
+    "y": 18709,
   },
   Object {
     "x": 1627974840000,
-    "y": 12028,
-  },
-  Object {
-    "x": 1627974860000,
-    "y": 6773.8,
+    "y": 12095,
   },
   Object {
-    "x": 1627974870000,
-    "y": 37030,
-  },
-  Object {
-    "x": 1627974890000,
-    "y": 29564,
-  },
-  Object {
-    "x": 1627974910000,
-    "y": 15606,
-  },
-  Object {
-    "x": 1627974930000,
-    "y": 11747,
-  },
-  Object {
-    "x": 1627974940000,
-    "y": 9425,
-  },
-  Object {
-    "x": 1627974950000,
-    "y": 20220,
-  },
-  Object {
-    "x": 1627975000000,
-    "y": 12995.5,
-  },
-  Object {
-    "x": 1627975030000,
-    "y": 13606,
-  },
-  Object {
-    "x": 1627975050000,
-    "y": 22030,
+    "x": 1627974900000,
+    "y": 16291,
   },
   Object {
-    "x": 1627975060000,
-    "y": 10819,
+    "x": 1627974960000,
+    "y": 13444.3333333333,
   },
   Object {
-    "x": 1627975070000,
-    "y": 26343,
+    "x": 1627975020000,
+    "y": 13241.6666666667,
   },
   Object {
     "x": 1627975080000,
-    "y": 33080.5,
+    "y": 25535,
   },
   Object {
-    "x": 1627975090000,
-    "y": 11899,
-  },
-  Object {
-    "x": 1627975100000,
-    "y": 5253,
-  },
-  Object {
-    "x": 1627975110000,
-    "y": 16502,
-  },
-  Object {
-    "x": 1627975120000,
-    "y": 6945.5,
-  },
-  Object {
-    "x": 1627975130000,
-    "y": 7244,
-  },
-  Object {
-    "x": 1627975150000,
-    "y": 22631.5,
-  },
-  Object {
-    "x": 1627975180000,
-    "y": 23489,
-  },
-  Object {
-    "x": 1627975190000,
-    "y": 10133.3333333333,
-  },
-  Object {
-    "x": 1627975210000,
-    "y": 52108,
+    "x": 1627975140000,
+    "y": 11024.6,
   },
 ]
 `;
@@ -200,200 +68,64 @@ Array [
 exports[`APM API tests basic apm_8.0.0 Latency with a basic license when data is loaded time comparison returns some data 2`] = `
 Array [
   Object {
-    "x": 1627974310000,
-    "y": 107053.5,
-  },
-  Object {
-    "x": 1627974370000,
-    "y": 9857,
-  },
-  Object {
-    "x": 1627974380000,
-    "y": 266341,
-  },
-  Object {
-    "x": 1627974390000,
-    "y": 11715.75,
-  },
-  Object {
-    "x": 1627974410000,
-    "y": 7805.25,
-  },
-  Object {
-    "x": 1627974430000,
-    "y": 15880,
+    "x": 1627974300000,
+    "y": 34866.2,
   },
   Object {
-    "x": 1627974460000,
-    "y": 21836,
+    "x": 1627974360000,
+    "y": 104799,
   },
   Object {
-    "x": 1627974470000,
-    "y": 23962,
+    "x": 1627974420000,
+    "y": 36247,
   },
   Object {
     "x": 1627974480000,
-    "y": 21352.5,
-  },
-  Object {
-    "x": 1627974490000,
-    "y": 21639,
-  },
-  Object {
-    "x": 1627974530000,
-    "y": 13970,
-  },
-  Object {
-    "x": 1627974550000,
-    "y": 58140,
-  },
-  Object {
-    "x": 1627974570000,
-    "y": 9853.75,
+    "y": 22207,
   },
   Object {
-    "x": 1627974580000,
-    "y": 6490,
-  },
-  Object {
-    "x": 1627974590000,
-    "y": 18894,
-  },
-  Object {
-    "x": 1627974610000,
-    "y": 14125,
+    "x": 1627974540000,
+    "y": 80191,
   },
   Object {
-    "x": 1627974640000,
-    "y": 86268.25,
+    "x": 1627974600000,
+    "y": 11520.4545454545,
   },
   Object {
     "x": 1627974660000,
-    "y": 14218,
-  },
-  Object {
-    "x": 1627974670000,
-    "y": 19127,
-  },
-  Object {
-    "x": 1627974680000,
-    "y": 31538,
+    "y": 47031.8888888889,
   },
   Object {
     "x": 1627974720000,
-    "y": 29535,
-  },
-  Object {
-    "x": 1627974740000,
-    "y": 11229,
-  },
-  Object {
-    "x": 1627974750000,
-    "y": 23940,
+    "y": 30249.6666666667,
   },
   Object {
-    "x": 1627974760000,
-    "y": 9262,
-  },
-  Object {
-    "x": 1627974790000,
-    "y": 15650,
+    "x": 1627974780000,
+    "y": 14868.3333333333,
   },
   Object {
     "x": 1627974840000,
-    "y": 17656.3333333333,
-  },
-  Object {
-    "x": 1627974880000,
-    "y": 8371.5,
-  },
-  Object {
-    "x": 1627974890000,
-    "y": 11386.5,
+    "y": 17199,
   },
   Object {
     "x": 1627974900000,
-    "y": 28923.75,
-  },
-  Object {
-    "x": 1627974910000,
-    "y": 22670,
-  },
-  Object {
-    "x": 1627974920000,
-    "y": 13607.6666666667,
-  },
-  Object {
-    "x": 1627974930000,
-    "y": 19640,
-  },
-  Object {
-    "x": 1627974940000,
-    "y": 20511,
+    "y": 19837.2222222222,
   },
   Object {
     "x": 1627974960000,
-    "y": 34862,
-  },
-  Object {
-    "x": 1627974990000,
-    "y": 27929.2,
+    "y": 19397.6666666667,
   },
   Object {
     "x": 1627975020000,
-    "y": 25569,
-  },
-  Object {
-    "x": 1627975030000,
-    "y": 6817.33333333333,
-  },
-  Object {
-    "x": 1627975040000,
-    "y": 10467.6666666667,
-  },
-  Object {
-    "x": 1627975060000,
-    "y": 6754.33333333333,
-  },
-  Object {
-    "x": 1627975070000,
-    "y": 22049,
+    "y": 22473.6666666667,
   },
   Object {
     "x": 1627975080000,
-    "y": 15029,
-  },
-  Object {
-    "x": 1627975090000,
-    "y": 14744,
-  },
-  Object {
-    "x": 1627975110000,
-    "y": 32192.3333333333,
-  },
-  Object {
-    "x": 1627975130000,
-    "y": 8321,
-  },
-  Object {
-    "x": 1627975160000,
-    "y": 11648,
-  },
-  Object {
-    "x": 1627975170000,
-    "y": 13157,
-  },
-  Object {
-    "x": 1627975190000,
-    "y": 12855,
-  },
-  Object {
-    "x": 1627975200000,
-    "y": 1322026.8,
+    "y": 11362.2,
   },
   Object {
-    "x": 1627975210000,
-    "y": 4650.33333333333,
+    "x": 1627975140000,
+    "y": 26319,
   },
 ]
 `;
diff --git a/x-pack/test/apm_api_integration/tests/transactions/error_rate.ts b/x-pack/test/apm_api_integration/tests/transactions/error_rate.ts
index 0507bc8f28b47..aeb7cc61a582a 100644
--- a/x-pack/test/apm_api_integration/tests/transactions/error_rate.ts
+++ b/x-pack/test/apm_api_integration/tests/transactions/error_rate.ts
@@ -112,12 +112,12 @@ export default function ApiTest({ getService }: FtrProviderContext) {
         });
 
         it('has the correct number of buckets', () => {
-          expectSnapshot(errorRateResponse.currentPeriod.timeseries.length).toMatchInline(`61`);
+          expectSnapshot(errorRateResponse.currentPeriod.timeseries.length).toMatchInline(`31`);
         });
 
         it('has the correct calculation for average', () => {
           expectSnapshot(errorRateResponse.currentPeriod.average).toMatchInline(
-            `0.092511013215859`
+            `0.0848214285714286`
           );
         });
 
@@ -168,32 +168,32 @@ export default function ApiTest({ getService }: FtrProviderContext) {
         it('has the correct start date', () => {
           expectSnapshot(
             new Date(first(errorRateResponse.currentPeriod.timeseries)?.x ?? NaN).toISOString()
-          ).toMatchInline(`"2021-08-03T07:05:10.000Z"`);
+          ).toMatchInline(`"2021-08-03T07:05:00.000Z"`);
           expectSnapshot(
             new Date(first(errorRateResponse.previousPeriod.timeseries)?.x ?? NaN).toISOString()
-          ).toMatchInline(`"2021-08-03T07:05:10.000Z"`);
+          ).toMatchInline(`"2021-08-03T07:05:00.000Z"`);
         });
 
         it('has the correct end date', () => {
           expectSnapshot(
             new Date(last(errorRateResponse.currentPeriod.timeseries)?.x ?? NaN).toISOString()
-          ).toMatchInline(`"2021-08-03T07:20:10.000Z"`);
+          ).toMatchInline(`"2021-08-03T07:20:00.000Z"`);
           expectSnapshot(
             new Date(last(errorRateResponse.previousPeriod.timeseries)?.x ?? NaN).toISOString()
-          ).toMatchInline(`"2021-08-03T07:20:10.000Z"`);
+          ).toMatchInline(`"2021-08-03T07:20:00.000Z"`);
         });
 
         it('has the correct number of buckets', () => {
-          expectSnapshot(errorRateResponse.currentPeriod.timeseries.length).toMatchInline(`91`);
-          expectSnapshot(errorRateResponse.previousPeriod.timeseries.length).toMatchInline(`91`);
+          expectSnapshot(errorRateResponse.currentPeriod.timeseries.length).toMatchInline(`16`);
+          expectSnapshot(errorRateResponse.previousPeriod.timeseries.length).toMatchInline(`16`);
         });
 
         it('has the correct calculation for average', () => {
           expectSnapshot(errorRateResponse.currentPeriod.average).toMatchInline(
-            `0.102040816326531`
+            `0.0792079207920792`
           );
           expectSnapshot(errorRateResponse.previousPeriod.average).toMatchInline(
-            `0.0852713178294574`
+            `0.0894308943089431`
           );
         });
 
diff --git a/x-pack/test/apm_api_integration/tests/transactions/latency.ts b/x-pack/test/apm_api_integration/tests/transactions/latency.ts
index d021e59ecff6c..beaff7647868a 100644
--- a/x-pack/test/apm_api_integration/tests/transactions/latency.ts
+++ b/x-pack/test/apm_api_integration/tests/transactions/latency.ts
@@ -113,7 +113,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
           expect(response.status).to.be(200);
           const latencyChartReturn = response.body as LatencyChartReturnType;
           expect(latencyChartReturn.currentPeriod.overallAvgDuration).not.to.be(null);
-          expect(latencyChartReturn.currentPeriod.latencyTimeseries.length).to.be.eql(61);
+          expect(latencyChartReturn.currentPeriod.latencyTimeseries.length).to.be.eql(31);
         });
       });
 
@@ -138,7 +138,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
           expect(response.status).to.be(200);
           const latencyChartReturn = response.body as LatencyChartReturnType;
           expect(latencyChartReturn.currentPeriod.overallAvgDuration).not.to.be(null);
-          expect(latencyChartReturn.currentPeriod.latencyTimeseries.length).to.be.eql(61);
+          expect(latencyChartReturn.currentPeriod.latencyTimeseries.length).to.be.eql(31);
         });
       });
 
@@ -165,10 +165,10 @@ export default function ApiTest({ getService }: FtrProviderContext) {
 
           expect(latencyChartReturn.currentPeriod.overallAvgDuration).not.to.be(null);
           expectSnapshot(latencyChartReturn.currentPeriod.overallAvgDuration).toMatchInline(
-            `53147.5747663551`
+            `53906.6603773585`
           );
 
-          expect(latencyChartReturn.currentPeriod.latencyTimeseries.length).to.be.eql(61);
+          expect(latencyChartReturn.currentPeriod.latencyTimeseries.length).to.be.eql(31);
         });
       });
 
diff --git a/x-pack/test/apm_api_integration/tests/transactions/transactions_groups_main_statistics.ts b/x-pack/test/apm_api_integration/tests/transactions/transactions_groups_main_statistics.ts
index f95d153b1c96e..7664d28271e14 100644
--- a/x-pack/test/apm_api_integration/tests/transactions/transactions_groups_main_statistics.ts
+++ b/x-pack/test/apm_api_integration/tests/transactions/transactions_groups_main_statistics.ts
@@ -98,18 +98,18 @@ export default function ApiTest({ getService }: FtrProviderContext) {
         );
         expectSnapshot(impacts).toMatchInline(`
           Array [
-            98.5616469236242,
-            0.088146942911198,
-            0.208815627929649,
-            0.189536811278812,
-            0.110293217369968,
-            0.191163512620049,
-            0.0899742946381385,
-            0.341831477754056,
-            0.0411384477014597,
-            0.0652338973356331,
-            0.109023796562458,
-            0.00319505027438735,
+            98.4867713293593,
+            0.0910992862692518,
+            0.217172932411727,
+            0.197499651612207,
+            0.117088451625813,
+            0.203168003440319,
+            0.0956764857936742,
+            0.353287132108131,
+            0.043688393280619,
+            0.0754467823979389,
+            0.115710953190738,
+            0.00339059851027124,
           ]
         `);
 
@@ -120,9 +120,9 @@ export default function ApiTest({ getService }: FtrProviderContext) {
         expectSnapshot(pick(firstItem, 'name', 'latency', 'throughput', 'errorRate', 'impact'))
           .toMatchInline(`
           Object {
-            "errorRate": 0.1,
-            "impact": 98.5616469236242,
-            "latency": 1925546.54,
+            "errorRate": 0.08,
+            "impact": 98.4867713293593,
+            "latency": 1816019.48,
             "name": "DispatcherServlet#doGet",
             "throughput": 1.66666666666667,
           }
@@ -150,7 +150,7 @@ export default function ApiTest({ getService }: FtrProviderContext) {
           response.body as TransactionsGroupsPrimaryStatistics;
 
         const firstItem = transctionsGroupsPrimaryStatistics.transactionGroups[0];
-        expectSnapshot(firstItem.latency).toMatchInline(`66836803`);
+        expectSnapshot(firstItem.latency).toMatchInline(`66846719`);
       });
     }
   );
diff --git a/x-pack/test/case_api_integration/security_and_spaces/tests/common/cases/patch_cases.ts b/x-pack/test/case_api_integration/security_and_spaces/tests/common/cases/patch_cases.ts
index d42d0c9328e30..559ada3f891bc 100644
--- a/x-pack/test/case_api_integration/security_and_spaces/tests/common/cases/patch_cases.ts
+++ b/x-pack/test/case_api_integration/security_and_spaces/tests/common/cases/patch_cases.ts
@@ -67,6 +67,7 @@ export default ({ getService }: FtrProviderContext): void => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
   const es = getService('es');
+  const log = getService('log');
 
   describe('patch_cases', () => {
     afterEach(async () => {
@@ -792,12 +793,12 @@ export default ({ getService }: FtrProviderContext): void => {
       describe('detections rule', () => {
         beforeEach(async () => {
           await esArchiver.load('x-pack/test/functional/es_archives/auditbeat/hosts');
-          await createSignalsIndex(supertest);
+          await createSignalsIndex(supertest, log);
         });
 
         afterEach(async () => {
-          await deleteSignalsIndex(supertest);
-          await deleteAllAlerts(supertest);
+          await deleteSignalsIndex(supertest, log);
+          await deleteAllAlerts(supertest, log);
           await esArchiver.unload('x-pack/test/functional/es_archives/auditbeat/hosts');
         });
 
@@ -805,10 +806,10 @@ export default ({ getService }: FtrProviderContext): void => {
           const rule = getRuleForSignalTesting(['auditbeat-*']);
           const postedCase = await createCase(supertest, postCaseReq);
 
-          const { id } = await createRule(supertest, rule);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 1, [id]);
-          const signals = await getSignalsByIds(supertest, [id]);
+          const { id } = await createRule(supertest, log, rule);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 1, [id]);
+          const signals = await getSignalsByIds(supertest, log, [id]);
 
           const alert = signals.hits.hits[0];
           expect(alert._source?.[ALERT_WORKFLOW_STATUS]).eql('open');
@@ -865,10 +866,10 @@ export default ({ getService }: FtrProviderContext): void => {
             settings: { syncAlerts: false },
           });
 
-          const { id } = await createRule(supertest, rule);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 1, [id]);
-          const signals = await getSignalsByIds(supertest, [id]);
+          const { id } = await createRule(supertest, log, rule);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 1, [id]);
+          const signals = await getSignalsByIds(supertest, log, [id]);
 
           const alert = signals.hits.hits[0];
           expect(alert._source?.[ALERT_WORKFLOW_STATUS]).eql('open');
@@ -918,10 +919,10 @@ export default ({ getService }: FtrProviderContext): void => {
             settings: { syncAlerts: false },
           });
 
-          const { id } = await createRule(supertest, rule);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 1, [id]);
-          const signals = await getSignalsByIds(supertest, [id]);
+          const { id } = await createRule(supertest, log, rule);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 1, [id]);
+          const signals = await getSignalsByIds(supertest, log, [id]);
 
           const alert = signals.hits.hits[0];
           expect(alert._source?.[ALERT_WORKFLOW_STATUS]).eql('open');
@@ -987,10 +988,10 @@ export default ({ getService }: FtrProviderContext): void => {
           const rule = getRuleForSignalTesting(['auditbeat-*']);
 
           const postedCase = await createCase(supertest, postCaseReq);
-          const { id } = await createRule(supertest, rule);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 1, [id]);
-          const signals = await getSignalsByIds(supertest, [id]);
+          const { id } = await createRule(supertest, log, rule);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 1, [id]);
+          const signals = await getSignalsByIds(supertest, log, [id]);
 
           const alert = signals.hits.hits[0];
           expect(alert._source?.[ALERT_WORKFLOW_STATUS]).eql('open');
diff --git a/x-pack/test/case_api_integration/security_and_spaces/tests/common/comments/post_comment.ts b/x-pack/test/case_api_integration/security_and_spaces/tests/common/comments/post_comment.ts
index 78a163224f047..6c8acb3bbc3b3 100644
--- a/x-pack/test/case_api_integration/security_and_spaces/tests/common/comments/post_comment.ts
+++ b/x-pack/test/case_api_integration/security_and_spaces/tests/common/comments/post_comment.ts
@@ -69,6 +69,7 @@ export default ({ getService }: FtrProviderContext): void => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
   const es = getService('es');
+  const log = getService('log');
 
   describe('post_comment', () => {
     afterEach(async () => {
@@ -339,12 +340,12 @@ export default ({ getService }: FtrProviderContext): void => {
     describe('alerts', () => {
       beforeEach(async () => {
         await esArchiver.load('x-pack/test/functional/es_archives/auditbeat/hosts');
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
         await esArchiver.unload('x-pack/test/functional/es_archives/auditbeat/hosts');
       });
 
@@ -366,10 +367,10 @@ export default ({ getService }: FtrProviderContext): void => {
           })
           .expect(200);
 
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signals = await getSignalsByIds(supertest, [id]);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signals = await getSignalsByIds(supertest, log, [id]);
 
         const alert = signals.hits.hits[0];
         expect(alert._source?.[ALERT_WORKFLOW_STATUS]).eql('open');
@@ -421,10 +422,10 @@ export default ({ getService }: FtrProviderContext): void => {
           })
           .expect(200);
 
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signals = await getSignalsByIds(supertest, [id]);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signals = await getSignalsByIds(supertest, log, [id]);
 
         const alert = signals.hits.hits[0];
         expect(alert._source?.[ALERT_WORKFLOW_STATUS]).eql('open');
diff --git a/x-pack/test/case_api_integration/security_and_spaces/tests/common/connectors/case.ts b/x-pack/test/case_api_integration/security_and_spaces/tests/common/connectors/case.ts
index 41d8cc12aaaab..7d5c8ec2c4f14 100644
--- a/x-pack/test/case_api_integration/security_and_spaces/tests/common/connectors/case.ts
+++ b/x-pack/test/case_api_integration/security_and_spaces/tests/common/connectors/case.ts
@@ -31,6 +31,7 @@ import {
 export default ({ getService }: FtrProviderContext): void => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
+  const log = getService('log');
 
   describe('case_connector', () => {
     let createdActionId = '';
@@ -708,21 +709,21 @@ export default ({ getService }: FtrProviderContext): void => {
       describe('adding alerts using a connector', () => {
         beforeEach(async () => {
           await esArchiver.load('x-pack/test/functional/es_archives/auditbeat/hosts');
-          await createSignalsIndex(supertest);
+          await createSignalsIndex(supertest, log);
         });
 
         afterEach(async () => {
-          await deleteSignalsIndex(supertest);
-          await deleteAllAlerts(supertest);
+          await deleteSignalsIndex(supertest, log);
+          await deleteAllAlerts(supertest, log);
           await esArchiver.unload('x-pack/test/functional/es_archives/auditbeat/hosts');
         });
 
         it('should add a comment of type alert', async () => {
           const rule = getRuleForSignalTesting(['auditbeat-*']);
-          const { id } = await createRule(supertest, rule);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 1, [id]);
-          const signals = await getSignalsByIds(supertest, [id]);
+          const { id } = await createRule(supertest, log, rule);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 1, [id]);
+          const signals = await getSignalsByIds(supertest, log, [id]);
           const alert = signals.hits.hits[0];
 
           const { body: createdAction } = await supertest
diff --git a/x-pack/test/detection_engine_api_integration/basic/tests/add_prepackaged_rules.ts b/x-pack/test/detection_engine_api_integration/basic/tests/add_prepackaged_rules.ts
index 468991ea14c14..8db3d9797b6df 100644
--- a/x-pack/test/detection_engine_api_integration/basic/tests/add_prepackaged_rules.ts
+++ b/x-pack/test/detection_engine_api_integration/basic/tests/add_prepackaged_rules.ts
@@ -23,32 +23,37 @@ import {
 export default ({ getService }: FtrProviderContext): void => {
   const es = getService('es');
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('add_prepackaged_rules', () => {
     describe('creating prepackaged rules', () => {
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
+        await deleteSignalsIndex(supertest, log);
 
-        await deleteAllAlerts(supertest);
+        await deleteAllAlerts(supertest, log);
         await deleteAllTimelines(es);
       });
 
       it('should create the prepackaged rules and return a count greater than zero, rules_updated to be zero, and contain the correct keys', async () => {
         let responseBody: unknown;
-        await waitFor(async () => {
-          const { body, status } = await supertest
-            .put(DETECTION_ENGINE_PREPACKAGED_URL)
-            .set('kbn-xsrf', 'true')
-            .send();
-          if (status === 200) {
-            responseBody = body;
-          }
-          return status === 200;
-        }, DETECTION_ENGINE_PREPACKAGED_URL);
+        await waitFor(
+          async () => {
+            const { body, status } = await supertest
+              .put(DETECTION_ENGINE_PREPACKAGED_URL)
+              .set('kbn-xsrf', 'true')
+              .send();
+            if (status === 200) {
+              responseBody = body;
+            }
+            return status === 200;
+          },
+          DETECTION_ENGINE_PREPACKAGED_URL,
+          log
+        );
 
         const prepackagedRules = responseBody as PrePackagedRulesAndTimelinesSchema;
         expect(prepackagedRules.rules_installed).to.be.greaterThan(0);
@@ -62,29 +67,37 @@ export default ({ getService }: FtrProviderContext): void => {
       });
 
       it('should be possible to call the API twice and the second time the number of rules installed should be zero as well as timeline', async () => {
-        await installPrePackagedRules(supertest);
+        await installPrePackagedRules(supertest, log);
 
         // NOTE: I call the GET call until eventually it becomes consistent and that the number of rules to install are zero.
         // This is to reduce flakiness where it can for a short period of time try to install the same rule twice.
-        await waitFor(async () => {
-          const { body } = await supertest
-            .get(`${DETECTION_ENGINE_PREPACKAGED_URL}/_status`)
-            .set('kbn-xsrf', 'true')
-            .expect(200);
-          return body.rules_not_installed === 0;
-        }, `${DETECTION_ENGINE_PREPACKAGED_URL}/_status`);
+        await waitFor(
+          async () => {
+            const { body } = await supertest
+              .get(`${DETECTION_ENGINE_PREPACKAGED_URL}/_status`)
+              .set('kbn-xsrf', 'true')
+              .expect(200);
+            return body.rules_not_installed === 0;
+          },
+          `${DETECTION_ENGINE_PREPACKAGED_URL}/_status`,
+          log
+        );
 
         let responseBody: unknown;
-        await waitFor(async () => {
-          const { body, status } = await supertest
-            .put(DETECTION_ENGINE_PREPACKAGED_URL)
-            .set('kbn-xsrf', 'true')
-            .send();
-          if (status === 200) {
-            responseBody = body;
-          }
-          return status === 200;
-        }, DETECTION_ENGINE_PREPACKAGED_URL);
+        await waitFor(
+          async () => {
+            const { body, status } = await supertest
+              .put(DETECTION_ENGINE_PREPACKAGED_URL)
+              .set('kbn-xsrf', 'true')
+              .send();
+            if (status === 200) {
+              responseBody = body;
+            }
+            return status === 200;
+          },
+          DETECTION_ENGINE_PREPACKAGED_URL,
+          log
+        );
 
         const prepackagedRules = responseBody as PrePackagedRulesAndTimelinesSchema;
         expect(prepackagedRules.rules_installed).to.eql(0);
diff --git a/x-pack/test/detection_engine_api_integration/basic/tests/create_rules.ts b/x-pack/test/detection_engine_api_integration/basic/tests/create_rules.ts
index b20e70497291a..fa78fdd5fe04e 100644
--- a/x-pack/test/detection_engine_api_integration/basic/tests/create_rules.ts
+++ b/x-pack/test/detection_engine_api_integration/basic/tests/create_rules.ts
@@ -27,6 +27,7 @@ import {
 export default ({ getService }: FtrProviderContext) => {
   const esArchiver = getService('esArchiver');
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('create_rules', () => {
     describe('creating rules', () => {
@@ -39,12 +40,12 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
       });
 
       it('should create a single rule with a rule_id', async () => {
diff --git a/x-pack/test/detection_engine_api_integration/basic/tests/create_rules_bulk.ts b/x-pack/test/detection_engine_api_integration/basic/tests/create_rules_bulk.ts
index 340358be51413..b54e1432f5463 100644
--- a/x-pack/test/detection_engine_api_integration/basic/tests/create_rules_bulk.ts
+++ b/x-pack/test/detection_engine_api_integration/basic/tests/create_rules_bulk.ts
@@ -25,6 +25,7 @@ import {
 export default ({ getService }: FtrProviderContext): void => {
   const esArchiver = getService('esArchiver');
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('create_rules_bulk', () => {
     describe('creating rules in bulk', () => {
@@ -37,12 +38,12 @@ export default ({ getService }: FtrProviderContext): void => {
       });
 
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
       });
 
       it('should create a single rule with a rule_id', async () => {
diff --git a/x-pack/test/detection_engine_api_integration/basic/tests/delete_rules.ts b/x-pack/test/detection_engine_api_integration/basic/tests/delete_rules.ts
index 3750a8eed394b..e5f828d0f862d 100644
--- a/x-pack/test/detection_engine_api_integration/basic/tests/delete_rules.ts
+++ b/x-pack/test/detection_engine_api_integration/basic/tests/delete_rules.ts
@@ -25,20 +25,21 @@ import {
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext): void => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('delete_rules', () => {
     describe('deleting rules', () => {
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
       });
 
       it('should delete a single rule with a rule_id', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // delete the rule by its rule_id
         const { body } = await supertest
@@ -51,7 +52,7 @@ export default ({ getService }: FtrProviderContext): void => {
       });
 
       it('should delete a single rule using an auto generated rule_id', async () => {
-        const bodyWithCreatedRule = await createRule(supertest, getSimpleRuleWithoutRuleId());
+        const bodyWithCreatedRule = await createRule(supertest, log, getSimpleRuleWithoutRuleId());
 
         // delete that rule by its auto-generated rule_id
         const { body } = await supertest
@@ -64,7 +65,7 @@ export default ({ getService }: FtrProviderContext): void => {
       });
 
       it('should delete a single rule using an auto generated id', async () => {
-        const bodyWithCreatedRule = await createRule(supertest, getSimpleRule());
+        const bodyWithCreatedRule = await createRule(supertest, log, getSimpleRule());
 
         // delete that rule by its auto-generated id
         const { body } = await supertest
diff --git a/x-pack/test/detection_engine_api_integration/basic/tests/delete_rules_bulk.ts b/x-pack/test/detection_engine_api_integration/basic/tests/delete_rules_bulk.ts
index e978f871b55c2..b7517697ad2a9 100644
--- a/x-pack/test/detection_engine_api_integration/basic/tests/delete_rules_bulk.ts
+++ b/x-pack/test/detection_engine_api_integration/basic/tests/delete_rules_bulk.ts
@@ -25,20 +25,21 @@ import {
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext): void => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('delete_rules_bulk', () => {
     describe('deleting rules bulk using DELETE', () => {
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
       });
 
       it('should delete a single rule with a rule_id', async () => {
-        await createRule(supertest, getSimpleRule());
+        await createRule(supertest, log, getSimpleRule());
 
         // delete the rule in bulk
         const { body } = await supertest
@@ -52,7 +53,7 @@ export default ({ getService }: FtrProviderContext): void => {
       });
 
       it('should delete a single rule using an auto generated rule_id', async () => {
-        const bodyWithCreatedRule = await createRule(supertest, getSimpleRuleWithoutRuleId());
+        const bodyWithCreatedRule = await createRule(supertest, log, getSimpleRuleWithoutRuleId());
 
         // delete that rule by its rule_id
         const { body } = await supertest
@@ -66,7 +67,7 @@ export default ({ getService }: FtrProviderContext): void => {
       });
 
       it('should delete a single rule using an auto generated id', async () => {
-        const bodyWithCreatedRule = await createRule(supertest, getSimpleRule());
+        const bodyWithCreatedRule = await createRule(supertest, log, getSimpleRule());
 
         // delete that rule by its id
         const { body } = await supertest
@@ -116,7 +117,7 @@ export default ({ getService }: FtrProviderContext): void => {
       });
 
       it('should delete a single rule using an auto generated rule_id but give an error if the second rule does not exist', async () => {
-        const bodyWithCreatedRule = await createRule(supertest, getSimpleRuleWithoutRuleId());
+        const bodyWithCreatedRule = await createRule(supertest, log, getSimpleRuleWithoutRuleId());
 
         const { body } = await supertest
           .delete(`${DETECTION_ENGINE_RULES_URL}/_bulk_delete`)
@@ -141,16 +142,16 @@ export default ({ getService }: FtrProviderContext): void => {
     // This is a repeat of the tests above but just using POST instead of DELETE
     describe('deleting rules bulk using POST', () => {
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
       });
 
       it('should delete a single rule with a rule_id', async () => {
-        await createRule(supertest, getSimpleRule());
+        await createRule(supertest, log, getSimpleRule());
 
         // delete the rule in bulk
         const { body } = await supertest
@@ -164,7 +165,7 @@ export default ({ getService }: FtrProviderContext): void => {
       });
 
       it('should delete a single rule using an auto generated rule_id', async () => {
-        const bodyWithCreatedRule = await createRule(supertest, getSimpleRuleWithoutRuleId());
+        const bodyWithCreatedRule = await createRule(supertest, log, getSimpleRuleWithoutRuleId());
 
         // delete that rule by its rule_id
         const { body } = await supertest
@@ -178,7 +179,7 @@ export default ({ getService }: FtrProviderContext): void => {
       });
 
       it('should delete a single rule using an auto generated id', async () => {
-        const bodyWithCreatedRule = await createRule(supertest, getSimpleRule());
+        const bodyWithCreatedRule = await createRule(supertest, log, getSimpleRule());
 
         // delete that rule by its id
         const { body } = await supertest
@@ -228,7 +229,7 @@ export default ({ getService }: FtrProviderContext): void => {
       });
 
       it('should delete a single rule using an auto generated rule_id but give an error if the second rule does not exist', async () => {
-        const bodyWithCreatedRule = await createRule(supertest, getSimpleRuleWithoutRuleId());
+        const bodyWithCreatedRule = await createRule(supertest, log, getSimpleRuleWithoutRuleId());
 
         const { body } = await supertest
           .post(`${DETECTION_ENGINE_RULES_URL}/_bulk_delete`)
diff --git a/x-pack/test/detection_engine_api_integration/basic/tests/export_rules.ts b/x-pack/test/detection_engine_api_integration/basic/tests/export_rules.ts
index 03b1beffa7993..913f93d24c16e 100644
--- a/x-pack/test/detection_engine_api_integration/basic/tests/export_rules.ts
+++ b/x-pack/test/detection_engine_api_integration/basic/tests/export_rules.ts
@@ -23,20 +23,21 @@ import {
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext): void => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('export_rules', () => {
     describe('exporting rules', () => {
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
       });
 
       it('should set the response content types to be expected', async () => {
-        await createRule(supertest, getSimpleRule());
+        await createRule(supertest, log, getSimpleRule());
 
         await supertest
           .post(`${DETECTION_ENGINE_RULES_URL}/_export`)
@@ -48,7 +49,7 @@ export default ({ getService }: FtrProviderContext): void => {
       });
 
       it('should export a single rule with a rule_id', async () => {
-        await createRule(supertest, getSimpleRule());
+        await createRule(supertest, log, getSimpleRule());
 
         const { body } = await supertest
           .post(`${DETECTION_ENGINE_RULES_URL}/_export`)
@@ -64,7 +65,7 @@ export default ({ getService }: FtrProviderContext): void => {
       });
 
       it('should export a exported count with a single rule_id', async () => {
-        await createRule(supertest, getSimpleRule());
+        await createRule(supertest, log, getSimpleRule());
 
         const { body } = await supertest
           .post(`${DETECTION_ENGINE_RULES_URL}/_export`)
@@ -78,6 +79,7 @@ export default ({ getService }: FtrProviderContext): void => {
         expect(bodySplitAndParsed).to.eql({
           exported_exception_list_count: 0,
           exported_exception_list_item_count: 0,
+          exported_count: 1,
           exported_rules_count: 1,
           missing_exception_list_item_count: 0,
           missing_exception_list_items: [],
@@ -89,8 +91,8 @@ export default ({ getService }: FtrProviderContext): void => {
       });
 
       it('should export exactly two rules given two rules', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
-        await createRule(supertest, getSimpleRule('rule-2'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-2'));
 
         const { body } = await supertest
           .post(`${DETECTION_ENGINE_RULES_URL}/_export`)
diff --git a/x-pack/test/detection_engine_api_integration/basic/tests/find_rules.ts b/x-pack/test/detection_engine_api_integration/basic/tests/find_rules.ts
index 30e1b3eef714a..5d33e85d2d598 100644
--- a/x-pack/test/detection_engine_api_integration/basic/tests/find_rules.ts
+++ b/x-pack/test/detection_engine_api_integration/basic/tests/find_rules.ts
@@ -24,15 +24,16 @@ import {
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext): void => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('find_rules', () => {
     beforeEach(async () => {
-      await createSignalsIndex(supertest);
+      await createSignalsIndex(supertest, log);
     });
 
     afterEach(async () => {
-      await deleteSignalsIndex(supertest);
-      await deleteAllAlerts(supertest);
+      await deleteSignalsIndex(supertest, log);
+      await deleteAllAlerts(supertest, log);
     });
 
     it('should return an empty find body correctly if no rules are loaded', async () => {
@@ -51,7 +52,7 @@ export default ({ getService }: FtrProviderContext): void => {
     });
 
     it('should return a single rule when a single rule is loaded from a find with defaults added', async () => {
-      await createRule(supertest, getSimpleRule());
+      await createRule(supertest, log, getSimpleRule());
 
       // query the single rule from _find
       const { body } = await supertest
diff --git a/x-pack/test/detection_engine_api_integration/basic/tests/find_statuses.ts b/x-pack/test/detection_engine_api_integration/basic/tests/find_statuses.ts
index 73eb57d5397f5..82a793619483e 100644
--- a/x-pack/test/detection_engine_api_integration/basic/tests/find_statuses.ts
+++ b/x-pack/test/detection_engine_api_integration/basic/tests/find_statuses.ts
@@ -24,6 +24,7 @@ export default ({ getService }: FtrProviderContext): void => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
   const es = getService('es');
+  const log = getService('log');
 
   describe('find_statuses', () => {
     before(async () => {
@@ -35,13 +36,13 @@ export default ({ getService }: FtrProviderContext): void => {
     });
 
     beforeEach(async () => {
-      await createSignalsIndex(supertest);
+      await createSignalsIndex(supertest, log);
     });
 
     afterEach(async () => {
-      await deleteSignalsIndex(supertest);
-      await deleteAllAlerts(supertest);
-      await deleteAllRulesStatuses(es);
+      await deleteSignalsIndex(supertest, log);
+      await deleteAllAlerts(supertest, log);
+      await deleteAllRulesStatuses(es, log);
     });
 
     it('should return an empty find statuses body correctly if no statuses are loaded', async () => {
@@ -55,9 +56,9 @@ export default ({ getService }: FtrProviderContext): void => {
     });
 
     it('should return a single rule status when a single rule is loaded from a find status with defaults added', async () => {
-      const resBody = await createRule(supertest, getSimpleRule('rule-1', true));
+      const resBody = await createRule(supertest, log, getSimpleRule('rule-1', true));
 
-      await waitForRuleSuccessOrStatus(supertest, resBody.id);
+      await waitForRuleSuccessOrStatus(supertest, log, resBody.id);
 
       // query the single rule from _find
       const { body } = await supertest
diff --git a/x-pack/test/detection_engine_api_integration/basic/tests/get_prepackaged_rules_status.ts b/x-pack/test/detection_engine_api_integration/basic/tests/get_prepackaged_rules_status.ts
index 6b226dae9cb11..6764ed27a43e7 100644
--- a/x-pack/test/detection_engine_api_integration/basic/tests/get_prepackaged_rules_status.ts
+++ b/x-pack/test/detection_engine_api_integration/basic/tests/get_prepackaged_rules_status.ts
@@ -24,16 +24,17 @@ import {
 export default ({ getService }: FtrProviderContext): void => {
   const supertest = getService('supertest');
   const es = getService('es');
+  const log = getService('log');
 
   describe('get_prepackaged_rules_status', () => {
     describe('getting prepackaged rules status', () => {
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
         await deleteAllTimelines(es);
       });
 
diff --git a/x-pack/test/detection_engine_api_integration/basic/tests/import_rules.ts b/x-pack/test/detection_engine_api_integration/basic/tests/import_rules.ts
index 095bc1a02c217..88541329fa314 100644
--- a/x-pack/test/detection_engine_api_integration/basic/tests/import_rules.ts
+++ b/x-pack/test/detection_engine_api_integration/basic/tests/import_rules.ts
@@ -23,16 +23,17 @@ import {
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext): void => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('import_rules', () => {
     describe('importing rules with an index', () => {
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
       });
 
       it('should set the response content types to be expected', async () => {
diff --git a/x-pack/test/detection_engine_api_integration/basic/tests/install_prepackaged_timelines.ts b/x-pack/test/detection_engine_api_integration/basic/tests/install_prepackaged_timelines.ts
index 49de588118b9a..20f5d3567ad23 100644
--- a/x-pack/test/detection_engine_api_integration/basic/tests/install_prepackaged_timelines.ts
+++ b/x-pack/test/detection_engine_api_integration/basic/tests/install_prepackaged_timelines.ts
@@ -21,16 +21,17 @@ import {
 export default ({ getService }: FtrProviderContext): void => {
   const supertest = getService('supertest');
   const es = getService('es');
+  const log = getService('log');
 
   describe('install_prepackaged_timelines', () => {
     describe('creating prepackaged rules', () => {
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
         await deleteAllTimelines(es);
       });
 
@@ -67,13 +68,17 @@ export default ({ getService }: FtrProviderContext): void => {
       it('should be possible to call the API twice and the second time the number of timelines installed should be zero', async () => {
         await supertest.put(TIMELINE_PREPACKAGED_URL).set('kbn-xsrf', 'true').send().expect(200);
 
-        await waitFor(async () => {
-          const { body } = await supertest
-            .get(`${TIMELINE_PREPACKAGED_URL}/_status`)
-            .set('kbn-xsrf', 'true')
-            .expect(200);
-          return body.timelines_not_installed === 0;
-        }, `${TIMELINE_PREPACKAGED_URL}/_status`);
+        await waitFor(
+          async () => {
+            const { body } = await supertest
+              .get(`${TIMELINE_PREPACKAGED_URL}/_status`)
+              .set('kbn-xsrf', 'true')
+              .expect(200);
+            return body.timelines_not_installed === 0;
+          },
+          `${TIMELINE_PREPACKAGED_URL}/_status`,
+          log
+        );
 
         const { body } = await supertest
           .put(TIMELINE_PREPACKAGED_URL)
diff --git a/x-pack/test/detection_engine_api_integration/basic/tests/open_close_signals.ts b/x-pack/test/detection_engine_api_integration/basic/tests/open_close_signals.ts
index d200814bfb3d1..fc0072de05f5e 100644
--- a/x-pack/test/detection_engine_api_integration/basic/tests/open_close_signals.ts
+++ b/x-pack/test/detection_engine_api_integration/basic/tests/open_close_signals.ts
@@ -32,6 +32,7 @@ import { RACAlert } from '../../../../plugins/security_solution/server/lib/detec
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
+  const log = getService('log');
 
   describe.skip('open_close_signals', () => {
     describe('tests with auditbeat data', () => {
@@ -44,30 +45,30 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       beforeEach(async () => {
-        await deleteAllAlerts(supertest);
-        await createSignalsIndex(supertest);
+        await deleteAllAlerts(supertest, log);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
       });
 
       it('should be able to execute and get 10 signals', async () => {
         const rule = getRuleForSignalTesting(['auditbeat-*']);
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 10, [id]);
-        const signalsOpen = await getSignalsByIds(supertest, [id]);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 10, [id]);
+        const signalsOpen = await getSignalsByIds(supertest, log, [id]);
         expect(signalsOpen.hits.hits.length).equal(10);
       });
 
       it('should be have set the signals in an open state initially', async () => {
         const rule = getRuleForSignalTesting(['auditbeat-*']);
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 10, [id]);
-        const signalsOpen = await getSignalsByIds(supertest, [id]);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 10, [id]);
+        const signalsOpen = await getSignalsByIds(supertest, log, [id]);
         const everySignalOpen = signalsOpen.hits.hits.every(
           (hit) => hit._source?.[ALERT_WORKFLOW_STATUS] === 'open'
         );
@@ -76,10 +77,10 @@ export default ({ getService }: FtrProviderContext) => {
 
       it('should be able to get a count of 10 closed signals when closing 10', async () => {
         const rule = getRuleForSignalTesting(['auditbeat-*']);
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 10, [id]);
-        const signalsOpen = await getSignalsByIds(supertest, [id]);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 10, [id]);
+        const signalsOpen = await getSignalsByIds(supertest, log, [id]);
         const signalIds = signalsOpen.hits.hits.map((signal) => signal._id);
 
         // set all of the signals to the state of closed. There is no reason to use a waitUntil here
@@ -101,10 +102,10 @@ export default ({ getService }: FtrProviderContext) => {
 
       it('should be able close 10 signals immediately and they all should be closed', async () => {
         const rule = getRuleForSignalTesting(['auditbeat-*']);
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 10, [id]);
-        const signalsOpen = await getSignalsByIds(supertest, [id]);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 10, [id]);
+        const signalsOpen = await getSignalsByIds(supertest, log, [id]);
         const signalIds = signalsOpen.hits.hits.map((signal) => signal._id);
 
         // set all of the signals to the state of closed. There is no reason to use a waitUntil here
diff --git a/x-pack/test/detection_engine_api_integration/basic/tests/patch_rules.ts b/x-pack/test/detection_engine_api_integration/basic/tests/patch_rules.ts
index 45ef1c88506b5..34d0369f72c03 100644
--- a/x-pack/test/detection_engine_api_integration/basic/tests/patch_rules.ts
+++ b/x-pack/test/detection_engine_api_integration/basic/tests/patch_rules.ts
@@ -24,20 +24,21 @@ import {
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('patch_rules', () => {
     describe('patch rules', () => {
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
       });
 
       it('should patch a single rule property of name using a rule_id', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // patch a simple rule's name
         const { body } = await supertest
@@ -54,7 +55,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should return a "403 forbidden" using a rule_id of type "machine learning"', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // patch a simple rule's type to machine learning
         const { body } = await supertest
@@ -73,7 +74,7 @@ export default ({ getService }: FtrProviderContext) => {
         // create a simple rule
         const rule = getSimpleRule('rule-1');
         delete rule.rule_id;
-        const createRuleBody = await createRule(supertest, rule);
+        const createRuleBody = await createRule(supertest, log, rule);
 
         // patch a simple rule's name
         const { body } = await supertest
@@ -90,7 +91,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should patch a single rule property of name using the auto-generated id', async () => {
-        const createdBody = await createRule(supertest, getSimpleRule('rule-1'));
+        const createdBody = await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // patch a simple rule's name
         const { body } = await supertest
@@ -107,7 +108,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should not change the version of a rule when it patches only enabled', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // patch a simple rule's enabled to false
         const { body } = await supertest
@@ -124,7 +125,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should change the version of a rule when it patches enabled and another property', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // patch a simple rule's enabled to false and another property
         const { body } = await supertest
@@ -143,7 +144,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should not change other properties when it does patches', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // patch a simple rule's timeline_title
         await supertest
diff --git a/x-pack/test/detection_engine_api_integration/basic/tests/patch_rules_bulk.ts b/x-pack/test/detection_engine_api_integration/basic/tests/patch_rules_bulk.ts
index 74d3bc8dd68d3..0be23c1d8a289 100644
--- a/x-pack/test/detection_engine_api_integration/basic/tests/patch_rules_bulk.ts
+++ b/x-pack/test/detection_engine_api_integration/basic/tests/patch_rules_bulk.ts
@@ -24,20 +24,21 @@ import {
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('patch_rules_bulk', () => {
     describe('patch rules bulk', () => {
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
       });
 
       it('should patch a single rule property of name using a rule_id', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // patch a simple rule's name
         const { body } = await supertest
@@ -54,8 +55,8 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should patch two rule properties of name using the two rules rule_id', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
-        await createRule(supertest, getSimpleRule('rule-2'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-2'));
 
         // patch both rule names
         const { body } = await supertest
@@ -82,7 +83,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should patch a single rule property of name using an id', async () => {
-        const createRuleBody = await createRule(supertest, getSimpleRule('rule-1'));
+        const createRuleBody = await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // patch a simple rule's name
         const { body } = await supertest
@@ -99,8 +100,8 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should patch two rule properties of name using the two rules id', async () => {
-        const createRule1 = await createRule(supertest, getSimpleRule('rule-1'));
-        const createRule2 = await createRule(supertest, getSimpleRule('rule-2'));
+        const createRule1 = await createRule(supertest, log, getSimpleRule('rule-1'));
+        const createRule2 = await createRule(supertest, log, getSimpleRule('rule-2'));
 
         // patch both rule names
         const { body } = await supertest
@@ -127,7 +128,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should patch a single rule property of name using the auto-generated id', async () => {
-        const createdBody = await createRule(supertest, getSimpleRule('rule-1'));
+        const createdBody = await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // patch a simple rule's name
         const { body } = await supertest
@@ -144,7 +145,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should not change the version of a rule when it patches only enabled', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // patch a simple rule's enabled to false
         const { body } = await supertest
@@ -161,7 +162,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should change the version of a rule when it patches enabled and another property', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // patch a simple rule's enabled to false and another property
         const { body } = await supertest
@@ -180,7 +181,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should not change other properties when it does patches', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // patch a simple rule's timeline_title
         await supertest
@@ -240,7 +241,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should patch one rule property and give an error about a second fake rule_id', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // patch one rule name and give a fake id for the second
         const { body } = await supertest
@@ -270,7 +271,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should patch one rule property and give an error about a second fake id', async () => {
-        const createdBody = await createRule(supertest, getSimpleRule('rule-1'));
+        const createdBody = await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // patch one rule name and give a fake id for the second
         const { body } = await supertest
diff --git a/x-pack/test/detection_engine_api_integration/basic/tests/query_signals.ts b/x-pack/test/detection_engine_api_integration/basic/tests/query_signals.ts
index 635000a6dd5d5..1c0c222c38beb 100644
--- a/x-pack/test/detection_engine_api_integration/basic/tests/query_signals.ts
+++ b/x-pack/test/detection_engine_api_integration/basic/tests/query_signals.ts
@@ -18,6 +18,7 @@ import { getSignalStatus, createSignalsIndex, deleteSignalsIndex } from '../../u
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
+  const log = getService('log');
 
   describe('query_signals_route and find_alerts_route', () => {
     describe('validation checks', () => {
@@ -39,7 +40,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it.skip('should not give errors when querying and the signals index does exist and is empty', async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
         const { body } = await supertest
           .post(DETECTION_ENGINE_QUERY_SIGNALS_URL)
           .set('kbn-xsrf', 'true')
@@ -58,18 +59,18 @@ export default ({ getService }: FtrProviderContext) => {
           },
         });
 
-        await deleteSignalsIndex(supertest);
+        await deleteSignalsIndex(supertest, log);
       });
     });
 
     describe('backwards compatibility', () => {
       before(async () => {
         await esArchiver.load('x-pack/test/functional/es_archives/endpoint/resolver/signals');
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
       after(async () => {
         await esArchiver.unload('x-pack/test/functional/es_archives/endpoint/resolver/signals');
-        await deleteSignalsIndex(supertest);
+        await deleteSignalsIndex(supertest, log);
       });
 
       it('should be able to filter old signals on host.os.name.caseless using runtime field', async () => {
@@ -125,7 +126,7 @@ export default ({ getService }: FtrProviderContext) => {
         });
 
         it.skip('should not give errors when querying and the signals index does exist and is empty', async () => {
-          await createSignalsIndex(supertest);
+          await createSignalsIndex(supertest, log);
           const { body } = await supertest
             .post(ALERTS_AS_DATA_FIND_URL)
             .set('kbn-xsrf', 'true')
@@ -144,11 +145,11 @@ export default ({ getService }: FtrProviderContext) => {
             },
           });
 
-          await deleteSignalsIndex(supertest);
+          await deleteSignalsIndex(supertest, log);
         });
 
         it('should not give errors when executing security solution histogram aggs', async () => {
-          await createSignalsIndex(supertest);
+          await createSignalsIndex(supertest, log);
           await supertest
             .post(ALERTS_AS_DATA_FIND_URL)
             .set('kbn-xsrf', 'true')
@@ -209,7 +210,7 @@ export default ({ getService }: FtrProviderContext) => {
             })
             .expect(200);
 
-          await deleteSignalsIndex(supertest);
+          await deleteSignalsIndex(supertest, log);
         });
       });
     });
diff --git a/x-pack/test/detection_engine_api_integration/basic/tests/read_rules.ts b/x-pack/test/detection_engine_api_integration/basic/tests/read_rules.ts
index 66a8459d0984c..b874f19f30d42 100644
--- a/x-pack/test/detection_engine_api_integration/basic/tests/read_rules.ts
+++ b/x-pack/test/detection_engine_api_integration/basic/tests/read_rules.ts
@@ -25,20 +25,21 @@ import {
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('read_rules', () => {
     describe('reading rules', () => {
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
       });
 
       it('should be able to read a single rule using rule_id', async () => {
-        await createRule(supertest, getSimpleRule());
+        await createRule(supertest, log, getSimpleRule());
 
         const { body } = await supertest
           .get(`${DETECTION_ENGINE_RULES_URL}?rule_id=rule-1`)
@@ -51,7 +52,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should be able to read a single rule using id', async () => {
-        const createRuleBody = await createRule(supertest, getSimpleRule());
+        const createRuleBody = await createRule(supertest, log, getSimpleRule());
 
         const { body } = await supertest
           .get(`${DETECTION_ENGINE_RULES_URL}?id=${createRuleBody.id}`)
@@ -64,7 +65,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should be able to read a single rule with an auto-generated rule_id', async () => {
-        const createRuleBody = await createRule(supertest, getSimpleRuleWithoutRuleId());
+        const createRuleBody = await createRule(supertest, log, getSimpleRuleWithoutRuleId());
 
         const { body } = await supertest
           .get(`${DETECTION_ENGINE_RULES_URL}?rule_id=${createRuleBody.rule_id}`)
diff --git a/x-pack/test/detection_engine_api_integration/basic/tests/update_rac_alerts.ts b/x-pack/test/detection_engine_api_integration/basic/tests/update_rac_alerts.ts
index e89ff48f9de10..18207f9258059 100644
--- a/x-pack/test/detection_engine_api_integration/basic/tests/update_rac_alerts.ts
+++ b/x-pack/test/detection_engine_api_integration/basic/tests/update_rac_alerts.ts
@@ -29,6 +29,7 @@ import { RACAlert } from '../../../../plugins/security_solution/server/lib/detec
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
+  const log = getService('log');
 
   describe('open_close_signals', () => {
     describe('tests with auditbeat data', () => {
@@ -39,29 +40,29 @@ export default ({ getService }: FtrProviderContext) => {
         await esArchiver.unload('x-pack/test/functional/es_archives/auditbeat/hosts');
       });
       beforeEach(async () => {
-        await deleteAllAlerts(supertest);
-        await createSignalsIndex(supertest);
+        await deleteAllAlerts(supertest, log);
+        await createSignalsIndex(supertest, log);
       });
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
       });
 
       it('should be able to execute and get 10 signals', async () => {
         const rule = getRuleForSignalTesting(['auditbeat-*']);
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 10, [id]);
-        const signalsOpen = await getSignalsByIds(supertest, [id]);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 10, [id]);
+        const signalsOpen = await getSignalsByIds(supertest, log, [id]);
         expect(signalsOpen.hits.hits.length).equal(10);
       });
 
       it('should be have set the signals in an open state initially', async () => {
         const rule = getRuleForSignalTesting(['auditbeat-*']);
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 10, [id]);
-        const signalsOpen = await getSignalsByIds(supertest, [id]);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 10, [id]);
+        const signalsOpen = await getSignalsByIds(supertest, log, [id]);
         const everySignalOpen = signalsOpen.hits.hits.every(
           (hit) => hit._source?.[ALERT_WORKFLOW_STATUS] === 'open'
         );
@@ -70,10 +71,10 @@ export default ({ getService }: FtrProviderContext) => {
 
       it('should be able to get a count of 10 closed signals when closing 10', async () => {
         const rule = getRuleForSignalTesting(['auditbeat-*']);
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 10, [id]);
-        const signalsOpen = await getSignalsByIds(supertest, [id]);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 10, [id]);
+        const signalsOpen = await getSignalsByIds(supertest, log, [id]);
         const signalIds = signalsOpen.hits.hits.map((signal) => signal._id);
 
         // set all of the signals to the state of closed. There is no reason to use a waitUntil here
@@ -95,10 +96,10 @@ export default ({ getService }: FtrProviderContext) => {
 
       it('should be able close 10 signals immediately and they all should be closed', async () => {
         const rule = getRuleForSignalTesting(['auditbeat-*']);
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 10, [id]);
-        const signalsOpen = await getSignalsByIds(supertest, [id]);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 10, [id]);
+        const signalsOpen = await getSignalsByIds(supertest, log, [id]);
         const signalIds = signalsOpen.hits.hits.map((signal) => signal._id);
 
         // set all of the signals to the state of closed. There is no reason to use a waitUntil here
@@ -124,10 +125,10 @@ export default ({ getService }: FtrProviderContext) => {
 
       it('should be able mark 10 signals as acknowledged immediately and they all should be acknowledged', async () => {
         const rule = getRuleForSignalTesting(['auditbeat-*']);
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 10, [id]);
-        const signalsOpen = await getSignalsByIds(supertest, [id]);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 10, [id]);
+        const signalsOpen = await getSignalsByIds(supertest, log, [id]);
         const signalIds = signalsOpen.hits.hits.map((signal) => signal._id);
 
         // set all of the signals to the state of acknowledged. There is no reason to use a waitUntil here
diff --git a/x-pack/test/detection_engine_api_integration/basic/tests/update_rules.ts b/x-pack/test/detection_engine_api_integration/basic/tests/update_rules.ts
index 6532c3ad2be07..66baade16bd3c 100644
--- a/x-pack/test/detection_engine_api_integration/basic/tests/update_rules.ts
+++ b/x-pack/test/detection_engine_api_integration/basic/tests/update_rules.ts
@@ -26,20 +26,21 @@ import {
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('update_rules', () => {
     describe('update rules', () => {
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
       });
 
       it('should update a single rule property of name using a rule_id', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // update a simple rule's name
         const updatedRule = getSimpleRuleUpdate('rule-1');
@@ -61,7 +62,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should return a 403 forbidden if it is a machine learning job', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // update a simple rule's type to try to be a machine learning job type
         const updatedRule = getSimpleMlRuleUpdate('rule-1');
@@ -84,7 +85,7 @@ export default ({ getService }: FtrProviderContext) => {
       it('should update a single rule property of name using an auto-generated rule_id', async () => {
         const rule = getSimpleRule('rule-1');
         delete rule.rule_id;
-        const createRuleBody = await createRule(supertest, rule);
+        const createRuleBody = await createRule(supertest, log, rule);
 
         // update a simple rule's name
         const updatedRule = getSimpleRuleUpdate('rule-1');
@@ -106,7 +107,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should update a single rule property of name using the auto-generated id', async () => {
-        const createdBody = await createRule(supertest, getSimpleRule('rule-1'));
+        const createdBody = await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // update a simple rule's name
         const updatedRule = getSimpleRuleUpdate('rule-1');
@@ -128,7 +129,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should change the version of a rule when it updates enabled and another property', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // update a simple rule's enabled to false and another property
         const updatedRule = getSimpleRuleUpdate('rule-1');
@@ -151,7 +152,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should change other properties when it does updates and effectively delete them such as timeline_title', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
 
         const ruleUpdate = getSimpleRuleUpdate('rule-1');
         ruleUpdate.timeline_title = 'some title';
diff --git a/x-pack/test/detection_engine_api_integration/basic/tests/update_rules_bulk.ts b/x-pack/test/detection_engine_api_integration/basic/tests/update_rules_bulk.ts
index 7612aafb5bb60..46e34869a8e03 100644
--- a/x-pack/test/detection_engine_api_integration/basic/tests/update_rules_bulk.ts
+++ b/x-pack/test/detection_engine_api_integration/basic/tests/update_rules_bulk.ts
@@ -25,20 +25,21 @@ import {
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('update_rules_bulk', () => {
     describe('update rules bulk', () => {
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
       });
 
       it('should update a single rule property of name using a rule_id', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
 
         const updatedRule = getSimpleRuleUpdate('rule-1');
         updatedRule.name = 'some other name';
@@ -58,7 +59,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should update two rule properties of name using the two rules rule_id', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // create a second simple rule
         await supertest
@@ -95,7 +96,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should update a single rule property of name using an id', async () => {
-        const createRuleBody = await createRule(supertest, getSimpleRule('rule-1'));
+        const createRuleBody = await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // update a simple rule's name
         const updatedRule1 = getSimpleRuleUpdate('rule-1');
@@ -117,8 +118,8 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should update two rule properties of name using the two rules id', async () => {
-        const createRule1 = await createRule(supertest, getSimpleRule('rule-1'));
-        const createRule2 = await createRule(supertest, getSimpleRule('rule-2'));
+        const createRule1 = await createRule(supertest, log, getSimpleRule('rule-1'));
+        const createRule2 = await createRule(supertest, log, getSimpleRule('rule-2'));
 
         // update both rule names
         const updatedRule1 = getSimpleRuleUpdate('rule-1');
@@ -152,7 +153,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should update a single rule property of name using the auto-generated id', async () => {
-        const createdBody = await createRule(supertest, getSimpleRule('rule-1'));
+        const createdBody = await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // update a simple rule's name
         const updatedRule1 = getSimpleRuleUpdate('rule-1');
@@ -174,7 +175,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should change the version of a rule when it updates enabled and another property', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // update a simple rule's enabled to false and another property
         const updatedRule1 = getSimpleRuleUpdate('rule-1');
@@ -197,7 +198,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should change other properties when it does updates and effectively delete them such as timeline_title', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // update a simple rule's timeline_title
         const ruleUpdate = getSimpleRuleUpdate('rule-1');
@@ -270,7 +271,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should update one rule property and give an error about a second fake rule_id', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
 
         const ruleUpdate = getSimpleRuleUpdate('rule-1');
         ruleUpdate.name = 'some other name';
@@ -305,7 +306,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should update one rule property and give an error about a second fake id', async () => {
-        const createdBody = await createRule(supertest, getSimpleRule('rule-1'));
+        const createdBody = await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // update one rule name and give a fake id for the second
         const rule1 = getSimpleRuleUpdate();
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/add_actions.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/add_actions.ts
index 3278bf902fae4..cf29875839060 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/add_actions.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/add_actions.ts
@@ -26,6 +26,7 @@ import {
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
+  const log = getService('log');
 
   describe('add_actions', () => {
     describe('adding actions', () => {
@@ -38,12 +39,12 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
       });
 
       it('should be able to create a new webhook action and attach it to a rule', async () => {
@@ -54,7 +55,7 @@ export default ({ getService }: FtrProviderContext) => {
           .send(getWebHookAction())
           .expect(200);
 
-        const rule = await createRule(supertest, getRuleWithWebHookAction(hookAction.id));
+        const rule = await createRule(supertest, log, getRuleWithWebHookAction(hookAction.id));
         const bodyToCompare = removeServerGeneratedProperties(rule);
         expect(bodyToCompare).to.eql(
           getSimpleRuleOutputWithWebHookAction(`${bodyToCompare?.actions?.[0].id}`)
@@ -69,8 +70,12 @@ export default ({ getService }: FtrProviderContext) => {
           .send(getWebHookAction())
           .expect(200);
 
-        const rule = await createRule(supertest, getRuleWithWebHookAction(hookAction.id, true));
-        await waitForRuleSuccessOrStatus(supertest, rule.id);
+        const rule = await createRule(
+          supertest,
+          log,
+          getRuleWithWebHookAction(hookAction.id, true)
+        );
+        await waitForRuleSuccessOrStatus(supertest, log, rule.id);
 
         // expected result for status should be 'succeeded'
         const { body } = await supertest
@@ -95,8 +100,8 @@ export default ({ getService }: FtrProviderContext) => {
           meta: {},
         };
 
-        const rule = await createRule(supertest, ruleWithAction);
-        await waitForRuleSuccessOrStatus(supertest, rule.id);
+        const rule = await createRule(supertest, log, ruleWithAction);
+        await waitForRuleSuccessOrStatus(supertest, log, rule.id);
 
         // expected result for status should be 'succeeded'
         const { body } = await supertest
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/add_prepackaged_rules.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/add_prepackaged_rules.ts
index 625cad531a181..b935a38753e1f 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/add_prepackaged_rules.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/add_prepackaged_rules.ts
@@ -23,31 +23,36 @@ import {
 export default ({ getService }: FtrProviderContext): void => {
   const es = getService('es');
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('add_prepackaged_rules', () => {
     describe('creating prepackaged rules', () => {
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
         await deleteAllTimelines(es);
       });
 
       it('should create the prepackaged rules and return a count greater than zero, rules_updated to be zero, and contain the correct keys', async () => {
         let responseBody: unknown;
-        await waitFor(async () => {
-          const { body, status } = await supertest
-            .put(DETECTION_ENGINE_PREPACKAGED_URL)
-            .set('kbn-xsrf', 'true')
-            .send();
-          if (status === 200) {
-            responseBody = body;
-          }
-          return status === 200;
-        }, DETECTION_ENGINE_PREPACKAGED_URL);
+        await waitFor(
+          async () => {
+            const { body, status } = await supertest
+              .put(DETECTION_ENGINE_PREPACKAGED_URL)
+              .set('kbn-xsrf', 'true')
+              .send();
+            if (status === 200) {
+              responseBody = body;
+            }
+            return status === 200;
+          },
+          DETECTION_ENGINE_PREPACKAGED_URL,
+          log
+        );
 
         const prepackagedRules = responseBody as PrePackagedRulesAndTimelinesSchema;
         expect(prepackagedRules.rules_installed).to.be.greaterThan(0);
@@ -61,29 +66,37 @@ export default ({ getService }: FtrProviderContext): void => {
       });
 
       it('should be possible to call the API twice and the second time the number of rules installed should be zero as well as timeline', async () => {
-        await installPrePackagedRules(supertest);
+        await installPrePackagedRules(supertest, log);
 
         // NOTE: I call the GET call until eventually it becomes consistent and that the number of rules to install are zero.
         // This is to reduce flakiness where it can for a short period of time try to install the same rule twice.
-        await waitFor(async () => {
-          const { body } = await supertest
-            .get(`${DETECTION_ENGINE_PREPACKAGED_URL}/_status`)
-            .set('kbn-xsrf', 'true')
-            .expect(200);
-          return body.rules_not_installed === 0;
-        }, `${DETECTION_ENGINE_PREPACKAGED_URL}/_status`);
+        await waitFor(
+          async () => {
+            const { body } = await supertest
+              .get(`${DETECTION_ENGINE_PREPACKAGED_URL}/_status`)
+              .set('kbn-xsrf', 'true')
+              .expect(200);
+            return body.rules_not_installed === 0;
+          },
+          `${DETECTION_ENGINE_PREPACKAGED_URL}/_status`,
+          log
+        );
 
         let responseBody: unknown;
-        await waitFor(async () => {
-          const { body, status } = await supertest
-            .put(DETECTION_ENGINE_PREPACKAGED_URL)
-            .set('kbn-xsrf', 'true')
-            .send();
-          if (status === 200) {
-            responseBody = body;
-          }
-          return status === 200;
-        }, DETECTION_ENGINE_PREPACKAGED_URL);
+        await waitFor(
+          async () => {
+            const { body, status } = await supertest
+              .put(DETECTION_ENGINE_PREPACKAGED_URL)
+              .set('kbn-xsrf', 'true')
+              .send();
+            if (status === 200) {
+              responseBody = body;
+            }
+            return status === 200;
+          },
+          DETECTION_ENGINE_PREPACKAGED_URL,
+          log
+        );
 
         const prepackagedRules = responseBody as PrePackagedRulesAndTimelinesSchema;
         expect(prepackagedRules.rules_installed).to.eql(0);
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/alerts/alerts_compatibility.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/alerts/alerts_compatibility.ts
index 09913388a0617..a9942fc86566b 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/alerts/alerts_compatibility.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/alerts/alerts_compatibility.ts
@@ -26,6 +26,7 @@ import { ThreatEcs } from '../../../../../plugins/security_solution/common/ecs/t
 export default ({ getService }: FtrProviderContext) => {
   const esArchiver = getService('esArchiver');
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('Alerts Compatibility', function () {
     describe('CTI', () => {
@@ -43,14 +44,14 @@ export default ({ getService }: FtrProviderContext) => {
         await esArchiver.load(
           'x-pack/test/functional/es_archives/security_solution/legacy_cti_signals'
         );
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
         await esArchiver.unload(
           'x-pack/test/functional/es_archives/security_solution/legacy_cti_signals'
         );
-        await deleteSignalsIndex(supertest);
+        await deleteSignalsIndex(supertest, log);
       });
 
       it('allows querying of legacy enriched signals by threat.indicator', async () => {
@@ -103,14 +104,23 @@ export default ({ getService }: FtrProviderContext) => {
         expect(indices.length).to.eql(1);
         expect(indices[0].is_outdated).to.eql(true);
 
-        const [migration] = await startSignalsMigration({ indices: [indices[0].index], supertest });
-        await waitFor(async () => {
-          const [{ completed }] = await finalizeSignalsMigration({
-            migrationIds: [migration.migration_id],
-            supertest,
-          });
-          return completed === true;
-        }, `polling finalize_migration until complete`);
+        const [migration] = await startSignalsMigration({
+          indices: [indices[0].index],
+          supertest,
+          log,
+        });
+        await waitFor(
+          async () => {
+            const [{ completed }] = await finalizeSignalsMigration({
+              migrationIds: [migration.migration_id],
+              supertest,
+              log,
+            });
+            return completed === true;
+          },
+          `polling finalize_migration until complete`,
+          log
+        );
 
         const {
           body: {
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/aliases.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/aliases.ts
index 3c033d2077c54..c2616d1155c40 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/aliases.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/aliases.ts
@@ -23,6 +23,8 @@ import {
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
+  const log = getService('log');
+
   interface HostAlias {
     name: string;
   }
@@ -37,20 +39,20 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     beforeEach(async () => {
-      await createSignalsIndex(supertest);
+      await createSignalsIndex(supertest, log);
     });
 
     afterEach(async () => {
-      await deleteSignalsIndex(supertest);
-      await deleteAllAlerts(supertest);
+      await deleteSignalsIndex(supertest, log);
+      await deleteAllAlerts(supertest, log);
     });
 
     it('should keep the original alias value such as "host_alias" from a source index when the value is indexed', async () => {
       const rule = getRuleForSignalTesting(['host_alias']);
-      const { id } = await createRule(supertest, rule);
-      await waitForRuleSuccessOrStatus(supertest, id);
-      await waitForSignalsToBePresent(supertest, 4, [id]);
-      const signalsOpen = await getSignalsById(supertest, id);
+      const { id } = await createRule(supertest, log, rule);
+      await waitForRuleSuccessOrStatus(supertest, log, id);
+      await waitForSignalsToBePresent(supertest, log, 4, [id]);
+      const signalsOpen = await getSignalsById(supertest, log, id);
       const hits = signalsOpen.hits.hits
         .map((signal) => (signal._source?.host_alias as HostAlias).name)
         .sort();
@@ -59,10 +61,10 @@ export default ({ getService }: FtrProviderContext) => {
 
     it('should copy alias data from a source index into the signals index in the same position when the target is ECS compatible', async () => {
       const rule = getRuleForSignalTesting(['host_alias']);
-      const { id } = await createRule(supertest, rule);
-      await waitForRuleSuccessOrStatus(supertest, id);
-      await waitForSignalsToBePresent(supertest, 4, [id]);
-      const signalsOpen = await getSignalsById(supertest, id);
+      const { id } = await createRule(supertest, log, rule);
+      await waitForRuleSuccessOrStatus(supertest, log, id);
+      await waitForSignalsToBePresent(supertest, log, 4, [id]);
+      const signalsOpen = await getSignalsById(supertest, log, id);
       const hits = signalsOpen.hits.hits
         .map((signal) => (signal._source?.host as HostAlias).name)
         .sort();
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/check_privileges.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/check_privileges.ts
index 58b5f98ff0c0d..4e7cccd85d828 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/check_privileges.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/check_privileges.ts
@@ -26,26 +26,27 @@ export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
   const supertestWithoutAuth = getService('supertestWithoutAuth');
+  const log = getService('log');
 
   describe('check_privileges', () => {
     before(async () => {
       await esArchiver.load('x-pack/test/functional/es_archives/auditbeat/hosts');
       await esArchiver.load('x-pack/test/functional/es_archives/security_solution/alias');
-      await createSignalsIndex(supertest);
+      await createSignalsIndex(supertest, log);
     });
 
     after(async () => {
       await esArchiver.unload('x-pack/test/functional/es_archives/auditbeat/hosts');
       await esArchiver.unload('x-pack/test/functional/es_archives/security_solution/alias');
-      await deleteSignalsIndex(supertest);
+      await deleteSignalsIndex(supertest, log);
     });
 
     beforeEach(async () => {
-      await deleteAllAlerts(supertest);
+      await deleteAllAlerts(supertest, log);
     });
 
     afterEach(async () => {
-      await deleteAllAlerts(supertest);
+      await deleteAllAlerts(supertest, log);
     });
 
     describe('should set status to partial failure when user has no access', () => {
@@ -63,7 +64,7 @@ export default ({ getService }: FtrProviderContext) => {
             user: ROLES.detections_admin,
             pass: 'changeme',
           });
-          await waitForRuleSuccessOrStatus(supertest, id, 'partial failure');
+          await waitForRuleSuccessOrStatus(supertest, log, id, 'partial failure');
           const { body } = await supertest
             .post(`${DETECTION_ENGINE_RULES_URL}/_find_statuses`)
             .set('kbn-xsrf', 'true')
@@ -89,7 +90,7 @@ export default ({ getService }: FtrProviderContext) => {
             user: ROLES.detections_admin,
             pass: 'changeme',
           });
-          await waitForRuleSuccessOrStatus(supertest, id, 'partial failure');
+          await waitForRuleSuccessOrStatus(supertest, log, id, 'partial failure');
           const { body } = await supertest
             .post(`${DETECTION_ENGINE_RULES_URL}/_find_statuses`)
             .set('kbn-xsrf', 'true')
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_endpoint_exceptions.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_endpoint_exceptions.ts
index 6c6fcc366782a..76848db5d55e8 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_endpoint_exceptions.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_endpoint_exceptions.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { ToolingLog } from '@kbn/dev-utils';
 import expect from '@kbn/expect';
 
 import type SuperTest from 'supertest';
@@ -42,9 +43,10 @@ interface Host {
  */
 export const getHostHits = async (
   supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog,
   id: string
 ): Promise<Host[]> => {
-  const signalsOpen = await getSignalsById(supertest, id);
+  const signalsOpen = await getSignalsById(supertest, log, id);
   return signalsOpen.hits.hits
     .map<Host>((hit) => hit._source?.host as Host)
     .sort((a, b) => {
@@ -69,6 +71,7 @@ export const getHostHits = async (
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
+  const log = getService('log');
 
   describe('Rule exception operators for endpoints', () => {
     before(async () => {
@@ -86,24 +89,24 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     beforeEach(async () => {
-      await createSignalsIndex(supertest);
-      await createListsIndex(supertest);
+      await createSignalsIndex(supertest, log);
+      await createListsIndex(supertest, log);
     });
 
     afterEach(async () => {
-      await deleteSignalsIndex(supertest);
-      await deleteAllAlerts(supertest);
-      await deleteAllExceptions(supertest);
-      await deleteListsIndex(supertest);
+      await deleteSignalsIndex(supertest, log);
+      await deleteAllAlerts(supertest, log);
+      await deleteAllExceptions(supertest, log);
+      await deleteListsIndex(supertest, log);
     });
 
     describe('no exceptions set', () => {
       it('should find all the "hosts" from a "agent" index when no exceptions are set on the rule', async () => {
         const rule = getRuleForSignalTesting(['agent']);
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const hits = await getHostHits(supertest, id);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const hits = await getHostHits(supertest, log, id);
         expect(hits).to.eql([
           {
             os: { type: 'linux' },
@@ -122,10 +125,10 @@ export default ({ getService }: FtrProviderContext) => {
 
       it('should find all the "hosts" from a "endpoint_without_host_type" index when no exceptions are set on the rule', async () => {
         const rule = getRuleForSignalTesting(['endpoint_without_host_type']);
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const hits = await getHostHits(supertest, id);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const hits = await getHostHits(supertest, log, id);
         expect(hits).to.eql([
           {
             os: { name: 'Linux' },
@@ -149,6 +152,7 @@ export default ({ getService }: FtrProviderContext) => {
           const rule = getRuleForSignalTesting(['endpoint_without_host_type']);
           const { id } = await createRuleWithExceptionEntries(
             supertest,
+            log,
             rule,
             [],
             [
@@ -165,9 +169,9 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ]
           );
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 3, [id]);
-          const hits = await getHostHits(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 3, [id]);
+          const hits = await getHostHits(supertest, log, id);
           expect(hits).to.eql([
             {
               os: { name: 'Linux' },
@@ -185,6 +189,7 @@ export default ({ getService }: FtrProviderContext) => {
           const rule = getRuleForSignalTesting(['endpoint_without_host_type']);
           const { id } = await createRuleWithExceptionEntries(
             supertest,
+            log,
             rule,
             [],
             [
@@ -201,9 +206,9 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ]
           );
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 3, [id]);
-          const hits = await getHostHits(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 3, [id]);
+          const hits = await getHostHits(supertest, log, id);
           expect(hits).to.eql([
             {
               os: { name: 'Linux' },
@@ -221,6 +226,7 @@ export default ({ getService }: FtrProviderContext) => {
           const rule = getRuleForSignalTesting(['endpoint_without_host_type']);
           const { id } = await createRuleWithExceptionEntries(
             supertest,
+            log,
             rule,
             [],
             [
@@ -248,9 +254,9 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ]
           );
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 2, [id]);
-          const hits = await getHostHits(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 2, [id]);
+          const hits = await getHostHits(supertest, log, id);
           expect(hits).to.eql([
             {
               os: { name: 'Linux' },
@@ -265,6 +271,7 @@ export default ({ getService }: FtrProviderContext) => {
           const rule = getRuleForSignalTesting(['endpoint_without_host_type']);
           const { id } = await createRuleWithExceptionEntries(
             supertest,
+            log,
             rule,
             [],
             [
@@ -292,9 +299,9 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ]
           );
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 2, [id]);
-          const hits = await getHostHits(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 2, [id]);
+          const hits = await getHostHits(supertest, log, id);
           expect(hits).to.eql([
             {
               os: { name: 'Linux' },
@@ -311,6 +318,7 @@ export default ({ getService }: FtrProviderContext) => {
           const rule = getRuleForSignalTesting(['agent']);
           const { id } = await createRuleWithExceptionEntries(
             supertest,
+            log,
             rule,
             [],
             [
@@ -327,9 +335,9 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ]
           );
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 3, [id]);
-          const hits = await getHostHits(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 3, [id]);
+          const hits = await getHostHits(supertest, log, id);
           expect(hits).to.eql([
             {
               os: { type: 'linux' },
@@ -347,6 +355,7 @@ export default ({ getService }: FtrProviderContext) => {
           const rule = getRuleForSignalTesting(['agent']);
           const { id } = await createRuleWithExceptionEntries(
             supertest,
+            log,
             rule,
             [],
             [
@@ -363,9 +372,9 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ]
           );
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 3, [id]);
-          const hits = await getHostHits(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 3, [id]);
+          const hits = await getHostHits(supertest, log, id);
           expect(hits).to.eql([
             {
               os: { type: 'linux' },
@@ -383,6 +392,7 @@ export default ({ getService }: FtrProviderContext) => {
           const rule = getRuleForSignalTesting(['agent']);
           const { id } = await createRuleWithExceptionEntries(
             supertest,
+            log,
             rule,
             [],
             [
@@ -410,9 +420,9 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ]
           );
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 2, [id]);
-          const hits = await getHostHits(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 2, [id]);
+          const hits = await getHostHits(supertest, log, id);
           expect(hits).to.eql([
             {
               os: { type: 'linux' },
@@ -427,6 +437,7 @@ export default ({ getService }: FtrProviderContext) => {
           const rule = getRuleForSignalTesting(['agent']);
           const { id } = await createRuleWithExceptionEntries(
             supertest,
+            log,
             rule,
             [],
             [
@@ -454,9 +465,9 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ]
           );
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 2, [id]);
-          const hits = await getHostHits(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 2, [id]);
+          const hits = await getHostHits(supertest, log, id);
           expect(hits).to.eql([
             {
               os: { type: 'linux' },
@@ -473,6 +484,7 @@ export default ({ getService }: FtrProviderContext) => {
           const rule = getRuleForSignalTesting(['agent', 'endpoint_without_host_type']);
           const { id } = await createRuleWithExceptionEntries(
             supertest,
+            log,
             rule,
             [],
             [
@@ -489,9 +501,9 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ]
           );
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 6, [id]);
-          const hits = await getHostHits(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 6, [id]);
+          const hits = await getHostHits(supertest, log, id);
           expect(hits).to.eql([
             {
               os: { type: 'linux' },
@@ -518,6 +530,7 @@ export default ({ getService }: FtrProviderContext) => {
           const rule = getRuleForSignalTesting(['agent', 'endpoint_without_host_type']);
           const { id } = await createRuleWithExceptionEntries(
             supertest,
+            log,
             rule,
             [],
             [
@@ -534,9 +547,9 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ]
           );
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 6, [id]);
-          const hits = await getHostHits(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 6, [id]);
+          const hits = await getHostHits(supertest, log, id);
           expect(hits).to.eql([
             {
               os: { type: 'linux' },
@@ -563,6 +576,7 @@ export default ({ getService }: FtrProviderContext) => {
           const rule = getRuleForSignalTesting(['agent', 'endpoint_without_host_type']);
           const { id } = await createRuleWithExceptionEntries(
             supertest,
+            log,
             rule,
             [],
             [
@@ -590,9 +604,9 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ]
           );
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 4, [id]);
-          const hits = await getHostHits(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 4, [id]);
+          const hits = await getHostHits(supertest, log, id);
           expect(hits).to.eql([
             {
               os: { type: 'linux' },
@@ -613,6 +627,7 @@ export default ({ getService }: FtrProviderContext) => {
           const rule = getRuleForSignalTesting(['agent', 'endpoint_without_host_type']);
           const { id } = await createRuleWithExceptionEntries(
             supertest,
+            log,
             rule,
             [],
             [
@@ -640,9 +655,9 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ]
           );
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 4, [id]);
-          const hits = await getHostHits(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 4, [id]);
+          const hits = await getHostHits(supertest, log, id);
           expect(hits).to.eql([
             {
               os: { type: 'linux' },
@@ -666,6 +681,7 @@ export default ({ getService }: FtrProviderContext) => {
         const rule = getRuleForSignalTesting(['agent']);
         const { id } = await createRuleWithExceptionEntries(
           supertest,
+          log,
           rule,
           [
             [
@@ -691,9 +707,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ]
         );
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const hits = await getHostHits(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const hits = await getHostHits(supertest, log, id);
         expect(hits).to.eql([
           {
             os: { type: 'macos' },
@@ -705,6 +721,7 @@ export default ({ getService }: FtrProviderContext) => {
         const rule = getRuleForSignalTesting(['agent']);
         const { id } = await createRuleWithExceptionEntries(
           supertest,
+          log,
           rule,
           [
             [
@@ -730,9 +747,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ]
         );
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const hits = await getHostHits(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const hits = await getHostHits(supertest, log, id);
         expect(hits).to.eql([
           {
             os: { type: 'macos' },
@@ -746,6 +763,7 @@ export default ({ getService }: FtrProviderContext) => {
         const rule = getRuleForSignalTesting(['agent']);
         const { id } = await createRuleWithExceptionEntries(
           supertest,
+          log,
           rule,
           [],
           [
@@ -762,9 +780,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ]
         );
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const hits = await getHostHits(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const hits = await getHostHits(supertest, log, id);
         expect(hits).to.eql([
           {
             os: { type: 'linux' },
@@ -782,6 +800,7 @@ export default ({ getService }: FtrProviderContext) => {
         const rule = getRuleForSignalTesting(['agent']);
         const { id } = await createRuleWithExceptionEntries(
           supertest,
+          log,
           rule,
           [],
           [
@@ -798,9 +817,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ]
         );
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const hits = await getHostHits(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const hits = await getHostHits(supertest, log, id);
         expect(hits).to.eql([
           {
             os: { type: 'linux' },
@@ -815,6 +834,7 @@ export default ({ getService }: FtrProviderContext) => {
         const rule = getRuleForSignalTesting(['agent']);
         const { id } = await createRuleWithExceptionEntries(
           supertest,
+          log,
           rule,
           [],
           [
@@ -831,9 +851,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ]
         );
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const hits = await getHostHits(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const hits = await getHostHits(supertest, log, id);
         expect(hits).to.eql([
           {
             os: { type: 'linux' },
@@ -848,6 +868,7 @@ export default ({ getService }: FtrProviderContext) => {
         const rule = getRuleForSignalTesting(['agent']);
         const { id } = await createRuleWithExceptionEntries(
           supertest,
+          log,
           rule,
           [],
           [
@@ -864,9 +885,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ]
         );
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const hits = await getHostHits(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const hits = await getHostHits(supertest, log, id);
         expect(hits).to.eql([
           {
             os: { type: 'linux' },
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_exceptions.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_exceptions.ts
index 1882f488e5a17..0dfc753be402c 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_exceptions.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_exceptions.ts
@@ -60,6 +60,7 @@ export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const supertestWithoutAuth = getService('supertestWithoutAuth');
   const esArchiver = getService('esArchiver');
+  const log = getService('log');
   const es = getService('es');
 
   describe('create_rules_with_exceptions', () => {
@@ -73,13 +74,13 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('creating rules with exceptions', () => {
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
-        await deleteAllExceptions(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
+        await deleteAllExceptions(supertest, log);
       });
 
       describe('elastic admin', () => {
@@ -104,7 +105,7 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           };
 
-          const rule = await createRule(supertest, ruleWithException);
+          const rule = await createRule(supertest, log, ruleWithException);
           const expected: Partial<RulesSchema> = {
             ...getSimpleRuleOutput(),
             exceptions_list: [
@@ -142,8 +143,8 @@ export default ({ getService }: FtrProviderContext) => {
             ],
           };
 
-          const rule = await createRule(supertest, ruleWithException);
-          await waitForRuleSuccessOrStatus(supertest, rule.id);
+          const rule = await createRule(supertest, log, ruleWithException);
+          await waitForRuleSuccessOrStatus(supertest, log, rule.id);
           const bodyToCompare = removeServerGeneratedProperties(rule);
 
           const expected: Partial<RulesSchema> = {
@@ -162,12 +163,16 @@ export default ({ getService }: FtrProviderContext) => {
         });
 
         it('should allow removing an exception list from an immutable rule through patch', async () => {
-          await installPrePackagedRules(supertest);
+          await installPrePackagedRules(supertest, log);
 
           // Rule id of "9a1a2dae-0b5f-4c3d-8305-a268d404c306" is from the file:
           // x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint.json
           // This rule has an existing exceptions_list that we are going to use
-          const immutableRule = await getRule(supertest, '9a1a2dae-0b5f-4c3d-8305-a268d404c306');
+          const immutableRule = await getRule(
+            supertest,
+            log,
+            '9a1a2dae-0b5f-4c3d-8305-a268d404c306'
+          );
           expect(immutableRule.exceptions_list.length).greaterThan(0); // make sure we have at least one exceptions_list
 
           // remove the exceptions list as a user is allowed to remove it from an immutable rule
@@ -179,23 +184,29 @@ export default ({ getService }: FtrProviderContext) => {
 
           const immutableRuleSecondTime = await getRule(
             supertest,
+            log,
             '9a1a2dae-0b5f-4c3d-8305-a268d404c306'
           );
           expect(immutableRuleSecondTime.exceptions_list.length).to.eql(0);
         });
 
         it('should allow adding a second exception list to an immutable rule through patch', async () => {
-          await installPrePackagedRules(supertest);
+          await installPrePackagedRules(supertest, log);
 
           const { id, list_id, namespace_type, type } = await createExceptionList(
             supertest,
+            log,
             getCreateExceptionListMinimalSchemaMock()
           );
 
           // Rule id of "9a1a2dae-0b5f-4c3d-8305-a268d404c306" is from the file:
           // x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint.json
           // This rule has an existing exceptions_list that we are going to use
-          const immutableRule = await getRule(supertest, '9a1a2dae-0b5f-4c3d-8305-a268d404c306');
+          const immutableRule = await getRule(
+            supertest,
+            log,
+            '9a1a2dae-0b5f-4c3d-8305-a268d404c306'
+          );
           expect(immutableRule.exceptions_list.length).greaterThan(0); // make sure we have at least one
 
           // add a second exceptions list as a user is allowed to add a second list to an immutable rule
@@ -218,6 +229,7 @@ export default ({ getService }: FtrProviderContext) => {
 
           const immutableRuleSecondTime = await getRule(
             supertest,
+            log,
             '9a1a2dae-0b5f-4c3d-8305-a268d404c306'
           );
 
@@ -225,12 +237,16 @@ export default ({ getService }: FtrProviderContext) => {
         });
 
         it('should override any updates to pre-packaged rules if the user removes the exception list through the API but the new version of a rule has an exception list again', async () => {
-          await installPrePackagedRules(supertest);
+          await installPrePackagedRules(supertest, log);
 
           // Rule id of "9a1a2dae-0b5f-4c3d-8305-a268d404c306" is from the file:
           // x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint.json
           // This rule has an existing exceptions_list that we are going to use
-          const immutableRule = await getRule(supertest, '9a1a2dae-0b5f-4c3d-8305-a268d404c306');
+          const immutableRule = await getRule(
+            supertest,
+            log,
+            '9a1a2dae-0b5f-4c3d-8305-a268d404c306'
+          );
           expect(immutableRule.exceptions_list.length).greaterThan(0); // make sure we have at least one
 
           await supertest
@@ -239,10 +255,11 @@ export default ({ getService }: FtrProviderContext) => {
             .send({ rule_id: '9a1a2dae-0b5f-4c3d-8305-a268d404c306', exceptions_list: [] })
             .expect(200);
 
-          await downgradeImmutableRule(es, '9a1a2dae-0b5f-4c3d-8305-a268d404c306');
-          await installPrePackagedRules(supertest);
+          await downgradeImmutableRule(es, log, '9a1a2dae-0b5f-4c3d-8305-a268d404c306');
+          await installPrePackagedRules(supertest, log);
           const immutableRuleSecondTime = await getRule(
             supertest,
+            log,
             '9a1a2dae-0b5f-4c3d-8305-a268d404c306'
           );
 
@@ -252,17 +269,22 @@ export default ({ getService }: FtrProviderContext) => {
         });
 
         it('should merge back an exceptions_list if it was removed from the immutable rule through PATCH', async () => {
-          await installPrePackagedRules(supertest);
+          await installPrePackagedRules(supertest, log);
 
           const { id, list_id, namespace_type, type } = await createExceptionList(
             supertest,
+            log,
             getCreateExceptionListMinimalSchemaMock()
           );
 
           // Rule id of "9a1a2dae-0b5f-4c3d-8305-a268d404c306" is from the file:
           // x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint.json
           // This rule has an existing exceptions_list that we are going to ensure does not stomp on our existing rule
-          const immutableRule = await getRule(supertest, '9a1a2dae-0b5f-4c3d-8305-a268d404c306');
+          const immutableRule = await getRule(
+            supertest,
+            log,
+            '9a1a2dae-0b5f-4c3d-8305-a268d404c306'
+          );
           expect(immutableRule.exceptions_list.length).greaterThan(0); // make sure we have at least one
 
           // remove the exception list and only have a single list that is not an endpoint_list
@@ -282,10 +304,11 @@ export default ({ getService }: FtrProviderContext) => {
             })
             .expect(200);
 
-          await downgradeImmutableRule(es, '9a1a2dae-0b5f-4c3d-8305-a268d404c306');
-          await installPrePackagedRules(supertest);
+          await downgradeImmutableRule(es, log, '9a1a2dae-0b5f-4c3d-8305-a268d404c306');
+          await installPrePackagedRules(supertest, log);
           const immutableRuleSecondTime = await getRule(
             supertest,
+            log,
             '9a1a2dae-0b5f-4c3d-8305-a268d404c306'
           );
 
@@ -301,19 +324,24 @@ export default ({ getService }: FtrProviderContext) => {
         });
 
         it('should NOT add an extra exceptions_list that already exists on a rule during an upgrade', async () => {
-          await installPrePackagedRules(supertest);
+          await installPrePackagedRules(supertest, log);
 
           // Rule id of "9a1a2dae-0b5f-4c3d-8305-a268d404c306" is from the file:
           // x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint.json
           // This rule has an existing exceptions_list that we are going to ensure does not stomp on our existing rule
-          const immutableRule = await getRule(supertest, '9a1a2dae-0b5f-4c3d-8305-a268d404c306');
+          const immutableRule = await getRule(
+            supertest,
+            log,
+            '9a1a2dae-0b5f-4c3d-8305-a268d404c306'
+          );
           expect(immutableRule.exceptions_list.length).greaterThan(0); // make sure we have at least one
 
-          await downgradeImmutableRule(es, '9a1a2dae-0b5f-4c3d-8305-a268d404c306');
-          await installPrePackagedRules(supertest);
+          await downgradeImmutableRule(es, log, '9a1a2dae-0b5f-4c3d-8305-a268d404c306');
+          await installPrePackagedRules(supertest, log);
 
           const immutableRuleSecondTime = await getRule(
             supertest,
+            log,
             '9a1a2dae-0b5f-4c3d-8305-a268d404c306'
           );
 
@@ -325,17 +353,22 @@ export default ({ getService }: FtrProviderContext) => {
         });
 
         it('should NOT allow updates to pre-packaged rules to overwrite existing exception based rules when the user adds an additional exception list', async () => {
-          await installPrePackagedRules(supertest);
+          await installPrePackagedRules(supertest, log);
 
           const { id, list_id, namespace_type, type } = await createExceptionList(
             supertest,
+            log,
             getCreateExceptionListMinimalSchemaMock()
           );
 
           // Rule id of "9a1a2dae-0b5f-4c3d-8305-a268d404c306" is from the file:
           // x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint.json
           // This rule has an existing exceptions_list that we are going to ensure does not stomp on our existing rule
-          const immutableRule = await getRule(supertest, '9a1a2dae-0b5f-4c3d-8305-a268d404c306');
+          const immutableRule = await getRule(
+            supertest,
+            log,
+            '9a1a2dae-0b5f-4c3d-8305-a268d404c306'
+          );
 
           // add a second exceptions list as a user is allowed to add a second list to an immutable rule
           await supertest
@@ -355,10 +388,11 @@ export default ({ getService }: FtrProviderContext) => {
             })
             .expect(200);
 
-          await downgradeImmutableRule(es, '9a1a2dae-0b5f-4c3d-8305-a268d404c306');
-          await installPrePackagedRules(supertest);
+          await downgradeImmutableRule(es, log, '9a1a2dae-0b5f-4c3d-8305-a268d404c306');
+          await installPrePackagedRules(supertest, log);
           const immutableRuleSecondTime = await getRule(
             supertest,
+            log,
             '9a1a2dae-0b5f-4c3d-8305-a268d404c306'
           );
 
@@ -375,18 +409,23 @@ export default ({ getService }: FtrProviderContext) => {
         });
 
         it('should not remove any exceptions added to a pre-packaged/immutable rule during an update if that rule has no existing exception lists', async () => {
-          await installPrePackagedRules(supertest);
+          await installPrePackagedRules(supertest, log);
 
           // Create a new exception list
           const { id, list_id, namespace_type, type } = await createExceptionList(
             supertest,
+            log,
             getCreateExceptionListMinimalSchemaMock()
           );
 
           // Rule id of "eb079c62-4481-4d6e-9643-3ca499df7aaa" is from the file:
           // x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/external_alerts.json
           // since this rule does not have existing exceptions_list that we are going to use for tests
-          const immutableRule = await getRule(supertest, 'eb079c62-4481-4d6e-9643-3ca499df7aaa');
+          const immutableRule = await getRule(
+            supertest,
+            log,
+            'eb079c62-4481-4d6e-9643-3ca499df7aaa'
+          );
           expect(immutableRule.exceptions_list.length).eql(0); // make sure we have no exceptions_list
 
           // add a second exceptions list as a user is allowed to add a second list to an immutable rule
@@ -406,10 +445,11 @@ export default ({ getService }: FtrProviderContext) => {
             })
             .expect(200);
 
-          await downgradeImmutableRule(es, 'eb079c62-4481-4d6e-9643-3ca499df7aaa');
-          await installPrePackagedRules(supertest);
+          await downgradeImmutableRule(es, log, 'eb079c62-4481-4d6e-9643-3ca499df7aaa');
+          await installPrePackagedRules(supertest, log);
           const immutableRuleSecondTime = await getRule(
             supertest,
+            log,
             'eb079c62-4481-4d6e-9643-3ca499df7aaa'
           );
 
@@ -424,17 +464,22 @@ export default ({ getService }: FtrProviderContext) => {
         });
 
         it('should not change the immutable tags when adding a second exception list to an immutable rule through patch', async () => {
-          await installPrePackagedRules(supertest);
+          await installPrePackagedRules(supertest, log);
 
           const { id, list_id, namespace_type, type } = await createExceptionList(
             supertest,
+            log,
             getCreateExceptionListMinimalSchemaMock()
           );
 
           // Rule id of "9a1a2dae-0b5f-4c3d-8305-a268d404c306" is from the file:
           // x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint.json
           // This rule has an existing exceptions_list that we are going to use
-          const immutableRule = await getRule(supertest, '9a1a2dae-0b5f-4c3d-8305-a268d404c306');
+          const immutableRule = await getRule(
+            supertest,
+            log,
+            '9a1a2dae-0b5f-4c3d-8305-a268d404c306'
+          );
           expect(immutableRule.exceptions_list.length).greaterThan(0); // make sure we have at least one
 
           // add a second exceptions list as a user is allowed to add a second list to an immutable rule
@@ -457,6 +502,7 @@ export default ({ getService }: FtrProviderContext) => {
 
           const body = await findImmutableRuleById(
             supertest,
+            log,
             '9a1a2dae-0b5f-4c3d-8305-a268d404c306'
           );
           expect(body.data.length).to.eql(1); // should have only one length to the data set, otherwise we have duplicates or the tags were removed and that is incredibly bad.
@@ -468,17 +514,22 @@ export default ({ getService }: FtrProviderContext) => {
         });
 
         it('should not change count of prepacked rules when adding a second exception list to an immutable rule through patch. If this fails, suspect the immutable tags are not staying on the rule correctly.', async () => {
-          await installPrePackagedRules(supertest);
+          await installPrePackagedRules(supertest, log);
 
           const { id, list_id, namespace_type, type } = await createExceptionList(
             supertest,
+            log,
             getCreateExceptionListMinimalSchemaMock()
           );
 
           // Rule id of "9a1a2dae-0b5f-4c3d-8305-a268d404c306" is from the file:
           // x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint.json
           // This rule has an existing exceptions_list that we are going to use
-          const immutableRule = await getRule(supertest, '9a1a2dae-0b5f-4c3d-8305-a268d404c306');
+          const immutableRule = await getRule(
+            supertest,
+            log,
+            '9a1a2dae-0b5f-4c3d-8305-a268d404c306'
+          );
           expect(immutableRule.exceptions_list.length).greaterThan(0); // make sure we have at least one
 
           // add a second exceptions list as a user is allowed to add a second list to an immutable rule
@@ -499,7 +550,7 @@ export default ({ getService }: FtrProviderContext) => {
             })
             .expect(200);
 
-          const status = await getPrePackagedRulesStatus(supertest);
+          const status = await getPrePackagedRulesStatus(supertest, log);
           expect(status.rules_not_installed).to.eql(0);
         });
       });
@@ -544,18 +595,19 @@ export default ({ getService }: FtrProviderContext) => {
         });
 
         beforeEach(async () => {
-          await createSignalsIndex(supertest);
+          await createSignalsIndex(supertest, log);
         });
 
         afterEach(async () => {
-          await deleteSignalsIndex(supertest);
-          await deleteAllAlerts(supertest);
-          await deleteAllExceptions(supertest);
+          await deleteSignalsIndex(supertest, log);
+          await deleteAllAlerts(supertest, log);
+          await deleteAllExceptions(supertest, log);
         });
 
         it('should be able to execute against an exception list that does not include valid entries and get back 10 signals', async () => {
           const { id, list_id, namespace_type, type } = await createExceptionList(
             supertest,
+            log,
             getCreateExceptionListMinimalSchemaMock()
           );
 
@@ -570,7 +622,7 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           };
-          await createExceptionListItem(supertest, exceptionListItem);
+          await createExceptionListItem(supertest, log, exceptionListItem);
 
           const ruleWithException: CreateRulesSchema = {
             name: 'Simple Rule Query',
@@ -592,10 +644,10 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           };
-          const { id: createdId } = await createRule(supertest, ruleWithException);
-          await waitForRuleSuccessOrStatus(supertest, createdId);
-          await waitForSignalsToBePresent(supertest, 10, [createdId]);
-          const signalsOpen = await getSignalsByIds(supertest, [createdId]);
+          const { id: createdId } = await createRule(supertest, log, ruleWithException);
+          await waitForRuleSuccessOrStatus(supertest, log, createdId);
+          await waitForSignalsToBePresent(supertest, log, 10, [createdId]);
+          const signalsOpen = await getSignalsByIds(supertest, log, [createdId]);
           expect(signalsOpen.hits.hits.length).equal(10);
         });
 
@@ -612,7 +664,7 @@ export default ({ getService }: FtrProviderContext) => {
             from: '1900-01-01T00:00:00.000Z',
             query: 'host.name: "suricata-sensor-amsterdam"',
           };
-          const createdRule = await createRuleWithExceptionEntries(supertest, rule, [
+          const createdRule = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'host.name', // This matches the query above which will exclude everything
@@ -622,7 +674,7 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          const signalsOpen = await getOpenSignals(supertest, es, createdRule);
+          const signalsOpen = await getOpenSignals(supertest, log, es, createdRule);
           expect(signalsOpen.hits.hits.length).equal(0);
         });
 
@@ -631,7 +683,7 @@ export default ({ getService }: FtrProviderContext) => {
             ...getEqlRuleForSignalTesting(['auditbeat-*']),
             query: 'configuration where agent.id=="a1d7b39c-f898-4dbe-a761-efb61939302d"',
           };
-          const createdRule = await createRuleWithExceptionEntries(supertest, rule, [
+          const createdRule = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'host.id',
@@ -641,7 +693,7 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          const signalsOpen = await getOpenSignals(supertest, es, createdRule);
+          const signalsOpen = await getOpenSignals(supertest, log, es, createdRule);
           expect(signalsOpen.hits.hits.length).equal(0);
         });
 
@@ -653,7 +705,7 @@ export default ({ getService }: FtrProviderContext) => {
               value: 700,
             },
           };
-          const createdRule = await createRuleWithExceptionEntries(supertest, rule, [
+          const createdRule = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'host.id',
@@ -663,7 +715,7 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          const signalsOpen = await getOpenSignals(supertest, es, createdRule);
+          const signalsOpen = await getOpenSignals(supertest, log, es, createdRule);
           expect(signalsOpen.hits.hits.length).equal(0);
         });
 
@@ -696,7 +748,7 @@ export default ({ getService }: FtrProviderContext) => {
             threat_filters: [],
           };
 
-          const createdRule = await createRuleWithExceptionEntries(supertest, rule, [
+          const createdRule = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'source.ip',
@@ -706,21 +758,21 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          const signalsOpen = await getOpenSignals(supertest, es, createdRule);
+          const signalsOpen = await getOpenSignals(supertest, log, es, createdRule);
           expect(signalsOpen.hits.hits.length).equal(0);
         });
         describe('rules with value list exceptions', () => {
           beforeEach(async () => {
-            await createListsIndex(supertest);
+            await createListsIndex(supertest, log);
           });
 
           afterEach(async () => {
-            await deleteListsIndex(supertest);
+            await deleteListsIndex(supertest, log);
           });
 
           it('generates no signals when a value list exception is added for a query rule', async () => {
             const valueListId = 'value-list-id';
-            await importFile(supertest, 'keyword', ['suricata-sensor-amsterdam'], valueListId);
+            await importFile(supertest, log, 'keyword', ['suricata-sensor-amsterdam'], valueListId);
             const rule: QueryCreateSchema = {
               name: 'Simple Rule Query',
               description: 'Simple Rule Query',
@@ -733,7 +785,7 @@ export default ({ getService }: FtrProviderContext) => {
               from: '1900-01-01T00:00:00.000Z',
               query: 'host.name: "suricata-sensor-amsterdam"',
             };
-            const createdRule = await createRuleWithExceptionEntries(supertest, rule, [
+            const createdRule = await createRuleWithExceptionEntries(supertest, log, rule, [
               [
                 {
                   field: 'host.name',
@@ -746,13 +798,13 @@ export default ({ getService }: FtrProviderContext) => {
                 },
               ],
             ]);
-            const signalsOpen = await getOpenSignals(supertest, es, createdRule);
+            const signalsOpen = await getOpenSignals(supertest, log, es, createdRule);
             expect(signalsOpen.hits.hits.length).equal(0);
           });
 
           it('generates no signals when a value list exception is added for a threat match rule', async () => {
             const valueListId = 'value-list-id';
-            await importFile(supertest, 'keyword', ['zeek-sensor-amsterdam'], valueListId);
+            await importFile(supertest, log, 'keyword', ['zeek-sensor-amsterdam'], valueListId);
             const rule: ThreatMatchCreateSchema = {
               description: 'Detecting root and admin users',
               name: 'Query with a rule id',
@@ -781,7 +833,7 @@ export default ({ getService }: FtrProviderContext) => {
               threat_filters: [],
             };
 
-            const createdRule = await createRuleWithExceptionEntries(supertest, rule, [
+            const createdRule = await createRuleWithExceptionEntries(supertest, log, rule, [
               [
                 {
                   field: 'host.name',
@@ -794,7 +846,7 @@ export default ({ getService }: FtrProviderContext) => {
                 },
               ],
             ]);
-            const signalsOpen = await getOpenSignals(supertest, es, createdRule);
+            const signalsOpen = await getOpenSignals(supertest, log, es, createdRule);
             expect(signalsOpen.hits.hits.length).equal(0);
           });
         });
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_index.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_index.ts
index 856a9f2b70658..fabc964692c7d 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_index.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_index.ts
@@ -19,10 +19,11 @@ export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
   const es = getService('es');
+  const log = getService('log');
 
   describe('create_index', () => {
     afterEach(async () => {
-      await deleteSignalsIndex(supertest);
+      await deleteSignalsIndex(supertest, log);
     });
 
     describe('elastic admin', () => {
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_ml.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_ml.ts
index 6cfc21306d0a6..57f4875b6c864 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_ml.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_ml.ts
@@ -37,13 +37,15 @@ import {
   ALERT_ANCESTORS,
   ALERT_DEPTH,
   ALERT_ORIGINAL_TIME,
-} from '../../../../plugins/security_solution/server/lib/detection_engine/rule_types/field_maps/field_names';
+} from '../../../../plugins/security_solution/common/field_maps/field_names';
 
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
   const es = getService('es');
+  const log = getService('log');
+
   const siemModule = 'siem_auditbeat';
   const mlJobId = 'linux_anomalous_network_activity_ecs';
   const testRule: MachineLearningCreateSchema = {
@@ -102,12 +104,12 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     afterEach(async () => {
-      await deleteAllAlerts(supertest);
+      await deleteAllAlerts(supertest, log);
     });
 
     it('should create 1 alert from ML rule when record meets anomaly_threshold', async () => {
-      const createdRule = await createRule(supertest, testRule);
-      const signalsOpen = await getOpenSignals(supertest, es, createdRule);
+      const createdRule = await createRule(supertest, log, testRule);
+      const signalsOpen = await getOpenSignals(supertest, log, es, createdRule);
       expect(signalsOpen.hits.hits.length).eql(1);
       const signal = signalsOpen.hits.hits[0];
       if (!signal._source) {
@@ -208,17 +210,17 @@ export default ({ getService }: FtrProviderContext) => {
         ...testRule,
         anomaly_threshold: 20,
       };
-      const createdRule = await createRule(supertest, rule);
-      const signalsOpen = await getOpenSignals(supertest, es, createdRule);
+      const createdRule = await createRule(supertest, log, rule);
+      const signalsOpen = await getOpenSignals(supertest, log, es, createdRule);
       expect(signalsOpen.hits.hits.length).eql(7);
     });
 
     describe('with non-value list exception', () => {
       afterEach(async () => {
-        await deleteAllExceptions(supertest);
+        await deleteAllExceptions(supertest, log);
       });
       it('generates no signals when an exception is added for an ML rule', async () => {
-        const createdRule = await createRuleWithExceptionEntries(supertest, testRule, [
+        const createdRule = await createRuleWithExceptionEntries(supertest, log, testRule, [
           [
             {
               field: 'host.name',
@@ -228,25 +230,25 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        const signalsOpen = await getOpenSignals(supertest, es, createdRule);
+        const signalsOpen = await getOpenSignals(supertest, log, es, createdRule);
         expect(signalsOpen.hits.hits.length).equal(0);
       });
     });
 
     describe('with value list exception', () => {
       beforeEach(async () => {
-        await createListsIndex(supertest);
+        await createListsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteListsIndex(supertest);
-        await deleteAllExceptions(supertest);
+        await deleteListsIndex(supertest, log);
+        await deleteAllExceptions(supertest, log);
       });
 
       it('generates no signals when a value list exception is added for an ML rule', async () => {
         const valueListId = 'value-list-id';
-        await importFile(supertest, 'keyword', ['mothra'], valueListId);
-        const createdRule = await createRuleWithExceptionEntries(supertest, testRule, [
+        await importFile(supertest, log, 'keyword', ['mothra'], valueListId);
+        const createdRule = await createRuleWithExceptionEntries(supertest, log, testRule, [
           [
             {
               field: 'host.name',
@@ -259,7 +261,7 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        const signalsOpen = await getOpenSignals(supertest, es, createdRule);
+        const signalsOpen = await getOpenSignals(supertest, log, es, createdRule);
         expect(signalsOpen.hits.hits.length).equal(0);
       });
     });
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_rules.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_rules.ts
index b43339261aae4..d7bba5fa5dbe5 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_rules.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_rules.ts
@@ -44,6 +44,7 @@ export default ({ getService }: FtrProviderContext) => {
   const esArchiver = getService('esArchiver');
   const supertest = getService('supertest');
   const supertestWithoutAuth = getService('supertestWithoutAuth');
+  const log = getService('log');
 
   describe('create_rules', () => {
     describe('creating rules', () => {
@@ -56,12 +57,12 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
       });
 
       describe('elastic admin', () => {
@@ -103,7 +104,7 @@ export default ({ getService }: FtrProviderContext) => {
             .send(simpleRule)
             .expect(200);
 
-          await waitForRuleSuccessOrStatus(supertest, body.id);
+          await waitForRuleSuccessOrStatus(supertest, log, body.id);
 
           const { body: statusBody } = await supertest
             .post(DETECTION_ENGINE_RULES_STATUS_URL)
@@ -123,7 +124,7 @@ export default ({ getService }: FtrProviderContext) => {
             .send(simpleRule)
             .expect(200);
 
-          await waitForRuleSuccessOrStatus(supertest, body.id, 'partial failure');
+          await waitForRuleSuccessOrStatus(supertest, log, body.id, 'partial failure');
 
           const { body: statusBody } = await supertest
             .post(DETECTION_ENGINE_RULES_STATUS_URL)
@@ -145,7 +146,7 @@ export default ({ getService }: FtrProviderContext) => {
             .send(simpleRule)
             .expect(200);
 
-          await waitForRuleSuccessOrStatus(supertest, body.id, 'succeeded');
+          await waitForRuleSuccessOrStatus(supertest, log, body.id, 'succeeded');
 
           const { body: statusBody } = await supertest
             .post(DETECTION_ENGINE_RULES_STATUS_URL)
@@ -289,7 +290,7 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('missing timestamps', () => {
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
         // to edit these files run the following script
         // cd $HOME/kibana/x-pack && nvm use && node ../scripts/es_archiver edit security_solution/timestamp_override
         await esArchiver.load(
@@ -297,8 +298,8 @@ export default ({ getService }: FtrProviderContext) => {
         );
       });
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
         await esArchiver.unload(
           'x-pack/test/functional/es_archives/security_solution/timestamp_override'
         );
@@ -316,8 +317,8 @@ export default ({ getService }: FtrProviderContext) => {
           .expect(200);
         const bodyId = body.id;
 
-        await waitForAlertToComplete(supertest, bodyId);
-        await waitForRuleSuccessOrStatus(supertest, bodyId, 'partial failure');
+        await waitForAlertToComplete(supertest, log, bodyId);
+        await waitForRuleSuccessOrStatus(supertest, log, bodyId, 'partial failure');
         await sleep(5000);
 
         const { body: statusBody } = await supertest
@@ -348,9 +349,9 @@ export default ({ getService }: FtrProviderContext) => {
           .expect(200);
         const bodyId = body.id;
 
-        await waitForRuleSuccessOrStatus(supertest, bodyId, 'partial failure');
+        await waitForRuleSuccessOrStatus(supertest, log, bodyId, 'partial failure');
         await sleep(5000);
-        await waitForSignalsToBePresent(supertest, 2, [bodyId]);
+        await waitForSignalsToBePresent(supertest, log, 2, [bodyId]);
 
         const { body: statusBody } = await supertest
           .post(DETECTION_ENGINE_RULES_STATUS_URL)
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_rules_bulk.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_rules_bulk.ts
index 3719a3c000e00..e12f9b7fe7825 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_rules_bulk.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_rules_bulk.ts
@@ -30,6 +30,7 @@ import {
 export default ({ getService }: FtrProviderContext): void => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
+  const log = getService('log');
 
   describe('create_rules_bulk', () => {
     describe('creating rules in bulk', () => {
@@ -42,12 +43,12 @@ export default ({ getService }: FtrProviderContext): void => {
       });
 
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
       });
 
       it('should create a single rule with a rule_id', async () => {
@@ -88,7 +89,7 @@ export default ({ getService }: FtrProviderContext): void => {
           .send([simpleRule])
           .expect(200);
 
-        await waitForRuleSuccessOrStatus(supertest, body[0].id);
+        await waitForRuleSuccessOrStatus(supertest, log, body[0].id);
 
         const { body: statusBody } = await supertest
           .post(DETECTION_ENGINE_RULES_STATUS_URL)
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_signals_migrations.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_signals_migrations.ts
index 78f117f3385af..60cb8a4017905 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_signals_migrations.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_signals_migrations.ts
@@ -42,6 +42,7 @@ export default ({ getService }: FtrProviderContext): void => {
   const kbnClient = getService('kibanaServer');
   const supertest = getService('supertest');
   const supertestWithoutAuth = getService('supertestWithoutAuth');
+  const log = getService('log');
 
   describe('Creating signals migrations', () => {
     let createdMigrations: CreateResponse[];
@@ -57,7 +58,7 @@ export default ({ getService }: FtrProviderContext): void => {
       outdatedSignalsIndexName = getIndexNameFromLoad(
         await esArchiver.load('x-pack/test/functional/es_archives/signals/outdated_signals_index')
       );
-      await createSignalsIndex(supertest);
+      await createSignalsIndex(supertest, log);
     });
 
     afterEach(async () => {
@@ -76,7 +77,7 @@ export default ({ getService }: FtrProviderContext): void => {
         kbnClient,
         ids: createdMigrations.filter((m) => m?.migration_id).map((m) => m.migration_id),
       });
-      await deleteSignalsIndex(supertest);
+      await deleteSignalsIndex(supertest, log);
     });
 
     it('returns the information necessary to finalize the migration', async () => {
@@ -110,7 +111,7 @@ export default ({ getService }: FtrProviderContext): void => {
       createResponses.forEach((response) => expect(response.migration_id).to.be.a('string'));
 
       const [{ migration_index: newIndex }] = createResponses;
-      await waitForIndexToPopulate(es, newIndex);
+      await waitForIndexToPopulate(es, log, newIndex);
       const migrationResults = await es.search<{ signal: Signal }>({ index: newIndex });
 
       expect(migrationResults.hits.hits).length(1);
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_threat_matching.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_threat_matching.ts
index dcfdfb7bbd9bc..3d09599278809 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_threat_matching.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_threat_matching.ts
@@ -41,6 +41,7 @@ import {
 import { getCreateThreatMatchRulesSchemaMock } from '../../../../plugins/security_solution/common/detection_engine/schemas/request/rule_schemas.mock';
 import { getThreatMatchingSchemaPartialMock } from '../../../../plugins/security_solution/common/detection_engine/schemas/response/rules_schema.mocks';
 import { ENRICHMENT_TYPES } from '../../../../plugins/security_solution/common/cti/constants';
+import { Ancestor } from '../../../../plugins/security_solution/server/lib/detection_engine/signals/types';
 import {
   ALERT_ANCESTORS,
   ALERT_DEPTH,
@@ -48,8 +49,7 @@ import {
   ALERT_ORIGINAL_EVENT_CATEGORY,
   ALERT_ORIGINAL_EVENT_MODULE,
   ALERT_ORIGINAL_TIME,
-} from '../../../../plugins/security_solution/server/lib/detection_engine/rule_types/field_maps/field_names';
-import { Ancestor } from '../../../../plugins/security_solution/server/lib/detection_engine/signals/types';
+} from '../../../../plugins/security_solution/common/field_maps/field_names';
 
 const format = (value: unknown): string => JSON.stringify(value, null, 2);
 
@@ -67,6 +67,7 @@ const assertContains = (subject: unknown[], expected: unknown[]) =>
 export default ({ getService }: FtrProviderContext) => {
   const esArchiver = getService('esArchiver');
   const supertest = getService('supertest');
+  const log = getService('log');
 
   /**
    * Specific api integration tests for threat matching rule type
@@ -82,16 +83,20 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
       });
 
       it('should create a single rule with a rule_id', async () => {
-        const ruleResponse = await createRule(supertest, getCreateThreatMatchRulesSchemaMock());
+        const ruleResponse = await createRule(
+          supertest,
+          log,
+          getCreateThreatMatchRulesSchemaMock()
+        );
         const bodyToCompare = removeServerGeneratedProperties(ruleResponse);
         expect(bodyToCompare).to.eql(getThreatMatchingSchemaPartialMock());
       });
@@ -99,10 +104,11 @@ export default ({ getService }: FtrProviderContext) => {
       it('should create a single rule with a rule_id and validate it ran successfully', async () => {
         const ruleResponse = await createRule(
           supertest,
+          log,
           getCreateThreatMatchRulesSchemaMock('rule-1', true)
         );
 
-        await waitForRuleSuccessOrStatus(supertest, ruleResponse.id, 'succeeded');
+        await waitForRuleSuccessOrStatus(supertest, log, ruleResponse.id, 'succeeded');
 
         const { body: statusBody } = await supertest
           .post(DETECTION_ENGINE_RULES_STATUS_URL)
@@ -126,13 +132,13 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       beforeEach(async () => {
-        await deleteAllAlerts(supertest);
-        await createSignalsIndex(supertest);
+        await deleteAllAlerts(supertest, log);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
       });
 
       it('should be able to execute and get 10 signals when doing a specific query', async () => {
@@ -164,10 +170,10 @@ export default ({ getService }: FtrProviderContext) => {
           threat_filters: [],
         };
 
-        const createdRule = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, createdRule.id);
-        await waitForSignalsToBePresent(supertest, 10, [createdRule.id]);
-        const signalsOpen = await getSignalsByIds(supertest, [createdRule.id]);
+        const createdRule = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, createdRule.id);
+        await waitForSignalsToBePresent(supertest, log, 10, [createdRule.id]);
+        const signalsOpen = await getSignalsByIds(supertest, log, [createdRule.id]);
         expect(signalsOpen.hits.hits.length).equal(10);
         const fullSource = signalsOpen.hits.hits.find(
           (signal) =>
@@ -368,9 +374,9 @@ export default ({ getService }: FtrProviderContext) => {
           threat_filters: [],
         };
 
-        const ruleResponse = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, ruleResponse.id);
-        const signalsOpen = await getSignalsByIds(supertest, [ruleResponse.id]);
+        const ruleResponse = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, ruleResponse.id);
+        const signalsOpen = await getSignalsByIds(supertest, log, [ruleResponse.id]);
         expect(signalsOpen.hits.hits.length).equal(0);
       });
 
@@ -407,9 +413,9 @@ export default ({ getService }: FtrProviderContext) => {
           threat_filters: [],
         };
 
-        const ruleResponse = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, ruleResponse.id);
-        const signalsOpen = await getSignalsByIds(supertest, [ruleResponse.id]);
+        const ruleResponse = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, ruleResponse.id);
+        const signalsOpen = await getSignalsByIds(supertest, log, [ruleResponse.id]);
         expect(signalsOpen.hits.hits.length).equal(0);
       });
 
@@ -446,9 +452,9 @@ export default ({ getService }: FtrProviderContext) => {
           threat_filters: [],
         };
 
-        const ruleResponse = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, ruleResponse.id);
-        const signalsOpen = await getSignalsByIds(supertest, [ruleResponse.id]);
+        const ruleResponse = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, ruleResponse.id);
+        const signalsOpen = await getSignalsByIds(supertest, log, [ruleResponse.id]);
         expect(signalsOpen.hits.hits.length).equal(0);
       });
 
@@ -485,8 +491,8 @@ export default ({ getService }: FtrProviderContext) => {
             items_per_search: 1, // iterate only 1 threat item per loop to ensure we're slow
           };
 
-          const { id } = await createRule(supertest, rule);
-          await waitForRuleSuccessOrStatus(supertest, id, 'failed');
+          const { id } = await createRule(supertest, log, rule);
+          await waitForRuleSuccessOrStatus(supertest, log, id, 'failed');
 
           const { body } = await supertest
             .post(`${DETECTION_ENGINE_RULES_URL}/_find_statuses`)
@@ -537,10 +543,10 @@ export default ({ getService }: FtrProviderContext) => {
             threat_filters: [],
           };
 
-          const { id } = await createRule(supertest, rule);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 2, [id]);
-          const signalsOpen = await getSignalsByIds(supertest, [id]);
+          const { id } = await createRule(supertest, log, rule);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 2, [id]);
+          const signalsOpen = await getSignalsByIds(supertest, log, [id]);
           expect(signalsOpen.hits.hits.length).equal(2);
 
           const { hits } = signalsOpen.hits;
@@ -626,10 +632,10 @@ export default ({ getService }: FtrProviderContext) => {
             threat_filters: [],
           };
 
-          const { id } = await createRule(supertest, rule);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 1, [id]);
-          const signalsOpen = await getSignalsByIds(supertest, [id]);
+          const { id } = await createRule(supertest, log, rule);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 1, [id]);
+          const signalsOpen = await getSignalsByIds(supertest, log, [id]);
           expect(signalsOpen.hits.hits.length).equal(1);
 
           const { hits } = signalsOpen.hits;
@@ -713,10 +719,10 @@ export default ({ getService }: FtrProviderContext) => {
             threat_filters: [],
           };
 
-          const { id } = await createRule(supertest, rule);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 1, [id]);
-          const signalsOpen = await getSignalsByIds(supertest, [id]);
+          const { id } = await createRule(supertest, log, rule);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 1, [id]);
+          const signalsOpen = await getSignalsByIds(supertest, log, [id]);
           expect(signalsOpen.hits.hits.length).equal(1);
 
           const { hits } = signalsOpen.hits;
@@ -827,10 +833,10 @@ export default ({ getService }: FtrProviderContext) => {
             threat_filters: [],
           };
 
-          const { id } = await createRule(supertest, rule);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 2, [id]);
-          const signalsOpen = await getSignalsByIds(supertest, [id]);
+          const { id } = await createRule(supertest, log, rule);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 2, [id]);
+          const signalsOpen = await getSignalsByIds(supertest, log, [id]);
           expect(signalsOpen.hits.hits.length).equal(2);
 
           const { hits } = signalsOpen.hits;
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/delete_rules.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/delete_rules.ts
index 3750a8eed394b..e5f828d0f862d 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/delete_rules.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/delete_rules.ts
@@ -25,20 +25,21 @@ import {
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext): void => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('delete_rules', () => {
     describe('deleting rules', () => {
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
       });
 
       it('should delete a single rule with a rule_id', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // delete the rule by its rule_id
         const { body } = await supertest
@@ -51,7 +52,7 @@ export default ({ getService }: FtrProviderContext): void => {
       });
 
       it('should delete a single rule using an auto generated rule_id', async () => {
-        const bodyWithCreatedRule = await createRule(supertest, getSimpleRuleWithoutRuleId());
+        const bodyWithCreatedRule = await createRule(supertest, log, getSimpleRuleWithoutRuleId());
 
         // delete that rule by its auto-generated rule_id
         const { body } = await supertest
@@ -64,7 +65,7 @@ export default ({ getService }: FtrProviderContext): void => {
       });
 
       it('should delete a single rule using an auto generated id', async () => {
-        const bodyWithCreatedRule = await createRule(supertest, getSimpleRule());
+        const bodyWithCreatedRule = await createRule(supertest, log, getSimpleRule());
 
         // delete that rule by its auto-generated id
         const { body } = await supertest
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/delete_rules_bulk.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/delete_rules_bulk.ts
index e978f871b55c2..b7517697ad2a9 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/delete_rules_bulk.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/delete_rules_bulk.ts
@@ -25,20 +25,21 @@ import {
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext): void => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('delete_rules_bulk', () => {
     describe('deleting rules bulk using DELETE', () => {
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
       });
 
       it('should delete a single rule with a rule_id', async () => {
-        await createRule(supertest, getSimpleRule());
+        await createRule(supertest, log, getSimpleRule());
 
         // delete the rule in bulk
         const { body } = await supertest
@@ -52,7 +53,7 @@ export default ({ getService }: FtrProviderContext): void => {
       });
 
       it('should delete a single rule using an auto generated rule_id', async () => {
-        const bodyWithCreatedRule = await createRule(supertest, getSimpleRuleWithoutRuleId());
+        const bodyWithCreatedRule = await createRule(supertest, log, getSimpleRuleWithoutRuleId());
 
         // delete that rule by its rule_id
         const { body } = await supertest
@@ -66,7 +67,7 @@ export default ({ getService }: FtrProviderContext): void => {
       });
 
       it('should delete a single rule using an auto generated id', async () => {
-        const bodyWithCreatedRule = await createRule(supertest, getSimpleRule());
+        const bodyWithCreatedRule = await createRule(supertest, log, getSimpleRule());
 
         // delete that rule by its id
         const { body } = await supertest
@@ -116,7 +117,7 @@ export default ({ getService }: FtrProviderContext): void => {
       });
 
       it('should delete a single rule using an auto generated rule_id but give an error if the second rule does not exist', async () => {
-        const bodyWithCreatedRule = await createRule(supertest, getSimpleRuleWithoutRuleId());
+        const bodyWithCreatedRule = await createRule(supertest, log, getSimpleRuleWithoutRuleId());
 
         const { body } = await supertest
           .delete(`${DETECTION_ENGINE_RULES_URL}/_bulk_delete`)
@@ -141,16 +142,16 @@ export default ({ getService }: FtrProviderContext): void => {
     // This is a repeat of the tests above but just using POST instead of DELETE
     describe('deleting rules bulk using POST', () => {
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
       });
 
       it('should delete a single rule with a rule_id', async () => {
-        await createRule(supertest, getSimpleRule());
+        await createRule(supertest, log, getSimpleRule());
 
         // delete the rule in bulk
         const { body } = await supertest
@@ -164,7 +165,7 @@ export default ({ getService }: FtrProviderContext): void => {
       });
 
       it('should delete a single rule using an auto generated rule_id', async () => {
-        const bodyWithCreatedRule = await createRule(supertest, getSimpleRuleWithoutRuleId());
+        const bodyWithCreatedRule = await createRule(supertest, log, getSimpleRuleWithoutRuleId());
 
         // delete that rule by its rule_id
         const { body } = await supertest
@@ -178,7 +179,7 @@ export default ({ getService }: FtrProviderContext): void => {
       });
 
       it('should delete a single rule using an auto generated id', async () => {
-        const bodyWithCreatedRule = await createRule(supertest, getSimpleRule());
+        const bodyWithCreatedRule = await createRule(supertest, log, getSimpleRule());
 
         // delete that rule by its id
         const { body } = await supertest
@@ -228,7 +229,7 @@ export default ({ getService }: FtrProviderContext): void => {
       });
 
       it('should delete a single rule using an auto generated rule_id but give an error if the second rule does not exist', async () => {
-        const bodyWithCreatedRule = await createRule(supertest, getSimpleRuleWithoutRuleId());
+        const bodyWithCreatedRule = await createRule(supertest, log, getSimpleRuleWithoutRuleId());
 
         const { body } = await supertest
           .post(`${DETECTION_ENGINE_RULES_URL}/_bulk_delete`)
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/delete_signals_migrations.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/delete_signals_migrations.ts
index 00d6607cba963..569f364dcea37 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/delete_signals_migrations.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/delete_signals_migrations.ts
@@ -34,6 +34,7 @@ export default ({ getService }: FtrProviderContext): void => {
   const esArchiver = getService('esArchiver');
   const supertest = getService('supertest');
   const supertestWithoutAuth = getService('supertestWithoutAuth');
+  const log = getService('log');
 
   describe('deleting signals migrations', () => {
     let outdatedSignalsIndexName: string;
@@ -45,7 +46,7 @@ export default ({ getService }: FtrProviderContext): void => {
         await esArchiver.load('x-pack/test/functional/es_archives/signals/outdated_signals_index')
       );
 
-      await createSignalsIndex(supertest);
+      await createSignalsIndex(supertest, log);
 
       ({
         body: {
@@ -57,24 +58,28 @@ export default ({ getService }: FtrProviderContext): void => {
         .send({ index: [outdatedSignalsIndexName] })
         .expect(200));
 
-      await waitFor(async () => {
-        ({
-          body: {
-            migrations: [finalizedMigration],
-          },
-        } = await supertest
-          .post(DETECTION_ENGINE_SIGNALS_FINALIZE_MIGRATION_URL)
-          .set('kbn-xsrf', 'true')
-          .send({ migration_ids: [createdMigration.migration_id] })
-          .expect(200));
-
-        return finalizedMigration.completed ?? false;
-      }, `polling finalize_migration until all complete`);
+      await waitFor(
+        async () => {
+          ({
+            body: {
+              migrations: [finalizedMigration],
+            },
+          } = await supertest
+            .post(DETECTION_ENGINE_SIGNALS_FINALIZE_MIGRATION_URL)
+            .set('kbn-xsrf', 'true')
+            .send({ migration_ids: [createdMigration.migration_id] })
+            .expect(200));
+
+          return finalizedMigration.completed ?? false;
+        },
+        `polling finalize_migration until all complete`,
+        log
+      );
     });
 
     afterEach(async () => {
       await esArchiver.unload('x-pack/test/functional/es_archives/signals/outdated_signals_index');
-      await deleteSignalsIndex(supertest);
+      await deleteSignalsIndex(supertest, log);
     });
 
     it('returns the deleted migration SavedObjects', async () => {
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/date.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/date.ts
index 742bbf7285e95..5ab47a91ef684 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/date.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/date.ts
@@ -30,6 +30,7 @@ import {
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
+  const log = getService('log');
 
   describe('Rule exception operators for data type date', () => {
     before(async () => {
@@ -41,24 +42,24 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     beforeEach(async () => {
-      await createSignalsIndex(supertest);
-      await createListsIndex(supertest);
+      await createSignalsIndex(supertest, log);
+      await createListsIndex(supertest, log);
     });
 
     afterEach(async () => {
-      await deleteSignalsIndex(supertest);
-      await deleteAllAlerts(supertest);
-      await deleteAllExceptions(supertest);
-      await deleteListsIndex(supertest);
+      await deleteSignalsIndex(supertest, log);
+      await deleteAllAlerts(supertest, log);
+      await deleteAllExceptions(supertest, log);
+      await deleteListsIndex(supertest, log);
     });
 
     describe('"is" operator', () => {
       it('should find all the dates from the data set when no exceptions are set on the rule', async () => {
         const rule = getRuleForSignalTesting(['date']);
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([
           '2020-10-01T05:08:53.000Z',
@@ -70,7 +71,7 @@ export default ({ getService }: FtrProviderContext) => {
 
       it('should filter 1 single date if it is set as an exception', async () => {
         const rule = getRuleForSignalTesting(['date']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'date',
@@ -80,9 +81,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([
           '2020-10-02T05:08:53.000Z',
@@ -93,7 +94,7 @@ export default ({ getService }: FtrProviderContext) => {
 
       it('should filter 2 dates if both are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['date']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'date',
@@ -111,16 +112,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql(['2020-10-03T05:08:53.000Z', '2020-10-04T05:08:53.000Z']);
       });
 
       it('should filter 3 dates if all 3 are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['date']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'date',
@@ -146,16 +147,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql(['2020-10-04T05:08:53.000Z']);
       });
 
       it('should filter 4 dates if all are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['date']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'date',
@@ -189,8 +190,8 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([]);
       });
@@ -199,7 +200,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is not" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
         const rule = getRuleForSignalTesting(['date']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'date',
@@ -209,15 +210,15 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([]);
       });
 
       it('will return just 1 result we excluded', async () => {
         const rule = getRuleForSignalTesting(['date']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'date',
@@ -227,16 +228,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql(['2020-10-01T05:08:53.000Z']);
       });
 
       it('will return 0 results if we exclude two dates', async () => {
         const rule = getRuleForSignalTesting(['date']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'date',
@@ -254,8 +255,8 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([]);
       });
@@ -264,7 +265,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is one of" operator', () => {
       it('should filter 1 single date if it is set as an exception', async () => {
         const rule = getRuleForSignalTesting(['date']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'date',
@@ -274,9 +275,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([
           '2020-10-02T05:08:53.000Z',
@@ -287,7 +288,7 @@ export default ({ getService }: FtrProviderContext) => {
 
       it('should filter 2 dates if both are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['date']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'date',
@@ -297,16 +298,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql(['2020-10-03T05:08:53.000Z', '2020-10-04T05:08:53.000Z']);
       });
 
       it('should filter 3 dates if all 3 are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['date']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'date',
@@ -320,16 +321,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql(['2020-10-04T05:08:53.000Z']);
       });
 
       it('should filter 4 dates if all are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['date']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'date',
@@ -344,8 +345,8 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([]);
       });
@@ -354,7 +355,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is not one of" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
         const rule = getRuleForSignalTesting(['date']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'date',
@@ -364,15 +365,15 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([]);
       });
 
       it('will return just the result we excluded', async () => {
         const rule = getRuleForSignalTesting(['date']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'date',
@@ -382,9 +383,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql(['2020-10-01T05:08:53.000Z', '2020-10-04T05:08:53.000Z']);
       });
@@ -393,7 +394,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"exists" operator', () => {
       it('will return 0 results if matching against date', async () => {
         const rule = getRuleForSignalTesting(['date']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'date',
@@ -402,8 +403,8 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([]);
       });
@@ -412,7 +413,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"does not exist" operator', () => {
       it('will return 4 results if matching against date', async () => {
         const rule = getRuleForSignalTesting(['date']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'date',
@@ -421,9 +422,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([
           '2020-10-01T05:08:53.000Z',
@@ -436,9 +437,9 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('"is in list" operator', () => {
       it('will return 3 results if we have a list that includes 1 date', async () => {
-        await importFile(supertest, 'date', ['2020-10-01T05:08:53.000Z'], 'list_items.txt');
+        await importFile(supertest, log, 'date', ['2020-10-01T05:08:53.000Z'], 'list_items.txt');
         const rule = getRuleForSignalTesting(['date']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'date',
@@ -451,9 +452,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([
           '2020-10-02T05:08:53.000Z',
@@ -465,12 +466,13 @@ export default ({ getService }: FtrProviderContext) => {
       it('will return 2 results if we have a list that includes 2 dates', async () => {
         await importFile(
           supertest,
+          log,
           'date',
           ['2020-10-01T05:08:53.000Z', '2020-10-03T05:08:53.000Z'],
           'list_items.txt'
         );
         const rule = getRuleForSignalTesting(['date']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'date',
@@ -483,9 +485,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql(['2020-10-02T05:08:53.000Z', '2020-10-04T05:08:53.000Z']);
       });
@@ -493,6 +495,7 @@ export default ({ getService }: FtrProviderContext) => {
       it('will return 0 results if we have a list that includes all dates', async () => {
         await importFile(
           supertest,
+          log,
           'date',
           [
             '2020-10-01T05:08:53.000Z',
@@ -503,7 +506,7 @@ export default ({ getService }: FtrProviderContext) => {
           'list_items.txt'
         );
         const rule = getRuleForSignalTesting(['date']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'date',
@@ -516,8 +519,8 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([]);
       });
@@ -525,9 +528,9 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('"is not in list" operator', () => {
       it('will return 1 result if we have a list that excludes 1 date', async () => {
-        await importFile(supertest, 'date', ['2020-10-01T05:08:53.000Z'], 'list_items.txt');
+        await importFile(supertest, log, 'date', ['2020-10-01T05:08:53.000Z'], 'list_items.txt');
         const rule = getRuleForSignalTesting(['date']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'date',
@@ -540,9 +543,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql(['2020-10-01T05:08:53.000Z']);
       });
@@ -550,12 +553,13 @@ export default ({ getService }: FtrProviderContext) => {
       it('will return 2 results if we have a list that excludes 2 dates', async () => {
         await importFile(
           supertest,
+          log,
           'date',
           ['2020-10-01T05:08:53.000Z', '2020-10-03T05:08:53.000Z'],
           'list_items.txt'
         );
         const rule = getRuleForSignalTesting(['date']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'date',
@@ -568,9 +572,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql(['2020-10-01T05:08:53.000Z', '2020-10-03T05:08:53.000Z']);
       });
@@ -578,6 +582,7 @@ export default ({ getService }: FtrProviderContext) => {
       it('will return 4 results if we have a list that excludes all dates', async () => {
         await importFile(
           supertest,
+          log,
           'date',
           [
             '2020-10-01T05:08:53.000Z',
@@ -588,7 +593,7 @@ export default ({ getService }: FtrProviderContext) => {
           'list_items.txt'
         );
         const rule = getRuleForSignalTesting(['date']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'date',
@@ -601,9 +606,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.date).sort();
         expect(hits).to.eql([
           '2020-10-01T05:08:53.000Z',
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/double.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/double.ts
index a2639ea522447..63b26c91073cd 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/double.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/double.ts
@@ -30,6 +30,7 @@ import {
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
+  const log = getService('log');
 
   describe('Rule exception operators for data type double', () => {
     before(async () => {
@@ -45,31 +46,31 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     beforeEach(async () => {
-      await createSignalsIndex(supertest);
-      await createListsIndex(supertest);
+      await createSignalsIndex(supertest, log);
+      await createListsIndex(supertest, log);
     });
 
     afterEach(async () => {
-      await deleteSignalsIndex(supertest);
-      await deleteAllAlerts(supertest);
-      await deleteAllExceptions(supertest);
-      await deleteListsIndex(supertest);
+      await deleteSignalsIndex(supertest, log);
+      await deleteAllAlerts(supertest, log);
+      await deleteAllExceptions(supertest, log);
+      await deleteListsIndex(supertest, log);
     });
 
     describe('"is" operator', () => {
       it('should find all the double from the data set when no exceptions are set on the rule', async () => {
         const rule = getRuleForSignalTesting(['double']);
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql(['1.0', '1.1', '1.2', '1.3']);
       });
 
       it('should filter 1 single double if it is set as an exception', async () => {
         const rule = getRuleForSignalTesting(['double']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'double',
@@ -79,16 +80,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql(['1.1', '1.2', '1.3']);
       });
 
       it('should filter 2 double if both are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['double']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'double',
@@ -106,16 +107,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql(['1.2', '1.3']);
       });
 
       it('should filter 3 double if all 3 are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['double']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'double',
@@ -141,16 +142,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql(['1.3']);
       });
 
       it('should filter 4 double if all are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['double']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'double',
@@ -184,8 +185,8 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql([]);
       });
@@ -194,7 +195,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is not" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
         const rule = getRuleForSignalTesting(['double']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'double',
@@ -204,15 +205,15 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql([]);
       });
 
       it('will return just 1 result we excluded', async () => {
         const rule = getRuleForSignalTesting(['double']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'double',
@@ -222,16 +223,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql(['1.0']);
       });
 
       it('will return 0 results if we exclude two double', async () => {
         const rule = getRuleForSignalTesting(['double']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'double',
@@ -249,8 +250,8 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql([]);
       });
@@ -259,7 +260,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is one of" operator', () => {
       it('should filter 1 single double if it is set as an exception', async () => {
         const rule = getRuleForSignalTesting(['double']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'double',
@@ -269,16 +270,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql(['1.1', '1.2', '1.3']);
       });
 
       it('should filter 2 double if both are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['double']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'double',
@@ -288,16 +289,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql(['1.2', '1.3']);
       });
 
       it('should filter 3 double if all 3 are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['double']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'double',
@@ -307,16 +308,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql(['1.3']);
       });
 
       it('should filter 4 double if all are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['double']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'double',
@@ -326,8 +327,8 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql([]);
       });
@@ -336,7 +337,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is not one of" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
         const rule = getRuleForSignalTesting(['double']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'double',
@@ -346,15 +347,15 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql([]);
       });
 
       it('will return just the result we excluded', async () => {
         const rule = getRuleForSignalTesting(['double']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'double',
@@ -364,9 +365,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql(['1.0', '1.3']);
       });
@@ -375,7 +376,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"exists" operator', () => {
       it('will return 0 results if matching against double', async () => {
         const rule = getRuleForSignalTesting(['double']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'double',
@@ -384,8 +385,8 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql([]);
       });
@@ -394,7 +395,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"does not exist" operator', () => {
       it('will return 4 results if matching against double', async () => {
         const rule = getRuleForSignalTesting(['double']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'double',
@@ -403,9 +404,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
         expect(hits).to.eql(['1.0', '1.1', '1.2', '1.3']);
       });
@@ -414,9 +415,9 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is in list" operator', () => {
       describe('working against double values in the data set', () => {
         it('will return 3 results if we have a list that includes 1 double', async () => {
-          await importFile(supertest, 'double', ['1.0'], 'list_items.txt');
+          await importFile(supertest, log, 'double', ['1.0'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['double']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'double',
@@ -429,17 +430,17 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 3, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 3, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql(['1.1', '1.2', '1.3']);
         });
 
         it('will return 2 results if we have a list that includes 2 double', async () => {
-          await importFile(supertest, 'double', ['1.0', '1.2'], 'list_items.txt');
+          await importFile(supertest, log, 'double', ['1.0', '1.2'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['double']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'double',
@@ -452,17 +453,23 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 2, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql(['1.1', '1.3']);
         });
 
         it('will return 0 results if we have a list that includes all double', async () => {
-          await importFile(supertest, 'double', ['1.0', '1.1', '1.2', '1.3'], 'list_items.txt');
+          await importFile(
+            supertest,
+            log,
+            'double',
+            ['1.0', '1.1', '1.2', '1.3'],
+            'list_items.txt'
+          );
           const rule = getRuleForSignalTesting(['double']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'double',
@@ -475,8 +482,8 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql([]);
         });
@@ -484,9 +491,9 @@ export default ({ getService }: FtrProviderContext) => {
 
       describe('working against string values in the data set', () => {
         it('will return 3 results if we have a list that includes 1 double', async () => {
-          await importFile(supertest, 'double', ['1.0'], 'list_items.txt');
+          await importFile(supertest, log, 'double', ['1.0'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['double_as_string']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'double',
@@ -499,17 +506,17 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 1, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 1, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql(['1.1', '1.2', '1.3']);
         });
 
         it('will return 2 results if we have a list that includes 2 double', async () => {
-          await importFile(supertest, 'double', ['1.0', '1.2'], 'list_items.txt');
+          await importFile(supertest, log, 'double', ['1.0', '1.2'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['double_as_string']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'double',
@@ -522,17 +529,23 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 2, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql(['1.1', '1.3']);
         });
 
         it('will return 0 results if we have a list that includes all double', async () => {
-          await importFile(supertest, 'double', ['1.0', '1.1', '1.2', '1.3'], 'list_items.txt');
+          await importFile(
+            supertest,
+            log,
+            'double',
+            ['1.0', '1.1', '1.2', '1.3'],
+            'list_items.txt'
+          );
           const rule = getRuleForSignalTesting(['double_as_string']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'double',
@@ -545,19 +558,19 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql([]);
         });
 
         it('will return 1 result if we have a list which contains the double range of 1.0-1.2', async () => {
-          await importFile(supertest, 'double_range', ['1.0-1.2'], 'list_items.txt', [
+          await importFile(supertest, log, 'double_range', ['1.0-1.2'], 'list_items.txt', [
             '1.0',
             '1.2',
           ]);
           const rule = getRuleForSignalTesting(['double_as_string']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'double',
@@ -570,9 +583,9 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 1, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 1, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql(['1.3']);
         });
@@ -582,9 +595,9 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is not in list" operator', () => {
       describe('working against double values in the data set', () => {
         it('will return 1 result if we have a list that excludes 1 double', async () => {
-          await importFile(supertest, 'double', ['1.0'], 'list_items.txt');
+          await importFile(supertest, log, 'double', ['1.0'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['double']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'double',
@@ -597,17 +610,17 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 1, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 1, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql(['1.0']);
         });
 
         it('will return 2 results if we have a list that excludes 2 double', async () => {
-          await importFile(supertest, 'double', ['1.0', '1.2'], 'list_items.txt');
+          await importFile(supertest, log, 'double', ['1.0', '1.2'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['double']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'double',
@@ -620,17 +633,23 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 2, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql(['1.0', '1.2']);
         });
 
         it('will return 4 results if we have a list that excludes all double', async () => {
-          await importFile(supertest, 'double', ['1.0', '1.1', '1.2', '1.3'], 'list_items.txt');
+          await importFile(
+            supertest,
+            log,
+            'double',
+            ['1.0', '1.1', '1.2', '1.3'],
+            'list_items.txt'
+          );
           const rule = getRuleForSignalTesting(['double']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'double',
@@ -643,9 +662,9 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 4, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 4, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql(['1.0', '1.1', '1.2', '1.3']);
         });
@@ -653,9 +672,9 @@ export default ({ getService }: FtrProviderContext) => {
 
       describe('working against string values in the data set', () => {
         it('will return 1 result if we have a list that excludes 1 double', async () => {
-          await importFile(supertest, 'double', ['1.0'], 'list_items.txt');
+          await importFile(supertest, log, 'double', ['1.0'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['double_as_string']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'double',
@@ -668,17 +687,17 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 1, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 1, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql(['1.0']);
         });
 
         it('will return 2 results if we have a list that excludes 2 double', async () => {
-          await importFile(supertest, 'double', ['1.0', '1.2'], 'list_items.txt');
+          await importFile(supertest, log, 'double', ['1.0', '1.2'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['double_as_string']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'double',
@@ -691,17 +710,23 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 2, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql(['1.0', '1.2']);
         });
 
         it('will return 4 results if we have a list that excludes all double', async () => {
-          await importFile(supertest, 'double', ['1.0', '1.1', '1.2', '1.3'], 'list_items.txt');
+          await importFile(
+            supertest,
+            log,
+            'double',
+            ['1.0', '1.1', '1.2', '1.3'],
+            'list_items.txt'
+          );
           const rule = getRuleForSignalTesting(['double_as_string']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'double',
@@ -714,20 +739,20 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 4, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 4, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql(['1.0', '1.1', '1.2', '1.3']);
         });
 
         it('will return 3 results if we have a list which contains the double range of 1.0-1.2', async () => {
-          await importFile(supertest, 'double_range', ['1.0-1.2'], 'list_items.txt', [
+          await importFile(supertest, log, 'double_range', ['1.0-1.2'], 'list_items.txt', [
             '1.0',
             '1.2',
           ]);
           const rule = getRuleForSignalTesting(['double_as_string']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'double',
@@ -740,9 +765,9 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 3, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 3, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.double).sort();
           expect(hits).to.eql(['1.0', '1.1', '1.2']);
         });
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/float.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/float.ts
index 288e2353166ee..840837186a426 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/float.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/float.ts
@@ -30,6 +30,7 @@ import {
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
+  const log = getService('log');
 
   describe('Rule exception operators for data type float', () => {
     before(async () => {
@@ -43,31 +44,31 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     beforeEach(async () => {
-      await createSignalsIndex(supertest);
-      await createListsIndex(supertest);
+      await createSignalsIndex(supertest, log);
+      await createListsIndex(supertest, log);
     });
 
     afterEach(async () => {
-      await deleteSignalsIndex(supertest);
-      await deleteAllAlerts(supertest);
-      await deleteAllExceptions(supertest);
-      await deleteListsIndex(supertest);
+      await deleteSignalsIndex(supertest, log);
+      await deleteAllAlerts(supertest, log);
+      await deleteAllExceptions(supertest, log);
+      await deleteListsIndex(supertest, log);
     });
 
     describe('"is" operator', () => {
       it('should find all the float from the data set when no exceptions are set on the rule', async () => {
         const rule = getRuleForSignalTesting(['float']);
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql(['1.0', '1.1', '1.2', '1.3']);
       });
 
       it('should filter 1 single float if it is set as an exception', async () => {
         const rule = getRuleForSignalTesting(['float']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'float',
@@ -77,16 +78,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql(['1.1', '1.2', '1.3']);
       });
 
       it('should filter 2 float if both are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['float']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'float',
@@ -104,16 +105,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql(['1.2', '1.3']);
       });
 
       it('should filter 3 float if all 3 are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['float']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'float',
@@ -139,16 +140,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql(['1.3']);
       });
 
       it('should filter 4 float if all are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['float']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'float',
@@ -182,8 +183,8 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql([]);
       });
@@ -192,7 +193,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is not" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
         const rule = getRuleForSignalTesting(['float']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'float',
@@ -202,15 +203,15 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql([]);
       });
 
       it('will return just 1 result we excluded', async () => {
         const rule = getRuleForSignalTesting(['float']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'float',
@@ -220,16 +221,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql(['1.0']);
       });
 
       it('will return 0 results if we exclude two float', async () => {
         const rule = getRuleForSignalTesting(['float']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'float',
@@ -247,8 +248,8 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql([]);
       });
@@ -257,7 +258,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is one of" operator', () => {
       it('should filter 1 single float if it is set as an exception', async () => {
         const rule = getRuleForSignalTesting(['float']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'float',
@@ -267,16 +268,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql(['1.1', '1.2', '1.3']);
       });
 
       it('should filter 2 float if both are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['float']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'float',
@@ -286,16 +287,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql(['1.2', '1.3']);
       });
 
       it('should filter 3 float if all 3 are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['float']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'float',
@@ -305,16 +306,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql(['1.3']);
       });
 
       it('should filter 4 float if all are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['float']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'float',
@@ -324,8 +325,8 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql([]);
       });
@@ -334,7 +335,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is not one of" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
         const rule = getRuleForSignalTesting(['float']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'float',
@@ -344,15 +345,15 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql([]);
       });
 
       it('will return just the result we excluded', async () => {
         const rule = getRuleForSignalTesting(['float']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'float',
@@ -362,9 +363,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql(['1.0', '1.3']);
       });
@@ -373,7 +374,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"exists" operator', () => {
       it('will return 0 results if matching against float', async () => {
         const rule = getRuleForSignalTesting(['float']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'float',
@@ -382,8 +383,8 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql([]);
       });
@@ -392,7 +393,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"does not exist" operator', () => {
       it('will return 4 results if matching against float', async () => {
         const rule = getRuleForSignalTesting(['float']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'float',
@@ -401,9 +402,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
         expect(hits).to.eql(['1.0', '1.1', '1.2', '1.3']);
       });
@@ -412,9 +413,9 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is in list" operator', () => {
       describe('working against float values in the data set', () => {
         it('will return 3 results if we have a list that includes 1 float', async () => {
-          await importFile(supertest, 'float', ['1.0'], 'list_items.txt');
+          await importFile(supertest, log, 'float', ['1.0'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['float']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'float',
@@ -427,17 +428,17 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 3, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 3, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql(['1.1', '1.2', '1.3']);
         });
 
         it('will return 2 results if we have a list that includes 2 float', async () => {
-          await importFile(supertest, 'float', ['1.0', '1.2'], 'list_items.txt');
+          await importFile(supertest, log, 'float', ['1.0', '1.2'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['float']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'float',
@@ -450,17 +451,17 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 2, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql(['1.1', '1.3']);
         });
 
         it('will return 0 results if we have a list that includes all float', async () => {
-          await importFile(supertest, 'float', ['1.0', '1.1', '1.2', '1.3'], 'list_items.txt');
+          await importFile(supertest, log, 'float', ['1.0', '1.1', '1.2', '1.3'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['float']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'float',
@@ -473,8 +474,8 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql([]);
         });
@@ -482,9 +483,9 @@ export default ({ getService }: FtrProviderContext) => {
 
       describe('working against string values in the data set', () => {
         it('will return 3 results if we have a list that includes 1 float', async () => {
-          await importFile(supertest, 'float', ['1.0'], 'list_items.txt');
+          await importFile(supertest, log, 'float', ['1.0'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['float_as_string']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'float',
@@ -497,17 +498,17 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 3, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 3, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql(['1.1', '1.2', '1.3']);
         });
 
         it('will return 2 results if we have a list that includes 2 float', async () => {
-          await importFile(supertest, 'float', ['1.0', '1.2'], 'list_items.txt');
+          await importFile(supertest, log, 'float', ['1.0', '1.2'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['float_as_string']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'float',
@@ -520,17 +521,17 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 2, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql(['1.1', '1.3']);
         });
 
         it('will return 0 results if we have a list that includes all float', async () => {
-          await importFile(supertest, 'float', ['1.0', '1.1', '1.2', '1.3'], 'list_items.txt');
+          await importFile(supertest, log, 'float', ['1.0', '1.1', '1.2', '1.3'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['float_as_string']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'float',
@@ -543,16 +544,19 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql([]);
         });
 
         it('will return 1 result if we have a list which contains the float range of 1.0-1.2', async () => {
-          await importFile(supertest, 'float_range', ['1.0-1.2'], 'list_items.txt', ['1.0', '1.2']);
+          await importFile(supertest, log, 'float_range', ['1.0-1.2'], 'list_items.txt', [
+            '1.0',
+            '1.2',
+          ]);
           const rule = getRuleForSignalTesting(['float_as_string']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'float',
@@ -565,9 +569,9 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 1, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 1, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql(['1.3']);
         });
@@ -577,9 +581,9 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is not in list" operator', () => {
       describe('working against float values in the data set', () => {
         it('will return 1 result if we have a list that excludes 1 float', async () => {
-          await importFile(supertest, 'float', ['1.0'], 'list_items.txt');
+          await importFile(supertest, log, 'float', ['1.0'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['float']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'float',
@@ -592,17 +596,17 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 1, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 1, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql(['1.0']);
         });
 
         it('will return 2 results if we have a list that excludes 2 float', async () => {
-          await importFile(supertest, 'float', ['1.0', '1.2'], 'list_items.txt');
+          await importFile(supertest, log, 'float', ['1.0', '1.2'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['float']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'float',
@@ -615,17 +619,17 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 2, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql(['1.0', '1.2']);
         });
 
         it('will return 4 results if we have a list that excludes all float', async () => {
-          await importFile(supertest, 'float', ['1.0', '1.1', '1.2', '1.3'], 'list_items.txt');
+          await importFile(supertest, log, 'float', ['1.0', '1.1', '1.2', '1.3'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['float']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'float',
@@ -638,9 +642,9 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 4, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 4, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql(['1.0', '1.1', '1.2', '1.3']);
         });
@@ -648,9 +652,9 @@ export default ({ getService }: FtrProviderContext) => {
 
       describe('working against string values in the data set', () => {
         it('will return 1 result if we have a list that excludes 1 float', async () => {
-          await importFile(supertest, 'float', ['1.0'], 'list_items.txt');
+          await importFile(supertest, log, 'float', ['1.0'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['float_as_string']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'float',
@@ -663,17 +667,17 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 1, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 1, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql(['1.0']);
         });
 
         it('will return 2 results if we have a list that excludes 2 float', async () => {
-          await importFile(supertest, 'float', ['1.0', '1.2'], 'list_items.txt');
+          await importFile(supertest, log, 'float', ['1.0', '1.2'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['float_as_string']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'float',
@@ -686,17 +690,17 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 2, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql(['1.0', '1.2']);
         });
 
         it('will return 4 results if we have a list that excludes all float', async () => {
-          await importFile(supertest, 'float', ['1.0', '1.1', '1.2', '1.3'], 'list_items.txt');
+          await importFile(supertest, log, 'float', ['1.0', '1.1', '1.2', '1.3'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['float_as_string']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'float',
@@ -709,17 +713,20 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 4, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 4, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql(['1.0', '1.1', '1.2', '1.3']);
         });
 
         it('will return 3 results if we have a list which contains the float range of 1.0-1.2', async () => {
-          await importFile(supertest, 'float_range', ['1.0-1.2'], 'list_items.txt', ['1.0', '1.2']);
+          await importFile(supertest, log, 'float_range', ['1.0-1.2'], 'list_items.txt', [
+            '1.0',
+            '1.2',
+          ]);
           const rule = getRuleForSignalTesting(['float_as_string']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'float',
@@ -732,9 +739,9 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 3, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 3, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.float).sort();
           expect(hits).to.eql(['1.0', '1.1', '1.2']);
         });
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/integer.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/integer.ts
index 459034cd06569..f7a2951790c56 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/integer.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/integer.ts
@@ -30,6 +30,7 @@ import {
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
+  const log = getService('log');
 
   describe('Rule exception operators for data type integer', () => {
     before(async () => {
@@ -45,31 +46,31 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     beforeEach(async () => {
-      await createSignalsIndex(supertest);
-      await createListsIndex(supertest);
+      await createSignalsIndex(supertest, log);
+      await createListsIndex(supertest, log);
     });
 
     afterEach(async () => {
-      await deleteSignalsIndex(supertest);
-      await deleteAllAlerts(supertest);
-      await deleteAllExceptions(supertest);
-      await deleteListsIndex(supertest);
+      await deleteSignalsIndex(supertest, log);
+      await deleteAllAlerts(supertest, log);
+      await deleteAllExceptions(supertest, log);
+      await deleteListsIndex(supertest, log);
     });
 
     describe('"is" operator', () => {
       it('should find all the integer from the data set when no exceptions are set on the rule', async () => {
         const rule = getRuleForSignalTesting(['integer']);
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql(['1', '2', '3', '4']);
       });
 
       it('should filter 1 single integer if it is set as an exception', async () => {
         const rule = getRuleForSignalTesting(['integer']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'integer',
@@ -79,16 +80,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql(['2', '3', '4']);
       });
 
       it('should filter 2 integer if both are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['integer']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'integer',
@@ -106,16 +107,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql(['3', '4']);
       });
 
       it('should filter 3 integer if all 3 are as exceptions', async () => {
         const rule = getRuleForSignalTesting(['integer']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'integer',
@@ -141,16 +142,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql(['4']);
       });
 
       it('should filter 4 integer if all are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['integer']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'integer',
@@ -184,8 +185,8 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql([]);
       });
@@ -194,7 +195,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is not" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
         const rule = getRuleForSignalTesting(['integer']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'integer',
@@ -204,15 +205,15 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql([]);
       });
 
       it('will return just 1 result we excluded', async () => {
         const rule = getRuleForSignalTesting(['integer']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'integer',
@@ -222,16 +223,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql(['1']);
       });
 
       it('will return 0 results if we exclude two integer', async () => {
         const rule = getRuleForSignalTesting(['integer']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'integer',
@@ -249,8 +250,8 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql([]);
       });
@@ -259,7 +260,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is one of" operator', () => {
       it('should filter 1 single integer if it is set as an exception', async () => {
         const rule = getRuleForSignalTesting(['integer']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'integer',
@@ -269,16 +270,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql(['2', '3', '4']);
       });
 
       it('should filter 2 integer if both are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['integer']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'integer',
@@ -288,16 +289,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql(['3', '4']);
       });
 
       it('should filter 3 integer if all 3 are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['integer']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'integer',
@@ -307,16 +308,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql(['4']);
       });
 
       it('should filter 4 integer if all are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['integer']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'integer',
@@ -326,8 +327,8 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql([]);
       });
@@ -336,7 +337,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is not one of" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
         const rule = getRuleForSignalTesting(['integer']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'integer',
@@ -346,15 +347,15 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql([]);
       });
 
       it('will return just the result we excluded', async () => {
         const rule = getRuleForSignalTesting(['integer']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'integer',
@@ -364,9 +365,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql(['1', '4']);
       });
@@ -375,7 +376,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"exists" operator', () => {
       it('will return 0 results if matching against integer', async () => {
         const rule = getRuleForSignalTesting(['integer']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'integer',
@@ -384,8 +385,8 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql([]);
       });
@@ -394,7 +395,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"does not exist" operator', () => {
       it('will return 4 results if matching against integer', async () => {
         const rule = getRuleForSignalTesting(['integer']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'integer',
@@ -403,9 +404,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
         expect(hits).to.eql(['1', '2', '3', '4']);
       });
@@ -414,9 +415,9 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is in list" operator', () => {
       describe('working against integer values in the data set', () => {
         it('will return 3 results if we have a list that includes 1 integer', async () => {
-          await importFile(supertest, 'integer', ['1'], 'list_items.txt');
+          await importFile(supertest, log, 'integer', ['1'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['integer']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'integer',
@@ -429,17 +430,17 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 3, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 3, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql(['2', '3', '4']);
         });
 
         it('will return 2 results if we have a list that includes 2 integer', async () => {
-          await importFile(supertest, 'integer', ['1', '3'], 'list_items.txt');
+          await importFile(supertest, log, 'integer', ['1', '3'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['integer']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'integer',
@@ -452,17 +453,17 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 2, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql(['2', '4']);
         });
 
         it('will return 0 results if we have a list that includes all integer', async () => {
-          await importFile(supertest, 'integer', ['1', '2', '3', '4'], 'list_items.txt');
+          await importFile(supertest, log, 'integer', ['1', '2', '3', '4'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['integer']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'integer',
@@ -475,8 +476,8 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql([]);
         });
@@ -484,9 +485,9 @@ export default ({ getService }: FtrProviderContext) => {
 
       describe('working against string values in the data set', () => {
         it('will return 3 results if we have a list that includes 1 integer', async () => {
-          await importFile(supertest, 'integer', ['1'], 'list_items.txt');
+          await importFile(supertest, log, 'integer', ['1'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['integer_as_string']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'integer',
@@ -499,17 +500,17 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 3, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 3, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql(['2', '3', '4']);
         });
 
         it('will return 2 results if we have a list that includes 2 integer', async () => {
-          await importFile(supertest, 'integer', ['1', '3'], 'list_items.txt');
+          await importFile(supertest, log, 'integer', ['1', '3'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['integer_as_string']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'integer',
@@ -522,17 +523,17 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 2, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql(['2', '4']);
         });
 
         it('will return 0 results if we have a list that includes all integer', async () => {
-          await importFile(supertest, 'integer', ['1', '2', '3', '4'], 'list_items.txt');
+          await importFile(supertest, log, 'integer', ['1', '2', '3', '4'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['integer_as_string']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'integer',
@@ -545,16 +546,16 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql([]);
         });
 
         it('will return 1 result if we have a list which contains the integer range of 1-3', async () => {
-          await importFile(supertest, 'integer_range', ['1-3'], 'list_items.txt', ['1', '2']);
+          await importFile(supertest, log, 'integer_range', ['1-3'], 'list_items.txt', ['1', '2']);
           const rule = getRuleForSignalTesting(['integer_as_string']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'integer',
@@ -567,9 +568,9 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 1, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 1, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql(['4']);
         });
@@ -579,9 +580,9 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is not in list" operator', () => {
       describe('working against integer values in the data set', () => {
         it('will return 1 result if we have a list that excludes 1 integer', async () => {
-          await importFile(supertest, 'integer', ['1'], 'list_items.txt');
+          await importFile(supertest, log, 'integer', ['1'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['integer']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'integer',
@@ -594,17 +595,17 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 1, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 1, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql(['1']);
         });
 
         it('will return 2 results if we have a list that excludes 2 integer', async () => {
-          await importFile(supertest, 'integer', ['1', '3'], 'list_items.txt');
+          await importFile(supertest, log, 'integer', ['1', '3'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['integer']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'integer',
@@ -617,17 +618,17 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 2, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql(['1', '3']);
         });
 
         it('will return 4 results if we have a list that excludes all integer', async () => {
-          await importFile(supertest, 'integer', ['1', '2', '3', '4'], 'list_items.txt');
+          await importFile(supertest, log, 'integer', ['1', '2', '3', '4'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['integer']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'integer',
@@ -640,9 +641,9 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 4, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 4, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql(['1', '2', '3', '4']);
         });
@@ -650,9 +651,9 @@ export default ({ getService }: FtrProviderContext) => {
 
       describe('working against string values in the data set', () => {
         it('will return 1 result if we have a list that excludes 1 integer', async () => {
-          await importFile(supertest, 'integer', ['1'], 'list_items.txt');
+          await importFile(supertest, log, 'integer', ['1'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['integer_as_string']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'integer',
@@ -665,17 +666,17 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 1, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 1, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql(['1']);
         });
 
         it('will return 2 results if we have a list that excludes 2 integer', async () => {
-          await importFile(supertest, 'integer', ['1', '3'], 'list_items.txt');
+          await importFile(supertest, log, 'integer', ['1', '3'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['integer_as_string']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'integer',
@@ -688,17 +689,17 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 2, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql(['1', '3']);
         });
 
         it('will return 4 results if we have a list that excludes all integer', async () => {
-          await importFile(supertest, 'integer', ['1', '2', '3', '4'], 'list_items.txt');
+          await importFile(supertest, log, 'integer', ['1', '2', '3', '4'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['integer_as_string']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'integer',
@@ -711,17 +712,21 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 4, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 4, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql(['1', '2', '3', '4']);
         });
 
         it('will return 3 results if we have a list which contains the integer range of 1-3', async () => {
-          await importFile(supertest, 'integer_range', ['1-3'], 'list_items.txt', ['1', '2', '3']);
+          await importFile(supertest, log, 'integer_range', ['1-3'], 'list_items.txt', [
+            '1',
+            '2',
+            '3',
+          ]);
           const rule = getRuleForSignalTesting(['integer_as_string']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'integer',
@@ -734,9 +739,9 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 3, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 3, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.integer).sort();
           expect(hits).to.eql(['1', '2', '3']);
         });
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/ip.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/ip.ts
index 2497bf096550a..8e79b933be126 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/ip.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/ip.ts
@@ -30,6 +30,7 @@ import {
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
+  const log = getService('log');
 
   describe('Rule exception operators for data type ip', () => {
     before(async () => {
@@ -41,31 +42,31 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     beforeEach(async () => {
-      await createSignalsIndex(supertest);
-      await createListsIndex(supertest);
+      await createSignalsIndex(supertest, log);
+      await createListsIndex(supertest, log);
     });
 
     afterEach(async () => {
-      await deleteSignalsIndex(supertest);
-      await deleteAllAlerts(supertest);
-      await deleteAllExceptions(supertest);
-      await deleteListsIndex(supertest);
+      await deleteSignalsIndex(supertest, log);
+      await deleteAllAlerts(supertest, log);
+      await deleteAllExceptions(supertest, log);
+      await deleteListsIndex(supertest, log);
     });
 
     describe('"is" operator', () => {
       it('should find all the ips from the data set when no exceptions are set on the rule', async () => {
         const rule = getRuleForSignalTesting(['ip']);
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4']);
       });
 
       it('should filter 1 single ip if it is set as an exception', async () => {
         const rule = getRuleForSignalTesting(['ip']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -75,16 +76,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.2', '127.0.0.3', '127.0.0.4']);
       });
 
       it('should filter 2 ips if both are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['ip']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -102,16 +103,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.3', '127.0.0.4']);
       });
 
       it('should filter 3 ips if all 3 are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['ip']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -137,16 +138,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.4']);
       });
 
       it('should filter 4 ips if all are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['ip']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -180,15 +181,15 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([]);
       });
 
       it('should filter a CIDR range of "127.0.0.1/30"', async () => {
         const rule = getRuleForSignalTesting(['ip']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -198,9 +199,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.4']);
       });
@@ -209,7 +210,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is not" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
         const rule = getRuleForSignalTesting(['ip']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -219,15 +220,15 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([]);
       });
 
       it('will return just 1 result we excluded', async () => {
         const rule = getRuleForSignalTesting(['ip']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -237,16 +238,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.1']);
       });
 
       it('will return 0 results if we exclude two ips', async () => {
         const rule = getRuleForSignalTesting(['ip']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -264,8 +265,8 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([]);
       });
@@ -274,7 +275,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is one of" operator', () => {
       it('should filter 1 single ip if it is set as an exception', async () => {
         const rule = getRuleForSignalTesting(['ip']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -284,16 +285,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.2', '127.0.0.3', '127.0.0.4']);
       });
 
       it('should filter 2 ips if both are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['ip']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -303,16 +304,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.3', '127.0.0.4']);
       });
 
       it('should filter 3 ips if all 3 are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['ip']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -322,16 +323,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.4']);
       });
 
       it('should filter 4 ips if all are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['ip']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -341,8 +342,8 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([]);
       });
@@ -351,7 +352,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is not one of" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
         const rule = getRuleForSignalTesting(['ip']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -361,15 +362,15 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([]);
       });
 
       it('will return just the result we excluded', async () => {
         const rule = getRuleForSignalTesting(['ip']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -379,9 +380,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.1', '127.0.0.4']);
       });
@@ -390,7 +391,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"exists" operator', () => {
       it('will return 0 results if matching against ip', async () => {
         const rule = getRuleForSignalTesting(['ip']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -399,8 +400,8 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([]);
       });
@@ -409,7 +410,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"does not exist" operator', () => {
       it('will return 4 results if matching against ip', async () => {
         const rule = getRuleForSignalTesting(['ip']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -418,9 +419,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4']);
       });
@@ -428,9 +429,9 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('"is in list" operator', () => {
       it('will return 3 results if we have a list that includes 1 ip', async () => {
-        await importFile(supertest, 'ip', ['127.0.0.1'], 'list_items.txt');
+        await importFile(supertest, log, 'ip', ['127.0.0.1'], 'list_items.txt');
         const rule = getRuleForSignalTesting(['ip']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -443,17 +444,17 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.2', '127.0.0.3', '127.0.0.4']);
       });
 
       it('will return 2 results if we have a list that includes 2 ips', async () => {
-        await importFile(supertest, 'ip', ['127.0.0.1', '127.0.0.3'], 'list_items.txt');
+        await importFile(supertest, log, 'ip', ['127.0.0.1', '127.0.0.3'], 'list_items.txt');
         const rule = getRuleForSignalTesting(['ip']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -466,9 +467,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.2', '127.0.0.4']);
       });
@@ -476,12 +477,13 @@ export default ({ getService }: FtrProviderContext) => {
       it('will return 0 results if we have a list that includes all ips', async () => {
         await importFile(
           supertest,
+          log,
           'ip',
           ['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4'],
           'list_items.txt'
         );
         const rule = getRuleForSignalTesting(['ip']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -494,20 +496,20 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([]);
       });
 
       it('will return 1 result if we have a list which contains the CIDR range of "127.0.0.1/30"', async () => {
-        await importFile(supertest, 'ip_range', ['127.0.0.1/30'], 'list_items.txt', [
+        await importFile(supertest, log, 'ip_range', ['127.0.0.1/30'], 'list_items.txt', [
           '127.0.0.1',
           '127.0.0.2',
           '127.0.0.3',
         ]);
         const rule = getRuleForSignalTesting(['ip']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -520,21 +522,21 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.4']);
       });
 
       it('will return 1 result if we have a list which contains the range syntax of "127.0.0.1-127.0.0.3"', async () => {
-        await importFile(supertest, 'ip_range', ['127.0.0.1-127.0.0.3'], 'list_items.txt', [
+        await importFile(supertest, log, 'ip_range', ['127.0.0.1-127.0.0.3'], 'list_items.txt', [
           '127.0.0.1',
           '127.0.0.2',
           '127.0.0.3',
         ]);
         const rule = getRuleForSignalTesting(['ip']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -547,9 +549,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.4']);
       });
@@ -557,13 +559,14 @@ export default ({ getService }: FtrProviderContext) => {
       it('will return 1 result if we have a list which contains the range mixed syntax of "127.0.0.1/32,127.0.0.2-127.0.0.3"', async () => {
         await importFile(
           supertest,
+          log,
           'ip_range',
           ['127.0.0.1/32', '127.0.0.2-127.0.0.3'],
           'list_items.txt',
           ['127.0.0.1', '127.0.0.2', '127.0.0.3']
         );
         const rule = getRuleForSignalTesting(['ip']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -576,9 +579,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.4']);
       });
@@ -586,9 +589,9 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('"is not in list" operator', () => {
       it('will return 1 result if we have a list that excludes 1 ip', async () => {
-        await importFile(supertest, 'ip', ['127.0.0.1'], 'list_items.txt');
+        await importFile(supertest, log, 'ip', ['127.0.0.1'], 'list_items.txt');
         const rule = getRuleForSignalTesting(['ip']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -601,17 +604,17 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.1']);
       });
 
       it('will return 2 results if we have a list that excludes 2 ips', async () => {
-        await importFile(supertest, 'ip', ['127.0.0.1', '127.0.0.3'], 'list_items.txt');
+        await importFile(supertest, log, 'ip', ['127.0.0.1', '127.0.0.3'], 'list_items.txt');
         const rule = getRuleForSignalTesting(['ip']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -624,9 +627,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.1', '127.0.0.3']);
       });
@@ -634,12 +637,13 @@ export default ({ getService }: FtrProviderContext) => {
       it('will return 4 results if we have a list that excludes all ips', async () => {
         await importFile(
           supertest,
+          log,
           'ip',
           ['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4'],
           'list_items.txt'
         );
         const rule = getRuleForSignalTesting(['ip']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -652,21 +656,21 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4']);
       });
 
       it('will return 3 results if we have a list which contains the CIDR range of "127.0.0.1/30"', async () => {
-        await importFile(supertest, 'ip_range', ['127.0.0.1/30'], 'list_items.txt', [
+        await importFile(supertest, log, 'ip_range', ['127.0.0.1/30'], 'list_items.txt', [
           '127.0.0.1',
           '127.0.0.2',
           '127.0.0.3',
         ]);
         const rule = getRuleForSignalTesting(['ip']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -679,21 +683,21 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.1', '127.0.0.2', '127.0.0.3']);
       });
 
       it('will return 3 results if we have a list which contains the range syntax of "127.0.0.1-127.0.0.3"', async () => {
-        await importFile(supertest, 'ip_range', ['127.0.0.1-127.0.0.3'], 'list_items.txt', [
+        await importFile(supertest, log, 'ip_range', ['127.0.0.1-127.0.0.3'], 'list_items.txt', [
           '127.0.0.1',
           '127.0.0.2',
           '127.0.0.3',
         ]);
         const rule = getRuleForSignalTesting(['ip']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -706,9 +710,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql(['127.0.0.1', '127.0.0.2', '127.0.0.3']);
       });
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/ip_array.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/ip_array.ts
index efff288fddac2..a057fe0cb8001 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/ip_array.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/ip_array.ts
@@ -30,6 +30,7 @@ import {
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
+  const log = getService('log');
 
   describe('Rule exception operators for data type ip', () => {
     before(async () => {
@@ -41,24 +42,24 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     beforeEach(async () => {
-      await createSignalsIndex(supertest);
-      await createListsIndex(supertest);
+      await createSignalsIndex(supertest, log);
+      await createListsIndex(supertest, log);
     });
 
     afterEach(async () => {
-      await deleteSignalsIndex(supertest);
-      await deleteAllAlerts(supertest);
-      await deleteAllExceptions(supertest);
-      await deleteListsIndex(supertest);
+      await deleteSignalsIndex(supertest, log);
+      await deleteAllAlerts(supertest, log);
+      await deleteAllExceptions(supertest, log);
+      await deleteListsIndex(supertest, log);
     });
 
     describe('"is" operator', () => {
       it('should find all the ips from the data set when no exceptions are set on the rule', async () => {
         const rule = getRuleForSignalTesting(['ip_as_array']);
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([
           [],
@@ -70,7 +71,7 @@ export default ({ getService }: FtrProviderContext) => {
 
       it('should filter 1 single ip if it is set as an exception', async () => {
         const rule = getRuleForSignalTesting(['ip_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -80,9 +81,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([
           [],
@@ -93,7 +94,7 @@ export default ({ getService }: FtrProviderContext) => {
 
       it('should filter 2 ips if both are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['ip_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -111,16 +112,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([[], ['127.0.0.8', '127.0.0.9', '127.0.0.10']]);
       });
 
       it('should filter 3 ips if all 3 are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['ip_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -146,16 +147,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips.flat(Number.MAX_SAFE_INTEGER)).to.eql([]);
       });
 
       it('should filter a CIDR range of "127.0.0.1/30"', async () => {
         const rule = getRuleForSignalTesting(['ip_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -165,9 +166,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([
           [],
@@ -178,7 +179,7 @@ export default ({ getService }: FtrProviderContext) => {
 
       it('should filter a CIDR range of "127.0.0.4/31"', async () => {
         const rule = getRuleForSignalTesting(['ip_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -188,9 +189,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([[], ['127.0.0.8', '127.0.0.9', '127.0.0.10']]);
       });
@@ -199,7 +200,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is not" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
         const rule = getRuleForSignalTesting(['ip_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -209,15 +210,15 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([]);
       });
 
       it('will return just 1 result we excluded', async () => {
         const rule = getRuleForSignalTesting(['ip_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -227,16 +228,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4']]);
       });
 
       it('will return just 1 result we excluded 2 from the same array elements', async () => {
         const rule = getRuleForSignalTesting(['ip_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -252,16 +253,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4']]);
       });
 
       it('will return 0 results if we exclude two ips', async () => {
         const rule = getRuleForSignalTesting(['ip_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -279,8 +280,8 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([]);
       });
@@ -289,7 +290,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is one of" operator', () => {
       it('should filter 1 single ip if it is set as an exception', async () => {
         const rule = getRuleForSignalTesting(['ip_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -299,9 +300,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([
           [],
@@ -312,7 +313,7 @@ export default ({ getService }: FtrProviderContext) => {
 
       it('should filter 2 ips if both are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['ip_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -322,16 +323,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([[], ['127.0.0.8', '127.0.0.9', '127.0.0.10']]);
       });
 
       it('should filter 3 ips if all 3 are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['ip_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -341,9 +342,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips.flat(Number.MAX_SAFE_INTEGER)).to.eql([]);
       });
@@ -352,7 +353,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is not one of" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
         const rule = getRuleForSignalTesting(['ip_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -362,15 +363,15 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([]);
       });
 
       it('will return just the result we excluded', async () => {
         const rule = getRuleForSignalTesting(['ip_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -380,9 +381,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([
           ['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4'],
@@ -394,7 +395,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"exists" operator', () => {
       it('will return 1 empty result if matching against ip', async () => {
         const rule = getRuleForSignalTesting(['ip_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -403,9 +404,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips.flat(Number.MAX_SAFE_INTEGER)).to.eql([]);
       });
@@ -414,7 +415,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"does not exist" operator', () => {
       it('will return 3 results if matching against ip', async () => {
         const rule = getRuleForSignalTesting(['ip_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -423,9 +424,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([
           ['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4'],
@@ -437,9 +438,9 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('"is in list" operator', () => {
       it('will return 3 results if we have a list that includes 1 ip', async () => {
-        await importFile(supertest, 'ip', ['127.0.0.1'], 'list_items.txt');
+        await importFile(supertest, log, 'ip', ['127.0.0.1'], 'list_items.txt');
         const rule = getRuleForSignalTesting(['ip_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -452,9 +453,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([
           [],
@@ -464,9 +465,9 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('will return 2 results if we have a list that includes 2 ips', async () => {
-        await importFile(supertest, 'ip', ['127.0.0.1', '127.0.0.5'], 'list_items.txt');
+        await importFile(supertest, log, 'ip', ['127.0.0.1', '127.0.0.5'], 'list_items.txt');
         const rule = getRuleForSignalTesting(['ip_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -479,9 +480,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([[], ['127.0.0.8', '127.0.0.9', '127.0.0.10']]);
       });
@@ -489,12 +490,13 @@ export default ({ getService }: FtrProviderContext) => {
       it('will return 1 result if we have a list that includes all ips', async () => {
         await importFile(
           supertest,
+          log,
           'ip',
           ['127.0.0.1', '127.0.0.5', '127.0.0.8'],
           'list_items.txt'
         );
         const rule = getRuleForSignalTesting(['ip_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -507,9 +509,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips.flat(Number.MAX_SAFE_INTEGER)).to.eql([]);
       });
@@ -517,6 +519,7 @@ export default ({ getService }: FtrProviderContext) => {
       it('will return 2 results if we have a list which contains the CIDR ranges of "127.0.0.1/32, 127.0.0.2/31, 127.0.0.4/30"', async () => {
         await importFile(
           supertest,
+          log,
           'ip_range',
           ['127.0.0.1/32', '127.0.0.2/31', '127.0.0.4/30'],
           'list_items.txt',
@@ -531,7 +534,7 @@ export default ({ getService }: FtrProviderContext) => {
           ]
         );
         const rule = getRuleForSignalTesting(['ip_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -544,15 +547,15 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([[], ['127.0.0.8', '127.0.0.9', '127.0.0.10']]);
       });
 
       it('will return 2 results if we have a list which contains the range syntax of "127.0.0.1-127.0.0.7', async () => {
-        await importFile(supertest, 'ip_range', ['127.0.0.1-127.0.0.7'], 'list_items.txt', [
+        await importFile(supertest, log, 'ip_range', ['127.0.0.1-127.0.0.7'], 'list_items.txt', [
           '127.0.0.1',
           '127.0.0.2',
           '127.0.0.3',
@@ -562,7 +565,7 @@ export default ({ getService }: FtrProviderContext) => {
           '127.0.0.7',
         ]);
         const rule = getRuleForSignalTesting(['ip_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -575,9 +578,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([[], ['127.0.0.8', '127.0.0.9', '127.0.0.10']]);
       });
@@ -585,9 +588,9 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('"is not in list" operator', () => {
       it('will return 1 result if we have a list that excludes 1 ip', async () => {
-        await importFile(supertest, 'ip', ['127.0.0.1'], 'list_items.txt');
+        await importFile(supertest, log, 'ip', ['127.0.0.1'], 'list_items.txt');
         const rule = getRuleForSignalTesting(['ip_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -600,17 +603,17 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4']]);
       });
 
       it('will return 2 results if we have a list that excludes 2 ips', async () => {
-        await importFile(supertest, 'ip', ['127.0.0.1', '127.0.0.5'], 'list_items.txt');
+        await importFile(supertest, log, 'ip', ['127.0.0.1', '127.0.0.5'], 'list_items.txt');
         const rule = getRuleForSignalTesting(['ip_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -623,9 +626,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([
           ['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4'],
@@ -636,12 +639,13 @@ export default ({ getService }: FtrProviderContext) => {
       it('will return 3 results if we have a list that excludes all ips', async () => {
         await importFile(
           supertest,
+          log,
           'ip',
           ['127.0.0.1', '127.0.0.5', '127.0.0.8'],
           'list_items.txt'
         );
         const rule = getRuleForSignalTesting(['ip_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -654,9 +658,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([
           ['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4'],
@@ -668,6 +672,7 @@ export default ({ getService }: FtrProviderContext) => {
       it('will return 3 results if we have a list which contains the CIDR ranges of "127.0.0.1/32, 127.0.0.2/31, 127.0.0.4/30"', async () => {
         await importFile(
           supertest,
+          log,
           'ip_range',
           ['127.0.0.1/32', '127.0.0.2/31', '127.0.0.4/30'],
           'list_items.txt',
@@ -682,7 +687,7 @@ export default ({ getService }: FtrProviderContext) => {
           ]
         );
         const rule = getRuleForSignalTesting(['ip_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -695,9 +700,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([
           ['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4'],
@@ -706,7 +711,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('will return 3 results if we have a list which contains the range syntax of "127.0.0.1-127.0.0.7"', async () => {
-        await importFile(supertest, 'ip_range', ['127.0.0.1-127.0.0.7'], 'list_items.txt', [
+        await importFile(supertest, log, 'ip_range', ['127.0.0.1-127.0.0.7'], 'list_items.txt', [
           '127.0.0.1',
           '127.0.0.2',
           '127.0.0.3',
@@ -716,7 +721,7 @@ export default ({ getService }: FtrProviderContext) => {
           '127.0.0.7',
         ]);
         const rule = getRuleForSignalTesting(['ip_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'ip',
@@ -729,9 +734,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const ips = signalsOpen.hits.hits.map((hit) => hit._source?.ip).sort();
         expect(ips).to.eql([
           ['127.0.0.1', '127.0.0.2', '127.0.0.3', '127.0.0.4'],
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/keyword.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/keyword.ts
index 8a184025b00e2..1e004c259e441 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/keyword.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/keyword.ts
@@ -30,6 +30,7 @@ import {
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
+  const log = getService('log');
 
   describe('Rule exception operators for data type keyword', () => {
     before(async () => {
@@ -41,31 +42,31 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     beforeEach(async () => {
-      await createSignalsIndex(supertest);
-      await createListsIndex(supertest);
+      await createSignalsIndex(supertest, log);
+      await createListsIndex(supertest, log);
     });
 
     afterEach(async () => {
-      await deleteSignalsIndex(supertest);
-      await deleteAllAlerts(supertest);
-      await deleteAllExceptions(supertest);
-      await deleteListsIndex(supertest);
+      await deleteSignalsIndex(supertest, log);
+      await deleteAllAlerts(supertest, log);
+      await deleteAllExceptions(supertest, log);
+      await deleteListsIndex(supertest, log);
     });
 
     describe('"is" operator', () => {
       it('should find all the keyword from the data set when no exceptions are set on the rule', async () => {
         const rule = getRuleForSignalTesting(['keyword']);
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four', 'word one', 'word three', 'word two']);
       });
 
       it('should filter 1 single keyword if it is set as an exception', async () => {
         const rule = getRuleForSignalTesting(['keyword']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -75,16 +76,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four', 'word three', 'word two']);
       });
 
       it('should filter 2 keyword if both are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['keyword']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -102,16 +103,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four', 'word three']);
       });
 
       it('should filter 3 keyword if all 3 are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['keyword']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -137,16 +138,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four']);
       });
 
       it('should filter 4 keyword if all are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['keyword']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -180,8 +181,8 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([]);
       });
@@ -190,7 +191,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is not" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
         const rule = getRuleForSignalTesting(['keyword']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -200,15 +201,15 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([]);
       });
 
       it('will return just 1 result we excluded', async () => {
         const rule = getRuleForSignalTesting(['keyword']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -218,16 +219,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word one']);
       });
 
       it('will return 0 results if we exclude two keyword', async () => {
         const rule = getRuleForSignalTesting(['keyword']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -245,8 +246,8 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([]);
       });
@@ -255,7 +256,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is one of" operator', () => {
       it('should filter 1 single keyword if it is set as an exception', async () => {
         const rule = getRuleForSignalTesting(['keyword']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -265,16 +266,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four', 'word three', 'word two']);
       });
 
       it('should filter 2 keyword if both are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['keyword']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -284,16 +285,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four', 'word three']);
       });
 
       it('should filter 3 keyword if all 3 are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['keyword']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -303,16 +304,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four']);
       });
 
       it('should filter 4 keyword if all are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['keyword']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -322,8 +323,8 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([]);
       });
@@ -332,7 +333,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is not one of" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
         const rule = getRuleForSignalTesting(['keyword']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -342,15 +343,15 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([]);
       });
 
       it('will return just the result we excluded', async () => {
         const rule = getRuleForSignalTesting(['keyword']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -360,9 +361,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four', 'word one']);
       });
@@ -371,7 +372,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"exists" operator', () => {
       it('will return 0 results if matching against keyword', async () => {
         const rule = getRuleForSignalTesting(['keyword']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -380,8 +381,8 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([]);
       });
@@ -390,7 +391,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"does not exist" operator', () => {
       it('will return 4 results if matching against keyword', async () => {
         const rule = getRuleForSignalTesting(['keyword']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -399,9 +400,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four', 'word one', 'word three', 'word two']);
       });
@@ -409,10 +410,10 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('"is in list" operator', () => {
       it('will return 4 results if we have two lists with an AND contradiction keyword === "word one" AND keyword === "word two"', async () => {
-        await importFile(supertest, 'keyword', ['word one'], 'list_items_1.txt');
-        await importFile(supertest, 'keyword', ['word two'], 'list_items_2.txt');
+        await importFile(supertest, log, 'keyword', ['word one'], 'list_items_1.txt');
+        await importFile(supertest, log, 'keyword', ['word two'], 'list_items_2.txt');
         const rule = getRuleForSignalTesting(['keyword']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -434,17 +435,17 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four', 'word one', 'word three', 'word two']);
       });
 
       it('will return 3 results if we have a list that includes 1 keyword', async () => {
-        await importFile(supertest, 'keyword', ['word one'], 'list_items.txt');
+        await importFile(supertest, log, 'keyword', ['word one'], 'list_items.txt');
         const rule = getRuleForSignalTesting(['keyword']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -457,17 +458,17 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four', 'word three', 'word two']);
       });
 
       it('will return 2 results if we have a list that includes 2 keyword', async () => {
-        await importFile(supertest, 'keyword', ['word one', 'word three'], 'list_items.txt');
+        await importFile(supertest, log, 'keyword', ['word one', 'word three'], 'list_items.txt');
         const rule = getRuleForSignalTesting(['keyword']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -480,9 +481,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four', 'word two']);
       });
@@ -490,12 +491,13 @@ export default ({ getService }: FtrProviderContext) => {
       it('will return 0 results if we have a list that includes all keyword', async () => {
         await importFile(
           supertest,
+          log,
           'keyword',
           ['word one', 'word two', 'word three', 'word four'],
           'list_items.txt'
         );
         const rule = getRuleForSignalTesting(['keyword']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -508,8 +510,8 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([]);
       });
@@ -517,9 +519,9 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('"is not in list" operator', () => {
       it('will return 1 result if we have a list that excludes 1 keyword', async () => {
-        await importFile(supertest, 'keyword', ['word one'], 'list_items.txt');
+        await importFile(supertest, log, 'keyword', ['word one'], 'list_items.txt');
         const rule = getRuleForSignalTesting(['keyword']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -532,17 +534,17 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word one']);
       });
 
       it('will return 2 results if we have a list that excludes 2 keyword', async () => {
-        await importFile(supertest, 'keyword', ['word one', 'word three'], 'list_items.txt');
+        await importFile(supertest, log, 'keyword', ['word one', 'word three'], 'list_items.txt');
         const rule = getRuleForSignalTesting(['keyword']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -555,9 +557,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word one', 'word three']);
       });
@@ -565,12 +567,13 @@ export default ({ getService }: FtrProviderContext) => {
       it('will return 4 results if we have a list that excludes all keyword', async () => {
         await importFile(
           supertest,
+          log,
           'keyword',
           ['word one', 'word two', 'word three', 'word four'],
           'list_items.txt'
         );
         const rule = getRuleForSignalTesting(['keyword']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -583,9 +586,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql(['word four', 'word one', 'word three', 'word two']);
       });
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/keyword_array.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/keyword_array.ts
index ee2f3e287cd66..b43cc818ec01d 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/keyword_array.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/keyword_array.ts
@@ -30,6 +30,7 @@ import {
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
+  const log = getService('log');
 
   describe('Rule exception operators for data type keyword', () => {
     before(async () => {
@@ -43,24 +44,24 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     beforeEach(async () => {
-      await createSignalsIndex(supertest);
-      await createListsIndex(supertest);
+      await createSignalsIndex(supertest, log);
+      await createListsIndex(supertest, log);
     });
 
     afterEach(async () => {
-      await deleteSignalsIndex(supertest);
-      await deleteAllAlerts(supertest);
-      await deleteAllExceptions(supertest);
-      await deleteListsIndex(supertest);
+      await deleteSignalsIndex(supertest, log);
+      await deleteAllAlerts(supertest, log);
+      await deleteAllExceptions(supertest, log);
+      await deleteListsIndex(supertest, log);
     });
 
     describe('"is" operator', () => {
       it('should find all the keyword from the data set when no exceptions are set on the rule', async () => {
         const rule = getRuleForSignalTesting(['keyword_as_array']);
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([
           [],
@@ -72,7 +73,7 @@ export default ({ getService }: FtrProviderContext) => {
 
       it('should filter 1 single keyword if it is set as an exception', async () => {
         const rule = getRuleForSignalTesting(['keyword_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -82,9 +83,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([
           [],
@@ -95,7 +96,7 @@ export default ({ getService }: FtrProviderContext) => {
 
       it('should filter 2 keyword if both are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['keyword_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -113,16 +114,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([[], ['word eight', 'word nine', 'word ten']]);
       });
 
       it('should filter 3 keyword if all 3 are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['keyword_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -148,9 +149,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits.flat(Number.MAX_SAFE_INTEGER)).to.eql([]);
       });
@@ -159,7 +160,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is not" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
         const rule = getRuleForSignalTesting(['keyword_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -169,15 +170,15 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([]);
       });
 
       it('will return just 1 result we excluded', async () => {
         const rule = getRuleForSignalTesting(['keyword_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -187,16 +188,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([['word one', 'word two', 'word three', 'word four']]);
       });
 
       it('will return 0 results if we exclude two keyword', async () => {
         const rule = getRuleForSignalTesting(['keyword_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -214,8 +215,8 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([]);
       });
@@ -224,7 +225,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is one of" operator', () => {
       it('should filter 1 single keyword if it is set as an exception', async () => {
         const rule = getRuleForSignalTesting(['keyword_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -234,9 +235,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([
           [],
@@ -247,7 +248,7 @@ export default ({ getService }: FtrProviderContext) => {
 
       it('should filter 2 keyword if both are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['keyword_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -257,16 +258,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([[], ['word eight', 'word nine', 'word ten']]);
       });
 
       it('should filter 3 keyword if all 3 are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['keyword_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -276,9 +277,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits.flat(Number.MAX_SAFE_INTEGER)).to.eql([]);
       });
@@ -287,7 +288,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is not one of" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
         const rule = getRuleForSignalTesting(['keyword_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -297,15 +298,15 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([]);
       });
 
       it('will return just the result we excluded', async () => {
         const rule = getRuleForSignalTesting(['keyword_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -315,9 +316,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([
           ['word five', null, 'word six', 'word seven'],
@@ -329,7 +330,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"exists" operator', () => {
       it('will return 1 results if matching against keyword for the empty array', async () => {
         const rule = getRuleForSignalTesting(['keyword_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -338,9 +339,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits.flat(Number.MAX_SAFE_INTEGER)).to.eql([]);
       });
@@ -349,7 +350,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"does not exist" operator', () => {
       it('will return 3 results if matching against keyword', async () => {
         const rule = getRuleForSignalTesting(['keyword_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -358,9 +359,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([
           ['word eight', 'word nine', 'word ten'],
@@ -372,10 +373,10 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('"is in list" operator', () => {
       it('will return 4 results if we have two lists with an AND contradiction keyword === "word one" AND keyword === "word five"', async () => {
-        await importFile(supertest, 'keyword', ['word one'], 'list_items_1.txt');
-        await importFile(supertest, 'keyword', ['word five'], 'list_items_2.txt');
+        await importFile(supertest, log, 'keyword', ['word one'], 'list_items_1.txt');
+        await importFile(supertest, log, 'keyword', ['word five'], 'list_items_2.txt');
         const rule = getRuleForSignalTesting(['keyword_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -397,9 +398,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([
           [],
@@ -410,10 +411,10 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('will return 3 results if we have two lists with an AND keyword === "word one" AND keyword === "word two" since we have an array', async () => {
-        await importFile(supertest, 'keyword', ['word one'], 'list_items_1.txt');
-        await importFile(supertest, 'keyword', ['word two'], 'list_items_2.txt');
+        await importFile(supertest, log, 'keyword', ['word one'], 'list_items_1.txt');
+        await importFile(supertest, log, 'keyword', ['word two'], 'list_items_2.txt');
         const rule = getRuleForSignalTesting(['keyword_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -435,9 +436,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([
           [],
@@ -447,9 +448,9 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('will return 3 results if we have a list that includes 1 keyword', async () => {
-        await importFile(supertest, 'keyword', ['word one'], 'list_items.txt');
+        await importFile(supertest, log, 'keyword', ['word one'], 'list_items.txt');
         const rule = getRuleForSignalTesting(['keyword_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -462,9 +463,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([
           [],
@@ -474,9 +475,9 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('will return 2 results if we have a list that includes 2 keyword', async () => {
-        await importFile(supertest, 'keyword', ['word one', 'word six'], 'list_items.txt');
+        await importFile(supertest, log, 'keyword', ['word one', 'word six'], 'list_items.txt');
         const rule = getRuleForSignalTesting(['keyword_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -489,9 +490,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([[], ['word eight', 'word nine', 'word ten']]);
       });
@@ -499,12 +500,13 @@ export default ({ getService }: FtrProviderContext) => {
       it('will return only the empty array for results if we have a list that includes all keyword', async () => {
         await importFile(
           supertest,
+          log,
           'keyword',
           ['word one', 'word five', 'word eight'],
           'list_items.txt'
         );
         const rule = getRuleForSignalTesting(['keyword_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -517,9 +519,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits.flat(Number.MAX_SAFE_INTEGER)).to.eql([]);
       });
@@ -527,9 +529,9 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('"is not in list" operator', () => {
       it('will return 1 result if we have a list that excludes 1 keyword', async () => {
-        await importFile(supertest, 'keyword', ['word one'], 'list_items.txt');
+        await importFile(supertest, log, 'keyword', ['word one'], 'list_items.txt');
         const rule = getRuleForSignalTesting(['keyword_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -542,17 +544,17 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([['word one', 'word two', 'word three', 'word four']]);
       });
 
       it('will return 1 result if we have a list that excludes 1 keyword but repeat 2 elements from the array in the list', async () => {
-        await importFile(supertest, 'keyword', ['word one', 'word two'], 'list_items.txt');
+        await importFile(supertest, log, 'keyword', ['word one', 'word two'], 'list_items.txt');
         const rule = getRuleForSignalTesting(['keyword_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -565,17 +567,17 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([['word one', 'word two', 'word three', 'word four']]);
       });
 
       it('will return 2 results if we have a list that excludes 2 keyword', async () => {
-        await importFile(supertest, 'keyword', ['word one', 'word five'], 'list_items.txt');
+        await importFile(supertest, log, 'keyword', ['word one', 'word five'], 'list_items.txt');
         const rule = getRuleForSignalTesting(['keyword_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -588,9 +590,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([
           ['word five', null, 'word six', 'word seven'],
@@ -601,12 +603,13 @@ export default ({ getService }: FtrProviderContext) => {
       it('will return 3 results if we have a list that excludes 3 items', async () => {
         await importFile(
           supertest,
+          log,
           'keyword',
           ['word one', 'word six', 'word ten'],
           'list_items.txt'
         );
         const rule = getRuleForSignalTesting(['keyword_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'keyword',
@@ -619,9 +622,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.keyword).sort();
         expect(hits).to.eql([
           ['word eight', 'word nine', 'word ten'],
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/long.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/long.ts
index f5bf3b627bc2f..36a2ff1e19cbf 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/long.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/long.ts
@@ -30,6 +30,7 @@ import {
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
+  const log = getService('log');
 
   describe('Rule exception operators for data type long', () => {
     before(async () => {
@@ -43,31 +44,31 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     beforeEach(async () => {
-      await createSignalsIndex(supertest);
-      await createListsIndex(supertest);
+      await createSignalsIndex(supertest, log);
+      await createListsIndex(supertest, log);
     });
 
     afterEach(async () => {
-      await deleteSignalsIndex(supertest);
-      await deleteAllAlerts(supertest);
-      await deleteAllExceptions(supertest);
-      await deleteListsIndex(supertest);
+      await deleteSignalsIndex(supertest, log);
+      await deleteAllAlerts(supertest, log);
+      await deleteAllExceptions(supertest, log);
+      await deleteListsIndex(supertest, log);
     });
 
     describe('"is" operator', () => {
       it('should find all the long from the data set when no exceptions are set on the rule', async () => {
         const rule = getRuleForSignalTesting(['long']);
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql(['1', '2', '3', '4']);
       });
 
       it('should filter 1 single long if it is set as an exception', async () => {
         const rule = getRuleForSignalTesting(['long']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'long',
@@ -77,16 +78,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql(['2', '3', '4']);
       });
 
       it('should filter 2 long if both are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['long']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'long',
@@ -104,16 +105,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql(['3', '4']);
       });
 
       it('should filter 3 long if all 3 are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['long']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'long',
@@ -139,16 +140,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql(['4']);
       });
 
       it('should filter 4 long if all are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['long']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'long',
@@ -182,8 +183,8 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql([]);
       });
@@ -192,7 +193,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is not" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
         const rule = getRuleForSignalTesting(['long']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'long',
@@ -202,15 +203,15 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql([]);
       });
 
       it('will return just 1 result we excluded', async () => {
         const rule = getRuleForSignalTesting(['long']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'long',
@@ -220,16 +221,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql(['1']);
       });
 
       it('will return 0 results if we exclude two long', async () => {
         const rule = getRuleForSignalTesting(['long']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'long',
@@ -247,8 +248,8 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql([]);
       });
@@ -257,7 +258,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is one of" operator', () => {
       it('should filter 1 single long if it is set as an exception', async () => {
         const rule = getRuleForSignalTesting(['long']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'long',
@@ -267,16 +268,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql(['2', '3', '4']);
       });
 
       it('should filter 2 long if both are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['long']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'long',
@@ -286,16 +287,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql(['3', '4']);
       });
 
       it('should filter 3 long if all 3 are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['long']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'long',
@@ -305,16 +306,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql(['4']);
       });
 
       it('should filter 4 long if all are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['long']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'long',
@@ -324,8 +325,8 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql([]);
       });
@@ -334,7 +335,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is not one of" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
         const rule = getRuleForSignalTesting(['long']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'long',
@@ -344,15 +345,15 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql([]);
       });
 
       it('will return just the result we excluded', async () => {
         const rule = getRuleForSignalTesting(['long']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'long',
@@ -362,9 +363,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql(['1', '4']);
       });
@@ -373,7 +374,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"exists" operator', () => {
       it('will return 0 results if matching against long', async () => {
         const rule = getRuleForSignalTesting(['long']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'long',
@@ -382,8 +383,8 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql([]);
       });
@@ -392,7 +393,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"does not exist" operator', () => {
       it('will return 4 results if matching against long', async () => {
         const rule = getRuleForSignalTesting(['long']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'long',
@@ -401,9 +402,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
         expect(hits).to.eql(['1', '2', '3', '4']);
       });
@@ -412,9 +413,9 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is in list" operator', () => {
       describe('working against long values in the data set', () => {
         it('will return 3 results if we have a list that includes 1 long', async () => {
-          await importFile(supertest, 'long', ['1'], 'list_items.txt');
+          await importFile(supertest, log, 'long', ['1'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['long']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'long',
@@ -427,17 +428,17 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 3, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 3, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql(['2', '3', '4']);
         });
 
         it('will return 2 results if we have a list that includes 2 long', async () => {
-          await importFile(supertest, 'long', ['1', '3'], 'list_items.txt');
+          await importFile(supertest, log, 'long', ['1', '3'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['long']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'long',
@@ -450,17 +451,17 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 2, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql(['2', '4']);
         });
 
         it('will return 0 results if we have a list that includes all long', async () => {
-          await importFile(supertest, 'long', ['1', '2', '3', '4'], 'list_items.txt');
+          await importFile(supertest, log, 'long', ['1', '2', '3', '4'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['long']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'long',
@@ -473,8 +474,8 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql([]);
         });
@@ -482,9 +483,9 @@ export default ({ getService }: FtrProviderContext) => {
 
       describe('working against string values in the data set', () => {
         it('will return 3 results if we have a list that includes 1 long', async () => {
-          await importFile(supertest, 'long', ['1'], 'list_items.txt');
+          await importFile(supertest, log, 'long', ['1'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['long_as_string']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'long',
@@ -497,17 +498,17 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 3, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 3, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql(['2', '3', '4']);
         });
 
         it('will return 2 results if we have a list that includes 2 long', async () => {
-          await importFile(supertest, 'long', ['1', '3'], 'list_items.txt');
+          await importFile(supertest, log, 'long', ['1', '3'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['long_as_string']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'long',
@@ -520,17 +521,17 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 2, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql(['2', '4']);
         });
 
         it('will return 0 results if we have a list that includes all long', async () => {
-          await importFile(supertest, 'long', ['1', '2', '3', '4'], 'list_items.txt');
+          await importFile(supertest, log, 'long', ['1', '2', '3', '4'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['long_as_string']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'long',
@@ -543,16 +544,20 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql([]);
         });
 
         it('will return 1 result if we have a list which contains the long range of 1-3', async () => {
-          await importFile(supertest, 'long_range', ['1-3'], 'list_items.txt', ['1', '2', '3']);
+          await importFile(supertest, log, 'long_range', ['1-3'], 'list_items.txt', [
+            '1',
+            '2',
+            '3',
+          ]);
           const rule = getRuleForSignalTesting(['long_as_string']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'long',
@@ -565,9 +570,9 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 1, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 1, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql(['4']);
         });
@@ -577,9 +582,9 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is not in list" operator', () => {
       describe('working against long values in the data set', () => {
         it('will return 1 result if we have a list that excludes 1 long', async () => {
-          await importFile(supertest, 'long', ['1'], 'list_items.txt');
+          await importFile(supertest, log, 'long', ['1'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['long']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'long',
@@ -592,17 +597,17 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 1, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 1, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql(['1']);
         });
 
         it('will return 2 results if we have a list that excludes 2 long', async () => {
-          await importFile(supertest, 'long', ['1', '3'], 'list_items.txt');
+          await importFile(supertest, log, 'long', ['1', '3'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['long']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'long',
@@ -615,17 +620,17 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 2, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql(['1', '3']);
         });
 
         it('will return 4 results if we have a list that excludes all long', async () => {
-          await importFile(supertest, 'long', ['1', '2', '3', '4'], 'list_items.txt');
+          await importFile(supertest, log, 'long', ['1', '2', '3', '4'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['long']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'long',
@@ -638,9 +643,9 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 4, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 4, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql(['1', '2', '3', '4']);
         });
@@ -648,9 +653,9 @@ export default ({ getService }: FtrProviderContext) => {
 
       describe('working against string values in the data set', () => {
         it('will return 1 result if we have a list that excludes 1 long', async () => {
-          await importFile(supertest, 'long', ['1'], 'list_items.txt');
+          await importFile(supertest, log, 'long', ['1'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['long_as_string']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'long',
@@ -663,17 +668,17 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 1, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 1, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql(['1']);
         });
 
         it('will return 2 results if we have a list that excludes 2 long', async () => {
-          await importFile(supertest, 'long', ['1', '3'], 'list_items.txt');
+          await importFile(supertest, log, 'long', ['1', '3'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['long_as_string']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'long',
@@ -686,17 +691,17 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 2, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql(['1', '3']);
         });
 
         it('will return 4 results if we have a list that excludes all long', async () => {
-          await importFile(supertest, 'long', ['1', '2', '3', '4'], 'list_items.txt');
+          await importFile(supertest, log, 'long', ['1', '2', '3', '4'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['long_as_string']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'long',
@@ -709,17 +714,21 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 4, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 4, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql(['1', '2', '3', '4']);
         });
 
         it('will return 3 results if we have a list which contains the long range of 1-3', async () => {
-          await importFile(supertest, 'long_range', ['1-3'], 'list_items.txt', ['1', '2', '3']);
+          await importFile(supertest, log, 'long_range', ['1-3'], 'list_items.txt', [
+            '1',
+            '2',
+            '3',
+          ]);
           const rule = getRuleForSignalTesting(['long_as_string']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'long',
@@ -732,9 +741,9 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 3, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 3, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.long).sort();
           expect(hits).to.eql(['1', '2', '3']);
         });
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/text.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/text.ts
index ff2f680654047..6a0eebb4161f5 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/text.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/text.ts
@@ -31,6 +31,7 @@ import {
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
+  const log = getService('log');
 
   describe('Rule exception operators for data type text', () => {
     before(async () => {
@@ -44,31 +45,31 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     beforeEach(async () => {
-      await createSignalsIndex(supertest);
-      await createListsIndex(supertest);
+      await createSignalsIndex(supertest, log);
+      await createListsIndex(supertest, log);
     });
 
     afterEach(async () => {
-      await deleteSignalsIndex(supertest);
-      await deleteAllAlerts(supertest);
-      await deleteAllExceptions(supertest);
-      await deleteListsIndex(supertest);
+      await deleteSignalsIndex(supertest, log);
+      await deleteAllAlerts(supertest, log);
+      await deleteAllExceptions(supertest, log);
+      await deleteListsIndex(supertest, log);
     });
 
     describe('"is" operator', () => {
       it('should find all the text from the data set when no exceptions are set on the rule', async () => {
         const rule = getRuleForSignalTesting(['text']);
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word four', 'word one', 'word three', 'word two']);
       });
 
       it('should filter 1 single text if it is set as an exception', async () => {
         const rule = getRuleForSignalTesting(['text']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -78,16 +79,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word four', 'word three', 'word two']);
       });
 
       it('should filter 2 text if both are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['text']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -105,16 +106,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word four', 'word three']);
       });
 
       it('should filter 3 text if all 3 are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['text']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -140,16 +141,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word four']);
       });
 
       it('should filter 4 text if all are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['text']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -183,15 +184,15 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([]);
       });
 
       it('should filter 1 single text using a single word', async () => {
         const rule = getRuleForSignalTesting(['text']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -201,16 +202,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word four', 'word three', 'word two']);
       });
 
       it('should filter all words using a common piece of text', async () => {
         const rule = getRuleForSignalTesting(['text']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -220,15 +221,15 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([]);
       });
 
       it('should filter 1 single text with punctuation added', async () => {
         const rule = getRuleForSignalTesting(['text']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -238,9 +239,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word four', 'word three', 'word two']);
       });
@@ -249,7 +250,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is not" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
         const rule = getRuleForSignalTesting(['text']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -259,15 +260,15 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([]);
       });
 
       it('will return just 1 result we excluded', async () => {
         const rule = getRuleForSignalTesting(['text']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -277,16 +278,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word one']);
       });
 
       it('will return 0 results if we exclude two text', async () => {
         const rule = getRuleForSignalTesting(['text']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -304,15 +305,15 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([]);
       });
 
       it('should filter 1 single text using a single word', async () => {
         const rule = getRuleForSignalTesting(['text']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -322,16 +323,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word one']);
       });
 
       it('should filter all words using a common piece of text', async () => {
         const rule = getRuleForSignalTesting(['text']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -341,16 +342,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word four', 'word one', 'word three', 'word two']);
       });
 
       it('should filter 1 single text with punctuation added', async () => {
         const rule = getRuleForSignalTesting(['text']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -360,9 +361,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word one']);
       });
@@ -371,7 +372,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is one of" operator', () => {
       it('should filter 1 single text if it is set as an exception', async () => {
         const rule = getRuleForSignalTesting(['text']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -381,16 +382,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word four', 'word three', 'word two']);
       });
 
       it('should filter 2 text if both are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['text']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -400,16 +401,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word four', 'word three']);
       });
 
       it('should filter 3 text if all 3 are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['text']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -419,16 +420,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word four']);
       });
 
       it('should filter 4 text if all are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['text']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -438,8 +439,8 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([]);
       });
@@ -448,7 +449,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is not one of" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
         const rule = getRuleForSignalTesting(['text']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -458,15 +459,15 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([]);
       });
 
       it('will return just the result we excluded', async () => {
         const rule = getRuleForSignalTesting(['text']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -476,9 +477,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word four', 'word one']);
       });
@@ -487,7 +488,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"exists" operator', () => {
       it('will return 0 results if matching against text', async () => {
         const rule = getRuleForSignalTesting(['text']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -496,8 +497,8 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([]);
       });
@@ -506,7 +507,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"does not exist" operator', () => {
       it('will return 4 results if matching against text', async () => {
         const rule = getRuleForSignalTesting(['text']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -515,9 +516,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql(['word four', 'word one', 'word three', 'word two']);
       });
@@ -526,9 +527,9 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is in list" operator', () => {
       describe('working against text values without spaces', () => {
         it('will return 3 results if we have a list that includes 1 text', async () => {
-          await importFile(supertest, 'text', ['one'], 'list_items.txt');
+          await importFile(supertest, log, 'text', ['one'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['text_no_spaces']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'text',
@@ -541,17 +542,17 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 3, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 3, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql(['four', 'three', 'two']);
         });
 
         it('will return 2 results if we have a list that includes 2 text', async () => {
-          await importFile(supertest, 'text', ['one', 'three'], 'list_items.txt');
+          await importFile(supertest, log, 'text', ['one', 'three'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['text_no_spaces']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'text',
@@ -564,9 +565,9 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 2, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql(['four', 'two']);
         });
@@ -574,12 +575,13 @@ export default ({ getService }: FtrProviderContext) => {
         it('will return 0 results if we have a list that includes all text', async () => {
           await importTextFile(
             supertest,
+            log,
             'text',
             ['one', 'two', 'three', 'four'],
             'list_items.txt'
           );
           const rule = getRuleForSignalTesting(['text_no_spaces']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'text',
@@ -592,8 +594,8 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql([]);
         });
@@ -601,9 +603,9 @@ export default ({ getService }: FtrProviderContext) => {
 
       describe('working against text values with spaces', () => {
         it('will return 3 results if we have a list that includes 1 text', async () => {
-          await importTextFile(supertest, 'text', ['word one'], 'list_items.txt');
+          await importTextFile(supertest, log, 'text', ['word one'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['text']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'text',
@@ -616,9 +618,9 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 3, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 3, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql(['word four', 'word three', 'word two']);
         });
@@ -626,12 +628,13 @@ export default ({ getService }: FtrProviderContext) => {
         it('will return 3 results if we have a list that includes 1 text with additional wording', async () => {
           await importTextFile(
             supertest,
+            log,
             'text',
             ['word one additional wording'],
             'list_items.txt'
           );
           const rule = getRuleForSignalTesting(['text']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'text',
@@ -644,17 +647,17 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 3, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 3, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql(['word four', 'word three', 'word two']);
         });
 
         it('will return 2 results if we have a list that includes 2 text', async () => {
-          await importFile(supertest, 'text', ['word one', 'word three'], 'list_items.txt');
+          await importFile(supertest, log, 'text', ['word one', 'word three'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['text']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'text',
@@ -667,9 +670,9 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 2, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql(['word four', 'word two']);
         });
@@ -677,12 +680,13 @@ export default ({ getService }: FtrProviderContext) => {
         it('will return 0 results if we have a list that includes all text', async () => {
           await importTextFile(
             supertest,
+            log,
             'text',
             ['word one', 'word two', 'word three', 'word four'],
             'list_items.txt'
           );
           const rule = getRuleForSignalTesting(['text']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'text',
@@ -695,8 +699,8 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql([]);
         });
@@ -706,9 +710,9 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is not in list" operator', () => {
       describe('working against text values without spaces', () => {
         it('will return 1 result if we have a list that excludes 1 text', async () => {
-          await importTextFile(supertest, 'text', ['one'], 'list_items.txt');
+          await importTextFile(supertest, log, 'text', ['one'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['text_no_spaces']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'text',
@@ -721,17 +725,17 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 1, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 1, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql(['one']);
         });
 
         it('will return 2 results if we have a list that excludes 2 text', async () => {
-          await importTextFile(supertest, 'text', ['one', 'three'], 'list_items.txt');
+          await importTextFile(supertest, log, 'text', ['one', 'three'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['text_no_spaces']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'text',
@@ -744,9 +748,9 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 2, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql(['one', 'three']);
         });
@@ -754,12 +758,13 @@ export default ({ getService }: FtrProviderContext) => {
         it('will return 4 results if we have a list that excludes all text', async () => {
           await importTextFile(
             supertest,
+            log,
             'text',
             ['one', 'two', 'three', 'four'],
             'list_items.txt'
           );
           const rule = getRuleForSignalTesting(['text_no_spaces']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'text',
@@ -772,9 +777,9 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 4, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 4, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql(['four', 'one', 'three', 'two']);
         });
@@ -782,9 +787,9 @@ export default ({ getService }: FtrProviderContext) => {
 
       describe('working against text values with spaces', () => {
         it('will return 1 result if we have a list that excludes 1 text', async () => {
-          await importTextFile(supertest, 'text', ['word one'], 'list_items.txt');
+          await importTextFile(supertest, log, 'text', ['word one'], 'list_items.txt');
           const rule = getRuleForSignalTesting(['text']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'text',
@@ -797,9 +802,9 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 1, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 1, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql(['word one']);
         });
@@ -807,12 +812,13 @@ export default ({ getService }: FtrProviderContext) => {
         it('will return 1 result if we have a list that excludes 1 text with additional wording', async () => {
           await importTextFile(
             supertest,
+            log,
             'text',
             ['word one additional wording'],
             'list_items.txt'
           );
           const rule = getRuleForSignalTesting(['text']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'text',
@@ -825,17 +831,23 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 1, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 1, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql(['word one']);
         });
 
         it('will return 2 results if we have a list that excludes 2 text', async () => {
-          await importTextFile(supertest, 'text', ['word one', 'word three'], 'list_items.txt');
+          await importTextFile(
+            supertest,
+            log,
+            'text',
+            ['word one', 'word three'],
+            'list_items.txt'
+          );
           const rule = getRuleForSignalTesting(['text']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'text',
@@ -848,9 +860,9 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 2, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 2, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql(['word one', 'word three']);
         });
@@ -858,12 +870,13 @@ export default ({ getService }: FtrProviderContext) => {
         it('will return 4 results if we have a list that excludes all text', async () => {
           await importTextFile(
             supertest,
+            log,
             'text',
             ['word one', 'word two', 'word three', 'word four'],
             'list_items.txt'
           );
           const rule = getRuleForSignalTesting(['text']);
-          const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+          const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
             [
               {
                 field: 'text',
@@ -876,9 +889,9 @@ export default ({ getService }: FtrProviderContext) => {
               },
             ],
           ]);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 4, [id]);
-          const signalsOpen = await getSignalsById(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 4, [id]);
+          const signalsOpen = await getSignalsById(supertest, log, id);
           const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
           expect(hits).to.eql(['word four', 'word one', 'word three', 'word two']);
         });
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/text_array.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/text_array.ts
index 6d25124667132..f079cc1e0fac1 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/text_array.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/exception_operators_data_types/text_array.ts
@@ -30,6 +30,7 @@ import {
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
+  const log = getService('log');
 
   describe('Rule exception operators for data type text', () => {
     before(async () => {
@@ -41,24 +42,24 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     beforeEach(async () => {
-      await createSignalsIndex(supertest);
-      await createListsIndex(supertest);
+      await createSignalsIndex(supertest, log);
+      await createListsIndex(supertest, log);
     });
 
     afterEach(async () => {
-      await deleteSignalsIndex(supertest);
-      await deleteAllAlerts(supertest);
-      await deleteAllExceptions(supertest);
-      await deleteListsIndex(supertest);
+      await deleteSignalsIndex(supertest, log);
+      await deleteAllAlerts(supertest, log);
+      await deleteAllExceptions(supertest, log);
+      await deleteListsIndex(supertest, log);
     });
 
     describe('"is" operator', () => {
       it('should find all the text from the data set when no exceptions are set on the rule', async () => {
         const rule = getRuleForSignalTesting(['text_as_array']);
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([
           [],
@@ -70,7 +71,7 @@ export default ({ getService }: FtrProviderContext) => {
 
       it('should filter 1 single text if it is set as an exception', async () => {
         const rule = getRuleForSignalTesting(['text_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -80,9 +81,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([
           [],
@@ -93,7 +94,7 @@ export default ({ getService }: FtrProviderContext) => {
 
       it('should filter 2 text if both are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['text_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -111,16 +112,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([[], ['word eight', 'word nine', 'word ten']]);
       });
 
       it('should filter 3 text if all 3 are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['text_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -146,9 +147,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits.flat(Number.MAX_SAFE_INTEGER)).to.eql([]);
       });
@@ -157,7 +158,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is not" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
         const rule = getRuleForSignalTesting(['text_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -167,15 +168,15 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([]);
       });
 
       it('will return just 1 result we excluded', async () => {
         const rule = getRuleForSignalTesting(['text_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -185,16 +186,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([['word one', 'word two', 'word three', 'word four']]);
       });
 
       it('will return 0 results if we exclude two text', async () => {
         const rule = getRuleForSignalTesting(['text_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -212,8 +213,8 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([]);
       });
@@ -222,7 +223,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is one of" operator', () => {
       it('should filter 1 single text if it is set as an exception', async () => {
         const rule = getRuleForSignalTesting(['text_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -232,9 +233,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([
           [],
@@ -245,7 +246,7 @@ export default ({ getService }: FtrProviderContext) => {
 
       it('should filter 2 text if both are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['text_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -255,16 +256,16 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([[], ['word eight', 'word nine', 'word ten']]);
       });
 
       it('should filter 3 text if all 3 are set as exceptions', async () => {
         const rule = getRuleForSignalTesting(['text_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -274,9 +275,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits.flat(Number.MAX_SAFE_INTEGER)).to.eql([]);
       });
@@ -285,7 +286,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"is not one of" operator', () => {
       it('will return 0 results if it cannot find what it is excluding', async () => {
         const rule = getRuleForSignalTesting(['text_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -295,15 +296,15 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([]);
       });
 
       it('will return just the result we excluded', async () => {
         const rule = getRuleForSignalTesting(['text_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -313,9 +314,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([
           ['word five', null, 'word six', 'word seven'],
@@ -327,7 +328,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"exists" operator', () => {
       it('will return 1 results if matching against text for the empty array', async () => {
         const rule = getRuleForSignalTesting(['text_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -336,9 +337,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits.flat(Number.MAX_SAFE_INTEGER)).to.eql([]);
       });
@@ -347,7 +348,7 @@ export default ({ getService }: FtrProviderContext) => {
     describe('"does not exist" operator', () => {
       it('will return 3 results if matching against text', async () => {
         const rule = getRuleForSignalTesting(['text_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -356,9 +357,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([
           ['word eight', 'word nine', 'word ten'],
@@ -370,10 +371,10 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('"is in list" operator', () => {
       it('will return 4 results if we have two lists with an AND contradiction text === "word one" AND text === "word five"', async () => {
-        await importFile(supertest, 'text', ['word one'], 'list_items_1.txt');
-        await importFile(supertest, 'text', ['word five'], 'list_items_2.txt');
+        await importFile(supertest, log, 'text', ['word one'], 'list_items_1.txt');
+        await importFile(supertest, log, 'text', ['word five'], 'list_items_2.txt');
         const rule = getRuleForSignalTesting(['text_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -395,9 +396,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([
           [],
@@ -408,10 +409,10 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('will return 3 results if we have two lists with an AND text === "word one" AND text === "word two" since we have an array', async () => {
-        await importFile(supertest, 'text', ['word one'], 'list_items_1.txt');
-        await importFile(supertest, 'text', ['word two'], 'list_items_2.txt');
+        await importFile(supertest, log, 'text', ['word one'], 'list_items_1.txt');
+        await importFile(supertest, log, 'text', ['word two'], 'list_items_2.txt');
         const rule = getRuleForSignalTesting(['text_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -433,9 +434,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([
           [],
@@ -445,9 +446,9 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('will return 3 results if we have a list that includes 1 text', async () => {
-        await importFile(supertest, 'text', ['word one'], 'list_items.txt');
+        await importFile(supertest, log, 'text', ['word one'], 'list_items.txt');
         const rule = getRuleForSignalTesting(['text_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -460,9 +461,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([
           [],
@@ -472,9 +473,9 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('will return 2 results if we have a list that includes 2 text', async () => {
-        await importFile(supertest, 'text', ['word one', 'word six'], 'list_items.txt');
+        await importFile(supertest, log, 'text', ['word one', 'word six'], 'list_items.txt');
         const rule = getRuleForSignalTesting(['text_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -487,9 +488,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([[], ['word eight', 'word nine', 'word ten']]);
       });
@@ -497,12 +498,13 @@ export default ({ getService }: FtrProviderContext) => {
       it('will return only the empty array for results if we have a list that includes all text', async () => {
         await importFile(
           supertest,
+          log,
           'text',
           ['word one', 'word five', 'word eight'],
           'list_items.txt'
         );
         const rule = getRuleForSignalTesting(['text_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -515,9 +517,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits.flat(Number.MAX_SAFE_INTEGER)).to.eql([]);
       });
@@ -525,9 +527,9 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('"is not in list" operator', () => {
       it('will return 1 result if we have a list that excludes 1 text', async () => {
-        await importFile(supertest, 'text', ['word one'], 'list_items.txt');
+        await importFile(supertest, log, 'text', ['word one'], 'list_items.txt');
         const rule = getRuleForSignalTesting(['text_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -540,17 +542,17 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([['word one', 'word two', 'word three', 'word four']]);
       });
 
       it('will return 1 result if we have a list that excludes 1 text but repeat 2 elements from the array in the list', async () => {
-        await importFile(supertest, 'text', ['word one', 'word two'], 'list_items.txt');
+        await importFile(supertest, log, 'text', ['word one', 'word two'], 'list_items.txt');
         const rule = getRuleForSignalTesting(['text_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -563,17 +565,17 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([['word one', 'word two', 'word three', 'word four']]);
       });
 
       it('will return 2 results if we have a list that excludes 2 text', async () => {
-        await importFile(supertest, 'text', ['word one', 'word five'], 'list_items.txt');
+        await importFile(supertest, log, 'text', ['word one', 'word five'], 'list_items.txt');
         const rule = getRuleForSignalTesting(['text_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -586,9 +588,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 2, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 2, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([
           ['word five', null, 'word six', 'word seven'],
@@ -597,9 +599,15 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('will return 3 results if we have a list that excludes 3 items', async () => {
-        await importFile(supertest, 'text', ['word one', 'word six', 'word ten'], 'list_items.txt');
+        await importFile(
+          supertest,
+          log,
+          'text',
+          ['word one', 'word six', 'word ten'],
+          'list_items.txt'
+        );
         const rule = getRuleForSignalTesting(['text_as_array']);
-        const { id } = await createRuleWithExceptionEntries(supertest, rule, [
+        const { id } = await createRuleWithExceptionEntries(supertest, log, rule, [
           [
             {
               field: 'text',
@@ -612,9 +620,9 @@ export default ({ getService }: FtrProviderContext) => {
             },
           ],
         ]);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 3, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 3, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.text).sort();
         expect(hits).to.eql([
           ['word eight', 'word nine', 'word ten'],
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/export_rules.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/export_rules.ts
index 0f4c42fd7ab39..7ea1985e8d7df 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/export_rules.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/export_rules.ts
@@ -24,20 +24,21 @@ import {
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext): void => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('export_rules', () => {
     describe('exporting rules', () => {
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
       });
 
       it('should set the response content types to be expected', async () => {
-        await createRule(supertest, getSimpleRule());
+        await createRule(supertest, log, getSimpleRule());
 
         await supertest
           .post(`${DETECTION_ENGINE_RULES_URL}/_export`)
@@ -49,7 +50,7 @@ export default ({ getService }: FtrProviderContext): void => {
       });
 
       it('should export a single rule with a rule_id', async () => {
-        await createRule(supertest, getSimpleRule());
+        await createRule(supertest, log, getSimpleRule());
 
         const { body } = await supertest
           .post(`${DETECTION_ENGINE_RULES_URL}/_export`)
@@ -65,7 +66,7 @@ export default ({ getService }: FtrProviderContext): void => {
       });
 
       it('should export a exported count with a single rule_id', async () => {
-        await createRule(supertest, getSimpleRule());
+        await createRule(supertest, log, getSimpleRule());
 
         const { body } = await supertest
           .post(`${DETECTION_ENGINE_RULES_URL}/_export`)
@@ -79,6 +80,7 @@ export default ({ getService }: FtrProviderContext): void => {
         expect(bodySplitAndParsed).to.eql({
           exported_exception_list_count: 0,
           exported_exception_list_item_count: 0,
+          exported_count: 1,
           exported_rules_count: 1,
           missing_exception_list_item_count: 0,
           missing_exception_list_items: [],
@@ -90,8 +92,8 @@ export default ({ getService }: FtrProviderContext): void => {
       });
 
       it('should export exactly two rules given two rules', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
-        await createRule(supertest, getSimpleRule('rule-2'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-2'));
 
         const { body } = await supertest
           .post(`${DETECTION_ENGINE_RULES_URL}/_export`)
@@ -144,7 +146,7 @@ export default ({ getService }: FtrProviderContext): void => {
           actions: [action1, action2],
         };
 
-        await createRule(supertest, rule1);
+        await createRule(supertest, log, rule1);
 
         const { body } = await supertest
           .post(`${DETECTION_ENGINE_RULES_URL}/_export`)
@@ -189,8 +191,8 @@ export default ({ getService }: FtrProviderContext): void => {
           actions: [action],
         };
 
-        await createRule(supertest, rule1);
-        await createRule(supertest, rule2);
+        await createRule(supertest, log, rule1);
+        await createRule(supertest, log, rule2);
 
         const { body } = await supertest
           .post(`${DETECTION_ENGINE_RULES_URL}/_export`)
@@ -232,7 +234,7 @@ export default ({ getService }: FtrProviderContext): void => {
             .expect(200);
 
           // create a rule without actions
-          const rule = await createRule(supertest, getSimpleRule('rule-1'));
+          const rule = await createRule(supertest, log, getSimpleRule('rule-1'));
 
           // attach the legacy notification
           await supertest
@@ -300,7 +302,7 @@ export default ({ getService }: FtrProviderContext): void => {
             .expect(200);
 
           // create a rule without actions
-          const rule = await createRule(supertest, getSimpleRule('rule-1'));
+          const rule = await createRule(supertest, log, getSimpleRule('rule-1'));
 
           // attach the legacy notification with actions
           await supertest
@@ -386,8 +388,8 @@ export default ({ getService }: FtrProviderContext): void => {
             .expect(200);
 
           // create 2 rules without actions
-          const rule1 = await createRule(supertest, getSimpleRule('rule-1'));
-          const rule2 = await createRule(supertest, getSimpleRule('rule-2'));
+          const rule1 = await createRule(supertest, log, getSimpleRule('rule-1'));
+          const rule2 = await createRule(supertest, log, getSimpleRule('rule-2'));
 
           // attach the legacy notification with actions to the first rule
           await supertest
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/finalize_signals_migrations.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/finalize_signals_migrations.ts
index 06961fe8fca58..df06647c2a8b5 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/finalize_signals_migrations.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/finalize_signals_migrations.ts
@@ -46,6 +46,7 @@ export default ({ getService }: FtrProviderContext): void => {
   const kbnClient = getService('kibanaServer');
   const supertest = getService('supertest');
   const supertestWithoutAuth = getService('supertestWithoutAuth');
+  const log = getService('log');
 
   describe('Finalizing signals migrations', () => {
     let legacySignalsIndexName: string;
@@ -61,7 +62,7 @@ export default ({ getService }: FtrProviderContext): void => {
       outdatedSignalsIndexName = getIndexNameFromLoad(
         await esArchiver.load('x-pack/test/functional/es_archives/signals/outdated_signals_index')
       );
-      await createSignalsIndex(supertest);
+      await createSignalsIndex(supertest, log);
 
       ({
         body: { indices: createdMigrations },
@@ -88,7 +89,7 @@ export default ({ getService }: FtrProviderContext): void => {
         kbnClient,
         ids: createdMigrations.filter((m) => m?.migration_id).map((m) => m.migration_id),
       });
-      await deleteSignalsIndex(supertest);
+      await deleteSignalsIndex(supertest, log);
     });
 
     it('replaces the original index alias with the migrated one', async () => {
@@ -103,31 +104,39 @@ export default ({ getService }: FtrProviderContext): void => {
       expect(indicesBefore).to.contain(createdMigration.index);
       expect(indicesBefore).not.to.contain(createdMigration.migration_index);
 
-      await waitFor(async () => {
-        const {
-          body: {
-            migrations: [{ completed }],
-          },
-        } = await supertest
-          .post(DETECTION_ENGINE_SIGNALS_FINALIZE_MIGRATION_URL)
-          .set('kbn-xsrf', 'true')
-          .send({ migration_ids: [createdMigration.migration_id] })
-          .expect(200);
-
-        return completed === true;
-      }, `polling finalize_migration until complete`);
+      await waitFor(
+        async () => {
+          const {
+            body: {
+              migrations: [{ completed }],
+            },
+          } = await supertest
+            .post(DETECTION_ENGINE_SIGNALS_FINALIZE_MIGRATION_URL)
+            .set('kbn-xsrf', 'true')
+            .send({ migration_ids: [createdMigration.migration_id] })
+            .expect(200);
+
+          return completed === true;
+        },
+        `polling finalize_migration until complete`,
+        log
+      );
 
       let statusAfter: StatusResponse[] = [];
-      await waitFor(async () => {
-        ({
-          body: { indices: statusAfter },
-        } = await supertest
-          .get(DETECTION_ENGINE_SIGNALS_MIGRATION_STATUS_URL)
-          .query({ from: '2020-10-10' })
-          .set('kbn-xsrf', 'true')
-          .expect(200));
-        return statusAfter.some((s) => !s.is_outdated);
-      }, `polling finalize_migration until complete`);
+      await waitFor(
+        async () => {
+          ({
+            body: { indices: statusAfter },
+          } = await supertest
+            .get(DETECTION_ENGINE_SIGNALS_MIGRATION_STATUS_URL)
+            .query({ from: '2020-10-10' })
+            .set('kbn-xsrf', 'true')
+            .expect(200));
+          return statusAfter.some((s) => !s.is_outdated);
+        },
+        `polling finalize_migration until complete`,
+        log
+      );
 
       const indicesAfter = statusAfter.map((s) => s.index);
 
@@ -145,17 +154,21 @@ export default ({ getService }: FtrProviderContext): void => {
       createdMigrations = [...createdMigrations, ...body.indices];
 
       let finalizeResponse: FinalizeResponse[];
-      await waitFor(async () => {
-        ({
-          body: { migrations: finalizeResponse },
-        } = await supertest
-          .post(DETECTION_ENGINE_SIGNALS_FINALIZE_MIGRATION_URL)
-          .set('kbn-xsrf', 'true')
-          .send({ migration_ids: createdMigrations.map((m) => m.migration_id) })
-          .expect(200));
-
-        return finalizeResponse.every((index) => index.completed);
-      }, `polling finalize_migration until all complete`);
+      await waitFor(
+        async () => {
+          ({
+            body: { migrations: finalizeResponse },
+          } = await supertest
+            .post(DETECTION_ENGINE_SIGNALS_FINALIZE_MIGRATION_URL)
+            .set('kbn-xsrf', 'true')
+            .send({ migration_ids: createdMigrations.map((m) => m.migration_id) })
+            .expect(200));
+
+          return finalizeResponse.every((index) => index.completed);
+        },
+        `polling finalize_migration until all complete`,
+        log
+      );
 
       const { body: bodyAfter } = await supertest
         .get(DETECTION_ENGINE_SIGNALS_MIGRATION_STATUS_URL)
@@ -171,19 +184,23 @@ export default ({ getService }: FtrProviderContext): void => {
     });
 
     it.skip('deletes the underlying migration task', async () => {
-      await waitFor(async () => {
-        const {
-          body: {
-            migrations: [{ completed }],
-          },
-        } = await supertest
-          .post(DETECTION_ENGINE_SIGNALS_FINALIZE_MIGRATION_URL)
-          .set('kbn-xsrf', 'true')
-          .send({ migration_ids: [createdMigration.migration_id] })
-          .expect(200);
-
-        return completed;
-      }, `polling finalize_migration until complete`);
+      await waitFor(
+        async () => {
+          const {
+            body: {
+              migrations: [{ completed }],
+            },
+          } = await supertest
+            .post(DETECTION_ENGINE_SIGNALS_FINALIZE_MIGRATION_URL)
+            .set('kbn-xsrf', 'true')
+            .send({ migration_ids: [createdMigration.migration_id] })
+            .expect(200);
+
+          return completed;
+        },
+        `polling finalize_migration until complete`,
+        log
+      );
 
       // const [{ taskId }] = await getMigration({ id: migration.migration_id });
       // expect(taskId.length).greaterThan(0);
@@ -192,19 +209,23 @@ export default ({ getService }: FtrProviderContext): void => {
     });
 
     it('subsequent attempts at finalization are idempotent', async () => {
-      await waitFor(async () => {
-        const {
-          body: {
-            migrations: [{ completed }],
-          },
-        } = await supertest
-          .post(DETECTION_ENGINE_SIGNALS_FINALIZE_MIGRATION_URL)
-          .set('kbn-xsrf', 'true')
-          .send({ migration_ids: [createdMigration.migration_id] })
-          .expect(200);
-
-        return completed;
-      }, `polling finalize_migration until complete`);
+      await waitFor(
+        async () => {
+          const {
+            body: {
+              migrations: [{ completed }],
+            },
+          } = await supertest
+            .post(DETECTION_ENGINE_SIGNALS_FINALIZE_MIGRATION_URL)
+            .set('kbn-xsrf', 'true')
+            .send({ migration_ids: [createdMigration.migration_id] })
+            .expect(200);
+
+          return completed;
+        },
+        `polling finalize_migration until complete`,
+        log
+      );
 
       const { body } = await supertest
         .post(DETECTION_ENGINE_SIGNALS_FINALIZE_MIGRATION_URL)
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/find_rules.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/find_rules.ts
index 2056d5648d6db..a56403ce54252 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/find_rules.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/find_rules.ts
@@ -25,15 +25,16 @@ import {
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext): void => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('find_rules', () => {
     beforeEach(async () => {
-      await createSignalsIndex(supertest);
+      await createSignalsIndex(supertest, log);
     });
 
     afterEach(async () => {
-      await deleteSignalsIndex(supertest);
-      await deleteAllAlerts(supertest);
+      await deleteSignalsIndex(supertest, log);
+      await deleteAllAlerts(supertest, log);
     });
 
     it('should return an empty find body correctly if no rules are loaded', async () => {
@@ -52,7 +53,7 @@ export default ({ getService }: FtrProviderContext): void => {
     });
 
     it('should return a single rule when a single rule is loaded from a find with defaults added', async () => {
-      await createRule(supertest, getSimpleRule());
+      await createRule(supertest, log, getSimpleRule());
 
       // query the single rule from _find
       const { body } = await supertest
@@ -114,7 +115,7 @@ export default ({ getService }: FtrProviderContext): void => {
         ...getSimpleRule('rule-1'),
         actions: [action],
       };
-      await createRule(supertest, rule);
+      await createRule(supertest, log, rule);
 
       // query the single rule from _find
       const { body } = await supertest
@@ -159,7 +160,7 @@ export default ({ getService }: FtrProviderContext): void => {
         throttle: '1h', // <-- throttle makes this a scheduled action
         actions: [action],
       };
-      await createRule(supertest, rule);
+      await createRule(supertest, log, rule);
 
       // query the single rule from _find
       const { body } = await supertest
@@ -197,7 +198,7 @@ export default ({ getService }: FtrProviderContext): void => {
           .expect(200);
 
         // create a rule without actions
-        const createRuleBody = await createRule(supertest, getSimpleRule('rule-1'));
+        const createRuleBody = await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // attach the legacy notification
         await supertest
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/find_statuses.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/find_statuses.ts
index c2dfed0c495db..0b430d6ae2d92 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/find_statuses.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/find_statuses.ts
@@ -24,6 +24,7 @@ export default ({ getService }: FtrProviderContext): void => {
   const supertest = getService('supertest');
   const es = getService('es');
   const esArchiver = getService('esArchiver');
+  const log = getService('log');
 
   describe('find_statuses', () => {
     before(async () => {
@@ -35,13 +36,13 @@ export default ({ getService }: FtrProviderContext): void => {
     });
 
     beforeEach(async () => {
-      await createSignalsIndex(supertest);
+      await createSignalsIndex(supertest, log);
     });
 
     afterEach(async () => {
-      await deleteSignalsIndex(supertest);
-      await deleteAllAlerts(supertest);
-      await deleteAllRulesStatuses(es);
+      await deleteSignalsIndex(supertest, log);
+      await deleteAllAlerts(supertest, log);
+      await deleteAllRulesStatuses(es, log);
     });
 
     it('should return an empty find statuses body correctly if no statuses are loaded', async () => {
@@ -74,9 +75,9 @@ export default ({ getService }: FtrProviderContext): void => {
        this pops up again elsewhere.
       */
     it('should return a single rule status when a single rule is loaded from a find status with defaults added', async () => {
-      const resBody = await createRule(supertest, getSimpleRule('rule-1', true));
+      const resBody = await createRule(supertest, log, getSimpleRule('rule-1', true));
 
-      await waitForRuleSuccessOrStatus(supertest, resBody.id);
+      await waitForRuleSuccessOrStatus(supertest, log, resBody.id);
 
       // query the single rule from _find
       const { body } = await supertest
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/generating_signals.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/generating_signals.ts
index 2977037a9523f..81291b3d46118 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/generating_signals.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/generating_signals.ts
@@ -46,15 +46,15 @@ import {
   waitForRuleSuccessOrStatus,
   waitForSignalsToBePresent,
 } from '../../utils';
+import { Ancestor } from '../../../../plugins/security_solution/server/lib/detection_engine/signals/types';
 import {
   ALERT_ANCESTORS,
   ALERT_DEPTH,
-  ALERT_GROUP_ID,
+  ALERT_ORIGINAL_TIME,
   ALERT_ORIGINAL_EVENT,
   ALERT_ORIGINAL_EVENT_CATEGORY,
-  ALERT_ORIGINAL_TIME,
-} from '../../../../plugins/security_solution/server/lib/detection_engine/rule_types/field_maps/field_names';
-import { Ancestor } from '../../../../plugins/security_solution/server/lib/detection_engine/signals/types';
+  ALERT_GROUP_ID,
+} from '../../../../plugins/security_solution/common/field_maps/field_names';
 
 /**
  * Specific _id to use for some of the tests. If the archiver changes and you see errors
@@ -67,16 +67,17 @@ export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
   const es = getService('es');
+  const log = getService('log');
 
   describe('Generating signals from source indexes', () => {
     beforeEach(async () => {
-      await deleteSignalsIndex(supertest);
-      await createSignalsIndex(supertest);
+      await deleteSignalsIndex(supertest, log);
+      await createSignalsIndex(supertest, log);
     });
 
     afterEach(async () => {
-      await deleteSignalsIndex(supertest);
-      await deleteAllAlerts(supertest);
+      await deleteSignalsIndex(supertest, log);
+      await deleteAllAlerts(supertest, log);
     });
 
     describe('Signals from audit beat are of the expected structure', () => {
@@ -93,10 +94,10 @@ export default ({ getService }: FtrProviderContext) => {
           ...getRuleForSignalTesting(['auditbeat-*']),
           query: `_id:${ID}`,
         };
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsByIds(supertest, [id]);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsByIds(supertest, log, [id]);
         expect(signalsOpen.hits.hits.length).greaterThan(0);
       });
 
@@ -106,10 +107,10 @@ export default ({ getService }: FtrProviderContext) => {
           ...getRuleForSignalTesting(['auditbeat-*']),
           max_signals: maxSignals,
         };
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, maxSignals, [id]);
-        const signalsOpen = await getSignalsByIds(supertest, [id], maxSignals);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, maxSignals, [id]);
+        const signalsOpen = await getSignalsByIds(supertest, log, [id], maxSignals);
         expect(signalsOpen.hits.hits.length).equal(maxSignals);
       });
 
@@ -118,10 +119,10 @@ export default ({ getService }: FtrProviderContext) => {
           ...getRuleForSignalTesting(['auditbeat-*']),
           query: `_id:${ID}`,
         };
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsByIds(supertest, [id]);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsByIds(supertest, log, [id]);
         expect(signalsOpen.hits.hits[0]._source![ALERT_RULE_RULE_ID]).eql(getSimpleRule().rule_id);
       });
 
@@ -130,10 +131,10 @@ export default ({ getService }: FtrProviderContext) => {
           ...getRuleForSignalTesting(['auditbeat-*']),
           query: `_id:${ID}`,
         };
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsByIds(supertest, [id]);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsByIds(supertest, log, [id]);
         const signal = signalsOpen.hits.hits[0]._source!;
 
         expect(signal).eql({
@@ -165,10 +166,10 @@ export default ({ getService }: FtrProviderContext) => {
           query: `_id:${ID}`,
           saved_id: 'doesnt-exist',
         };
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsByIds(supertest, [id]);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsByIds(supertest, log, [id]);
         const signal = signalsOpen.hits.hits[0]._source!;
         expect(signal).eql({
           ...signal,
@@ -197,9 +198,9 @@ export default ({ getService }: FtrProviderContext) => {
           ...getRuleForSignalTesting(['auditbeat-*']),
           query: `_id:${ID}`,
         };
-        const { id: createdId } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, createdId);
-        await waitForSignalsToBePresent(supertest, 1, [createdId]);
+        const { id: createdId } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, createdId);
+        await waitForSignalsToBePresent(supertest, log, 1, [createdId]);
 
         // Run signals on top of that 1 signal which should create a single signal (on top of) a signal
         const ruleForSignals: QueryCreateSchema = {
@@ -207,12 +208,12 @@ export default ({ getService }: FtrProviderContext) => {
           rule_id: 'signal-on-signal',
         };
 
-        const { id } = await createRule(supertest, ruleForSignals);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
+        const { id } = await createRule(supertest, log, ruleForSignals);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
 
         // Get our single signal on top of a signal
-        const signalsOpen = await getSignalsByRuleIds(supertest, ['signal-on-signal']);
+        const signalsOpen = await getSignalsByRuleIds(supertest, log, ['signal-on-signal']);
 
         const signal = signalsOpen.hits.hits[0]._source!;
         expect(signal).eql({
@@ -249,10 +250,10 @@ export default ({ getService }: FtrProviderContext) => {
             ...getEqlRuleForSignalTesting(['auditbeat-*']),
             query: 'configuration where agent.id=="a1d7b39c-f898-4dbe-a761-efb61939302d"',
           };
-          const { id } = await createRule(supertest, rule);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 1, [id]);
-          const signals = await getSignalsByIds(supertest, [id]);
+          const { id } = await createRule(supertest, log, rule);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 1, [id]);
+          const signals = await getSignalsByIds(supertest, log, [id]);
           expect(signals.hits.hits.length).eql(1);
           const fullSignal = signals.hits.hits[0]._source;
           if (!fullSignal) {
@@ -350,10 +351,10 @@ export default ({ getService }: FtrProviderContext) => {
 
         it('generates up to max_signals for non-sequence EQL queries', async () => {
           const rule: EqlCreateSchema = getEqlRuleForSignalTesting(['auditbeat-*']);
-          const { id } = await createRule(supertest, rule);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 100, [id]);
-          const signals = await getSignalsByIds(supertest, [id], 1000);
+          const { id } = await createRule(supertest, log, rule);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 100, [id]);
+          const signals = await getSignalsByIds(supertest, log, [id], 1000);
           const filteredSignals = signals.hits.hits.filter(
             (signal) => signal._source?.[ALERT_DEPTH] === 1
           );
@@ -366,10 +367,10 @@ export default ({ getService }: FtrProviderContext) => {
             query: 'config_change where agent.id=="a1d7b39c-f898-4dbe-a761-efb61939302d"',
             event_category_override: 'auditd.message_type',
           };
-          const { id } = await createRule(supertest, rule);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 1, [id]);
-          const signals = await getSignalsByIds(supertest, [id]);
+          const { id } = await createRule(supertest, log, rule);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 1, [id]);
+          const signals = await getSignalsByIds(supertest, log, [id]);
           expect(signals.hits.hits.length).eql(1);
           const fullSignal = signals.hits.hits[0]._source;
           if (!fullSignal) {
@@ -438,10 +439,10 @@ export default ({ getService }: FtrProviderContext) => {
             ...getEqlRuleForSignalTesting(['auditbeat-*']),
             query: 'sequence by host.name [anomoly where true] [any where true]', // TODO: spelling
           };
-          const { id } = await createRule(supertest, rule);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 3, [id]);
-          const signals = await getSignalsByIds(supertest, [id]);
+          const { id } = await createRule(supertest, log, rule);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 3, [id]);
+          const signals = await getSignalsByIds(supertest, log, [id]);
           const buildingBlock = signals.hits.hits.find(
             (signal) =>
               signal._source?.[ALERT_DEPTH] === 1 &&
@@ -586,10 +587,10 @@ export default ({ getService }: FtrProviderContext) => {
             ...getEqlRuleForSignalTesting(['auditbeat-*']),
             query: 'sequence by host.name [anomoly where true] [any where true]',
           };
-          const { id } = await createRule(supertest, rule);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 3, [id]);
-          const signalsOpen = await getSignalsByIds(supertest, [id]);
+          const { id } = await createRule(supertest, log, rule);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 3, [id]);
+          const signalsOpen = await getSignalsByIds(supertest, log, [id]);
           const sequenceSignal = signalsOpen.hits.hits.find(
             (signal) => signal._source?.[ALERT_DEPTH] === 2
           );
@@ -672,13 +673,13 @@ export default ({ getService }: FtrProviderContext) => {
             ...getEqlRuleForSignalTesting(['auditbeat-*']),
             query: 'sequence by host.name [any where true] [any where true]',
           };
-          const { id } = await createRule(supertest, rule);
-          await waitForRuleSuccessOrStatus(supertest, id);
+          const { id } = await createRule(supertest, log, rule);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
           // For EQL rules, max_signals is the maximum number of detected sequences: each sequence has a building block
           // alert for each event in the sequence, so max_signals=100 results in 200 building blocks in addition to
           // 100 regular alerts
-          await waitForSignalsToBePresent(supertest, 300, [id]);
-          const signalsOpen = await getSignalsByIds(supertest, [id], 1000);
+          await waitForSignalsToBePresent(supertest, log, 300, [id]);
+          const signalsOpen = await getSignalsByIds(supertest, log, [id], 1000);
           expect(signalsOpen.hits.hits.length).eql(300);
           const shellSignals = signalsOpen.hits.hits.filter(
             (signal) => signal._source?.[ALERT_DEPTH] === 2
@@ -700,10 +701,10 @@ export default ({ getService }: FtrProviderContext) => {
               value: 700,
             },
           };
-          const { id } = await createRule(supertest, rule);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 1, [id]);
-          const signalsOpen = await getSignalsByIds(supertest, [id]);
+          const { id } = await createRule(supertest, log, rule);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 1, [id]);
+          const signalsOpen = await getSignalsByIds(supertest, log, [id]);
           expect(signalsOpen.hits.hits.length).eql(1);
           const fullSignal = signalsOpen.hits.hits[0]._source;
           if (!fullSignal) {
@@ -748,10 +749,10 @@ export default ({ getService }: FtrProviderContext) => {
               value: 100,
             },
           };
-          const { id } = await createRule(supertest, rule);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 2, [id]);
-          const signalsOpen = await getSignalsByIds(supertest, [id]);
+          const { id } = await createRule(supertest, log, rule);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 2, [id]);
+          const signalsOpen = await getSignalsByIds(supertest, log, [id]);
           expect(signalsOpen.hits.hits.length).eql(2);
         });
 
@@ -764,10 +765,10 @@ export default ({ getService }: FtrProviderContext) => {
               value: 21,
             },
           };
-          const { id } = await createRule(supertest, rule);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 1, [id]);
-          const signalsOpen = await getSignalsByIds(supertest, [id]);
+          const { id } = await createRule(supertest, log, rule);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 1, [id]);
+          const signalsOpen = await getSignalsByIds(supertest, log, [id]);
           expect(signalsOpen.hits.hits.length).eql(1);
         });
 
@@ -785,8 +786,8 @@ export default ({ getService }: FtrProviderContext) => {
               ],
             },
           };
-          const createdRule = await createRule(supertest, rule);
-          const signalsOpen = await getOpenSignals(supertest, es, createdRule);
+          const createdRule = await createRule(supertest, log, rule);
+          const signalsOpen = await getOpenSignals(supertest, log, es, createdRule);
           expect(signalsOpen.hits.hits.length).eql(0);
         });
 
@@ -804,8 +805,8 @@ export default ({ getService }: FtrProviderContext) => {
               ],
             },
           };
-          const createdRule = await createRule(supertest, rule);
-          const signalsOpen = await getOpenSignals(supertest, es, createdRule);
+          const createdRule = await createRule(supertest, log, rule);
+          const signalsOpen = await getOpenSignals(supertest, log, es, createdRule);
           expect(signalsOpen.hits.hits.length).eql(0);
         });
 
@@ -823,8 +824,8 @@ export default ({ getService }: FtrProviderContext) => {
               ],
             },
           };
-          const createdRule = await createRule(supertest, rule);
-          const signalsOpen = await getOpenSignals(supertest, es, createdRule);
+          const createdRule = await createRule(supertest, log, rule);
+          const signalsOpen = await getOpenSignals(supertest, log, es, createdRule);
           expect(signalsOpen.hits.hits.length).eql(1);
           const fullSignal = signalsOpen.hits.hits[0]._source;
           if (!fullSignal) {
@@ -875,8 +876,8 @@ export default ({ getService }: FtrProviderContext) => {
               value: 22,
             },
           };
-          const createdRule = await createRule(supertest, rule);
-          const signalsOpen = await getOpenSignals(supertest, es, createdRule);
+          const createdRule = await createRule(supertest, log, rule);
+          const signalsOpen = await getOpenSignals(supertest, log, es, createdRule);
           expect(signalsOpen.hits.hits.length).eql(0);
         });
 
@@ -888,8 +889,8 @@ export default ({ getService }: FtrProviderContext) => {
               value: 21,
             },
           };
-          const createdRule = await createRule(supertest, rule);
-          const signalsOpen = await getOpenSignals(supertest, es, createdRule);
+          const createdRule = await createRule(supertest, log, rule);
+          const signalsOpen = await getOpenSignals(supertest, log, es, createdRule);
           expect(signalsOpen.hits.hits.length).eql(1);
           const fullSignal = signalsOpen.hits.hits[0]._source;
           if (!fullSignal) {
@@ -955,10 +956,10 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       const executeRuleAndGetSignals = async (rule: QueryCreateSchema) => {
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const signalsResponse = await getSignalsByIds(supertest, [id]);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const signalsResponse = await getSignalsByIds(supertest, log, [id]);
         const signals = signalsResponse.hits.hits.map((hit) => hit._source);
         const signalsOrderedByEventId = orderBy(signals, 'signal.parent.id', 'asc');
         return signalsOrderedByEventId;
@@ -1102,13 +1103,13 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       beforeEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await createSignalsIndex(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
       });
 
       it('should generate signals with name_override field', async () => {
@@ -1117,11 +1118,11 @@ export default ({ getService }: FtrProviderContext) => {
           rule_name_override: 'event.action',
         };
 
-        const { id } = await createRule(supertest, rule);
+        const { id } = await createRule(supertest, log, rule);
 
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsResponse = await getSignalsByIds(supertest, [id], 1);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsResponse = await getSignalsByIds(supertest, log, [id], 1);
         const signals = signalsResponse.hits.hits.map((hit) => hit._source);
         const signalsOrderedByEventId = orderBy(signals, 'signal.parent.id', 'asc');
         const fullSignal = signalsOrderedByEventId[0];
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/get_prepackaged_rules_status.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/get_prepackaged_rules_status.ts
index 6b226dae9cb11..6764ed27a43e7 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/get_prepackaged_rules_status.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/get_prepackaged_rules_status.ts
@@ -24,16 +24,17 @@ import {
 export default ({ getService }: FtrProviderContext): void => {
   const supertest = getService('supertest');
   const es = getService('es');
+  const log = getService('log');
 
   describe('get_prepackaged_rules_status', () => {
     describe('getting prepackaged rules status', () => {
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
         await deleteAllTimelines(es);
       });
 
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/get_signals_migration_status.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/get_signals_migration_status.ts
index 1f7d1054b706e..a1400e865fa56 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/get_signals_migration_status.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/get_signals_migration_status.ts
@@ -18,6 +18,7 @@ export default ({ getService }: FtrProviderContext): void => {
   const esArchiver = getService('esArchiver');
   const supertest = getService('supertest');
   const supertestWithoutAuth = getService('supertestWithoutAuth');
+  const log = getService('log');
 
   describe('Signals migration status', () => {
     let legacySignalsIndexName: string;
@@ -25,12 +26,12 @@ export default ({ getService }: FtrProviderContext): void => {
       legacySignalsIndexName = getIndexNameFromLoad(
         await esArchiver.load('x-pack/test/functional/es_archives/signals/legacy_signals_index')
       );
-      await createSignalsIndex(supertest);
+      await createSignalsIndex(supertest, log);
     });
 
     afterEach(async () => {
       await esArchiver.unload('x-pack/test/functional/es_archives/signals/legacy_signals_index');
-      await deleteSignalsIndex(supertest);
+      await deleteSignalsIndex(supertest, log);
     });
 
     it('returns no indexes if no signals exist in the specified range', async () => {
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/ignore_fields.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/ignore_fields.ts
index 409128523ea40..d7528fbf6e8f5 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/ignore_fields.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/ignore_fields.ts
@@ -50,6 +50,7 @@ export default ({ getService }: FtrProviderContext): void => {
   describe('ignore_fields', () => {
     const supertest = getService('supertest');
     const esArchiver = getService('esArchiver');
+    const log = getService('log');
 
     before(async () => {
       await esArchiver.load('x-pack/test/functional/es_archives/security_solution/ignore_fields');
@@ -60,21 +61,21 @@ export default ({ getService }: FtrProviderContext): void => {
     });
 
     beforeEach(async () => {
-      await createSignalsIndex(supertest);
+      await createSignalsIndex(supertest, log);
     });
 
     afterEach(async () => {
-      await deleteSignalsIndex(supertest);
-      await deleteAllAlerts(supertest);
+      await deleteSignalsIndex(supertest, log);
+      await deleteAllAlerts(supertest, log);
     });
 
     it('should ignore the field of "testing_ignored"', async () => {
       const rule = getEqlRuleForSignalTesting(['ignore_fields']);
 
-      const { id } = await createRule(supertest, rule);
-      await waitForRuleSuccessOrStatus(supertest, id);
-      await waitForSignalsToBePresent(supertest, 4, [id]);
-      const signalsOpen = await getSignalsById(supertest, id);
+      const { id } = await createRule(supertest, log, rule);
+      await waitForRuleSuccessOrStatus(supertest, log, id);
+      await waitForSignalsToBePresent(supertest, log, 4, [id]);
+      const signalsOpen = await getSignalsById(supertest, log, id);
       const hits = signalsOpen.hits.hits
         .map((hit) => (hit._source as Ignore).testing_ignored)
         .sort();
@@ -86,10 +87,10 @@ export default ({ getService }: FtrProviderContext): void => {
     it('should ignore the field of "testing_regex"', async () => {
       const rule = getEqlRuleForSignalTesting(['ignore_fields']);
 
-      const { id } = await createRule(supertest, rule);
-      await waitForRuleSuccessOrStatus(supertest, id);
-      await waitForSignalsToBePresent(supertest, 4, [id]);
-      const signalsOpen = await getSignalsById(supertest, id);
+      const { id } = await createRule(supertest, log, rule);
+      await waitForRuleSuccessOrStatus(supertest, log, id);
+      await waitForSignalsToBePresent(supertest, log, 4, [id]);
+      const signalsOpen = await getSignalsById(supertest, log, id);
       const hits = signalsOpen.hits.hits.map((hit) => (hit._source as Ignore).testing_regex).sort();
 
       // Value should be "undefined for all records"
@@ -99,10 +100,10 @@ export default ({ getService }: FtrProviderContext): void => {
     it('should have the field of "normal_constant"', async () => {
       const rule = getEqlRuleForSignalTesting(['ignore_fields']);
 
-      const { id } = await createRule(supertest, rule);
-      await waitForRuleSuccessOrStatus(supertest, id);
-      await waitForSignalsToBePresent(supertest, 4, [id]);
-      const signalsOpen = await getSignalsById(supertest, id);
+      const { id } = await createRule(supertest, log, rule);
+      await waitForRuleSuccessOrStatus(supertest, log, id);
+      await waitForSignalsToBePresent(supertest, log, 4, [id]);
+      const signalsOpen = await getSignalsById(supertest, log, id);
       const hits = signalsOpen.hits.hits
         .map((hit) => (hit._source as Ignore).normal_constant)
         .sort();
@@ -115,10 +116,10 @@ export default ({ getService }: FtrProviderContext): void => {
     it('should ignore the field of "_ignored" when using EQL and index the data', async () => {
       const rule = getEqlRuleForSignalTesting(['ignore_fields']);
 
-      const { id } = await createRule(supertest, rule);
-      await waitForRuleSuccessOrStatus(supertest, id);
-      await waitForSignalsToBePresent(supertest, 4, [id]);
-      const signalsOpen = await getSignalsById(supertest, id);
+      const { id } = await createRule(supertest, log, rule);
+      await waitForRuleSuccessOrStatus(supertest, log, id);
+      await waitForSignalsToBePresent(supertest, log, 4, [id]);
+      const signalsOpen = await getSignalsById(supertest, log, id);
       const hits = signalsOpen.hits.hits.map((hit) => (hit._source as Ignore).small_field).sort();
 
       // We just test a constant value to ensure this did not blow up on us and did index data.
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/import_rules.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/import_rules.ts
index 72912c9d10f0b..9a9d4f7758d07 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/import_rules.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/import_rules.ts
@@ -24,16 +24,17 @@ import {
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext): void => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('import_rules', () => {
     describe('importing rules with an index', () => {
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
       });
 
       it('should set the response content types to be expected', async () => {
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/keyword_family/const_keyword.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/keyword_family/const_keyword.ts
index 152b8100f9aa9..80e85fb491fc1 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/keyword_family/const_keyword.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/keyword_family/const_keyword.ts
@@ -29,6 +29,7 @@ import {
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
+  const log = getService('log');
 
   describe('Rule detects against a keyword of event.dataset', () => {
     before(async () => {
@@ -42,12 +43,12 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     beforeEach(async () => {
-      await createSignalsIndex(supertest);
+      await createSignalsIndex(supertest, log);
     });
 
     afterEach(async () => {
-      await deleteSignalsIndex(supertest);
-      await deleteAllAlerts(supertest);
+      await deleteSignalsIndex(supertest, log);
+      await deleteAllAlerts(supertest, log);
     });
 
     describe('"kql" rule type', () => {
@@ -56,10 +57,10 @@ export default ({ getService }: FtrProviderContext) => {
           ...getRuleForSignalTesting(['const_keyword']),
           query: 'event.dataset: "dataset_name_1"',
         };
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         expect(signalsOpen.hits.hits.length).to.eql(4);
       });
 
@@ -68,10 +69,10 @@ export default ({ getService }: FtrProviderContext) => {
           ...getRuleForSignalTesting(['const_keyword']),
           query: 'event.dataset: "dataset_name_1"',
         };
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.['event.dataset']).sort();
         expect(hits).to.eql([
           'dataset_name_1',
@@ -89,10 +90,10 @@ export default ({ getService }: FtrProviderContext) => {
           query: 'any where event.dataset=="dataset_name_1"',
         };
 
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         expect(signalsOpen.hits.hits.length).to.eql(4);
       });
 
@@ -102,10 +103,10 @@ export default ({ getService }: FtrProviderContext) => {
           query: 'any where event.dataset=="dataset_name_1"',
         };
 
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.['event.dataset']).sort();
         expect(hits).to.eql([
           'dataset_name_1',
@@ -125,10 +126,10 @@ export default ({ getService }: FtrProviderContext) => {
             value: 1,
           },
         };
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits
           .map((hit) => hit._source?.threshold_result ?? null)
           .sort();
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/keyword_family/keyword.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/keyword_family/keyword.ts
index a3004d8942922..bdfe496bd3fa6 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/keyword_family/keyword.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/keyword_family/keyword.ts
@@ -30,6 +30,7 @@ import {
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
+  const log = getService('log');
 
   describe('Rule detects against a keyword of event.dataset', () => {
     before(async () => {
@@ -41,12 +42,12 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     beforeEach(async () => {
-      await createSignalsIndex(supertest);
+      await createSignalsIndex(supertest, log);
     });
 
     afterEach(async () => {
-      await deleteSignalsIndex(supertest);
-      await deleteAllAlerts(supertest);
+      await deleteSignalsIndex(supertest, log);
+      await deleteAllAlerts(supertest, log);
     });
 
     describe('"kql" rule type', () => {
@@ -55,10 +56,10 @@ export default ({ getService }: FtrProviderContext) => {
           ...getRuleForSignalTesting(['keyword']),
           query: 'event.dataset: "dataset_name_1"',
         };
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.['event.dataset']).sort();
         expect(hits).to.eql([
           'dataset_name_1',
@@ -76,10 +77,10 @@ export default ({ getService }: FtrProviderContext) => {
           query: 'any where event.dataset=="dataset_name_1"',
         };
 
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.['event.dataset']).sort();
         expect(hits).to.eql([
           'dataset_name_1',
@@ -99,10 +100,10 @@ export default ({ getService }: FtrProviderContext) => {
             value: 1,
           },
         };
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits
           .map((hit) => hit._source?.threshold_result ?? null)
           .sort();
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/keyword_family/keyword_mixed_with_const.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/keyword_family/keyword_mixed_with_const.ts
index f33ce52318579..4076a34b6139b 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/keyword_family/keyword_mixed_with_const.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/keyword_family/keyword_mixed_with_const.ts
@@ -28,6 +28,7 @@ import {
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
+  const log = getService('log');
 
   describe('Rule detects against a keyword and constant_keyword of event.dataset', () => {
     before(async () => {
@@ -43,12 +44,12 @@ export default ({ getService }: FtrProviderContext) => {
     });
 
     beforeEach(async () => {
-      await createSignalsIndex(supertest);
+      await createSignalsIndex(supertest, log);
     });
 
     afterEach(async () => {
-      await deleteSignalsIndex(supertest);
-      await deleteAllAlerts(supertest);
+      await deleteSignalsIndex(supertest, log);
+      await deleteAllAlerts(supertest, log);
     });
 
     describe('"kql" rule type', () => {
@@ -57,10 +58,10 @@ export default ({ getService }: FtrProviderContext) => {
           ...getRuleForSignalTesting(['keyword', 'const_keyword']),
           query: 'event.dataset: "dataset_name_1"',
         };
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 8, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 8, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         expect(signalsOpen.hits.hits.length).to.eql(8);
       });
 
@@ -69,10 +70,10 @@ export default ({ getService }: FtrProviderContext) => {
           ...getRuleForSignalTesting(['keyword', 'const_keyword']),
           query: 'event.dataset: "dataset_name_1"',
         };
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 8, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 8, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.['event.dataset']).sort();
         expect(hits).to.eql([
           'dataset_name_1',
@@ -94,10 +95,10 @@ export default ({ getService }: FtrProviderContext) => {
           query: 'any where event.dataset=="dataset_name_1"',
         };
 
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 8, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 8, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         expect(signalsOpen.hits.hits.length).to.eql(8);
       });
 
@@ -107,10 +108,10 @@ export default ({ getService }: FtrProviderContext) => {
           query: 'any where event.dataset=="dataset_name_1"',
         };
 
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 8, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 8, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map((hit) => hit._source?.['event.dataset']).sort();
         expect(hits).to.eql([
           'dataset_name_1',
@@ -138,10 +139,10 @@ export default ({ getService }: FtrProviderContext) => {
             value: 1,
           },
         };
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 1, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 1, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits
           .map((hit) => hit._source?.threshold_result ?? null)
           .sort();
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/open_close_signals.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/open_close_signals.ts
index 49b8bc640cde3..f9a5a3283bd2f 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/open_close_signals.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/open_close_signals.ts
@@ -36,6 +36,7 @@ export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
   const supertestWithoutAuth = getService('supertestWithoutAuth');
+  const log = getService('log');
 
   describe('open_close_signals', () => {
     describe.skip('validation checks', () => {
@@ -53,7 +54,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should not give errors when querying and the signals index does exist and is empty', async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
         const { body } = await supertest
           .post(DETECTION_ENGINE_SIGNALS_STATUS_URL)
           .set('kbn-xsrf', 'true')
@@ -65,7 +66,7 @@ export default ({ getService }: FtrProviderContext) => {
 
         expect(body).to.eql(getSignalStatusEmptyResponse());
 
-        await deleteSignalsIndex(supertest);
+        await deleteSignalsIndex(supertest, log);
       });
 
       describe('tests with auditbeat data', () => {
@@ -78,30 +79,30 @@ export default ({ getService }: FtrProviderContext) => {
         });
 
         beforeEach(async () => {
-          await deleteAllAlerts(supertest);
-          await createSignalsIndex(supertest);
+          await deleteAllAlerts(supertest, log);
+          await createSignalsIndex(supertest, log);
         });
 
         afterEach(async () => {
-          await deleteSignalsIndex(supertest);
-          await deleteAllAlerts(supertest);
+          await deleteSignalsIndex(supertest, log);
+          await deleteAllAlerts(supertest, log);
         });
 
         it('should be able to execute and get 10 signals', async () => {
           const rule = getRuleForSignalTesting(['auditbeat-*']);
-          const { id } = await createRule(supertest, rule);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 10, [id]);
-          const signalsOpen = await getSignalsByIds(supertest, [id]);
+          const { id } = await createRule(supertest, log, rule);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 10, [id]);
+          const signalsOpen = await getSignalsByIds(supertest, log, [id]);
           expect(signalsOpen.hits.hits.length).equal(10);
         });
 
         it('should be have set the signals in an open state initially', async () => {
           const rule = getRuleForSignalTesting(['auditbeat-*']);
-          const { id } = await createRule(supertest, rule);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 10, [id]);
-          const signalsOpen = await getSignalsByIds(supertest, [id]);
+          const { id } = await createRule(supertest, log, rule);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 10, [id]);
+          const signalsOpen = await getSignalsByIds(supertest, log, [id]);
           const everySignalOpen = signalsOpen.hits.hits.every(
             (hit) => hit._source?.[ALERT_WORKFLOW_STATUS] === 'open'
           );
@@ -110,10 +111,10 @@ export default ({ getService }: FtrProviderContext) => {
 
         it('should be able to get a count of 10 closed signals when closing 10', async () => {
           const rule = getRuleForSignalTesting(['auditbeat-*']);
-          const { id } = await createRule(supertest, rule);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 10, [id]);
-          const signalsOpen = await getSignalsByIds(supertest, [id]);
+          const { id } = await createRule(supertest, log, rule);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 10, [id]);
+          const signalsOpen = await getSignalsByIds(supertest, log, [id]);
           const signalIds = signalsOpen.hits.hits.map((signal) => signal._id);
 
           // set all of the signals to the state of closed. There is no reason to use a waitUntil here
@@ -136,10 +137,10 @@ export default ({ getService }: FtrProviderContext) => {
 
         it('should be able close signals immediately and they all should be closed', async () => {
           const rule = getRuleForSignalTesting(['auditbeat-*']);
-          const { id } = await createRule(supertest, rule);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 1, [id]);
-          const signalsOpen = await getSignalsByIds(supertest, [id]);
+          const { id } = await createRule(supertest, log, rule);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 1, [id]);
+          const signalsOpen = await getSignalsByIds(supertest, log, [id]);
           const signalIds = signalsOpen.hits.hits.map((signal) => signal._id);
 
           // set all of the signals to the state of closed. There is no reason to use a waitUntil here
@@ -166,11 +167,11 @@ export default ({ getService }: FtrProviderContext) => {
 
         it('should be able to close signals with t1 analyst user', async () => {
           const rule = getRuleForSignalTesting(['auditbeat-*']);
-          const { id } = await createRule(supertest, rule);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 1, [id]);
+          const { id } = await createRule(supertest, log, rule);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 1, [id]);
           await createUserAndRole(getService, ROLES.t1_analyst);
-          const signalsOpen = await getSignalsByIds(supertest, [id]);
+          const signalsOpen = await getSignalsByIds(supertest, log, [id]);
           const signalIds = signalsOpen.hits.hits.map((signal) => signal._id);
 
           // Try to set all of the signals to the state of closed.
@@ -201,12 +202,12 @@ export default ({ getService }: FtrProviderContext) => {
 
         it('should be able to close signals with soc_manager user', async () => {
           const rule = getRuleForSignalTesting(['auditbeat-*']);
-          const { id } = await createRule(supertest, rule);
-          await waitForRuleSuccessOrStatus(supertest, id);
-          await waitForSignalsToBePresent(supertest, 1, [id]);
+          const { id } = await createRule(supertest, log, rule);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
+          await waitForSignalsToBePresent(supertest, log, 1, [id]);
           const userAndRole = ROLES.soc_manager;
           await createUserAndRole(getService, userAndRole);
-          const signalsOpen = await getSignalsByIds(supertest, [id]);
+          const signalsOpen = await getSignalsByIds(supertest, log, [id]);
           const signalIds = signalsOpen.hits.hits.map((signal) => signal._id);
 
           // Try to set all of the signals to the state of closed.
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/patch_rules.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/patch_rules.ts
index 6918dc7a1876f..7867fc2fd16e4 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/patch_rules.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/patch_rules.ts
@@ -27,20 +27,21 @@ import {
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('patch_rules', () => {
     describe('patch rules', () => {
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
       });
 
       it('should patch a single rule property of name using a rule_id', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // patch a simple rule's name
         const { body } = await supertest
@@ -57,7 +58,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it("should patch a machine_learning rule's job ID if in a legacy format", async () => {
-        await createRule(supertest, getSimpleMlRule('rule-1'));
+        await createRule(supertest, log, getSimpleMlRule('rule-1'));
 
         // patch a simple rule's name
         const { body } = await supertest
@@ -73,7 +74,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should patch a single rule property of name using a rule_id of type "machine learning"', async () => {
-        await createRule(supertest, getSimpleMlRule('rule-1'));
+        await createRule(supertest, log, getSimpleMlRule('rule-1'));
 
         // patch a simple rule's name
         const { body } = await supertest
@@ -92,7 +93,7 @@ export default ({ getService }: FtrProviderContext) => {
       it('should patch a single rule property of name using the auto-generated rule_id', async () => {
         const rule = getSimpleRule('rule-1');
         delete rule.rule_id;
-        const createRuleBody = await createRule(supertest, rule);
+        const createRuleBody = await createRule(supertest, log, rule);
 
         // patch a simple rule's name
         const { body } = await supertest
@@ -109,7 +110,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should patch a single rule property of name using the auto-generated id', async () => {
-        const createdBody = await createRule(supertest, getSimpleRule('rule-1'));
+        const createdBody = await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // patch a simple rule's name
         const { body } = await supertest
@@ -126,7 +127,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should not change the version of a rule when it patches only enabled', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // patch a simple rule's enabled to false
         const { body } = await supertest
@@ -143,7 +144,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should change the version of a rule when it patches enabled and another property', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // patch a simple rule's enabled to false and another property
         const { body } = await supertest
@@ -162,7 +163,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should not change other properties when it does patches', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // patch a simple rule's timeline_title
         await supertest
@@ -200,7 +201,7 @@ export default ({ getService }: FtrProviderContext) => {
                 webhookUrl: 'http://localhost:1234',
               },
             }),
-          createRule(supertest, getSimpleRule('rule-1')),
+          createRule(supertest, log, getSimpleRule('rule-1')),
         ]);
         await createLegacyRuleAction(supertest, rule.id, connector.body.id);
 
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/patch_rules_bulk.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/patch_rules_bulk.ts
index bc388d73cac6b..d3128c6670402 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/patch_rules_bulk.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/patch_rules_bulk.ts
@@ -25,20 +25,21 @@ import {
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('patch_rules_bulk', () => {
     describe('patch rules bulk', () => {
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
       });
 
       it('should patch a single rule property of name using a rule_id', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // patch a simple rule's name
         const { body } = await supertest
@@ -55,8 +56,8 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should patch two rule properties of name using the two rules rule_id', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
-        await createRule(supertest, getSimpleRule('rule-2'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-2'));
 
         // patch both rule names
         const { body } = await supertest
@@ -83,7 +84,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should patch a single rule property of name using an id', async () => {
-        const createRuleBody = await createRule(supertest, getSimpleRule('rule-1'));
+        const createRuleBody = await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // patch a simple rule's name
         const { body } = await supertest
@@ -100,8 +101,8 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should patch two rule properties of name using the two rules id', async () => {
-        const createRule1 = await createRule(supertest, getSimpleRule('rule-1'));
-        const createRule2 = await createRule(supertest, getSimpleRule('rule-2'));
+        const createRule1 = await createRule(supertest, log, getSimpleRule('rule-1'));
+        const createRule2 = await createRule(supertest, log, getSimpleRule('rule-2'));
 
         // patch both rule names
         const { body } = await supertest
@@ -139,8 +140,8 @@ export default ({ getService }: FtrProviderContext) => {
                 webhookUrl: 'http://localhost:1234',
               },
             }),
-          createRule(supertest, getSimpleRule('rule-1')),
-          createRule(supertest, getSimpleRule('rule-2')),
+          createRule(supertest, log, getSimpleRule('rule-1')),
+          createRule(supertest, log, getSimpleRule('rule-2')),
         ]);
         await Promise.all([
           createLegacyRuleAction(supertest, rule1.id, connector.body.id),
@@ -177,7 +178,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should patch a single rule property of name using the auto-generated id', async () => {
-        const createdBody = await createRule(supertest, getSimpleRule('rule-1'));
+        const createdBody = await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // patch a simple rule's name
         const { body } = await supertest
@@ -194,7 +195,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should not change the version of a rule when it patches only enabled', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // patch a simple rule's enabled to false
         const { body } = await supertest
@@ -211,7 +212,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should change the version of a rule when it patches enabled and another property', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // patch a simple rule's enabled to false and another property
         const { body } = await supertest
@@ -230,7 +231,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should not change other properties when it does patches', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // patch a simple rule's timeline_title
         await supertest
@@ -290,7 +291,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should patch one rule property and give an error about a second fake rule_id', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // patch one rule name and give a fake id for the second
         const { body } = await supertest
@@ -320,7 +321,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should patch one rule property and give an error about a second fake id', async () => {
-        const createdBody = await createRule(supertest, getSimpleRule('rule-1'));
+        const createdBody = await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // patch one rule name and give a fake id for the second
         const { body } = await supertest
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/perform_bulk_action.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/perform_bulk_action.ts
index 83166619b152d..bb117b50d5aed 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/perform_bulk_action.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/perform_bulk_action.ts
@@ -27,19 +27,20 @@ import {
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext): void => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('perform_bulk_action', () => {
     beforeEach(async () => {
-      await createSignalsIndex(supertest);
+      await createSignalsIndex(supertest, log);
     });
 
     afterEach(async () => {
-      await deleteSignalsIndex(supertest);
-      await deleteAllAlerts(supertest);
+      await deleteSignalsIndex(supertest, log);
+      await deleteAllAlerts(supertest, log);
     });
 
     it('should export rules', async () => {
-      await createRule(supertest, getSimpleRule());
+      await createRule(supertest, log, getSimpleRule());
 
       const { body } = await supertest
         .post(DETECTION_ENGINE_RULES_BULK_ACTION)
@@ -59,6 +60,7 @@ export default ({ getService }: FtrProviderContext): void => {
       expect(exportDetails).to.eql({
         exported_exception_list_count: 0,
         exported_exception_list_item_count: 0,
+        exported_count: 1,
         exported_rules_count: 1,
         missing_exception_list_item_count: 0,
         missing_exception_list_items: [],
@@ -71,7 +73,7 @@ export default ({ getService }: FtrProviderContext): void => {
 
     it('should delete rules', async () => {
       const ruleId = 'ruleId';
-      await createRule(supertest, getSimpleRule(ruleId));
+      await createRule(supertest, log, getSimpleRule(ruleId));
 
       const { body } = await supertest
         .post(DETECTION_ENGINE_RULES_BULK_ACTION)
@@ -89,7 +91,7 @@ export default ({ getService }: FtrProviderContext): void => {
 
     it('should enable rules', async () => {
       const ruleId = 'ruleId';
-      await createRule(supertest, getSimpleRule(ruleId));
+      await createRule(supertest, log, getSimpleRule(ruleId));
 
       const { body } = await supertest
         .post(DETECTION_ENGINE_RULES_BULK_ACTION)
@@ -114,7 +116,7 @@ export default ({ getService }: FtrProviderContext): void => {
 
     it('should disable rules', async () => {
       const ruleId = 'ruleId';
-      await createRule(supertest, getSimpleRule(ruleId, true));
+      await createRule(supertest, log, getSimpleRule(ruleId, true));
 
       const { body } = await supertest
         .post(DETECTION_ENGINE_RULES_BULK_ACTION)
@@ -137,7 +139,7 @@ export default ({ getService }: FtrProviderContext): void => {
 
     it('should duplicate rules', async () => {
       const ruleId = 'ruleId';
-      await createRule(supertest, getSimpleRule(ruleId));
+      await createRule(supertest, log, getSimpleRule(ruleId));
 
       const { body } = await supertest
         .post(DETECTION_ENGINE_RULES_BULK_ACTION)
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/read_rules.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/read_rules.ts
index 0a51e6227cc9b..92cc8cf52f18f 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/read_rules.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/read_rules.ts
@@ -26,20 +26,21 @@ import {
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('read_rules', () => {
     describe('reading rules', () => {
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
       });
 
       it('should be able to read a single rule using rule_id', async () => {
-        await createRule(supertest, getSimpleRule());
+        await createRule(supertest, log, getSimpleRule());
 
         const { body } = await supertest
           .get(`${DETECTION_ENGINE_RULES_URL}?rule_id=rule-1`)
@@ -52,7 +53,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should be able to read a single rule using id', async () => {
-        const createRuleBody = await createRule(supertest, getSimpleRule());
+        const createRuleBody = await createRule(supertest, log, getSimpleRule());
 
         const { body } = await supertest
           .get(`${DETECTION_ENGINE_RULES_URL}?id=${createRuleBody.id}`)
@@ -65,7 +66,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should be able to read a single rule with an auto-generated rule_id', async () => {
-        const createRuleBody = await createRule(supertest, getSimpleRuleWithoutRuleId());
+        const createRuleBody = await createRule(supertest, log, getSimpleRuleWithoutRuleId());
 
         const { body } = await supertest
           .get(`${DETECTION_ENGINE_RULES_URL}?rule_id=${createRuleBody.rule_id}`)
@@ -123,7 +124,7 @@ export default ({ getService }: FtrProviderContext) => {
           ...getSimpleRule('rule-1'),
           actions: [action],
         };
-        const createRuleBody = await createRule(supertest, rule);
+        const createRuleBody = await createRule(supertest, log, rule);
 
         const { body } = await supertest
           .get(`${DETECTION_ENGINE_RULES_URL}?id=${createRuleBody.id}`)
@@ -162,7 +163,7 @@ export default ({ getService }: FtrProviderContext) => {
           actions: [action],
         };
 
-        const createRuleBody = await createRule(supertest, rule);
+        const createRuleBody = await createRule(supertest, log, rule);
 
         const { body } = await supertest
           .get(`${DETECTION_ENGINE_RULES_URL}?id=${createRuleBody.id}`)
@@ -193,7 +194,7 @@ export default ({ getService }: FtrProviderContext) => {
             .expect(200);
 
           // create a rule without actions
-          const createRuleBody = await createRule(supertest, getSimpleRule('rule-1'));
+          const createRuleBody = await createRule(supertest, log, getSimpleRule('rule-1'));
 
           // attach the legacy notification
           await supertest
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/resolve_read_rules.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/resolve_read_rules.ts
index 440672e33d8ed..a7333ef8716f2 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/resolve_read_rules.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/resolve_read_rules.ts
@@ -18,19 +18,20 @@ export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const es = getService('es');
   const esArchiver = getService('esArchiver');
+  const log = getService('log');
 
   describe('resolve_read_rules', () => {
     describe('reading rules', () => {
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
         await esArchiver.load(
           'x-pack/test/functional/es_archives/security_solution/resolve_read_rules/7_14'
         );
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
         await esArchiver.unload(
           'x-pack/test/functional/es_archives/security_solution/resolve_read_rules/7_14'
         );
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/runtime.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/runtime.ts
index 293f3e758911e..e6d1ef69f0913 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/runtime.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/runtime.ts
@@ -23,6 +23,8 @@ import {
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
+  const log = getService('log');
+
   interface Runtime {
     name: string;
     hostname: string;
@@ -39,20 +41,20 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('Regular runtime field mappings', () => {
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
       });
 
       it('should copy normal non-runtime data set from the source index into the signals index in the same position when the target is ECS compatible', async () => {
         const rule = getRuleForSignalTesting(['runtime']);
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits
           .map((signal) => (signal._source?.host as Runtime).name)
           .sort();
@@ -61,10 +63,10 @@ export default ({ getService }: FtrProviderContext) => {
 
       it('should copy "runtime mapping" data from a source index into the signals index in the same position when the target is ECS compatible', async () => {
         const rule = getRuleForSignalTesting(['runtime']);
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits
           .map((signal) => (signal._source?.host as Runtime).hostname)
           .sort();
@@ -74,15 +76,15 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('Runtime field mappings that have conflicts within them', () => {
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
         await esArchiver.load(
           'x-pack/test/functional/es_archives/security_solution/runtime_conflicting_fields'
         );
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
         await esArchiver.unload(
           'x-pack/test/functional/es_archives/security_solution/runtime_conflicting_fields'
         );
@@ -95,10 +97,10 @@ export default ({ getService }: FtrProviderContext) => {
        */
       it('should NOT copy normal non-runtime data set from the source index into the signals index in the same position when the target is ECS compatible', async () => {
         const rule = getRuleForSignalTesting(['runtime_conflicting_fields']);
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits
           .map((signal) => signal._source?.host as Array<{ name: string }>)
           .map((host) => {
@@ -152,10 +154,10 @@ export default ({ getService }: FtrProviderContext) => {
        */
       it('should NOT copy "runtime mapping" data from a source index into the signals index in the same position when the target is ECS compatible', async () => {
         const rule = getRuleForSignalTesting(['runtime_conflicting_fields']);
-        const { id } = await createRule(supertest, rule);
-        await waitForRuleSuccessOrStatus(supertest, id);
-        await waitForSignalsToBePresent(supertest, 4, [id]);
-        const signalsOpen = await getSignalsById(supertest, id);
+        const { id } = await createRule(supertest, log, rule);
+        await waitForRuleSuccessOrStatus(supertest, log, id);
+        await waitForSignalsToBePresent(supertest, log, 4, [id]);
+        const signalsOpen = await getSignalsById(supertest, log, id);
         const hits = signalsOpen.hits.hits.map(
           (signal) => (signal._source?.host as Runtime).hostname
         );
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/throttle.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/throttle.ts
index f0fef839482ce..ec12446f1f9df 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/throttle.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/throttle.ts
@@ -29,6 +29,7 @@ import {
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   /**
    *
@@ -46,12 +47,12 @@ export default ({ getService }: FtrProviderContext) => {
   describe('throttle', () => {
     describe('adding actions', () => {
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
       });
 
       describe('creating a rule', () => {
@@ -63,7 +64,7 @@ export default ({ getService }: FtrProviderContext) => {
             .send(getWebHookAction())
             .expect(200);
 
-          const rule = await createRule(supertest, getRuleWithWebHookAction(hookAction.id));
+          const rule = await createRule(supertest, log, getRuleWithWebHookAction(hookAction.id));
           const {
             body: { mute_all: muteAll, notify_when: notifyWhen },
           } = await supertest.get(`/api/alerting/rule/${rule.id}`);
@@ -76,7 +77,7 @@ export default ({ getService }: FtrProviderContext) => {
             ...getSimpleRule(),
             throttle: NOTIFICATION_THROTTLE_NO_ACTIONS,
           };
-          const rule = await createRule(supertest, ruleWithThrottle);
+          const rule = await createRule(supertest, log, ruleWithThrottle);
           const {
             body: { mute_all: muteAll, notify_when: notifyWhen },
           } = await supertest.get(`/api/alerting/rule/${rule.id}`);
@@ -96,7 +97,7 @@ export default ({ getService }: FtrProviderContext) => {
             ...getRuleWithWebHookAction(hookAction.id),
             throttle: NOTIFICATION_THROTTLE_NO_ACTIONS,
           };
-          const rule = await createRule(supertest, ruleWithThrottle);
+          const rule = await createRule(supertest, log, ruleWithThrottle);
           const {
             body: { mute_all: muteAll, notify_when: notifyWhen },
           } = await supertest.get(`/api/alerting/rule/${rule.id}`);
@@ -109,7 +110,7 @@ export default ({ getService }: FtrProviderContext) => {
             ...getSimpleRule(),
             throttle: NOTIFICATION_THROTTLE_RULE,
           };
-          const rule = await createRule(supertest, ruleWithThrottle);
+          const rule = await createRule(supertest, log, ruleWithThrottle);
           const {
             body: { mute_all: muteAll, notify_when: notifyWhen },
           } = await supertest.get(`/api/alerting/rule/${rule.id}`);
@@ -123,7 +124,7 @@ export default ({ getService }: FtrProviderContext) => {
             ...getSimpleRule(),
             throttle: NOTIFICATION_THROTTLE_RULE,
           };
-          const rule = await createRule(supertest, ruleWithThrottle);
+          const rule = await createRule(supertest, log, ruleWithThrottle);
           expect(rule.throttle).to.eql(NOTIFICATION_THROTTLE_NO_ACTIONS);
         });
 
@@ -139,7 +140,7 @@ export default ({ getService }: FtrProviderContext) => {
             ...getRuleWithWebHookAction(hookAction.id),
             throttle: NOTIFICATION_THROTTLE_RULE,
           };
-          const rule = await createRule(supertest, ruleWithThrottle);
+          const rule = await createRule(supertest, log, ruleWithThrottle);
           const {
             body: { mute_all: muteAll, notify_when: notifyWhen },
           } = await supertest.get(`/api/alerting/rule/${rule.id}`);
@@ -152,7 +153,7 @@ export default ({ getService }: FtrProviderContext) => {
             ...getSimpleRule(),
             throttle: '1h',
           };
-          const rule = await createRule(supertest, ruleWithThrottle);
+          const rule = await createRule(supertest, log, ruleWithThrottle);
           const {
             body: { mute_all: muteAll, notify_when: notifyWhen },
           } = await supertest.get(`/api/alerting/rule/${rule.id}`);
@@ -172,7 +173,7 @@ export default ({ getService }: FtrProviderContext) => {
             ...getRuleWithWebHookAction(hookAction.id),
             throttle: '1h',
           };
-          const rule = await createRule(supertest, ruleWithThrottle);
+          const rule = await createRule(supertest, log, ruleWithThrottle);
           const {
             body: { mute_all: muteAll, notify_when: notifyWhen },
           } = await supertest.get(`/api/alerting/rule/${rule.id}`);
@@ -190,8 +191,8 @@ export default ({ getService }: FtrProviderContext) => {
             .send(getWebHookAction())
             .expect(200);
 
-          const rule = await createRule(supertest, getRuleWithWebHookAction(hookAction.id));
-          const readRule = await getRule(supertest, rule.rule_id);
+          const rule = await createRule(supertest, log, getRuleWithWebHookAction(hookAction.id));
+          const readRule = await getRule(supertest, log, rule.rule_id);
           expect(readRule.throttle).to.eql(NOTIFICATION_THROTTLE_RULE);
         });
 
@@ -200,8 +201,8 @@ export default ({ getService }: FtrProviderContext) => {
             ...getSimpleRule(),
             throttle: NOTIFICATION_THROTTLE_NO_ACTIONS,
           };
-          const rule = await createRule(supertest, ruleWithThrottle);
-          const readRule = await getRule(supertest, rule.rule_id);
+          const rule = await createRule(supertest, log, ruleWithThrottle);
+          const readRule = await getRule(supertest, log, rule.rule_id);
           expect(readRule.throttle).to.eql(NOTIFICATION_THROTTLE_NO_ACTIONS);
         });
 
@@ -211,8 +212,8 @@ export default ({ getService }: FtrProviderContext) => {
             ...getSimpleRule(),
             throttle: NOTIFICATION_THROTTLE_RULE,
           };
-          const rule = await createRule(supertest, ruleWithThrottle);
-          const readRule = await getRule(supertest, rule.rule_id);
+          const rule = await createRule(supertest, log, ruleWithThrottle);
+          const readRule = await getRule(supertest, log, rule.rule_id);
           expect(readRule.throttle).to.eql(NOTIFICATION_THROTTLE_NO_ACTIONS);
         });
 
@@ -224,13 +225,13 @@ export default ({ getService }: FtrProviderContext) => {
             .send(getWebHookAction())
             .expect(200);
 
-          const rule = await createRule(supertest, getRuleWithWebHookAction(hookAction.id));
+          const rule = await createRule(supertest, log, getRuleWithWebHookAction(hookAction.id));
           await supertest
             .post(`/api/alerting/rule/${rule.id}/_mute_all`)
             .set('kbn-xsrf', 'true')
             .send()
             .expect(204);
-          const readRule = await getRule(supertest, rule.rule_id);
+          const readRule = await getRule(supertest, log, rule.rule_id);
           expect(readRule.throttle).to.eql(NOTIFICATION_THROTTLE_NO_ACTIONS);
         });
       });
@@ -245,9 +246,9 @@ export default ({ getService }: FtrProviderContext) => {
             .expect(200);
 
           const ruleWithWebHookAction = getRuleWithWebHookAction(hookAction.id);
-          await createRule(supertest, ruleWithWebHookAction);
+          await createRule(supertest, log, ruleWithWebHookAction);
           ruleWithWebHookAction.name = 'some other name';
-          const updated = await updateRule(supertest, ruleWithWebHookAction);
+          const updated = await updateRule(supertest, log, ruleWithWebHookAction);
           expect(updated.throttle).to.eql(NOTIFICATION_THROTTLE_RULE);
         });
 
@@ -260,9 +261,9 @@ export default ({ getService }: FtrProviderContext) => {
             .expect(200);
 
           const ruleWithWebHookAction = getRuleWithWebHookAction(hookAction.id);
-          await createRule(supertest, ruleWithWebHookAction);
+          await createRule(supertest, log, ruleWithWebHookAction);
           ruleWithWebHookAction.name = 'some other name';
-          const updated = await updateRule(supertest, ruleWithWebHookAction);
+          const updated = await updateRule(supertest, log, ruleWithWebHookAction);
           const {
             body: { mute_all: muteAll, notify_when: notifyWhen },
           } = await supertest.get(`/api/alerting/rule/${updated.id}`);
@@ -280,9 +281,9 @@ export default ({ getService }: FtrProviderContext) => {
             .expect(200);
 
           const ruleWithWebHookAction = getRuleWithWebHookAction(hookAction.id);
-          await createRule(supertest, ruleWithWebHookAction);
+          await createRule(supertest, log, ruleWithWebHookAction);
           ruleWithWebHookAction.actions = [];
-          const updated = await updateRule(supertest, ruleWithWebHookAction);
+          const updated = await updateRule(supertest, log, ruleWithWebHookAction);
           expect(updated.throttle).to.eql(NOTIFICATION_THROTTLE_NO_ACTIONS);
         });
       });
@@ -297,14 +298,14 @@ export default ({ getService }: FtrProviderContext) => {
             .expect(200);
 
           const ruleWithWebHookAction = getRuleWithWebHookAction(hookAction.id);
-          const rule = await createRule(supertest, ruleWithWebHookAction);
+          const rule = await createRule(supertest, log, ruleWithWebHookAction);
           // patch a simple rule's name
           await supertest
             .patch(DETECTION_ENGINE_RULES_URL)
             .set('kbn-xsrf', 'true')
             .send({ rule_id: rule.rule_id, name: 'some other name' })
             .expect(200);
-          const readRule = await getRule(supertest, rule.rule_id);
+          const readRule = await getRule(supertest, log, rule.rule_id);
           expect(readRule.throttle).to.eql(NOTIFICATION_THROTTLE_RULE);
         });
 
@@ -317,7 +318,7 @@ export default ({ getService }: FtrProviderContext) => {
             .expect(200);
 
           const ruleWithWebHookAction = getRuleWithWebHookAction(hookAction.id);
-          const rule = await createRule(supertest, ruleWithWebHookAction);
+          const rule = await createRule(supertest, log, ruleWithWebHookAction);
           // patch a simple rule's name
           await supertest
             .patch(DETECTION_ENGINE_RULES_URL)
@@ -341,14 +342,14 @@ export default ({ getService }: FtrProviderContext) => {
             .expect(200);
 
           const ruleWithWebHookAction = getRuleWithWebHookAction(hookAction.id);
-          const rule = await createRule(supertest, ruleWithWebHookAction);
+          const rule = await createRule(supertest, log, ruleWithWebHookAction);
           // patch a simple rule's action
           await supertest
             .patch(DETECTION_ENGINE_RULES_URL)
             .set('kbn-xsrf', 'true')
             .send({ rule_id: rule.rule_id, actions: [] })
             .expect(200);
-          const readRule = await getRule(supertest, rule.rule_id);
+          const readRule = await getRule(supertest, log, rule.rule_id);
           expect(readRule.throttle).to.eql(NOTIFICATION_THROTTLE_NO_ACTIONS);
         });
       });
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/timestamps.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/timestamps.ts
index f4b91cae36448..e8017591faf0d 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/timestamps.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/timestamps.ts
@@ -11,7 +11,7 @@ import {
   EqlCreateSchema,
   QueryCreateSchema,
 } from '../../../../plugins/security_solution/common/detection_engine/schemas/request';
-import { ALERT_ORIGINAL_TIME } from '../../../../plugins/security_solution/server/lib/detection_engine/rule_types/field_maps/field_names';
+import { ALERT_ORIGINAL_TIME } from '../../../../plugins/security_solution/common/field_maps/field_names';
 
 import { FtrProviderContext } from '../../common/ftr_provider_context';
 import {
@@ -34,6 +34,7 @@ function sleep(ms: number) {
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
+  const log = getService('log');
 
   /**
    * Tests around timestamps within signals such as the copying of timestamps correctly into
@@ -43,7 +44,7 @@ export default ({ getService }: FtrProviderContext) => {
   describe('timestamp tests', () => {
     describe('Signals generated from events with a timestamp in seconds is converted correctly into the forced ISO8601 format when copying', () => {
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
         await esArchiver.load(
           'x-pack/test/functional/es_archives/security_solution/timestamp_in_seconds'
         );
@@ -53,8 +54,8 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
         await esArchiver.unload(
           'x-pack/test/functional/es_archives/security_solution/timestamp_in_seconds'
         );
@@ -66,11 +67,11 @@ export default ({ getService }: FtrProviderContext) => {
       describe('KQL query', () => {
         it('should convert the @timestamp which is epoch_seconds into the correct ISO format', async () => {
           const rule = getRuleForSignalTesting(['timestamp_in_seconds']);
-          const { id } = await createRule(supertest, rule);
-          await waitForRuleSuccessOrStatus(supertest, id);
+          const { id } = await createRule(supertest, log, rule);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
           await sleep(5000);
-          await waitForSignalsToBePresent(supertest, 1, [id]);
-          const signalsOpen = await getSignalsByIds(supertest, [id]);
+          await waitForSignalsToBePresent(supertest, log, 1, [id]);
+          const signalsOpen = await getSignalsByIds(supertest, log, [id]);
           const hits = signalsOpen.hits.hits
             .map((hit) => hit._source?.[ALERT_ORIGINAL_TIME])
             .sort();
@@ -82,11 +83,11 @@ export default ({ getService }: FtrProviderContext) => {
             ...getRuleForSignalTesting(['myfakeindex-5']),
             timestamp_override: 'event.ingested',
           };
-          const { id } = await createRule(supertest, rule);
-          await waitForRuleSuccessOrStatus(supertest, id);
+          const { id } = await createRule(supertest, log, rule);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
           await sleep(5000);
-          await waitForSignalsToBePresent(supertest, 1, [id]);
-          const signalsOpen = await getSignalsByIds(supertest, [id]);
+          await waitForSignalsToBePresent(supertest, log, 1, [id]);
+          const signalsOpen = await getSignalsByIds(supertest, log, [id]);
           const hits = signalsOpen.hits.hits
             .map((hit) => hit._source?.[ALERT_ORIGINAL_TIME])
             .sort();
@@ -97,11 +98,11 @@ export default ({ getService }: FtrProviderContext) => {
       describe('EQL query', () => {
         it('should convert the @timestamp which is epoch_seconds into the correct ISO format for EQL', async () => {
           const rule = getEqlRuleForSignalTesting(['timestamp_in_seconds']);
-          const { id } = await createRule(supertest, rule);
-          await waitForRuleSuccessOrStatus(supertest, id);
+          const { id } = await createRule(supertest, log, rule);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
           await sleep(5000);
-          await waitForSignalsToBePresent(supertest, 1, [id]);
-          const signalsOpen = await getSignalsByIds(supertest, [id]);
+          await waitForSignalsToBePresent(supertest, log, 1, [id]);
+          const signalsOpen = await getSignalsByIds(supertest, log, [id]);
           const hits = signalsOpen.hits.hits
             .map((hit) => hit._source?.[ALERT_ORIGINAL_TIME])
             .sort();
@@ -113,11 +114,11 @@ export default ({ getService }: FtrProviderContext) => {
             ...getEqlRuleForSignalTesting(['myfakeindex-5']),
             timestamp_override: 'event.ingested',
           };
-          const { id } = await createRule(supertest, rule);
-          await waitForRuleSuccessOrStatus(supertest, id);
+          const { id } = await createRule(supertest, log, rule);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
           await sleep(5000);
-          await waitForSignalsToBePresent(supertest, 1, [id]);
-          const signalsOpen = await getSignalsByIds(supertest, [id]);
+          await waitForSignalsToBePresent(supertest, log, 1, [id]);
+          const signalsOpen = await getSignalsByIds(supertest, log, [id]);
           const hits = signalsOpen.hits.hits
             .map((hit) => hit._source?.[ALERT_ORIGINAL_TIME])
             .sort();
@@ -134,8 +135,8 @@ export default ({ getService }: FtrProviderContext) => {
      */
     describe('Signals generated from events with timestamp override field', async () => {
       beforeEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await createSignalsIndex(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await createSignalsIndex(supertest, log);
         await esArchiver.load(
           'x-pack/test/functional/es_archives/security_solution/timestamp_override_1'
         );
@@ -151,8 +152,8 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
         await esArchiver.unload(
           'x-pack/test/functional/es_archives/security_solution/timestamp_override_1'
         );
@@ -174,12 +175,12 @@ export default ({ getService }: FtrProviderContext) => {
             timestamp_override: 'event.ingested',
           };
 
-          const { id } = await createRule(supertest, rule);
+          const { id } = await createRule(supertest, log, rule);
 
-          await waitForRuleSuccessOrStatus(supertest, id, 'partial failure');
+          await waitForRuleSuccessOrStatus(supertest, log, id, 'partial failure');
           await sleep(5000);
-          await waitForSignalsToBePresent(supertest, 3, [id]);
-          const signalsResponse = await getSignalsByIds(supertest, [id], 3);
+          await waitForSignalsToBePresent(supertest, log, 3, [id]);
+          const signalsResponse = await getSignalsByIds(supertest, log, [id], 3);
           const signals = signalsResponse.hits.hits.map((hit) => hit._source);
           const signalsOrderedByEventId = orderBy(signals, 'signal.parent.id', 'asc');
 
@@ -189,12 +190,12 @@ export default ({ getService }: FtrProviderContext) => {
         it('should generate 2 signals with @timestamp', async () => {
           const rule: QueryCreateSchema = getRuleForSignalTesting(['myfa*']);
 
-          const { id } = await createRule(supertest, rule);
+          const { id } = await createRule(supertest, log, rule);
 
-          await waitForRuleSuccessOrStatus(supertest, id, 'partial failure');
+          await waitForRuleSuccessOrStatus(supertest, log, id, 'partial failure');
           await sleep(5000);
-          await waitForSignalsToBePresent(supertest, 2, [id]);
-          const signalsResponse = await getSignalsByIds(supertest, [id]);
+          await waitForSignalsToBePresent(supertest, log, 2, [id]);
+          const signalsResponse = await getSignalsByIds(supertest, log, [id]);
           const signals = signalsResponse.hits.hits.map((hit) => hit._source);
           const signalsOrderedByEventId = orderBy(signals, 'signal.parent.id', 'asc');
 
@@ -206,12 +207,12 @@ export default ({ getService }: FtrProviderContext) => {
             ...getRuleForSignalTesting(['myfa*']),
             timestamp_override: 'event.fakeingestfield',
           };
-          const { id } = await createRule(supertest, rule);
+          const { id } = await createRule(supertest, log, rule);
 
-          await waitForRuleSuccessOrStatus(supertest, id, 'partial failure');
+          await waitForRuleSuccessOrStatus(supertest, log, id, 'partial failure');
           await sleep(5000);
-          await waitForSignalsToBePresent(supertest, 2, [id]);
-          const signalsResponse = await getSignalsByIds(supertest, [id, id]);
+          await waitForSignalsToBePresent(supertest, log, 2, [id]);
+          const signalsResponse = await getSignalsByIds(supertest, log, [id, id]);
           const signals = signalsResponse.hits.hits.map((hit) => hit._source);
           const signalsOrderedByEventId = orderBy(signals, 'signal.parent.id', 'asc');
 
@@ -229,12 +230,12 @@ export default ({ getService }: FtrProviderContext) => {
             ...getRuleForSignalTesting(['myfakeindex-2']),
             timestamp_override: 'event.ingested',
           };
-          const { id } = await createRule(supertest, rule);
+          const { id } = await createRule(supertest, log, rule);
 
-          await waitForRuleSuccessOrStatus(supertest, id);
+          await waitForRuleSuccessOrStatus(supertest, log, id);
           await sleep(5000);
-          await waitForSignalsToBePresent(supertest, 1, [id]);
-          const signalsResponse = await getSignalsByIds(supertest, [id, id]);
+          await waitForSignalsToBePresent(supertest, log, 1, [id]);
+          const signalsResponse = await getSignalsByIds(supertest, log, [id, id]);
           const hits = signalsResponse.hits.hits
             .map((hit) => hit._source?.[ALERT_ORIGINAL_TIME])
             .sort();
@@ -246,12 +247,12 @@ export default ({ getService }: FtrProviderContext) => {
         it('should generate 2 signals with @timestamp', async () => {
           const rule: EqlCreateSchema = getEqlRuleForSignalTesting(['myfa*']);
 
-          const { id } = await createRule(supertest, rule);
+          const { id } = await createRule(supertest, log, rule);
 
-          await waitForRuleSuccessOrStatus(supertest, id, 'partial failure');
+          await waitForRuleSuccessOrStatus(supertest, log, id, 'partial failure');
           await sleep(5000);
-          await waitForSignalsToBePresent(supertest, 2, [id]);
-          const signalsResponse = await getSignalsByIds(supertest, [id]);
+          await waitForSignalsToBePresent(supertest, log, 2, [id]);
+          const signalsResponse = await getSignalsByIds(supertest, log, [id]);
           const signals = signalsResponse.hits.hits.map((hit) => hit._source);
           const signalsOrderedByEventId = orderBy(signals, 'signal.parent.id', 'asc');
 
@@ -270,12 +271,12 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
       });
 
       describe('KQL', () => {
@@ -297,11 +298,11 @@ export default ({ getService }: FtrProviderContext) => {
             max_signals: 200,
           };
 
-          const { id } = await createRule(supertest, rule);
-          await waitForRuleSuccessOrStatus(supertest, id, 'partial failure');
+          const { id } = await createRule(supertest, log, rule);
+          await waitForRuleSuccessOrStatus(supertest, log, id, 'partial failure');
           await sleep(5000);
-          await waitForSignalsToBePresent(supertest, 200, [id]);
-          const signalsResponse = await getSignalsByIds(supertest, [id], 200);
+          await waitForSignalsToBePresent(supertest, log, 200, [id]);
+          const signalsResponse = await getSignalsByIds(supertest, log, [id], 200);
           const signals = signalsResponse.hits.hits.map((hit) => hit._source);
 
           expect(signals.length).equal(200);
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/update_actions.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/update_actions.ts
index 930486dab97bb..43b982ff537d7 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/update_actions.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/update_actions.ts
@@ -33,6 +33,7 @@ import {
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
+  const log = getService('log');
 
   describe('update_actions', () => {
     describe('updating actions', () => {
@@ -45,20 +46,20 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
       });
 
       it('should be able to create a new webhook action and update a rule with the webhook action', async () => {
-        const hookAction = await createNewAction(supertest);
+        const hookAction = await createNewAction(supertest, log);
         const rule = getSimpleRule();
-        await createRule(supertest, rule);
+        await createRule(supertest, log, rule);
         const ruleToUpdate = getRuleWithWebHookAction(hookAction.id, false, rule);
-        const updatedRule = await updateRule(supertest, ruleToUpdate);
+        const updatedRule = await updateRule(supertest, log, ruleToUpdate);
         const bodyToCompare = removeServerGeneratedProperties(updatedRule);
 
         const expected = {
@@ -69,12 +70,12 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should be able to add a new webhook action and then remove the action from the rule again', async () => {
-        const hookAction = await createNewAction(supertest);
+        const hookAction = await createNewAction(supertest, log);
         const rule = getSimpleRule();
-        await createRule(supertest, rule);
+        await createRule(supertest, log, rule);
         const ruleToUpdate = getRuleWithWebHookAction(hookAction.id, false, rule);
-        await updateRule(supertest, ruleToUpdate);
-        const ruleAfterActionRemoved = await updateRule(supertest, rule);
+        await updateRule(supertest, log, ruleToUpdate);
+        const ruleAfterActionRemoved = await updateRule(supertest, log, rule);
         const bodyToCompare = removeServerGeneratedProperties(ruleAfterActionRemoved);
         const expected = {
           ...getSimpleRuleOutput(),
@@ -84,12 +85,12 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should be able to create a new webhook action and attach it to a rule without a meta field and run it correctly', async () => {
-        const hookAction = await createNewAction(supertest);
+        const hookAction = await createNewAction(supertest, log);
         const rule = getSimpleRule();
-        await createRule(supertest, rule);
+        await createRule(supertest, log, rule);
         const ruleToUpdate = getRuleWithWebHookAction(hookAction.id, true, rule);
-        const updatedRule = await updateRule(supertest, ruleToUpdate);
-        await waitForRuleSuccessOrStatus(supertest, updatedRule.id);
+        const updatedRule = await updateRule(supertest, log, ruleToUpdate);
+        await waitForRuleSuccessOrStatus(supertest, log, updatedRule.id);
 
         // expected result for status should be 'succeeded'
         const { body } = await supertest
@@ -101,15 +102,15 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should be able to create a new webhook action and attach it to a rule with a meta field and run it correctly', async () => {
-        const hookAction = await createNewAction(supertest);
+        const hookAction = await createNewAction(supertest, log);
         const rule = getSimpleRule();
-        await createRule(supertest, rule);
+        await createRule(supertest, log, rule);
         const ruleToUpdate: CreateRulesSchema = {
           ...getRuleWithWebHookAction(hookAction.id, true, rule),
           meta: {}, // create a rule with the action attached and a meta field
         };
-        const updatedRule = await updateRule(supertest, ruleToUpdate);
-        await waitForRuleSuccessOrStatus(supertest, updatedRule.id);
+        const updatedRule = await updateRule(supertest, log, ruleToUpdate);
+        await waitForRuleSuccessOrStatus(supertest, log, updatedRule.id);
 
         // expected result for status should be 'succeeded'
         const { body } = await supertest
@@ -121,14 +122,14 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should be able to create a new webhook action and attach it to an immutable rule', async () => {
-        await installPrePackagedRules(supertest);
+        await installPrePackagedRules(supertest, log);
         // Rule id of "9a1a2dae-0b5f-4c3d-8305-a268d404c306" is from the file:
         // x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint.json
-        const immutableRule = await getRule(supertest, '9a1a2dae-0b5f-4c3d-8305-a268d404c306');
-        const hookAction = await createNewAction(supertest);
+        const immutableRule = await getRule(supertest, log, '9a1a2dae-0b5f-4c3d-8305-a268d404c306');
+        const hookAction = await createNewAction(supertest, log);
         const newRuleToUpdate = getSimpleRule(immutableRule.rule_id);
         const ruleToUpdate = getRuleWithWebHookAction(hookAction.id, false, newRuleToUpdate);
-        const updatedRule = await updateRule(supertest, ruleToUpdate);
+        const updatedRule = await updateRule(supertest, log, ruleToUpdate);
         const bodyToCompare = removeServerGeneratedProperties(updatedRule);
 
         const expected = {
@@ -141,29 +142,33 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should be able to create a new webhook action, attach it to an immutable rule and the count of prepackaged rules should not increase. If this fails, suspect the immutable tags are not staying on the rule correctly.', async () => {
-        await installPrePackagedRules(supertest);
+        await installPrePackagedRules(supertest, log);
         // Rule id of "9a1a2dae-0b5f-4c3d-8305-a268d404c306" is from the file:
         // x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint.json
-        const immutableRule = await getRule(supertest, '9a1a2dae-0b5f-4c3d-8305-a268d404c306');
-        const hookAction = await createNewAction(supertest);
+        const immutableRule = await getRule(supertest, log, '9a1a2dae-0b5f-4c3d-8305-a268d404c306');
+        const hookAction = await createNewAction(supertest, log);
         const newRuleToUpdate = getSimpleRule(immutableRule.rule_id);
         const ruleToUpdate = getRuleWithWebHookAction(hookAction.id, false, newRuleToUpdate);
-        await updateRule(supertest, ruleToUpdate);
+        await updateRule(supertest, log, ruleToUpdate);
 
-        const status = await getPrePackagedRulesStatus(supertest);
+        const status = await getPrePackagedRulesStatus(supertest, log);
         expect(status.rules_not_installed).to.eql(0);
       });
 
       it('should be able to create a new webhook action, attach it to an immutable rule and the rule should stay immutable when searching against immutable tags', async () => {
-        await installPrePackagedRules(supertest);
+        await installPrePackagedRules(supertest, log);
         // Rule id of "9a1a2dae-0b5f-4c3d-8305-a268d404c306" is from the file:
         // x-pack/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint.json
-        const immutableRule = await getRule(supertest, '9a1a2dae-0b5f-4c3d-8305-a268d404c306');
-        const hookAction = await createNewAction(supertest);
+        const immutableRule = await getRule(supertest, log, '9a1a2dae-0b5f-4c3d-8305-a268d404c306');
+        const hookAction = await createNewAction(supertest, log);
         const newRuleToUpdate = getSimpleRule(immutableRule.rule_id);
         const ruleToUpdate = getRuleWithWebHookAction(hookAction.id, false, newRuleToUpdate);
-        await updateRule(supertest, ruleToUpdate);
-        const body = await findImmutableRuleById(supertest, '9a1a2dae-0b5f-4c3d-8305-a268d404c306');
+        await updateRule(supertest, log, ruleToUpdate);
+        const body = await findImmutableRuleById(
+          supertest,
+          log,
+          '9a1a2dae-0b5f-4c3d-8305-a268d404c306'
+        );
 
         expect(body.data.length).to.eql(1); // should have only one length to the data set, otherwise we have duplicates or the tags were removed and that is incredibly bad.
         const bodyToCompare = removeServerGeneratedProperties(body.data[0]);
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/update_rules.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/update_rules.ts
index 2b91e0c3abd55..d6f69095c43c4 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/update_rules.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/update_rules.ts
@@ -29,20 +29,21 @@ import {
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('update_rules', () => {
     describe('update rules', () => {
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
       });
 
       it('should update a single rule property of name using a rule_id', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // update a simple rule's name
         const updatedRule = getSimpleRuleUpdate('rule-1');
@@ -64,7 +65,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it("should update a rule's machine learning job ID if given a legacy job ID format", async () => {
-        await createRule(supertest, getSimpleMlRule('rule-1'));
+        await createRule(supertest, log, getSimpleMlRule('rule-1'));
 
         // update rule's machine_learning_job_id
         const updatedRule = getSimpleMlRuleUpdate('rule-1');
@@ -86,7 +87,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should update a single rule property of name using a rule_id with a machine learning job', async () => {
-        await createRule(supertest, getSimpleMlRule('rule-1'));
+        await createRule(supertest, log, getSimpleMlRule('rule-1'));
 
         // update a simple rule's name
         const updatedRule = getSimpleMlRuleUpdate('rule-1');
@@ -110,7 +111,7 @@ export default ({ getService }: FtrProviderContext) => {
       it('should update a single rule property of name using an auto-generated rule_id', async () => {
         const rule = getSimpleRule('rule-1');
         delete rule.rule_id;
-        const createRuleBody = await createRule(supertest, rule);
+        const createRuleBody = await createRule(supertest, log, rule);
 
         // update a simple rule's name
         const updatedRule = getSimpleRuleUpdate('rule-1');
@@ -145,7 +146,7 @@ export default ({ getService }: FtrProviderContext) => {
                 webhookUrl: 'http://localhost:1234',
               },
             }),
-          createRule(supertest, rule),
+          createRule(supertest, log, rule),
         ]);
         await createLegacyRuleAction(supertest, createRuleBody.id, connector.body.id);
 
@@ -181,7 +182,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should update a single rule property of name using the auto-generated id', async () => {
-        const createdBody = await createRule(supertest, getSimpleRule('rule-1'));
+        const createdBody = await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // update a simple rule's name
         const updatedRule = getSimpleRuleUpdate('rule-1');
@@ -203,7 +204,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should change the version of a rule when it updates enabled and another property', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // update a simple rule's enabled to false and another property
         const updatedRule = getSimpleRuleUpdate('rule-1');
@@ -226,7 +227,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should change other properties when it does updates and effectively delete them such as timeline_title', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
 
         const ruleUpdate = getSimpleRuleUpdate('rule-1');
         ruleUpdate.timeline_title = 'some title';
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/update_rules_bulk.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/update_rules_bulk.ts
index d950b30d584af..217debca079dc 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/update_rules_bulk.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/update_rules_bulk.ts
@@ -26,20 +26,21 @@ import {
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('update_rules_bulk', () => {
     describe('update rules bulk', () => {
       beforeEach(async () => {
-        await createSignalsIndex(supertest);
+        await createSignalsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteSignalsIndex(supertest);
-        await deleteAllAlerts(supertest);
+        await deleteSignalsIndex(supertest, log);
+        await deleteAllAlerts(supertest, log);
       });
 
       it('should update a single rule property of name using a rule_id', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
 
         const updatedRule = getSimpleRuleUpdate('rule-1');
         updatedRule.name = 'some other name';
@@ -59,7 +60,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should update two rule properties of name using the two rules rule_id', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // create a second simple rule
         await supertest
@@ -107,8 +108,8 @@ export default ({ getService }: FtrProviderContext) => {
                 webhookUrl: 'http://localhost:1234',
               },
             }),
-          createRule(supertest, getSimpleRule('rule-1')),
-          createRule(supertest, getSimpleRule('rule-2')),
+          createRule(supertest, log, getSimpleRule('rule-1')),
+          createRule(supertest, log, getSimpleRule('rule-2')),
         ]);
         await Promise.all([
           createLegacyRuleAction(supertest, rule1.id, connector.body.id),
@@ -154,7 +155,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should update a single rule property of name using an id', async () => {
-        const createRuleBody = await createRule(supertest, getSimpleRule('rule-1'));
+        const createRuleBody = await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // update a simple rule's name
         const updatedRule1 = getSimpleRuleUpdate('rule-1');
@@ -176,8 +177,8 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should update two rule properties of name using the two rules id', async () => {
-        const createRule1 = await createRule(supertest, getSimpleRule('rule-1'));
-        const createRule2 = await createRule(supertest, getSimpleRule('rule-2'));
+        const createRule1 = await createRule(supertest, log, getSimpleRule('rule-1'));
+        const createRule2 = await createRule(supertest, log, getSimpleRule('rule-2'));
 
         // update both rule names
         const updatedRule1 = getSimpleRuleUpdate('rule-1');
@@ -211,7 +212,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should update a single rule property of name using the auto-generated id', async () => {
-        const createdBody = await createRule(supertest, getSimpleRule('rule-1'));
+        const createdBody = await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // update a simple rule's name
         const updatedRule1 = getSimpleRuleUpdate('rule-1');
@@ -233,7 +234,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should change the version of a rule when it updates enabled and another property', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // update a simple rule's enabled to false and another property
         const updatedRule1 = getSimpleRuleUpdate('rule-1');
@@ -256,7 +257,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should change other properties when it does updates and effectively delete them such as timeline_title', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // update a simple rule's timeline_title
         const ruleUpdate = getSimpleRuleUpdate('rule-1');
@@ -329,7 +330,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should update one rule property and give an error about a second fake rule_id', async () => {
-        await createRule(supertest, getSimpleRule('rule-1'));
+        await createRule(supertest, log, getSimpleRule('rule-1'));
 
         const ruleUpdate = getSimpleRuleUpdate('rule-1');
         ruleUpdate.name = 'some other name';
@@ -364,7 +365,7 @@ export default ({ getService }: FtrProviderContext) => {
       });
 
       it('should update one rule property and give an error about a second fake id', async () => {
-        const createdBody = await createRule(supertest, getSimpleRule('rule-1'));
+        const createdBody = await createRule(supertest, log, getSimpleRule('rule-1'));
 
         // update one rule name and give a fake id for the second
         const rule1 = getSimpleRuleUpdate();
diff --git a/x-pack/test/detection_engine_api_integration/utils.ts b/x-pack/test/detection_engine_api_integration/utils.ts
index 848dbc8fd50af..cc915324a4a35 100644
--- a/x-pack/test/detection_engine_api_integration/utils.ts
+++ b/x-pack/test/detection_engine_api_integration/utils.ts
@@ -24,6 +24,7 @@ import type {
   ExceptionListSchema,
 } from '@kbn/securitysolution-io-ts-list-types';
 import { EXCEPTION_LIST_ITEM_URL, EXCEPTION_LIST_URL } from '@kbn/securitysolution-list-constants';
+import { ToolingLog } from '@kbn/dev-utils';
 import { PrePackagedRulesAndTimelinesStatusSchema } from '../../plugins/security_solution/common/detection_engine/schemas/response';
 import {
   CreateRulesSchema,
@@ -415,7 +416,8 @@ export const getSimpleMlRuleOutput = (ruleId = 'rule-1'): Partial<RulesSchema> =
  * @param supertest The supertest agent.
  */
 export const deleteAllAlerts = async (
-  supertest: SuperTest.SuperTest<SuperTest.Test>
+  supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog
 ): Promise<void> => {
   await countDownTest(
     async () => {
@@ -440,33 +442,42 @@ export const deleteAllAlerts = async (
       return finalCheck.data.length === 0;
     },
     'deleteAllAlerts',
+    log,
     50,
     1000
   );
 };
 
-export const downgradeImmutableRule = async (es: Client, ruleId: string): Promise<void> => {
-  return countDownES(async () => {
-    return es.updateByQuery(
-      {
-        index: '.kibana',
-        refresh: true,
-        wait_for_completion: true,
-        body: {
-          script: {
-            lang: 'painless',
-            source: 'ctx._source.alert.params.version--',
-          },
-          query: {
-            term: {
-              'alert.tags': `${INTERNAL_RULE_ID_KEY}:${ruleId}`,
+export const downgradeImmutableRule = async (
+  es: Client,
+  log: ToolingLog,
+  ruleId: string
+): Promise<void> => {
+  return countDownES(
+    async () => {
+      return es.updateByQuery(
+        {
+          index: '.kibana',
+          refresh: true,
+          wait_for_completion: true,
+          body: {
+            script: {
+              lang: 'painless',
+              source: 'ctx._source.alert.params.version--',
+            },
+            query: {
+              term: {
+                'alert.tags': `${INTERNAL_RULE_ID_KEY}:${ruleId}`,
+              },
             },
           },
         },
-      },
-      { meta: true }
-    );
-  }, 'downgradeImmutableRule');
+        { meta: true }
+      );
+    },
+    'downgradeImmutableRule',
+    log
+  );
 };
 
 /**
@@ -487,20 +498,25 @@ export const deleteAllTimelines = async (es: Client): Promise<void> => {
  * Remove all rules statuses from the .kibana index
  * This will retry 20 times before giving up and hopefully still not interfere with other tests
  * @param es The ElasticSearch handle
+ * @param log The tooling logger
  */
-export const deleteAllRulesStatuses = async (es: Client): Promise<void> => {
-  return countDownES(async () => {
-    return es.deleteByQuery(
-      {
-        index: '.kibana',
-        q: 'type:siem-detection-engine-rule-status',
-        wait_for_completion: true,
-        refresh: true,
-        body: {},
-      },
-      { meta: true }
-    );
-  }, 'deleteAllRulesStatuses');
+export const deleteAllRulesStatuses = async (es: Client, log: ToolingLog): Promise<void> => {
+  return countDownES(
+    async () => {
+      return es.deleteByQuery(
+        {
+          index: '.kibana',
+          q: 'type:siem-detection-engine-rule-status',
+          wait_for_completion: true,
+          refresh: true,
+          body: {},
+        },
+        { meta: true }
+      );
+    },
+    'deleteAllRulesStatuses',
+    log
+  );
 };
 
 /**
@@ -509,12 +525,17 @@ export const deleteAllRulesStatuses = async (es: Client): Promise<void> => {
  * @param supertest The supertest client library
  */
 export const createSignalsIndex = async (
-  supertest: SuperTest.SuperTest<SuperTest.Test>
+  supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog
 ): Promise<void> => {
-  await countDownTest(async () => {
-    await supertest.post(DETECTION_ENGINE_INDEX_URL).set('kbn-xsrf', 'true').send();
-    return true;
-  }, 'createSignalsIndex');
+  await countDownTest(
+    async () => {
+      await supertest.post(DETECTION_ENGINE_INDEX_URL).set('kbn-xsrf', 'true').send();
+      return true;
+    },
+    'createSignalsIndex',
+    log
+  );
 };
 
 export const createLegacyRuleAction = async (
@@ -545,12 +566,17 @@ export const createLegacyRuleAction = async (
  * @param supertest The supertest client library
  */
 export const deleteSignalsIndex = async (
-  supertest: SuperTest.SuperTest<SuperTest.Test>
+  supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog
 ): Promise<void> => {
-  await countDownTest(async () => {
-    await supertest.delete(DETECTION_ENGINE_INDEX_URL).set('kbn-xsrf', 'true').send();
-    return true;
-  }, 'deleteSignalsIndex');
+  await countDownTest(
+    async () => {
+      await supertest.delete(DETECTION_ENGINE_INDEX_URL).set('kbn-xsrf', 'true').send();
+      return true;
+    },
+    'deleteSignalsIndex',
+    log
+  );
 };
 
 /**
@@ -809,6 +835,7 @@ export const getSimpleRuleOutputWithWebHookAction = (actionId: string): Partial<
 export const waitFor = async (
   functionToTest: () => Promise<boolean>,
   functionName: string,
+  log: ToolingLog,
   maxTimeout: number = 800000,
   timeoutWait: number = 250
 ): Promise<void> => {
@@ -819,8 +846,7 @@ export const waitFor = async (
     if (await functionToTest()) {
       found = true;
     } else {
-      // eslint-disable-next-line no-console
-      console.log(`Try number ${numberOfTries} out of ${maxTries} for function ${functionName}`);
+      log.debug(`Try number ${numberOfTries} out of ${maxTries} for function ${functionName}`);
       numberOfTries++;
     }
 
@@ -838,12 +864,14 @@ export const waitFor = async (
  * reliant.
  * @param esFunction The function to test against
  * @param esFunctionName The name of the function to print if we encounter errors
+ * @param log The tooling logger
  * @param retryCount The number of times to retry before giving up (has default)
  * @param timeoutWait Time to wait before trying again (has default)
  */
 export const countDownES = async (
   esFunction: () => Promise<TransportResult<Record<string, any>, unknown>>,
   esFunctionName: string,
+  log: ToolingLog,
   retryCount: number = 20,
   timeoutWait = 250
 ): Promise<void> => {
@@ -851,14 +879,14 @@ export const countDownES = async (
     async () => {
       const result = await esFunction();
       if (result.body.version_conflicts !== 0) {
-        // eslint-disable-next-line no-console
-        console.log(`Version conflicts for ${result.body.version_conflicts}`);
+        log.error(`Version conflicts for ${result.body.version_conflicts}`);
         return false;
       } else {
         return true;
       }
     },
     esFunctionName,
+    log,
     retryCount,
     timeoutWait
   );
@@ -881,12 +909,14 @@ export const refreshIndex = async (es: Client, index?: string) => {
  * for testing resiliency.
  * @param functionToTest The function to test against
  * @param name The name of the function to print if we encounter errors
+ * @param log The tooling logger
  * @param retryCount The number of times to retry before giving up (has default)
  * @param timeoutWait Time to wait before trying again (has default)
  */
 export const countDownTest = async (
   functionToTest: () => Promise<boolean>,
   name: string,
+  log: ToolingLog,
   retryCount: number = 20,
   timeoutWait = 250,
   ignoreThrow: boolean = false
@@ -895,30 +925,27 @@ export const countDownTest = async (
     try {
       const passed = await functionToTest();
       if (!passed) {
-        // eslint-disable-next-line no-console
-        console.log(`Failure trying to ${name}, retries left are: ${retryCount - 1}`);
+        log.error(`Failure trying to ${name}, retries left are: ${retryCount - 1}`);
         // retry, counting down, and delay a bit before
         await new Promise((resolve) => setTimeout(resolve, timeoutWait));
-        await countDownTest(functionToTest, name, retryCount - 1, timeoutWait, ignoreThrow);
+        await countDownTest(functionToTest, name, log, retryCount - 1, timeoutWait, ignoreThrow);
       }
     } catch (err) {
       if (ignoreThrow) {
         throw err;
       } else {
-        // eslint-disable-next-line no-console
-        console.log(
-          `Failure trying to ${name}, with exception message of:`,
-          err.message,
-          `retries left are: ${retryCount - 1}`
+        log.error(
+          `Failure trying to ${name}, with exception message of: ${
+            err.message
+          }, retries left are: ${retryCount - 1}`
         );
         // retry, counting down, and delay a bit before
         await new Promise((resolve) => setTimeout(resolve, timeoutWait));
-        await countDownTest(functionToTest, name, retryCount - 1, timeoutWait, ignoreThrow);
+        await countDownTest(functionToTest, name, log, retryCount - 1, timeoutWait, ignoreThrow);
       }
     }
   } else {
-    // eslint-disable-next-line no-console
-    console.log(`Could not ${name}, no retries are left`);
+    log.error(`Could not ${name}, no retries are left`);
   }
 };
 
@@ -929,9 +956,11 @@ export const countDownTest = async (
  * rule a second attempt. It only re-tries adding the rule if it encounters a conflict once.
  * @param supertest The supertest deps
  * @param rule The rule to create
+ * @param log The tooling logger
  */
 export const createRule = async (
   supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog,
   rule: CreateRulesSchema
 ): Promise<FullResponseSchema> => {
   const response = await supertest
@@ -940,13 +969,12 @@ export const createRule = async (
     .send(rule);
   if (response.status === 409) {
     if (rule.rule_id != null) {
-      // eslint-disable-next-line no-console
-      console.log(
+      log.debug(
         `Did not get an expected 200 "ok" when creating a rule (createRule). CI issues could happen. Suspect this line if you are seeing CI issues. body: ${JSON.stringify(
           response.body
         )}, status: ${JSON.stringify(response.status)}`
       );
-      await deleteRule(supertest, rule.rule_id);
+      await deleteRule(supertest, log, rule.rule_id);
       const secondResponseTry = await supertest
         .post(DETECTION_ENGINE_RULES_URL)
         .set('kbn-xsrf', 'true')
@@ -976,18 +1004,19 @@ export const createRule = async (
  * Helper to cut down on the noise in some of the tests. Does a delete of a rule.
  * It does not check for a 200 "ok" on this.
  * @param supertest The supertest deps
- * @param id The rule id to delete
+ * @param ruleId The rule id to delete
+ * @param log The tooling logger
  */
 export const deleteRule = async (
   supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog,
   ruleId: string
 ): Promise<FullResponseSchema> => {
   const response = await supertest
     .delete(`${DETECTION_ENGINE_RULES_URL}?rule_id=${ruleId}`)
     .set('kbn-xsrf', 'true');
   if (response.status !== 200) {
-    // eslint-disable-next-line no-console
-    console.log(
+    log.error(
       `Did not get an expected 200 "ok" when deleting the rule (deleteRule). CI issues could happen. Suspect this line if you are seeing CI issues. body: ${JSON.stringify(
         response.body
       )}, status: ${JSON.stringify(response.status)}`
@@ -1023,6 +1052,7 @@ export const createRuleWithAuth = async (
  */
 export const updateRule = async (
   supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog,
   updatedRule: UpdateRulesSchema
 ): Promise<FullResponseSchema> => {
   const response = await supertest
@@ -1030,8 +1060,7 @@ export const updateRule = async (
     .set('kbn-xsrf', 'true')
     .send(updatedRule);
   if (response.status !== 200) {
-    // eslint-disable-next-line no-console
-    console.log(
+    log.error(
       `Did not get an expected 200 "ok" when updating a rule (updateRule). CI issues could happen. Suspect this line if you are seeing CI issues. body: ${JSON.stringify(
         response.body
       )}, status: ${JSON.stringify(response.status)}`
@@ -1045,14 +1074,16 @@ export const updateRule = async (
  * creates a new action and expects a 200 and does not do any retries.
  * @param supertest The supertest deps
  */
-export const createNewAction = async (supertest: SuperTest.SuperTest<SuperTest.Test>) => {
+export const createNewAction = async (
+  supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog
+) => {
   const response = await supertest
     .post('/api/actions/action')
     .set('kbn-xsrf', 'true')
     .send(getWebHookAction());
   if (response.status !== 200) {
-    // eslint-disable-next-line no-console
-    console.log(
+    log.error(
       `Did not get an expected 200 "ok" when creating a new action. CI issues could happen. Suspect this line if you are seeing CI issues. body: ${JSON.stringify(
         response.body
       )}, status: ${JSON.stringify(response.status)}`
@@ -1068,6 +1099,7 @@ export const createNewAction = async (supertest: SuperTest.SuperTest<SuperTest.T
  */
 export const findImmutableRuleById = async (
   supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog,
   ruleId: string
 ): Promise<{
   page: number;
@@ -1082,8 +1114,7 @@ export const findImmutableRuleById = async (
     .set('kbn-xsrf', 'true')
     .send();
   if (response.status !== 200) {
-    // eslint-disable-next-line no-console
-    console.log(
+    log.error(
       `Did not get an expected 200 "ok" when finding an immutable rule by id (findImmutableRuleById). CI issues could happen. Suspect this line if you are seeing CI issues. body: ${JSON.stringify(
         response.body
       )}, status: ${JSON.stringify(response.status)}`
@@ -1098,7 +1129,8 @@ export const findImmutableRuleById = async (
  * @param supertest The supertest deps
  */
 export const getPrePackagedRulesStatus = async (
-  supertest: SuperTest.SuperTest<SuperTest.Test>
+  supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog
 ): Promise<PrePackagedRulesAndTimelinesStatusSchema> => {
   const response = await supertest
     .get(`${DETECTION_ENGINE_PREPACKAGED_URL}/_status`)
@@ -1106,8 +1138,7 @@ export const getPrePackagedRulesStatus = async (
     .send();
 
   if (response.status !== 200) {
-    // eslint-disable-next-line no-console
-    console.log(
+    log.error(
       `Did not get an expected 200 "ok" when getting a pre-packaged rule status. CI issues could happen. Suspect this line if you are seeing CI issues. body: ${JSON.stringify(
         response.body
       )}, status: ${JSON.stringify(response.status)}`
@@ -1120,10 +1151,12 @@ export const getPrePackagedRulesStatus = async (
  * Helper to cut down on the noise in some of the tests. This checks for
  * an expected 200 still and does not try to any retries. Creates exception lists
  * @param supertest The supertest deps
- * @param rule The rule to create
+ * @param exceptionList The exception list to create
+ * @param log The tooling logger
  */
 export const createExceptionList = async (
   supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog,
   exceptionList: CreateExceptionListSchema
 ): Promise<ExceptionListSchema> => {
   const response = await supertest
@@ -1133,13 +1166,12 @@ export const createExceptionList = async (
 
   if (response.status === 409) {
     if (exceptionList.list_id != null) {
-      // eslint-disable-next-line no-console
-      console.log(
+      log.error(
         `When creating an exception list found an unexpected conflict (409) creating an exception list (createExceptionList), will attempt a cleanup and one time re-try. This usually indicates a bad cleanup or race condition within the tests: ${JSON.stringify(
           response.body
         )}, status: ${JSON.stringify(response.status)}`
       );
-      await deleteExceptionList(supertest, exceptionList.list_id);
+      await deleteExceptionList(supertest, log, exceptionList.list_id);
       const secondResponseTry = await supertest
         .post(EXCEPTION_LIST_URL)
         .set('kbn-xsrf', 'true')
@@ -1171,18 +1203,19 @@ export const createExceptionList = async (
  * Helper to cut down on the noise in some of the tests. Does a delete of an exception list.
  * It does not check for a 200 "ok" on this.
  * @param supertest The supertest deps
- * @param id The rule id to delete
+ * @param listId The exception list to delete
+ * @param log The tooling logger
  */
 export const deleteExceptionList = async (
   supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog,
   listId: string
 ): Promise<FullResponseSchema> => {
   const response = await supertest
     .delete(`${EXCEPTION_LIST_URL}?list_id=${listId}`)
     .set('kbn-xsrf', 'true');
   if (response.status !== 200) {
-    // eslint-disable-next-line no-console
-    console.log(
+    log.error(
       `Did not get an expected 200 "ok" when deleting an exception list (deleteExceptionList). CI issues could happen. Suspect this line if you are seeing CI issues. body: ${JSON.stringify(
         response.body
       )}, status: ${JSON.stringify(response.status)}`
@@ -1196,10 +1229,12 @@ export const deleteExceptionList = async (
  * Helper to cut down on the noise in some of the tests. This checks for
  * an expected 200 still and does not try to any retries. Creates exception lists
  * @param supertest The supertest deps
- * @param rule The rule to create
+ * @param exceptionListItem The exception list item to create
+ * @param log The tooling logger
  */
 export const createExceptionListItem = async (
   supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog,
   exceptionListItem: CreateExceptionListItemSchema
 ): Promise<ExceptionListItemSchema> => {
   const response = await supertest
@@ -1208,8 +1243,7 @@ export const createExceptionListItem = async (
     .send(exceptionListItem);
 
   if (response.status !== 200) {
-    // eslint-disable-next-line no-console
-    console.log(
+    log.error(
       `Did not get an expected 200 "ok" when creating an exception list item (createExceptionListItem). CI issues could happen. Suspect this line if you are seeing CI issues. body: ${JSON.stringify(
         response.body
       )}, status: ${JSON.stringify(response.status)}`
@@ -1226,6 +1260,7 @@ export const createExceptionListItem = async (
  */
 export const getRule = async (
   supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog,
   ruleId: string
 ): Promise<RulesSchema> => {
   const response = await supertest
@@ -1233,8 +1268,7 @@ export const getRule = async (
     .set('kbn-xsrf', 'true');
 
   if (response.status !== 200) {
-    // eslint-disable-next-line no-console
-    console.log(
+    log.error(
       `Did not get an expected 200 "ok" when getting a rule (getRule). CI issues could happen. Suspect this line if you are seeing CI issues. body: ${JSON.stringify(
         response.body
       )}, status: ${JSON.stringify(response.status)}`
@@ -1245,20 +1279,24 @@ export const getRule = async (
 
 export const waitForAlertToComplete = async (
   supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog,
   id: string
 ): Promise<void> => {
-  await waitFor(async () => {
-    const response = await supertest.get(`/api/alerts/alert/${id}/state`).set('kbn-xsrf', 'true');
-    if (response.status !== 200) {
-      // eslint-disable-next-line no-console
-      console.log(
-        `Did not get an expected 200 "ok" when waiting for an alert to complete (waitForAlertToComplete). CI issues could happen. Suspect this line if you are seeing CI issues. body: ${JSON.stringify(
-          response.body
-        )}, status: ${JSON.stringify(response.status)}`
-      );
-    }
-    return response.body.previousStartedAt != null;
-  }, 'waitForAlertToComplete');
+  await waitFor(
+    async () => {
+      const response = await supertest.get(`/api/alerts/alert/${id}/state`).set('kbn-xsrf', 'true');
+      if (response.status !== 200) {
+        log.error(
+          `Did not get an expected 200 "ok" when waiting for an alert to complete (waitForAlertToComplete). CI issues could happen. Suspect this line if you are seeing CI issues. body: ${JSON.stringify(
+            response.body
+          )}, status: ${JSON.stringify(response.status)}`
+        );
+      }
+      return response.body.previousStartedAt != null;
+    },
+    'waitForAlertToComplete',
+    log
+  );
 };
 
 /**
@@ -1268,40 +1306,43 @@ export const waitForAlertToComplete = async (
  */
 export const waitForRuleSuccessOrStatus = async (
   supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog,
   id: string,
   status: 'succeeded' | 'failed' | 'partial failure' | 'warning' = 'succeeded'
 ): Promise<void> => {
-  await waitFor(async () => {
-    try {
-      const response = await supertest
-        .post(`${DETECTION_ENGINE_RULES_URL}/_find_statuses`)
-        .set('kbn-xsrf', 'true')
-        .send({ ids: [id] });
-      if (response.status !== 200) {
-        // eslint-disable-next-line no-console
-        console.log(
-          `Did not get an expected 200 "ok" when waiting for a rule success or status (waitForRuleSuccessOrStatus). CI issues could happen. Suspect this line if you are seeing CI issues. body: ${JSON.stringify(
-            response.body
-          )}, status: ${JSON.stringify(response.status)}`
-        );
-      }
-      if (response.body[id]?.current_status?.status !== status) {
-        // eslint-disable-next-line no-console
-        console.log(
-          `Did not get an expected status of ${status} while waiting for a rule success or status for rule id ${id} (waitForRuleSuccessOrStatus). Will continue retrying until status is found. body: ${JSON.stringify(
-            response.body
-          )}, status: ${JSON.stringify(response.status)}`
-        );
-      }
-
-      return response.body[id]?.current_status?.status === status;
-    } catch (e) {
-      if ((e as Error).message.includes('got 503 "Service Unavailable"')) {
-        return false;
+  await waitFor(
+    async () => {
+      try {
+        const response = await supertest
+          .post(`${DETECTION_ENGINE_RULES_URL}/_find_statuses`)
+          .set('kbn-xsrf', 'true')
+          .send({ ids: [id] });
+        if (response.status !== 200) {
+          log.error(
+            `Did not get an expected 200 "ok" when waiting for a rule success or status (waitForRuleSuccessOrStatus). CI issues could happen. Suspect this line if you are seeing CI issues. body: ${JSON.stringify(
+              response.body
+            )}, status: ${JSON.stringify(response.status)}`
+          );
+        }
+        if (response.body[id]?.current_status?.status !== status) {
+          log.debug(
+            `Did not get an expected status of ${status} while waiting for a rule success or status for rule id ${id} (waitForRuleSuccessOrStatus). Will continue retrying until status is found. body: ${JSON.stringify(
+              response.body
+            )}, status: ${JSON.stringify(response.status)}`
+          );
+        }
+
+        return response.body[id]?.current_status?.status === status;
+      } catch (e) {
+        if ((e as Error).message.includes('got 503 "Service Unavailable"')) {
+          return false;
+        }
+        throw e;
       }
-      throw e;
-    }
-  }, 'waitForRuleSuccessOrStatus');
+    },
+    'waitForRuleSuccessOrStatus',
+    log
+  );
 };
 
 /**
@@ -1312,15 +1353,17 @@ export const waitForRuleSuccessOrStatus = async (
  */
 export const waitForSignalsToBePresent = async (
   supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog,
   numberOfSignals = 1,
   signalIds: string[]
 ): Promise<void> => {
   await waitFor(
     async () => {
-      const signalsOpen = await getSignalsByIds(supertest, signalIds, numberOfSignals);
+      const signalsOpen = await getSignalsByIds(supertest, log, signalIds, numberOfSignals);
       return signalsOpen.hits.hits.length >= numberOfSignals;
     },
     'waitForSignalsToBePresent',
+    log,
     20000,
     250 // Wait 250ms between tries
   );
@@ -1332,6 +1375,7 @@ export const waitForSignalsToBePresent = async (
  */
 export const getSignalsByRuleIds = async (
   supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog,
   ruleIds: string[]
 ): Promise<estypes.SearchResponse<RACAlert>> => {
   const response = await supertest
@@ -1340,8 +1384,7 @@ export const getSignalsByRuleIds = async (
     .send(getQuerySignalsRuleId(ruleIds));
 
   if (response.status !== 200) {
-    // eslint-disable-next-line no-console
-    console.log(
+    log.error(
       `Did not get an expected 200 "ok" when getting a signal by rule_id (getSignalsByRuleIds). CI issues could happen. Suspect this line if you are seeing CI issues. body: ${JSON.stringify(
         response.body
       )}, status: ${JSON.stringify(response.status)}`
@@ -1360,6 +1403,7 @@ export const getSignalsByRuleIds = async (
  */
 export const getSignalsByIds = async (
   supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog,
   ids: string[],
   size?: number
 ): Promise<estypes.SearchResponse<RACAlert>> => {
@@ -1369,8 +1413,7 @@ export const getSignalsByIds = async (
     .send(getQuerySignalsId(ids, size));
 
   if (response.status !== 200) {
-    // eslint-disable-next-line no-console
-    console.log(
+    log.error(
       `Did not get an expected 200 "ok" when getting a signal by id. CI issues could happen (getSignalsByIds). Suspect this line if you are seeing CI issues. body: ${JSON.stringify(
         response.body
       )}, status: ${JSON.stringify(response.status)}`
@@ -1387,6 +1430,7 @@ export const getSignalsByIds = async (
  */
 export const getSignalsById = async (
   supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog,
   id: string
 ): Promise<estypes.SearchResponse<RACAlert>> => {
   const response = await supertest
@@ -1395,8 +1439,7 @@ export const getSignalsById = async (
     .send(getQuerySignalsId([id]));
 
   if (response.status !== 200) {
-    // eslint-disable-next-line no-console
-    console.log(
+    log.error(
       `Did not get an expected 200 "ok" when getting signals by id (getSignalsById). CI issues could happen. Suspect this line if you are seeing CI issues. body: ${JSON.stringify(
         response.body
       )}, status: ${JSON.stringify(response.status)}`
@@ -1407,24 +1450,28 @@ export const getSignalsById = async (
 };
 
 export const installPrePackagedRules = async (
-  supertest: SuperTest.SuperTest<SuperTest.Test>
+  supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog
 ): Promise<void> => {
-  await countDownTest(async () => {
-    const { status, body } = await supertest
-      .put(DETECTION_ENGINE_PREPACKAGED_URL)
-      .set('kbn-xsrf', 'true')
-      .send();
-    if (status !== 200) {
-      // eslint-disable-next-line no-console
-      console.log(
-        `Did not get an expected 200 "ok" when installing pre-packaged rules (installPrePackagedRules) yet. Retrying until we get a 200 "ok". body: ${JSON.stringify(
-          body
-        )}, status: ${JSON.stringify(status)}`
-      );
-    }
+  await countDownTest(
+    async () => {
+      const { status, body } = await supertest
+        .put(DETECTION_ENGINE_PREPACKAGED_URL)
+        .set('kbn-xsrf', 'true')
+        .send();
+      if (status !== 200) {
+        log.debug(
+          `Did not get an expected 200 "ok" when installing pre-packaged rules (installPrePackagedRules) yet. Retrying until we get a 200 "ok". body: ${JSON.stringify(
+            body
+          )}, status: ${JSON.stringify(status)}`
+        );
+      }
 
-    return status === 200;
-  }, 'installPrePackagedRules');
+      return status === 200;
+    },
+    'installPrePackagedRules',
+    log
+  );
 };
 
 /**
@@ -1436,6 +1483,7 @@ export const installPrePackagedRules = async (
  */
 export const createContainerWithEndpointEntries = async (
   supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog,
   endpointEntries: Array<{
     entries: NonEmptyEntriesArray;
     osTypes: OsTypeArray | undefined;
@@ -1448,7 +1496,7 @@ export const createContainerWithEndpointEntries = async (
 
   // create the endpoint exception list container
   // eslint-disable-next-line @typescript-eslint/naming-convention
-  const { id, list_id, namespace_type, type } = await createExceptionList(supertest, {
+  const { id, list_id, namespace_type, type } = await createExceptionList(supertest, log, {
     description: 'endpoint description',
     list_id: 'endpoint_list',
     name: 'endpoint_list',
@@ -1466,16 +1514,20 @@ export const createContainerWithEndpointEntries = async (
         os_types: endpointEntry.osTypes,
         type: 'simple',
       };
-      return createExceptionListItem(supertest, exceptionListItem);
+      return createExceptionListItem(supertest, log, exceptionListItem);
     })
   );
 
   // To reduce the odds of in-determinism and/or bugs we ensure we have
   // the same length of entries before continuing.
-  await waitFor(async () => {
-    const { body } = await supertest.get(`${EXCEPTION_LIST_ITEM_URL}/_find?list_id=${list_id}`);
-    return body.data.length === endpointEntries.length;
-  }, `within createContainerWithEndpointEntries ${EXCEPTION_LIST_ITEM_URL}/_find?list_id=${list_id}`);
+  await waitFor(
+    async () => {
+      const { body } = await supertest.get(`${EXCEPTION_LIST_ITEM_URL}/_find?list_id=${list_id}`);
+      return body.data.length === endpointEntries.length;
+    },
+    `within createContainerWithEndpointEntries ${EXCEPTION_LIST_ITEM_URL}/_find?list_id=${list_id}`,
+    log
+  );
 
   return [
     {
@@ -1496,6 +1548,7 @@ export const createContainerWithEndpointEntries = async (
  */
 export const createContainerWithEntries = async (
   supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog,
   entries: NonEmptyEntriesArray[]
 ): Promise<ListArray> => {
   // If not given any endpoint entries, return without any
@@ -1504,7 +1557,7 @@ export const createContainerWithEntries = async (
   }
   // Create the rule exception list container
   // eslint-disable-next-line @typescript-eslint/naming-convention
-  const { id, list_id, namespace_type, type } = await createExceptionList(supertest, {
+  const { id, list_id, namespace_type, type } = await createExceptionList(supertest, log, {
     description: 'some description',
     list_id: 'some-list-id',
     name: 'some name',
@@ -1521,16 +1574,20 @@ export const createContainerWithEntries = async (
         type: 'simple',
         entries: entry,
       };
-      return createExceptionListItem(supertest, exceptionListItem);
+      return createExceptionListItem(supertest, log, exceptionListItem);
     })
   );
 
   // To reduce the odds of in-determinism and/or bugs we ensure we have
   // the same length of entries before continuing.
-  await waitFor(async () => {
-    const { body } = await supertest.get(`${EXCEPTION_LIST_ITEM_URL}/_find?list_id=${list_id}`);
-    return body.data.length === entries.length;
-  }, `within createContainerWithEntries ${EXCEPTION_LIST_ITEM_URL}/_find?list_id=${list_id}`);
+  await waitFor(
+    async () => {
+      const { body } = await supertest.get(`${EXCEPTION_LIST_ITEM_URL}/_find?list_id=${list_id}`);
+      return body.data.length === entries.length;
+    },
+    `within createContainerWithEntries ${EXCEPTION_LIST_ITEM_URL}/_find?list_id=${list_id}`,
+    log
+  );
 
   return [
     {
@@ -1554,6 +1611,7 @@ export const createContainerWithEntries = async (
  */
 export const createRuleWithExceptionEntries = async (
   supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog,
   rule: CreateRulesSchema,
   entries: NonEmptyEntriesArray[],
   endpointEntries?: Array<{
@@ -1561,9 +1619,10 @@ export const createRuleWithExceptionEntries = async (
     osTypes: OsTypeArray | undefined;
   }>
 ): Promise<FullResponseSchema> => {
-  const maybeExceptionList = await createContainerWithEntries(supertest, entries);
+  const maybeExceptionList = await createContainerWithEntries(supertest, log, entries);
   const maybeEndpointList = await createContainerWithEndpointEntries(
     supertest,
+    log,
     endpointEntries ?? []
   );
 
@@ -1576,15 +1635,14 @@ export const createRuleWithExceptionEntries = async (
     enabled: false,
     exceptions_list: [...maybeExceptionList, ...maybeEndpointList],
   };
-  const ruleResponse = await createRule(supertest, ruleWithException);
+  const ruleResponse = await createRule(supertest, log, ruleWithException);
   const response = await supertest
     .patch(DETECTION_ENGINE_RULES_URL)
     .set('kbn-xsrf', 'true')
     .send({ rule_id: ruleResponse.rule_id, enabled: true });
 
   if (response.status !== 200) {
-    // eslint-disable-next-line no-console
-    console.log(
+    log.error(
       `Did not get an expected 200 "ok" when patching a rule with exception entries (createRuleWithExceptionEntries). CI issues could happen. Suspect this line if you are seeing CI issues. body: ${JSON.stringify(
         response.body
       )}, status: ${JSON.stringify(response.status)}`
@@ -1609,11 +1667,19 @@ export const getIndexNameFromLoad = (loadResponse: Record<string, unknown>): str
  * @param esClient elasticsearch {@link Client}
  * @param index name of the index to query
  */
-export const waitForIndexToPopulate = async (es: Client, index: string): Promise<void> => {
-  await waitFor(async () => {
-    const response = await es.count({ index });
-    return response.count > 0;
-  }, `waitForIndexToPopulate: ${index}`);
+export const waitForIndexToPopulate = async (
+  es: Client,
+  log: ToolingLog,
+  index: string
+): Promise<void> => {
+  await waitFor(
+    async () => {
+      const response = await es.count({ index });
+      return response.count > 0;
+    },
+    `waitForIndexToPopulate: ${index}`,
+    log
+  );
 };
 
 export const deleteMigrations = async ({
@@ -1642,8 +1708,10 @@ interface CreateMigrationResponse {
 export const startSignalsMigration = async ({
   indices,
   supertest,
+  log,
 }: {
   supertest: SuperTest.SuperTest<SuperTest.Test>;
+  log: ToolingLog;
   indices: string[];
 }): Promise<CreateMigrationResponse[]> => {
   const response = await supertest
@@ -1655,8 +1723,7 @@ export const startSignalsMigration = async ({
     body: { indices: created },
   }: { body: { indices: CreateMigrationResponse[] } } = response;
   if (response.status !== 200) {
-    // eslint-disable-next-line no-console
-    console.log(
+    log.error(
       `Did not get an expected 200 "ok" when starting a signals migration (startSignalsMigration). CI issues could happen. Suspect this line if you are seeing CI issues. body: ${JSON.stringify(
         response.body
       )}, status: ${JSON.stringify(response.status)}`
@@ -1674,8 +1741,10 @@ interface FinalizeMigrationResponse {
 export const finalizeSignalsMigration = async ({
   migrationIds,
   supertest,
+  log,
 }: {
   supertest: SuperTest.SuperTest<SuperTest.Test>;
+  log: ToolingLog;
   migrationIds: string[];
 }): Promise<FinalizeMigrationResponse[]> => {
   const response = await supertest
@@ -1687,8 +1756,7 @@ export const finalizeSignalsMigration = async ({
     body: { migrations },
   }: { body: { migrations: FinalizeMigrationResponse[] } } = response;
   if (response.status !== 200) {
-    // eslint-disable-next-line no-console
-    console.log(
+    log.error(
       `Did not get an expected 200 "ok" when finalizing signals migration (finalizeSignalsMigration). CI issues could happen. Suspect this line if you are seeing CI issues. body: ${JSON.stringify(
         response.body
       )}, status: ${JSON.stringify(response.status)}`
@@ -1699,13 +1767,14 @@ export const finalizeSignalsMigration = async ({
 
 export const getOpenSignals = async (
   supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog,
   es: Client,
   rule: FullResponseSchema
 ) => {
-  await waitForRuleSuccessOrStatus(supertest, rule.id);
+  await waitForRuleSuccessOrStatus(supertest, log, rule.id);
   // Critically important that we wait for rule success AND refresh the write index in that order before we
   // assert that no signals were created. Otherwise, signals could be written but not available to query yet
   // when we search, causing tests that check that signals are NOT created to pass when they should fail.
   await refreshIndex(es, '.alerts-security.alerts-default*');
-  return getSignalsByIds(supertest, [rule.id]);
+  return getSignalsByIds(supertest, log, [rule.id]);
 };
diff --git a/x-pack/test/examples/embedded_lens/index.ts b/x-pack/test/examples/embedded_lens/index.ts
index 3bd4ea31cc89b..98ea7f80754a2 100644
--- a/x-pack/test/examples/embedded_lens/index.ts
+++ b/x-pack/test/examples/embedded_lens/index.ts
@@ -15,14 +15,19 @@ export default function ({ getService, loadTestFile }: PluginFunctionalProviderC
   describe('embedded Lens examples', function () {
     before(async () => {
       await esArchiver.load('x-pack/test/functional/es_archives/logstash_functional');
-      await esArchiver.load('x-pack/test/functional/es_archives/lens/basic'); // need at least one index pattern
+      await kibanaServer.importExport.load(
+        'x-pack/test/functional/fixtures/kbn_archiver/lens/lens_basic.json'
+      ); // need at least one index pattern
       await kibanaServer.uiSettings.update({
         defaultIndex: 'logstash-*',
       });
     });
 
     after(async () => {
-      await esArchiver.unload('x-pack/test/functional/es_archives/lens/basic');
+      await esArchiver.unload('x-pack/test/functional/es_archives/logstash_functional');
+      await kibanaServer.importExport.unload(
+        'x-pack/test/functional/fixtures/kbn_archiver/lens/lens_basic.json'
+      );
     });
 
     describe('', function () {
diff --git a/x-pack/test/examples/search_examples/index.ts b/x-pack/test/examples/search_examples/index.ts
index 41c4945ca4569..ac9e385d3d391 100644
--- a/x-pack/test/examples/search_examples/index.ts
+++ b/x-pack/test/examples/search_examples/index.ts
@@ -10,17 +10,23 @@ import { PluginFunctionalProviderContext } from 'test/plugin_functional/services
 // eslint-disable-next-line import/no-default-export
 export default function ({ getService, loadTestFile }: PluginFunctionalProviderContext) {
   const esArchiver = getService('esArchiver');
+  const kibanaServer = getService('kibanaServer');
 
   describe('search examples', function () {
     this.tags('ciGroup13');
     before(async () => {
       await esArchiver.emptyKibanaIndex();
       await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/logstash_functional');
-      await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/lens/basic'); // need at least one index pattern
+      await kibanaServer.importExport.load(
+        'x-pack/test/functional/fixtures/kbn_archiver/lens/lens_basic.json'
+      ); // need at least one index pattern
     });
 
     after(async () => {
-      await esArchiver.unload('x-pack/test/functional/es_archives/lens/basic');
+      await esArchiver.unload('x-pack/test/functional/es_archives/logstash_functional');
+      await kibanaServer.importExport.unload(
+        'x-pack/test/functional/fixtures/kbn_archiver/lens/lens_basic.json'
+      );
     });
 
     loadTestFile(require.resolve('./search_session_example'));
diff --git a/x-pack/test/fleet_api_integration/apis/package_policy/create.ts b/x-pack/test/fleet_api_integration/apis/package_policy/create.ts
index 6a0d46a605386..6817289d389f3 100644
--- a/x-pack/test/fleet_api_integration/apis/package_policy/create.ts
+++ b/x-pack/test/fleet_api_integration/apis/package_policy/create.ts
@@ -68,7 +68,7 @@ export default function (providerContext: FtrProviderContext) {
         .post(`/api/fleet/package_policies`)
         .set('kbn-xsrf', 'xxxx')
         .send({
-          name: 'filetest-1',
+          name: 'filetest',
           description: '',
           namespace: 'default',
           policy_id: hostedPolicy.id,
@@ -85,7 +85,7 @@ export default function (providerContext: FtrProviderContext) {
 
       expect(responseWithoutForce.statusCode).to.be(400);
       expect(responseWithoutForce.message).to.contain(
-        'Cannot add integrations to hosted agent policy'
+        'Cannot update integrations of hosted agent policy'
       );
 
       // try same request with `force: true`
@@ -122,7 +122,7 @@ export default function (providerContext: FtrProviderContext) {
         .post(`/api/fleet/package_policies`)
         .set('kbn-xsrf', 'xxxx')
         .send({
-          name: 'filetest-1',
+          name: 'filetest-2',
           description: '',
           namespace: 'default',
           policy_id: agentPolicyId,
@@ -276,5 +276,53 @@ export default function (providerContext: FtrProviderContext) {
         })
         .expect(400);
     });
+
+    it('should return a 400 if there is a package policy with the same name on a different policy', async function () {
+      const { body: agentPolicyResponse } = await supertest
+        .post(`/api/fleet/agent_policies`)
+        .set('kbn-xsrf', 'xxxx')
+        .send({
+          name: 'Test policy 2',
+          namespace: 'default',
+        });
+      const otherAgentPolicyId = agentPolicyResponse.item.id;
+
+      await supertest
+        .post(`/api/fleet/package_policies`)
+        .set('kbn-xsrf', 'xxxx')
+        .send({
+          name: 'same-name-test-2',
+          description: '',
+          namespace: 'default',
+          policy_id: otherAgentPolicyId,
+          enabled: true,
+          output_id: '',
+          inputs: [],
+          package: {
+            name: 'filetest',
+            title: 'For File Tests',
+            version: '0.1.0',
+          },
+        })
+        .expect(200);
+      await supertest
+        .post(`/api/fleet/package_policies`)
+        .set('kbn-xsrf', 'xxxx')
+        .send({
+          name: 'same-name-test-2',
+          description: '',
+          namespace: 'default',
+          policy_id: agentPolicyId,
+          enabled: true,
+          output_id: '',
+          inputs: [],
+          package: {
+            name: 'filetest',
+            title: 'For File Tests',
+            version: '0.1.0',
+          },
+        })
+        .expect(400);
+    });
   });
 }
diff --git a/x-pack/test/fleet_api_integration/apis/package_policy/update.ts b/x-pack/test/fleet_api_integration/apis/package_policy/update.ts
index 315ca276c393f..7d62ea3bf7ec3 100644
--- a/x-pack/test/fleet_api_integration/apis/package_policy/update.ts
+++ b/x-pack/test/fleet_api_integration/apis/package_policy/update.ts
@@ -158,7 +158,7 @@ export default function (providerContext: FtrProviderContext) {
         });
     });
 
-    it('should return a 500 if there is another package policy with the same name', async function () {
+    it('should return a 400 if there is another package policy with the same name', async function () {
       await supertest
         .put(`/api/fleet/package_policies/${packagePolicyId2}`)
         .set('kbn-xsrf', 'xxxx')
@@ -176,7 +176,37 @@ export default function (providerContext: FtrProviderContext) {
             version: '0.1.0',
           },
         })
-        .expect(500);
+        .expect(400);
+    });
+
+    it('should return a 400 if there is another package policy with the same name on a different policy', async function () {
+      const { body: agentPolicyResponse } = await supertest
+        .post(`/api/fleet/agent_policies`)
+        .set('kbn-xsrf', 'xxxx')
+        .send({
+          name: 'Test policy 2',
+          namespace: 'default',
+        });
+      const otherAgentPolicyId = agentPolicyResponse.item.id;
+
+      await supertest
+        .put(`/api/fleet/package_policies/${packagePolicyId2}`)
+        .set('kbn-xsrf', 'xxxx')
+        .send({
+          name: 'filetest-1',
+          description: '',
+          namespace: 'updated_namespace',
+          policy_id: otherAgentPolicyId,
+          enabled: true,
+          output_id: '',
+          inputs: [],
+          package: {
+            name: 'filetest',
+            title: 'For File Tests',
+            version: '0.1.0',
+          },
+        })
+        .expect(400);
     });
 
     it('should work with frozen input vars', async function () {
diff --git a/x-pack/test/functional/apps/advanced_settings/feature_controls/advanced_settings_security.ts b/x-pack/test/functional/apps/advanced_settings/feature_controls/advanced_settings_security.ts
index 7efa86c3acf28..20c79d9142f09 100644
--- a/x-pack/test/functional/apps/advanced_settings/feature_controls/advanced_settings_security.ts
+++ b/x-pack/test/functional/apps/advanced_settings/feature_controls/advanced_settings_security.ts
@@ -9,7 +9,6 @@ import expect from '@kbn/expect';
 import { FtrProviderContext } from '../../../ftr_provider_context';
 
 export default function ({ getPageObjects, getService }: FtrProviderContext) {
-  const esArchiver = getService('esArchiver');
   const kibanaServer = getService('kibanaServer');
   const security = getService('security');
   const PageObjects = getPageObjects(['common', 'settings', 'security', 'spaceSelector']);
@@ -18,14 +17,6 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
   const globalNav = getService('globalNav');
 
   describe('security feature controls', () => {
-    before(async () => {
-      await esArchiver.load('x-pack/test/functional/es_archives/empty_kibana');
-    });
-
-    after(async () => {
-      await esArchiver.unload('x-pack/test/functional/es_archives/empty_kibana');
-    });
-
     describe('global advanced_settings all privileges', () => {
       before(async () => {
         await security.role.create('global_advanced_settings_all_role', {
diff --git a/x-pack/test/functional/apps/advanced_settings/feature_controls/advanced_settings_spaces.ts b/x-pack/test/functional/apps/advanced_settings/feature_controls/advanced_settings_spaces.ts
index 41a03b36d3c43..0d1c525f56904 100644
--- a/x-pack/test/functional/apps/advanced_settings/feature_controls/advanced_settings_spaces.ts
+++ b/x-pack/test/functional/apps/advanced_settings/feature_controls/advanced_settings_spaces.ts
@@ -25,7 +25,6 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
       before(async () => {
         // we need to load the following in every situation as deleting
         // a space deletes all of the associated saved objects
-        await esArchiver.load('x-pack/test/functional/es_archives/empty_kibana');
 
         await spacesService.create({
           id: 'custom_space',
@@ -36,7 +35,6 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
 
       after(async () => {
         await spacesService.delete('custom_space');
-        await esArchiver.unload('x-pack/test/functional/es_archives/empty_kibana');
       });
 
       it('shows Management navlink', async () => {
diff --git a/x-pack/test/functional/apps/api_keys/feature_controls/api_keys_security.ts b/x-pack/test/functional/apps/api_keys/feature_controls/api_keys_security.ts
index 9e25ca1d79f9b..9b418e5fd2b94 100644
--- a/x-pack/test/functional/apps/api_keys/feature_controls/api_keys_security.ts
+++ b/x-pack/test/functional/apps/api_keys/feature_controls/api_keys_security.ts
@@ -9,7 +9,6 @@ import expect from '@kbn/expect';
 import { FtrProviderContext } from '../../../ftr_provider_context';
 
 export default function ({ getPageObjects, getService }: FtrProviderContext) {
-  const esArchiver = getService('esArchiver');
   const security = getService('security');
   const PageObjects = getPageObjects(['common', 'settings', 'security']);
   const appsMenu = getService('appsMenu');
@@ -17,14 +16,9 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
 
   describe('security', () => {
     before(async () => {
-      await esArchiver.load('x-pack/test/functional/es_archives/empty_kibana');
       await PageObjects.common.navigateToApp('home');
     });
 
-    after(async () => {
-      await esArchiver.unload('x-pack/test/functional/es_archives/empty_kibana');
-    });
-
     describe('global all privileges (aka kibana_admin)', () => {
       before(async () => {
         await security.testUser.setRoles(['kibana_admin'], true);
diff --git a/x-pack/test/functional/apps/api_keys/home_page.ts b/x-pack/test/functional/apps/api_keys/home_page.ts
index be8f128359345..5907247527585 100644
--- a/x-pack/test/functional/apps/api_keys/home_page.ts
+++ b/x-pack/test/functional/apps/api_keys/home_page.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import expect from '@kbn/expect';
 import { FtrProviderContext } from '../../ftr_provider_context';
 
 export default ({ getPageObjects, getService }: FtrProviderContext) => {
@@ -13,6 +14,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
   const security = getService('security');
   const testSubjects = getService('testSubjects');
   const find = getService('find');
+  const browser = getService('browser');
 
   describe('Home page', function () {
     before(async () => {
@@ -34,5 +36,90 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
       log.debug('Checking for create API key call to action');
       await find.existsByLinkText('Create API key');
     });
+
+    describe('creates API key', function () {
+      before(async () => {
+        await security.testUser.setRoles(['kibana_admin']);
+        await security.testUser.setRoles(['test_api_keys']);
+        await pageObjects.common.navigateToApp('apiKeys');
+      });
+
+      afterEach(async () => {
+        await pageObjects.apiKeys.deleteAllApiKeyOneByOne();
+      });
+
+      it('when submitting form, close dialog and displays new api key', async () => {
+        const apiKeyName = 'Happy API Key';
+        await pageObjects.apiKeys.clickOnPromptCreateApiKey();
+        expect(await browser.getCurrentUrl()).to.contain('app/management/security/api_keys/create');
+
+        await pageObjects.apiKeys.setApiKeyName(apiKeyName);
+        await pageObjects.apiKeys.submitOnCreateApiKey();
+        const newApiKeyCreation = await pageObjects.apiKeys.getNewApiKeyCreation();
+
+        expect(await browser.getCurrentUrl()).to.not.contain(
+          'app/management/security/api_keys/create'
+        );
+        expect(await browser.getCurrentUrl()).to.contain('app/management/security/api_keys');
+        expect(await pageObjects.apiKeys.isApiKeyModalExists()).to.be(false);
+        expect(newApiKeyCreation).to.be(`Created API key '${apiKeyName}'`);
+      });
+
+      it('with optional expiration, redirects back and displays base64', async () => {
+        const apiKeyName = 'Happy expiration API key';
+        await pageObjects.apiKeys.clickOnPromptCreateApiKey();
+        expect(await browser.getCurrentUrl()).to.contain('app/management/security/api_keys/create');
+
+        await pageObjects.apiKeys.setApiKeyName(apiKeyName);
+        await pageObjects.apiKeys.toggleCustomExpiration();
+        await pageObjects.apiKeys.submitOnCreateApiKey();
+        expect(await pageObjects.apiKeys.getErrorCallOutText()).to.be(
+          'Enter a valid duration or disable this option.'
+        );
+
+        await pageObjects.apiKeys.setApiKeyCustomExpiration('12');
+        await pageObjects.apiKeys.submitOnCreateApiKey();
+        const newApiKeyCreation = await pageObjects.apiKeys.getNewApiKeyCreation();
+
+        expect(await browser.getCurrentUrl()).to.not.contain(
+          'app/management/security/api_keys/create'
+        );
+        expect(await browser.getCurrentUrl()).to.contain('app/management/security/api_keys');
+        expect(await pageObjects.apiKeys.isApiKeyModalExists()).to.be(false);
+        expect(newApiKeyCreation).to.be(`Created API key '${apiKeyName}'`);
+      });
+    });
+
+    describe('deletes API key(s)', function () {
+      before(async () => {
+        await security.testUser.setRoles(['kibana_admin']);
+        await security.testUser.setRoles(['test_api_keys']);
+        await pageObjects.common.navigateToApp('apiKeys');
+      });
+
+      beforeEach(async () => {
+        await pageObjects.apiKeys.clickOnPromptCreateApiKey();
+        await pageObjects.apiKeys.setApiKeyName('api key 1');
+        await pageObjects.apiKeys.submitOnCreateApiKey();
+      });
+
+      it('one by one', async () => {
+        await pageObjects.apiKeys.deleteAllApiKeyOneByOne();
+        expect(await pageObjects.apiKeys.getApiKeysFirstPromptTitle()).to.be(
+          'Create your first API key'
+        );
+      });
+
+      it('by bulk', async () => {
+        await pageObjects.apiKeys.clickOnTableCreateApiKey();
+        await pageObjects.apiKeys.setApiKeyName('api key 2');
+        await pageObjects.apiKeys.submitOnCreateApiKey();
+
+        await pageObjects.apiKeys.bulkDeleteApiKeys();
+        expect(await pageObjects.apiKeys.getApiKeysFirstPromptTitle()).to.be(
+          'Create your first API key'
+        );
+      });
+    });
   });
 };
diff --git a/x-pack/test/functional/apps/apm/feature_controls/apm_security.ts b/x-pack/test/functional/apps/apm/feature_controls/apm_security.ts
index 6f6d29db1ef0c..05e13bb04d91b 100644
--- a/x-pack/test/functional/apps/apm/feature_controls/apm_security.ts
+++ b/x-pack/test/functional/apps/apm/feature_controls/apm_security.ts
@@ -9,7 +9,6 @@ import expect from '@kbn/expect';
 import { FtrProviderContext } from '../../../ftr_provider_context';
 
 export default function ({ getPageObjects, getService }: FtrProviderContext) {
-  const esArchiver = getService('esArchiver');
   const security = getService('security');
   const PageObjects = getPageObjects(['common', 'error', 'security']);
   const testSubjects = getService('testSubjects');
@@ -18,7 +17,6 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
 
   describe('security', () => {
     before(async () => {
-      await esArchiver.load('x-pack/test/functional/es_archives/empty_kibana');
       // ensure we're logged out so we can login as the appropriate users
       await PageObjects.security.forceLogout();
     });
diff --git a/x-pack/test/functional/apps/dashboard/dashboard_lens_by_value.ts b/x-pack/test/functional/apps/dashboard/dashboard_lens_by_value.ts
index b1d7c1194e7bc..26efa4248850b 100644
--- a/x-pack/test/functional/apps/dashboard/dashboard_lens_by_value.ts
+++ b/x-pack/test/functional/apps/dashboard/dashboard_lens_by_value.ts
@@ -15,16 +15,26 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
   const esArchiver = getService('esArchiver');
   const testSubjects = getService('testSubjects');
   const dashboardPanelActions = getService('dashboardPanelActions');
+  const kibanaServer = getService('kibanaServer');
 
   describe('dashboard lens by value', function () {
     before(async () => {
       await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/logstash_functional');
-      await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/lens/basic');
+      await kibanaServer.importExport.load(
+        'x-pack/test/functional/fixtures/kbn_archiver/lens/lens_basic.json'
+      );
       await PageObjects.common.navigateToApp('dashboard');
       await PageObjects.dashboard.preserveCrossAppState();
       await PageObjects.dashboard.clickNewDashboard();
     });
 
+    after(async () => {
+      await esArchiver.unload('x-pack/test/functional/es_archives/logstash_functional');
+      await kibanaServer.importExport.unload(
+        'x-pack/test/functional/fixtures/kbn_archiver/lens/lens_basic.json'
+      );
+    });
+
     it('can add a lens panel by value', async () => {
       await PageObjects.lens.createAndAddLensFromDashboard({});
       const newPanelCount = await PageObjects.dashboard.getPanelCount();
diff --git a/x-pack/test/functional/apps/dashboard/dashboard_maps_by_value.ts b/x-pack/test/functional/apps/dashboard/dashboard_maps_by_value.ts
index 043acf90bb893..f8a90767b54ac 100644
--- a/x-pack/test/functional/apps/dashboard/dashboard_maps_by_value.ts
+++ b/x-pack/test/functional/apps/dashboard/dashboard_maps_by_value.ts
@@ -23,6 +23,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
   const testSubjects = getService('testSubjects');
   const appsMenu = getService('appsMenu');
   const dashboardAddPanel = getService('dashboardAddPanel');
+  const kibanaServer = getService('kibanaServer');
 
   const LAYER_NAME = 'World Countries';
   let mapCounter = 0;
@@ -77,7 +78,19 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
   describe('dashboard maps by value', function () {
     before(async () => {
       await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/logstash_functional');
-      await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/lens/basic');
+      await kibanaServer.importExport.load(
+        'x-pack/test/functional/fixtures/kbn_archiver/lens/lens_basic.json'
+      );
+    });
+
+    after(async () => {
+      await esArchiver.unload('x-pack/test/functional/es_archives/logstash_functional');
+      await kibanaServer.importExport.unload(
+        'x-pack/test/functional/fixtures/kbn_archiver/lens/lens_basic.json'
+      );
+      await kibanaServer.savedObjects.clean({
+        types: ['search', 'index-pattern', 'visualization', 'dashboard', 'tag', 'map'],
+      });
     });
 
     describe('adding a map by value', () => {
diff --git a/x-pack/test/functional/apps/dashboard/dashboard_tagging.ts b/x-pack/test/functional/apps/dashboard/dashboard_tagging.ts
index 707b3877a70b5..7a358e24a2b41 100644
--- a/x-pack/test/functional/apps/dashboard/dashboard_tagging.ts
+++ b/x-pack/test/functional/apps/dashboard/dashboard_tagging.ts
@@ -11,6 +11,7 @@ import { FtrProviderContext } from '../../ftr_provider_context';
 export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const listingTable = getService('listingTable');
   const testSubjects = getService('testSubjects');
+  const kibanaServer = getService('kibanaServer');
   const esArchiver = getService('esArchiver');
   const find = getService('find');
   const PageObjects = getPageObjects([
@@ -67,12 +68,24 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
 
     before(async () => {
       await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/logstash_functional');
-      await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/lens/basic');
+      await kibanaServer.importExport.load(
+        'x-pack/test/functional/fixtures/kbn_archiver/lens/lens_basic.json'
+      );
       await PageObjects.common.navigateToApp('dashboard');
       await PageObjects.dashboard.preserveCrossAppState();
       await PageObjects.dashboard.clickNewDashboard();
     });
 
+    after(async () => {
+      await esArchiver.unload('x-pack/test/functional/es_archives/logstash_functional');
+      await kibanaServer.importExport.unload(
+        'x-pack/test/functional/fixtures/kbn_archiver/lens/lens_basic.json'
+      );
+      await kibanaServer.savedObjects.clean({
+        types: ['search', 'index-pattern', 'visualization', 'dashboard', 'tag'],
+      });
+    });
+
     it('adds a new tag to a new Dashboard', async () => {
       await createTagFromDashboard();
       PageObjects.dashboard.saveDashboard(dashboardTitle, {}, false);
diff --git a/x-pack/test/functional/apps/dashboard/drilldowns/dashboard_to_dashboard_drilldown.ts b/x-pack/test/functional/apps/dashboard/drilldowns/dashboard_to_dashboard_drilldown.ts
index 3e83d38593601..f42be7b4229f9 100644
--- a/x-pack/test/functional/apps/dashboard/drilldowns/dashboard_to_dashboard_drilldown.ts
+++ b/x-pack/test/functional/apps/dashboard/drilldowns/dashboard_to_dashboard_drilldown.ts
@@ -156,7 +156,8 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       });
     });
 
-    describe('Copy to space', () => {
+    // FLAKY: https://github.com/elastic/kibana/issues/83824
+    describe.skip('Copy to space', () => {
       const destinationSpaceId = 'custom_space';
       before(async () => {
         await spaces.create({
diff --git a/x-pack/test/functional/apps/dashboard/sync_colors.ts b/x-pack/test/functional/apps/dashboard/sync_colors.ts
index 2fcc1cf5614fb..a3628635dfa2f 100644
--- a/x-pack/test/functional/apps/dashboard/sync_colors.ts
+++ b/x-pack/test/functional/apps/dashboard/sync_colors.ts
@@ -22,6 +22,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const dashboardAddPanel = getService('dashboardAddPanel');
   const filterBar = getService('filterBar');
   const elasticChart = getService('elasticChart');
+  const kibanaServer = getService('kibanaServer');
 
   function getColorMapping(debugState: DebugState | null) {
     if (!debugState) return {};
@@ -37,12 +38,16 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   describe.skip('sync colors', function () {
     before(async function () {
       await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/logstash_functional');
-      await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/lens/basic');
+      await kibanaServer.importExport.load(
+        'x-pack/test/functional/fixtures/kbn_archiver/lens/lens_basic.json'
+      );
     });
 
     after(async function () {
       await esArchiver.unload('x-pack/test/functional/es_archives/logstash_functional');
-      await esArchiver.unload('x-pack/test/functional/es_archives/lens/basic');
+      await kibanaServer.importExport.unload(
+        'x-pack/test/functional/fixtures/kbn_archiver/lens/lens_basic.json'
+      );
     });
 
     it('should sync colors on dashboard by default', async function () {
diff --git a/x-pack/test/functional/apps/discover/visualize_field.ts b/x-pack/test/functional/apps/discover/visualize_field.ts
index 650d67f05129c..584558c90c2b2 100644
--- a/x-pack/test/functional/apps/discover/visualize_field.ts
+++ b/x-pack/test/functional/apps/discover/visualize_field.ts
@@ -14,6 +14,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
   const queryBar = getService('queryBar');
   const testSubjects = getService('testSubjects');
   const retry = getService('retry');
+  const kibanaServer = getService('kibanaServer');
   const PageObjects = getPageObjects([
     'common',
     'error',
@@ -31,13 +32,18 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
   describe('discover field visualize button', () => {
     beforeEach(async () => {
       await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/logstash_functional');
-      await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/lens/basic');
+      await kibanaServer.importExport.load(
+        'x-pack/test/functional/fixtures/kbn_archiver/lens/lens_basic.json'
+      );
       await PageObjects.common.navigateToApp('discover');
       await setDiscoverTimeRange();
     });
 
     after(async () => {
-      await esArchiver.unload('x-pack/test/functional/es_archives/lens/basic');
+      await esArchiver.unload('x-pack/test/functional/es_archives/logstash_functional');
+      await kibanaServer.importExport.unload(
+        'x-pack/test/functional/fixtures/kbn_archiver/lens/lens_basic.json'
+      );
     });
 
     it('shows "visualize" field button', async () => {
diff --git a/x-pack/test/functional/apps/lens/heatmap.ts b/x-pack/test/functional/apps/lens/heatmap.ts
index deca06b6b351a..5b80e6ad5cf55 100644
--- a/x-pack/test/functional/apps/lens/heatmap.ts
+++ b/x-pack/test/functional/apps/lens/heatmap.ts
@@ -13,7 +13,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const elasticChart = getService('elasticChart');
   const testSubjects = getService('testSubjects');
 
-  describe('lens heatmap', () => {
+  // FLAKY: https://github.com/elastic/kibana/issues/117404
+  // FLAKY: https://github.com/elastic/kibana/issues/113043
+  describe.skip('lens heatmap', () => {
     before(async () => {
       await PageObjects.visualize.navigateToNewVisualization();
       await PageObjects.visualize.clickVisType('lens');
diff --git a/x-pack/test/functional/apps/lens/index.ts b/x-pack/test/functional/apps/lens/index.ts
index 86ceb4812ad3b..f9e4835f044af 100644
--- a/x-pack/test/functional/apps/lens/index.ts
+++ b/x-pack/test/functional/apps/lens/index.ts
@@ -7,18 +7,24 @@
 
 import { FtrProviderContext } from '../../ftr_provider_context';
 
-export default function ({ getService, loadTestFile }: FtrProviderContext) {
+export default function ({ getService, loadTestFile, getPageObjects }: FtrProviderContext) {
   const browser = getService('browser');
   const log = getService('log');
   const esArchiver = getService('esArchiver');
   const kibanaServer = getService('kibanaServer');
+  const PageObjects = getPageObjects(['timePicker']);
 
   describe('lens app', () => {
     before(async () => {
       log.debug('Starting lens before method');
       await browser.setWindowSize(1280, 800);
       await esArchiver.load('x-pack/test/functional/es_archives/logstash_functional');
-      await esArchiver.load('x-pack/test/functional/es_archives/lens/basic');
+      // changing the timepicker default here saves us from having to set it in Discover (~8s)
+      await PageObjects.timePicker.setDefaultAbsoluteRangeViaUiSettings();
+      await kibanaServer.uiSettings.update({ defaultIndex: 'logstash-*', 'dateFormat:tz': 'UTC' });
+      await kibanaServer.importExport.load(
+        'x-pack/test/functional/fixtures/kbn_archiver/lens/lens_basic.json'
+      );
       await kibanaServer.importExport.load(
         'x-pack/test/functional/fixtures/kbn_archiver/lens/default'
       );
@@ -26,7 +32,10 @@ export default function ({ getService, loadTestFile }: FtrProviderContext) {
 
     after(async () => {
       await esArchiver.unload('x-pack/test/functional/es_archives/logstash_functional');
-      await esArchiver.unload('x-pack/test/functional/es_archives/lens/basic');
+      await PageObjects.timePicker.resetDefaultAbsoluteRangeViaUiSettings();
+      await kibanaServer.importExport.unload(
+        'x-pack/test/functional/fixtures/kbn_archiver/lens/lens_basic.json'
+      );
       await kibanaServer.importExport.unload(
         'x-pack/test/functional/fixtures/kbn_archiver/lens/default'
       );
@@ -50,14 +59,13 @@ export default function ({ getService, loadTestFile }: FtrProviderContext) {
       loadTestFile(require.resolve('./time_shift'));
       loadTestFile(require.resolve('./drag_and_drop'));
       loadTestFile(require.resolve('./geo_field'));
-      loadTestFile(require.resolve('./lens_reporting'));
-      loadTestFile(require.resolve('./lens_tagging'));
       loadTestFile(require.resolve('./formula'));
       loadTestFile(require.resolve('./heatmap'));
       loadTestFile(require.resolve('./reference_lines'));
       loadTestFile(require.resolve('./inspector'));
       loadTestFile(require.resolve('./error_handling'));
-
+      loadTestFile(require.resolve('./lens_tagging'));
+      loadTestFile(require.resolve('./lens_reporting'));
       // has to be last one in the suite because it overrides saved objects
       loadTestFile(require.resolve('./rollup'));
     });
diff --git a/x-pack/test/functional/apps/lens/lens_reporting.ts b/x-pack/test/functional/apps/lens/lens_reporting.ts
index bd0c003ff3f45..2d0ff14ef95f2 100644
--- a/x-pack/test/functional/apps/lens/lens_reporting.ts
+++ b/x-pack/test/functional/apps/lens/lens_reporting.ts
@@ -9,7 +9,7 @@ import expect from '@kbn/expect';
 import { FtrProviderContext } from '../../ftr_provider_context';
 
 export default function ({ getService, getPageObjects }: FtrProviderContext) {
-  const PageObjects = getPageObjects(['common', 'dashboard', 'reporting']);
+  const PageObjects = getPageObjects(['common', 'dashboard', 'reporting', 'timePicker']);
   const es = getService('es');
   const esArchiver = getService('esArchiver');
   const listingTable = getService('listingTable');
@@ -18,6 +18,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   describe('lens reporting', () => {
     before(async () => {
       await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/lens/reporting');
+      await PageObjects.timePicker.setDefaultAbsoluteRangeViaUiSettings();
       await security.testUser.setRoles(
         [
           'test_logstash_reader',
@@ -30,6 +31,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
 
     after(async () => {
       await esArchiver.unload('x-pack/test/functional/es_archives/lens/reporting');
+      await PageObjects.timePicker.resetDefaultAbsoluteRangeViaUiSettings();
       await es.deleteByQuery({
         index: '.reporting-*',
         refresh: true,
diff --git a/x-pack/test/functional/apps/lens/lens_tagging.ts b/x-pack/test/functional/apps/lens/lens_tagging.ts
index cbe04b26830d6..3852fdb0456ac 100644
--- a/x-pack/test/functional/apps/lens/lens_tagging.ts
+++ b/x-pack/test/functional/apps/lens/lens_tagging.ts
@@ -11,8 +11,8 @@ import { FtrProviderContext } from '../../ftr_provider_context';
 export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const listingTable = getService('listingTable');
   const testSubjects = getService('testSubjects');
-  const esArchiver = getService('esArchiver');
   const retry = getService('retry');
+  const esArchiver = getService('esArchiver');
   const find = getService('find');
   const dashboardAddPanel = getService('dashboardAddPanel');
   const dashboardPanelActions = getService('dashboardPanelActions');
@@ -23,6 +23,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
     'dashboard',
     'visualize',
     'lens',
+    'timePicker',
   ]);
 
   const lensTag = 'extreme-lens-tag';
@@ -31,12 +32,16 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   describe('lens tagging', () => {
     before(async () => {
       await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/logstash_functional');
-      await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/lens/basic');
+      await PageObjects.timePicker.setDefaultAbsoluteRangeViaUiSettings();
       await PageObjects.common.navigateToApp('dashboard');
       await PageObjects.dashboard.preserveCrossAppState();
       await PageObjects.dashboard.clickNewDashboard();
     });
 
+    after(async () => {
+      await PageObjects.timePicker.setDefaultAbsoluteRangeViaUiSettings();
+    });
+
     it('adds a new tag to a Lens visualization', async () => {
       // create lens
       await dashboardAddPanel.clickCreateNewLink();
diff --git a/x-pack/test/functional/apps/lens/rollup.ts b/x-pack/test/functional/apps/lens/rollup.ts
index 267c83cda1386..7de0d7e76c95c 100644
--- a/x-pack/test/functional/apps/lens/rollup.ts
+++ b/x-pack/test/functional/apps/lens/rollup.ts
@@ -9,21 +9,22 @@ import expect from '@kbn/expect';
 import { FtrProviderContext } from '../../ftr_provider_context';
 
 export default function ({ getService, getPageObjects }: FtrProviderContext) {
-  const PageObjects = getPageObjects(['visualize', 'lens', 'header']);
+  const PageObjects = getPageObjects(['visualize', 'lens', 'header', 'timePicker']);
   const find = getService('find');
   const listingTable = getService('listingTable');
   const esArchiver = getService('esArchiver');
 
-  // FAILING: https://github.com/elastic/kibana/issues/84957
-  describe.skip('lens rollup tests', () => {
+  describe('lens rollup tests', () => {
     before(async () => {
       await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/lens/rollup/data');
       await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/lens/rollup/config');
+      await PageObjects.timePicker.setDefaultAbsoluteRangeViaUiSettings();
     });
 
     after(async () => {
       await esArchiver.unload('x-pack/test/functional/es_archives/lens/rollup/data');
       await esArchiver.unload('x-pack/test/functional/es_archives/lens/rollup/config');
+      await PageObjects.timePicker.resetDefaultAbsoluteRangeViaUiSettings();
     });
 
     it('should allow creation of lens xy chart', async () => {
diff --git a/x-pack/test/functional/apps/lens/table.ts b/x-pack/test/functional/apps/lens/table.ts
index 892534eec7033..94bc5e8b266ea 100644
--- a/x-pack/test/functional/apps/lens/table.ts
+++ b/x-pack/test/functional/apps/lens/table.ts
@@ -60,12 +60,12 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       expect(await PageObjects.lens.getDatatableHeaderText(1)).to.equal('@timestamp per 3 hours');
       expect(await PageObjects.lens.getDatatableHeaderText(2)).to.equal('Average of bytes');
 
-      await PageObjects.lens.toggleColumnVisibility('lnsDatatable_rows > lns-dimensionTrigger');
+      await PageObjects.lens.toggleColumnVisibility('lnsDatatable_rows > lns-dimensionTrigger', 1);
 
       expect(await PageObjects.lens.getDatatableHeaderText(0)).to.equal('@timestamp per 3 hours');
       expect(await PageObjects.lens.getDatatableHeaderText(1)).to.equal('Average of bytes');
 
-      await PageObjects.lens.toggleColumnVisibility('lnsDatatable_rows > lns-dimensionTrigger');
+      await PageObjects.lens.toggleColumnVisibility('lnsDatatable_rows > lns-dimensionTrigger', 4);
 
       expect(await PageObjects.lens.getDatatableHeaderText(0)).to.equal('Top values of ip');
       expect(await PageObjects.lens.getDatatableHeaderText(1)).to.equal('@timestamp per 3 hours');
diff --git a/x-pack/test/functional/apps/ml/embeddables/anomaly_charts_dashboard_embeddables.ts b/x-pack/test/functional/apps/ml/embeddables/anomaly_charts_dashboard_embeddables.ts
index 1c47893dbafd0..66a32a888b77a 100644
--- a/x-pack/test/functional/apps/ml/embeddables/anomaly_charts_dashboard_embeddables.ts
+++ b/x-pack/test/functional/apps/ml/embeddables/anomaly_charts_dashboard_embeddables.ts
@@ -6,42 +6,16 @@
  */
 
 import { FtrProviderContext } from '../../../ftr_provider_context';
-import { Job, Datafeed } from '../../../../../plugins/ml/common/types/anomaly_detection_jobs';
-
-// @ts-expect-error not full interface
-const JOB_CONFIG: Job = {
-  job_id: `fq_multi_1_ae`,
-  description:
-    'mean/min/max(responsetime) partition=airline on farequote dataset with 1h bucket span',
-  groups: ['farequote', 'automated', 'multi-metric'],
-  analysis_config: {
-    bucket_span: '1h',
-    influencers: ['airline'],
-    detectors: [
-      { function: 'mean', field_name: 'responsetime', partition_field_name: 'airline' },
-      { function: 'min', field_name: 'responsetime', partition_field_name: 'airline' },
-      { function: 'max', field_name: 'responsetime', partition_field_name: 'airline' },
-    ],
-  },
-  data_description: { time_field: '@timestamp' },
-  analysis_limits: { model_memory_limit: '20mb' },
-  model_plot_config: { enabled: true },
-};
-
-// @ts-expect-error not full interface
-const DATAFEED_CONFIG: Datafeed = {
-  datafeed_id: 'datafeed-fq_multi_1_ae',
-  indices: ['ft_farequote'],
-  job_id: 'fq_multi_1_ae',
-  query: { bool: { must: [{ match_all: {} }] } },
-};
+import { JOB_CONFIG, DATAFEED_CONFIG, ML_EMBEDDABLE_TYPES } from './constants';
 
 const testDataList = [
   {
+    type: 'testData',
     suiteSuffix: 'with multi metric job',
     panelTitle: `ML anomaly charts for ${JOB_CONFIG.job_id}`,
     jobConfig: JOB_CONFIG,
     datafeedConfig: DATAFEED_CONFIG,
+    dashboardTitle: `ML anomaly charts for fq_multi_1_ae ${Date.now()}`,
     expected: {
       influencers: [
         {
@@ -59,7 +33,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const ml = getService('ml');
   const PageObjects = getPageObjects(['common', 'timePicker', 'dashboard']);
 
-  describe('anomaly charts', function () {
+  describe('anomaly charts in dashboard', function () {
     this.tags(['mlqa']);
 
     before(async () => {
@@ -69,6 +43,10 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await ml.securityUI.loginAsMlPowerUser();
     });
 
+    after(async () => {
+      await ml.api.cleanMlIndices();
+    });
+
     for (const testData of testDataList) {
       describe(testData.suiteSuffix, function () {
         before(async () => {
@@ -79,14 +57,12 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
           await PageObjects.common.navigateToApp('dashboard');
         });
 
-        after(async () => {
-          await ml.api.cleanMlIndices();
-        });
-
         it('can open job selection flyout', async () => {
-          await PageObjects.dashboard.clickCreateDashboardPrompt();
+          await PageObjects.dashboard.clickNewDashboard();
           await ml.dashboardEmbeddables.assertDashboardIsEmpty();
-          await ml.dashboardEmbeddables.openJobSelectionFlyout();
+          await ml.dashboardEmbeddables.openAnomalyJobSelectionFlyout(
+            ML_EMBEDDABLE_TYPES.ANOMALY_CHARTS
+          );
         });
 
         it('can select jobs', async () => {
@@ -109,6 +85,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
           await PageObjects.timePicker.pauseAutoRefresh();
           await ml.dashboardEmbeddables.assertAnomalyChartsSeverityThresholdControlExists();
           await ml.dashboardEmbeddables.assertAnomalyChartsExists();
+          await PageObjects.dashboard.saveDashboard(testData.dashboardTitle);
         });
       });
     }
diff --git a/x-pack/test/functional/apps/ml/embeddables/anomaly_embeddables_migration.ts b/x-pack/test/functional/apps/ml/embeddables/anomaly_embeddables_migration.ts
new file mode 100644
index 0000000000000..a7fcfa1b83475
--- /dev/null
+++ b/x-pack/test/functional/apps/ml/embeddables/anomaly_embeddables_migration.ts
@@ -0,0 +1,118 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrProviderContext } from '../../../ftr_provider_context';
+import { JOB_CONFIG, DATAFEED_CONFIG, ML_EMBEDDABLE_TYPES } from './constants';
+
+const testDataList = [
+  {
+    type: ML_EMBEDDABLE_TYPES.ANOMALY_SWIMLANE,
+    panelTitle: 'ML anomaly swim lane',
+    dashboardSavedObject: {
+      type: 'dashboard',
+      attributes: {
+        title: `7.15.2 ML anomaly swimlane dashboard ${Date.now()}`,
+        description: '',
+        panelsJSON: `[{"version":"7.15.2","type":"ml_anomaly_swimlane","gridData":{"x":0,"y":0,"w":24,"h":15,"i":"c177ed0a-dea0-40f8-8980-cfb0c6bc13a8"},"panelIndex":"c177ed0a-dea0-40f8-8980-cfb0c6bc13a8","embeddableConfig":{"jobIds":["fq_multi_1_ae"],"swimlaneType":"viewBy","viewBy":"airline","enhancements":{}},"title":"ML anomaly swim lane"}]`,
+        optionsJSON: '{"useMargins":true,"syncColors":false,"hidePanelTitles":false}',
+        timeRestore: true,
+        timeTo: '2016-02-11T00:00:00.000Z',
+        timeFrom: '2016-02-07T00:00:00.000Z',
+        refreshInterval: {
+          pause: true,
+          value: 0,
+        },
+        kibanaSavedObjectMeta: {
+          searchSourceJSON: '{"query":{"query":"","language":"kuery"},"filter":[]}',
+        },
+      },
+      coreMigrationVersion: '7.15.2',
+    },
+  },
+  {
+    type: ML_EMBEDDABLE_TYPES.ANOMALY_CHARTS,
+    panelTitle: 'ML anomaly charts',
+    dashboardSavedObject: {
+      type: 'dashboard',
+      attributes: {
+        title: `7.15.2 ML anomaly charts dashboard ${Date.now()}`,
+        description: '',
+        panelsJSON:
+          '[{"version":"7.15.2","type":"ml_anomaly_charts","gridData":{"x":0,"y":0,"w":38,"h":21,"i":"1155890b-c19c-4d98-8153-50e6434612f1"},"panelIndex":"1155890b-c19c-4d98-8153-50e6434612f1","embeddableConfig":{"jobIds":["fq_multi_1_ae"],"maxSeriesToPlot":6,"severityThreshold":0,"enhancements":{}},"title":"ML anomaly charts"}]',
+        optionsJSON: '{"useMargins":true,"syncColors":false,"hidePanelTitles":false}',
+        timeRestore: true,
+        timeTo: '2016-02-11T00:00:00.000Z',
+        timeFrom: '2016-02-07T00:00:00.000Z',
+        refreshInterval: {
+          pause: true,
+          value: 0,
+        },
+        kibanaSavedObjectMeta: {
+          searchSourceJSON: '{"query":{"query":"","language":"kuery"},"filter":[]}',
+        },
+      },
+      coreMigrationVersion: '7.15.2',
+    },
+  },
+];
+
+export default function ({ getService, getPageObjects }: FtrProviderContext) {
+  const esArchiver = getService('esArchiver');
+  const ml = getService('ml');
+  const PageObjects = getPageObjects(['common', 'timePicker', 'dashboard']);
+
+  describe('anomaly embeddables migration in Dashboard', function () {
+    this.tags(['mlqa']);
+
+    before(async () => {
+      await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/ml/farequote');
+      await ml.testResources.createIndexPatternIfNeeded('ft_farequote', '@timestamp');
+      await ml.testResources.setKibanaTimeZoneToUTC();
+      await ml.securityUI.loginAsMlPowerUser();
+
+      await ml.api.createAndRunAnomalyDetectionLookbackJob(JOB_CONFIG, DATAFEED_CONFIG);
+      // Using bulk API because create API might return 400 for conflict errors
+      await ml.testResources.createBulkSavedObjects(
+        testDataList.map((d) => d.dashboardSavedObject)
+      );
+
+      await PageObjects.common.navigateToApp('dashboard');
+    });
+
+    after(async () => {
+      await ml.api.cleanMlIndices();
+    });
+
+    for (const testData of testDataList) {
+      const { dashboardSavedObject, panelTitle, type } = testData;
+      describe(`for ${panelTitle}`, function () {
+        before(async () => {
+          await PageObjects.common.navigateToApp('dashboard');
+        });
+
+        after(async () => {
+          await ml.testResources.deleteDashboardByTitle(dashboardSavedObject.attributes.title);
+        });
+
+        it(`loads saved dashboard from version ${dashboardSavedObject.coreMigrationVersion}`, async () => {
+          await PageObjects.dashboard.loadSavedDashboard(dashboardSavedObject.attributes.title);
+
+          await ml.dashboardEmbeddables.assertDashboardPanelExists(panelTitle);
+
+          if (type === ML_EMBEDDABLE_TYPES.ANOMALY_CHARTS) {
+            await ml.dashboardEmbeddables.assertAnomalyChartsSeverityThresholdControlExists();
+            await ml.dashboardEmbeddables.assertAnomalyChartsExists();
+          }
+
+          if (type === ML_EMBEDDABLE_TYPES.ANOMALY_SWIMLANE) {
+            await ml.dashboardEmbeddables.assertAnomalySwimlaneExists();
+          }
+        });
+      });
+    }
+  });
+}
diff --git a/x-pack/test/functional/apps/ml/embeddables/constants.ts b/x-pack/test/functional/apps/ml/embeddables/constants.ts
new file mode 100644
index 0000000000000..f315b7ee44dc8
--- /dev/null
+++ b/x-pack/test/functional/apps/ml/embeddables/constants.ts
@@ -0,0 +1,41 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { Datafeed, Job } from '../../../../../plugins/ml/common/types/anomaly_detection_jobs';
+
+// @ts-expect-error not full interface
+export const JOB_CONFIG: Job = {
+  job_id: `fq_multi_1_ae`,
+  description:
+    'mean/min/max(responsetime) partition=airline on farequote dataset with 1h bucket span',
+  groups: ['farequote', 'automated', 'multi-metric'],
+  analysis_config: {
+    bucket_span: '1h',
+    influencers: ['airline'],
+    detectors: [
+      { function: 'mean', field_name: 'responsetime', partition_field_name: 'airline' },
+      { function: 'min', field_name: 'responsetime', partition_field_name: 'airline' },
+      { function: 'max', field_name: 'responsetime', partition_field_name: 'airline' },
+    ],
+  },
+  data_description: { time_field: '@timestamp' },
+  analysis_limits: { model_memory_limit: '20mb' },
+  model_plot_config: { enabled: true },
+};
+
+// @ts-expect-error not full interface
+export const DATAFEED_CONFIG: Datafeed = {
+  datafeed_id: 'datafeed-fq_multi_1_ae',
+  indices: ['ft_farequote'],
+  job_id: 'fq_multi_1_ae',
+  query: { bool: { must: [{ match_all: {} }] } },
+};
+
+export const ML_EMBEDDABLE_TYPES = {
+  ANOMALY_SWIMLANE: 'ml_anomaly_swimlane',
+  ANOMALY_CHARTS: 'ml_anomaly_charts',
+} as const;
diff --git a/x-pack/test/functional/apps/ml/embeddables/index.ts b/x-pack/test/functional/apps/ml/embeddables/index.ts
index dc059a1862c80..31074a59866a6 100644
--- a/x-pack/test/functional/apps/ml/embeddables/index.ts
+++ b/x-pack/test/functional/apps/ml/embeddables/index.ts
@@ -11,5 +11,6 @@ export default function ({ loadTestFile }: FtrProviderContext) {
   describe('embeddables', function () {
     this.tags(['skipFirefox']);
     loadTestFile(require.resolve('./anomaly_charts_dashboard_embeddables'));
+    loadTestFile(require.resolve('./anomaly_embeddables_migration'));
   });
 }
diff --git a/x-pack/test/functional/apps/spaces/copy_saved_objects.ts b/x-pack/test/functional/apps/spaces/copy_saved_objects.ts
index 2d2fdf61a94b6..807e0fff16ff1 100644
--- a/x-pack/test/functional/apps/spaces/copy_saved_objects.ts
+++ b/x-pack/test/functional/apps/spaces/copy_saved_objects.ts
@@ -17,7 +17,8 @@ export default function spaceSelectorFunctonalTests({
   const testSubjects = getService('testSubjects');
   const PageObjects = getPageObjects(['security', 'settings', 'copySavedObjectsToSpace']);
 
-  describe('Copy Saved Objects to Space', function () {
+  // FLAKY: https://github.com/elastic/kibana/issues/44575
+  describe.skip('Copy Saved Objects to Space', function () {
     before(async () => {
       await esArchiver.load('x-pack/test/functional/es_archives/spaces/copy_saved_objects');
 
diff --git a/x-pack/test/functional/apps/spaces/spaces_selection.ts b/x-pack/test/functional/apps/spaces/spaces_selection.ts
index 0b9d1f420c663..bab90a6d567fe 100644
--- a/x-pack/test/functional/apps/spaces/spaces_selection.ts
+++ b/x-pack/test/functional/apps/spaces/spaces_selection.ts
@@ -22,8 +22,7 @@ export default function spaceSelectorFunctionalTests({
     'spaceSelector',
   ]);
 
-  // FLAKY: https://github.com/elastic/kibana/issues/99581
-  describe.skip('Spaces', function () {
+  describe('Spaces', function () {
     this.tags('includeFirefox');
     describe('Space Selector', () => {
       before(async () => {
diff --git a/x-pack/test/functional/es_archives/lens/basic/data.json b/x-pack/test/functional/es_archives/lens/basic/data.json
deleted file mode 100644
index a985de882929d..0000000000000
--- a/x-pack/test/functional/es_archives/lens/basic/data.json
+++ /dev/null
@@ -1,577 +0,0 @@
-{
-  "type": "doc",
-  "value": {
-    "id": "space:default",
-    "index": ".kibana_1",
-    "source": {
-      "migrationVersion": {
-        "space": "6.6.0"
-      },
-      "references": [],
-      "space": {
-        "_reserved": true,
-        "description": "This is the default space!",
-        "disabledFeatures": [],
-        "name": "Default"
-      },
-      "type": "space"
-    },
-    "type": "_doc"
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "id": "index-pattern:logstash-*",
-    "index": ".kibana_1",
-    "source": {
-      "index-pattern": {
-        "fields": "[{\"name\":\"@message\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"@message.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"@tags\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"@tags.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"@timestamp\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_score\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_source\",\"type\":\"_source\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"agent\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"agent.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"clientip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"extension\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"extension.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.coordinates\",\"type\":\"geo_point\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.dest\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.src\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.srcdest\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"headings\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"headings.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"host.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"index.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"links\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"links.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"machine.os\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"machine.os.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"machine.ram\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"memory\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"meta.char\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"meta.related\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"meta.user.firstname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"meta.user.lastname\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"phpmemory\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"referer\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.article:modified_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.article:published_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.article:section\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.article:section.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.article:tag\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.article:tag.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:description\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:description.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:image\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:image.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:image:height\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:image:height.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:image:width\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:image:width.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:site_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:site_name.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:title\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:title.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:type.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.twitter:card\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:card.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.twitter:description\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:description.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.twitter:image\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:image.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.twitter:site\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:site.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.twitter:title\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:title.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"request\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"request.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"response\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"response.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"spaces\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"spaces.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"utc_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"xss\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"xss.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true}]",
-        "timeFieldName": "@timestamp",
-        "title": "logstash-*"
-      },
-      "migrationVersion": {
-        "index-pattern": "6.5.0"
-      },
-      "references": [],
-      "type": "index-pattern",
-      "updated_at": "2018-12-21T00:43:07.096Z"
-    },
-    "type": "_doc"
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "id": "index-pattern:log*",
-    "index": ".kibana_1",
-    "source": {
-      "index-pattern": {
-        "fields": "[{\"name\":\"@message\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"@message.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"@tags\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"@tags.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"@timestamp\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_score\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_source\",\"type\":\"_source\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"agent\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"agent.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"clientip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"extension\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"extension.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.coordinates\",\"type\":\"geo_point\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.dest\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.src\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.srcdest\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"headings\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"headings.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"host.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"index.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"links\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"links.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"machine.os\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"machine.os.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"machine.ram\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"memory\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"meta.char\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"meta.related\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"meta.user.firstname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"meta.user.lastname\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"phpmemory\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"referer\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.article:modified_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.article:published_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.article:section\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.article:section.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.article:tag\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.article:tag.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:description\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:description.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:image\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:image.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:image:height\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:image:height.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:image:width\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:image:width.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:site_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:site_name.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:title\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:title.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:type.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.twitter:card\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:card.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.twitter:description\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:description.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.twitter:image\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:image.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.twitter:site\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:site.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.twitter:title\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:title.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"request\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"request.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"response\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"response.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"spaces\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"spaces.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"utc_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"xss\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"xss.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true}]",
-        "timeFieldName": "@timestamp",
-        "title": "log*"
-      },
-      "migrationVersion": {
-        "index-pattern": "6.5.0"
-      },
-      "references": [],
-      "type": "index-pattern",
-      "updated_at": "2018-12-21T00:43:07.096Z"
-    },
-    "type": "_doc"
-  }
-}
-
-
-{
-  "type": "doc",
-  "value": {
-    "id": "custom_space:index-pattern:logstash-*",
-    "index": ".kibana_1",
-    "source": {
-      "index-pattern": {
-        "fields": "[{\"name\":\"@message\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"@message.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"@tags\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"@tags.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"@timestamp\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_score\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_source\",\"type\":\"_source\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"agent\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"agent.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"clientip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"extension\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"extension.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.coordinates\",\"type\":\"geo_point\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.dest\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.src\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.srcdest\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"headings\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"headings.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"host.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"index.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"links\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"links.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"machine.os\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"machine.os.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"machine.ram\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"memory\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"meta.char\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"meta.related\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"meta.user.firstname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"meta.user.lastname\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"phpmemory\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"referer\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.article:modified_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.article:published_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.article:section\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.article:section.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.article:tag\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.article:tag.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:description\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:description.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:image\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:image.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:image:height\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:image:height.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:image:width\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:image:width.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:site_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:site_name.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:title\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:title.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:type.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.twitter:card\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:card.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.twitter:description\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:description.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.twitter:image\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:image.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.twitter:site\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:site.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.twitter:title\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:title.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"request\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"request.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"response\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"response.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"spaces\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"spaces.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"utc_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"xss\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"xss.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true}]",
-        "timeFieldName": "@timestamp",
-        "title": "logstash-*"
-      },
-      "migrationVersion": {
-        "index-pattern": "6.5.0"
-      },
-      "namespace": "custom_space",
-      "references": [],
-      "type": "index-pattern",
-      "updated_at": "2018-12-21T00:43:07.096Z"
-    },
-    "type": "_doc"
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "id": "visualization:i-exist",
-    "index": ".kibana_1",
-    "source": {
-      "migrationVersion": {
-        "visualization": "7.3.1"
-      },
-      "references": [
-        {
-          "id": "logstash-*",
-          "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
-          "type": "index-pattern"
-        }
-      ],
-      "type": "visualization",
-      "updated_at": "2019-01-22T19:32:31.206Z",
-      "visualization": {
-        "description": "",
-        "kibanaSavedObjectMeta": {
-          "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"
-        },
-        "title": "A Pie",
-        "uiStateJSON": "{}",
-        "version": 1,
-        "visState": "{\"title\":\"A Pie\",\"type\":\"pie\",\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100},\"dimensions\":{\"metric\":{\"accessor\":0,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"geo.src\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}"
-      }
-    },
-    "type": "_doc"
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "id": "custom_space:visualization:i-exist",
-    "index": ".kibana_1",
-    "source": {
-      "migrationVersion": {
-        "visualization": "7.3.1"
-      },
-      "namespace": "custom_space",
-      "references": [
-        {
-          "id": "logstash-*",
-          "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
-          "type": "index-pattern"
-        }
-      ],
-      "type": "visualization",
-      "updated_at": "2019-01-22T19:32:31.206Z",
-      "visualization": {
-        "description": "",
-        "kibanaSavedObjectMeta": {
-          "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"
-        },
-        "title": "A Pie",
-        "uiStateJSON": "{}",
-        "version": 1,
-        "visState": "{\"title\":\"A Pie\",\"type\":\"pie\",\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100},\"dimensions\":{\"metric\":{\"accessor\":0,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"geo.src\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}"
-      }
-    },
-    "type": "_doc"
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "id": "query:okjpgs",
-    "index": ".kibana_1",
-    "source": {
-      "query": {
-        "description": "Ok responses for jpg files",
-        "filters": [
-          {
-            "$state": {
-              "store": "appState"
-            },
-            "meta": {
-              "alias": null,
-              "disabled": false,
-              "index": "b15b1d40-a8bb-11e9-98cf-2bb06ef63e0b",
-              "key": "extension.raw",
-              "negate": false,
-              "params": {
-                "query": "jpg"
-              },
-              "type": "phrase",
-              "value": "jpg"
-            },
-            "query": {
-              "match": {
-                "extension.raw": {
-                  "query": "jpg",
-                  "type": "phrase"
-                }
-              }
-            }
-          }
-        ],
-        "query": {
-          "language": "kuery",
-          "query": "response:200"
-        },
-        "title": "OKJpgs"
-      },
-      "references": [],
-      "type": "query",
-      "updated_at": "2019-07-17T17:54:26.378Z"
-    },
-    "type": "_doc"
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "id": "config:8.0.0",
-    "index": ".kibana_1",
-    "source": {
-      "config": {
-        "accessibility:disableAnimations": true,
-        "buildNum": 9007199254740991,
-        "dateFormat:tz": "UTC",
-        "defaultIndex": "logstash-*"
-      },
-      "references": [],
-      "type": "config",
-      "updated_at": "2019-09-04T18:47:24.761Z"
-    },
-    "type": "_doc"
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "id": "lens:76fc4200-cf44-11e9-b933-fd84270f3ac1",
-    "index": ".kibana_1",
-    "source": {
-      "lens": {
-        "expression": "kibana\n| kibana_context  query=\"{\\\"language\\\":\\\"kuery\\\",\\\"query\\\":\\\"\\\"}\" filters=\"[]\"\n| lens_merge_tables layerIds=\"c61a8afb-a185-4fae-a064-fb3846f6c451\" \n  tables={esaggs index=\"logstash-*\" metricsAtAllLevels=false partialRows=false includeFormatHints=true aggConfigs={lens_auto_date aggConfigs=\"[{\\\"id\\\":\\\"2cd09808-3915-49f4-b3b0-82767eba23f7\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"max\\\",\\\"schema\\\":\\\"metric\\\",\\\"params\\\":{\\\"field\\\":\\\"bytes\\\"}}]\"} | lens_rename_columns idMap=\"{\\\"col-0-2cd09808-3915-49f4-b3b0-82767eba23f7\\\":{\\\"dataType\\\":\\\"number\\\",\\\"isBucketed\\\":false,\\\"label\\\":\\\"Maximum of bytes\\\",\\\"operationType\\\":\\\"max\\\",\\\"scale\\\":\\\"ratio\\\",\\\"sourceField\\\":\\\"bytes\\\",\\\"id\\\":\\\"2cd09808-3915-49f4-b3b0-82767eba23f7\\\"}}\"}\n| lens_metric_chart title=\"Maximum of bytes\" accessor=\"2cd09808-3915-49f4-b3b0-82767eba23f7\" mode=\"full\"",
-        "state": {
-          "datasourceMetaData": {
-            "filterableIndexPatterns": [
-              {
-                "id": "logstash-*",
-                "title": "logstash-*"
-              }
-            ]
-          },
-          "datasourceStates": {
-            "indexpattern": {
-              "currentIndexPatternId": "logstash-*",
-              "layers": {
-                "c61a8afb-a185-4fae-a064-fb3846f6c451": {
-                  "columnOrder": [
-                    "2cd09808-3915-49f4-b3b0-82767eba23f7"
-                  ],
-                  "columns": {
-                    "2cd09808-3915-49f4-b3b0-82767eba23f7": {
-                      "dataType": "number",
-                      "isBucketed": false,
-                      "label": "Maximum of bytes",
-                      "operationType": "max",
-                      "scale": "ratio",
-                      "sourceField": "bytes"
-                    }
-                  },
-                  "indexPatternId": "logstash-*"
-                }
-              }
-            }
-          },
-          "filters": [],
-          "query": {
-            "language": "kuery",
-            "query": ""
-          },
-          "visualization": {
-            "accessor": "2cd09808-3915-49f4-b3b0-82767eba23f7",
-            "isHorizontal": false,
-            "layerId": "c61a8afb-a185-4fae-a064-fb3846f6c451",
-            "layers": [
-              {
-                "accessors": [
-                  "d3e62a7a-c259-4fff-a2fc-eebf20b7008a",
-                  "26ef70a9-c837-444c-886e-6bd905ee7335"
-                ],
-                "layerId": "c61a8afb-a185-4fae-a064-fb3846f6c451",
-                "seriesType": "area",
-                "splitAccessor": "54cd64ed-2a44-4591-af84-b2624504569a",
-                "xAccessor": "d6e40cea-6299-43b4-9c9d-b4ee305a2ce8"
-              }
-            ],
-            "legend": {
-              "isVisible": true,
-              "position": "right"
-            },
-            "preferredSeriesType": "area"
-          }
-        },
-        "title": "Artistpreviouslyknownaslens",
-        "visualizationType": "lnsMetric"
-      },
-      "references": [],
-      "type": "lens",
-      "updated_at": "2019-10-16T00:28:08.979Z"
-    },
-    "type": "_doc"
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "id": "lens:9536bed0-d57e-11ea-b169-e3a222a76b9c",
-    "index": ".kibana_1",
-    "source": {
-      "lens": {
-        "expression": "kibana\n| kibana_context  query=\"{\\\"language\\\":\\\"kuery\\\",\\\"query\\\":\\\"\\\"}\" filters=\"[]\"\n| lens_merge_tables layerIds=\"4ba1a1be-6e67-434b-b3a0-f30db8ea5395\" \n  tables={esaggs index=\"logstash-*\" metricsAtAllLevels=true partialRows=true includeFormatHints=true  aggConfigs=\"[{\\\"id\\\":\\\"bafe3009-1776-4227-a0fe-b0d6ccbb4961\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"terms\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"geo.dest\\\",\\\"orderBy\\\":\\\"3dc0bd55-2087-4e60-aea2-f9910714f7db\\\",\\\"order\\\":\\\"desc\\\",\\\"size\\\":7,\\\"otherBucket\\\":false,\\\"otherBucketLabel\\\":\\\"Other\\\",\\\"missingBucket\\\":false,\\\"missingBucketLabel\\\":\\\"Missing\\\"}},{\\\"id\\\":\\\"c1ebe4c9-f283-486c-ae95-6b3e99e83bd8\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"terms\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"geo.src\\\",\\\"orderBy\\\":\\\"3dc0bd55-2087-4e60-aea2-f9910714f7db\\\",\\\"order\\\":\\\"desc\\\",\\\"size\\\":3,\\\"otherBucket\\\":false,\\\"otherBucketLabel\\\":\\\"Other\\\",\\\"missingBucket\\\":false,\\\"missingBucketLabel\\\":\\\"Missing\\\"}},{\\\"id\\\":\\\"3dc0bd55-2087-4e60-aea2-f9910714f7db\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"avg\\\",\\\"schema\\\":\\\"metric\\\",\\\"params\\\":{\\\"field\\\":\\\"bytes\\\",\\\"missing\\\":0}}]\" | lens_rename_columns idMap=\"{\\\"col-0-bafe3009-1776-4227-a0fe-b0d6ccbb4961\\\":{\\\"dataType\\\":\\\"string\\\",\\\"isBucketed\\\":true,\\\"label\\\":\\\"Top values of geo.dest\\\",\\\"operationType\\\":\\\"terms\\\",\\\"params\\\":{\\\"orderBy\\\":{\\\"columnId\\\":\\\"3dc0bd55-2087-4e60-aea2-f9910714f7db\\\",\\\"type\\\":\\\"column\\\"},\\\"orderDirection\\\":\\\"desc\\\",\\\"size\\\":7},\\\"scale\\\":\\\"ordinal\\\",\\\"sourceField\\\":\\\"geo.dest\\\",\\\"id\\\":\\\"bafe3009-1776-4227-a0fe-b0d6ccbb4961\\\"},\\\"col-2-c1ebe4c9-f283-486c-ae95-6b3e99e83bd8\\\":{\\\"label\\\":\\\"Top values of geo.src\\\",\\\"dataType\\\":\\\"string\\\",\\\"operationType\\\":\\\"terms\\\",\\\"scale\\\":\\\"ordinal\\\",\\\"sourceField\\\":\\\"geo.src\\\",\\\"isBucketed\\\":true,\\\"params\\\":{\\\"size\\\":3,\\\"orderBy\\\":{\\\"type\\\":\\\"column\\\",\\\"columnId\\\":\\\"3dc0bd55-2087-4e60-aea2-f9910714f7db\\\"},\\\"orderDirection\\\":\\\"desc\\\"},\\\"id\\\":\\\"c1ebe4c9-f283-486c-ae95-6b3e99e83bd8\\\"},\\\"col-3-3dc0bd55-2087-4e60-aea2-f9910714f7db\\\":{\\\"dataType\\\":\\\"number\\\",\\\"isBucketed\\\":false,\\\"label\\\":\\\"Average of bytes\\\",\\\"operationType\\\":\\\"avg\\\",\\\"scale\\\":\\\"ratio\\\",\\\"sourceField\\\":\\\"bytes\\\",\\\"id\\\":\\\"3dc0bd55-2087-4e60-aea2-f9910714f7db\\\"}}\"}\n| lens_pie shape=\"pie\" hideLabels=false groups=\"bafe3009-1776-4227-a0fe-b0d6ccbb4961\"\n  groups=\"c1ebe4c9-f283-486c-ae95-6b3e99e83bd8\" metric=\"3dc0bd55-2087-4e60-aea2-f9910714f7db\" numberDisplay=\"percent\" categoryDisplay=\"default\" legendDisplay=\"default\" legendPosition=\"right\" percentDecimals=3 nestedLegend=false",
-        "state": {
-          "datasourceMetaData": {
-            "filterableIndexPatterns": [
-              {
-                "id": "logstash-*",
-                "title": "logstash-*"
-              }
-            ]
-          },
-          "datasourceStates": {
-            "indexpattern": {
-              "currentIndexPatternId": "logstash-*",
-              "layers": {
-                "4ba1a1be-6e67-434b-b3a0-f30db8ea5395": {
-                  "columnOrder": [
-                    "bafe3009-1776-4227-a0fe-b0d6ccbb4961",
-                    "c1ebe4c9-f283-486c-ae95-6b3e99e83bd8",
-                    "3dc0bd55-2087-4e60-aea2-f9910714f7db"
-                  ],
-                  "columns": {
-                    "3dc0bd55-2087-4e60-aea2-f9910714f7db": {
-                      "dataType": "number",
-                      "isBucketed": false,
-                      "label": "Average of bytes",
-                      "operationType": "avg",
-                      "scale": "ratio",
-                      "sourceField": "bytes"
-                    },
-                    "5bd1c078-e1dd-465b-8d25-7a6404befa88": {
-                      "dataType": "date",
-                      "isBucketed": true,
-                      "label": "@timestamp",
-                      "operationType": "date_histogram",
-                      "params": {
-                        "interval": "auto"
-                      },
-                      "scale": "interval",
-                      "sourceField": "@timestamp"
-                    },
-                    "65340cf3-8402-4494-96f2-293701c59571": {
-                      "dataType": "number",
-                      "isBucketed": true,
-                      "label": "Top values of bytes",
-                      "operationType": "terms",
-                      "params": {
-                        "orderBy": {
-                          "columnId": "3dc0bd55-2087-4e60-aea2-f9910714f7db",
-                          "type": "column"
-                        },
-                        "orderDirection": "desc",
-                        "size": 3
-                      },
-                      "scale": "ordinal",
-                      "sourceField": "bytes"
-                    },
-                    "87554e1d-3dbf-4c1c-a358-4c9d40424cfa": {
-                      "dataType": "string",
-                      "isBucketed": true,
-                      "label": "Top values of type",
-                      "operationType": "terms",
-                      "params": {
-                        "orderBy": {
-                          "columnId": "3dc0bd55-2087-4e60-aea2-f9910714f7db",
-                          "type": "column"
-                        },
-                        "orderDirection": "desc",
-                        "size": 3
-                      },
-                      "scale": "ordinal",
-                      "sourceField": "type"
-                    },
-                    "bafe3009-1776-4227-a0fe-b0d6ccbb4961": {
-                      "dataType": "string",
-                      "isBucketed": true,
-                      "label": "Top values of geo.dest",
-                      "operationType": "terms",
-                      "params": {
-                        "orderBy": {
-                          "columnId": "3dc0bd55-2087-4e60-aea2-f9910714f7db",
-                          "type": "column"
-                        },
-                        "orderDirection": "desc",
-                        "size": 7
-                      },
-                      "scale": "ordinal",
-                      "sourceField": "geo.dest"
-                    },
-                    "c1ebe4c9-f283-486c-ae95-6b3e99e83bd8": {
-                      "dataType": "string",
-                      "isBucketed": true,
-                      "label": "Top values of geo.src",
-                      "operationType": "terms",
-                      "params": {
-                        "orderBy": {
-                          "columnId": "3dc0bd55-2087-4e60-aea2-f9910714f7db",
-                          "type": "column"
-                        },
-                        "orderDirection": "desc",
-                        "size": 3
-                      },
-                      "scale": "ordinal",
-                      "sourceField": "geo.src"
-                    }
-                  },
-                  "indexPatternId": "logstash-*"
-                }
-              }
-            }
-          },
-          "filters": [],
-          "query": {
-            "language": "kuery",
-            "query": ""
-          },
-          "visualization": {
-            "layers": [
-              {
-                "categoryDisplay": "default",
-                "groups": [
-                  "bafe3009-1776-4227-a0fe-b0d6ccbb4961",
-                  "c1ebe4c9-f283-486c-ae95-6b3e99e83bd8"
-                ],
-                "layerId": "4ba1a1be-6e67-434b-b3a0-f30db8ea5395",
-                "legendDisplay": "default",
-                "metric": "3dc0bd55-2087-4e60-aea2-f9910714f7db",
-                "nestedLegend": false,
-                "numberDisplay": "percent"
-              }
-            ],
-            "shape": "pie"
-          }
-        },
-        "title": "lnsPieVis",
-        "visualizationType": "lnsPie"
-      },
-      "references": [],
-      "type": "lens",
-      "updated_at": "2020-08-03T11:43:43.421Z"
-    },
-    "type": "_doc"
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "id": "lens:76fc4200-cf44-11e9-b933-fd84270f3ac2",
-    "index": ".kibana_1",
-    "source": {
-      "lens": {
-        "expression": "kibana\n| kibana_context  query=\"{\\\"query\\\":\\\"\\\",\\\"language\\\":\\\"kuery\\\"}\" filters=\"[]\"\n| lens_merge_tables layerIds=\"4ba1a1be-6e67-434b-b3a0-f30db8ea5395\" \n  tables={esaggs index=\"logstash-*\" metricsAtAllLevels=false partialRows=false includeFormatHints=true aggConfigs={lens_auto_date aggConfigs=\"[{\\\"id\\\":\\\"7a5d833b-ca6f-4e48-a924-d2a28d365dc3\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"terms\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"ip\\\",\\\"orderBy\\\":\\\"3dc0bd55-2087-4e60-aea2-f9910714f7db\\\",\\\"order\\\":\\\"desc\\\",\\\"size\\\":3,\\\"otherBucket\\\":false,\\\"otherBucketLabel\\\":\\\"Other\\\",\\\"missingBucket\\\":false,\\\"missingBucketLabel\\\":\\\"Missing\\\"}},{\\\"id\\\":\\\"3cf18f28-3495-4d45-a55f-d97f88022099\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"date_histogram\\\",\\\"schema\\\":\\\"segment\\\",\\\"params\\\":{\\\"field\\\":\\\"@timestamp\\\",\\\"useNormalizedEsInterval\\\":true,\\\"interval\\\":\\\"auto\\\",\\\"drop_partials\\\":false,\\\"min_doc_count\\\":0,\\\"extended_bounds\\\":{}}},{\\\"id\\\":\\\"3dc0bd55-2087-4e60-aea2-f9910714f7db\\\",\\\"enabled\\\":true,\\\"type\\\":\\\"avg\\\",\\\"schema\\\":\\\"metric\\\",\\\"params\\\":{\\\"field\\\":\\\"bytes\\\",\\\"missing\\\":0}}]\"} | lens_rename_columns idMap=\"{\\\"col-0-7a5d833b-ca6f-4e48-a924-d2a28d365dc3\\\":{\\\"label\\\":\\\"Top values of ip\\\",\\\"dataType\\\":\\\"ip\\\",\\\"operationType\\\":\\\"terms\\\",\\\"scale\\\":\\\"ordinal\\\",\\\"suggestedPriority\\\":0,\\\"sourceField\\\":\\\"ip\\\",\\\"isBucketed\\\":true,\\\"params\\\":{\\\"size\\\":3,\\\"orderBy\\\":{\\\"type\\\":\\\"column\\\",\\\"columnId\\\":\\\"3dc0bd55-2087-4e60-aea2-f9910714f7db\\\"},\\\"orderDirection\\\":\\\"desc\\\"},\\\"id\\\":\\\"7a5d833b-ca6f-4e48-a924-d2a28d365dc3\\\"},\\\"col-1-3cf18f28-3495-4d45-a55f-d97f88022099\\\":{\\\"label\\\":\\\"@timestamp\\\",\\\"dataType\\\":\\\"date\\\",\\\"operationType\\\":\\\"date_histogram\\\",\\\"suggestedPriority\\\":1,\\\"sourceField\\\":\\\"@timestamp\\\",\\\"isBucketed\\\":true,\\\"scale\\\":\\\"interval\\\",\\\"params\\\":{\\\"interval\\\":\\\"auto\\\"},\\\"id\\\":\\\"3cf18f28-3495-4d45-a55f-d97f88022099\\\"},\\\"col-2-3dc0bd55-2087-4e60-aea2-f9910714f7db\\\":{\\\"label\\\":\\\"Average of bytes\\\",\\\"dataType\\\":\\\"number\\\",\\\"operationType\\\":\\\"avg\\\",\\\"sourceField\\\":\\\"bytes\\\",\\\"isBucketed\\\":false,\\\"scale\\\":\\\"ratio\\\",\\\"id\\\":\\\"3dc0bd55-2087-4e60-aea2-f9910714f7db\\\"}}\"}\n| lens_xy_chart xTitle=\"@timestamp\" yTitle=\"Average of bytes\" legend={lens_xy_legendConfig isVisible=true position=\"right\"} \n  layers={lens_xy_layer layerId=\"4ba1a1be-6e67-434b-b3a0-f30db8ea5395\" hide=false xAccessor=\"3cf18f28-3495-4d45-a55f-d97f88022099\" yScaleType=\"linear\" xScaleType=\"time\" isHistogram=true splitAccessor=\"7a5d833b-ca6f-4e48-a924-d2a28d365dc3\" seriesType=\"bar_stacked\" accessors=\"3dc0bd55-2087-4e60-aea2-f9910714f7db\" columnToLabel=\"{\\\"3dc0bd55-2087-4e60-aea2-f9910714f7db\\\":\\\"Average of bytes\\\",\\\"7a5d833b-ca6f-4e48-a924-d2a28d365dc3\\\":\\\"Top values of ip\\\"}\"}",
-        "state": {
-          "datasourceMetaData": {
-            "filterableIndexPatterns": [
-              {
-                "id": "logstash-*",
-                "title": "logstash-*"
-              }
-            ]
-          },
-          "datasourceStates": {
-            "indexpattern": {
-              "currentIndexPatternId": "logstash-*",
-              "layers": {
-                "4ba1a1be-6e67-434b-b3a0-f30db8ea5395": {
-                  "columnOrder": [
-                    "7a5d833b-ca6f-4e48-a924-d2a28d365dc3",
-                    "3cf18f28-3495-4d45-a55f-d97f88022099",
-                    "3dc0bd55-2087-4e60-aea2-f9910714f7db"
-                  ],
-                  "columns": {
-                    "3cf18f28-3495-4d45-a55f-d97f88022099": {
-                      "dataType": "date",
-                      "isBucketed": true,
-                      "label": "@timestamp",
-                      "operationType": "date_histogram",
-                      "params": {
-                        "interval": "auto"
-                      },
-                      "scale": "interval",
-                      "sourceField": "@timestamp",
-                      "suggestedPriority": 1
-                    },
-                    "3dc0bd55-2087-4e60-aea2-f9910714f7db": {
-                      "dataType": "number",
-                      "isBucketed": false,
-                      "label": "Average of bytes",
-                      "operationType": "avg",
-                      "scale": "ratio",
-                      "sourceField": "bytes"
-                    },
-                    "7a5d833b-ca6f-4e48-a924-d2a28d365dc3": {
-                      "dataType": "ip",
-                      "isBucketed": true,
-                      "label": "Top values of ip",
-                      "operationType": "terms",
-                      "params": {
-                        "orderBy": {
-                          "columnId": "3dc0bd55-2087-4e60-aea2-f9910714f7db",
-                          "type": "column"
-                        },
-                        "orderDirection": "desc",
-                        "size": 3
-                      },
-                      "scale": "ordinal",
-                      "sourceField": "ip",
-                      "suggestedPriority": 0
-                    }
-                  },
-                  "indexPatternId": "logstash-*"
-                }
-              }
-            }
-          },
-          "filters": [],
-          "query": {
-            "language": "kuery",
-            "query": ""
-          },
-          "visualization": {
-            "layers": [
-              {
-                "accessors": [
-                  "3dc0bd55-2087-4e60-aea2-f9910714f7db"
-                ],
-                "layerId": "4ba1a1be-6e67-434b-b3a0-f30db8ea5395",
-                "seriesType": "bar_stacked",
-                "splitAccessor": "7a5d833b-ca6f-4e48-a924-d2a28d365dc3",
-                "xAccessor": "3cf18f28-3495-4d45-a55f-d97f88022099"
-              }
-            ],
-            "legend": {
-              "isVisible": true,
-              "position": "right"
-            },
-            "preferredSeriesType": "bar_stacked"
-          }
-        },
-        "title": "lnsXYvis",
-        "visualizationType": "lnsXY"
-      },
-      "references": [],
-      "type": "lens",
-      "updated_at": "2019-10-16T00:28:08.979Z"
-    },
-    "type": "_doc"
-  }
-}
-
-{
-  "type": "doc",
-  "value": {
-    "id": "ui-metric:DashboardPanelVersionInUrl:8.0.0",
-    "index": ".kibana_1",
-    "source": {
-      "type": "ui-metric",
-      "ui-metric": {
-        "count": 1
-      },
-      "updated_at": "2019-10-16T00:28:24.399Z"
-    },
-    "type": "_doc"
-  }
-}
diff --git a/x-pack/test/functional/es_archives/lens/basic/mappings.json b/x-pack/test/functional/es_archives/lens/basic/mappings.json
deleted file mode 100644
index 5ff0a0e4661c3..0000000000000
--- a/x-pack/test/functional/es_archives/lens/basic/mappings.json
+++ /dev/null
@@ -1,1252 +0,0 @@
-{
-  "type": "index",
-  "value": {
-    "aliases": {
-      ".kibana": {
-      }
-    },
-    "index": ".kibana_1",
-    "mappings": {
-      "_meta": {
-        "migrationMappingPropertyHashes": {
-          "apm-telemetry": "07ee1939fa4302c62ddc052ec03fed90",
-          "canvas-element": "7390014e1091044523666d97247392fc",
-          "canvas-workpad": "b0a1706d356228dbdcb4a17e6b9eb231",
-          "config": "87aca8fdb053154f11383fce3dbf3edf",
-          "dashboard": "d00f614b29a80360e1190193fd333bab",
-          "file-upload-telemetry": "0ed4d3e1983d1217a30982630897092e",
-          "graph-workspace": "cd7ba1330e6682e9cc00b78850874be1",
-          "index-pattern": "66eccb05066c5a89924f48a9e9736499",
-          "infrastructure-ui-source": "ddc0ecb18383f6b26101a2fadb2dab0c",
-          "inventory-view": "84b320fd67209906333ffce261128462",
-          "kql-telemetry": "d12a98a6f19a2d273696597547e064ee",
-          "lens": "21c3ea0763beb1ecb0162529706b88c5",
-          "maps-telemetry": "a4229f8b16a6820c6d724b7e0c1f729d",
-          "metrics-explorer-view": "53c5365793677328df0ccb6138bf3cdd",
-          "migrationVersion": "4a1746014a75ade3a714e1db5763276f",
-          "ml-telemetry": "257fd1d4b4fdbb9cb4b8a3b27da201e9",
-          "namespace": "2f4316de49999235636386fe51dc06c1",
-          "query": "11aaeb7f5f7fa5bb43f25e18ce26e7d9",
-          "references": "7997cf5a56cc02bdc9c93361bde732b0",
-          "sample-data-telemetry": "7d3cfeb915303c9641c59681967ffeb4",
-          "search": "181661168bbadd1eff5902361e2a0d5c",
-          "server": "ec97f1c5da1a19609a60874e5af1100c",
-          "siem-ui-timeline": "1f6f0860ad7bc0dba3e42467ca40470d",
-          "siem-ui-timeline-note": "8874706eedc49059d4cf0f5094559084",
-          "siem-ui-timeline-pinned-event": "20638091112f0e14f0e443d512301c29",
-          "space": "c5ca8acafa0beaa4d08d014a97b6bc6b",
-          "telemetry": "e1c8bc94e443aefd9458932cc0697a4d",
-          "type": "2f4316de49999235636386fe51dc06c1",
-          "ui-metric": "0d409297dc5ebe1e3a1da691c6ee32e3",
-          "updated_at": "00da57df13e94e9d98437d13ace4bfe0",
-          "upgrade-assistant-reindex-operation": "a53a20fe086b72c9a86da3cc12dad8a6",
-          "upgrade-assistant-telemetry": "56702cec857e0a9dacfb696655b4ff7b",
-          "url": "c7f66a0df8b1b52f17c28c4adb111105",
-          "visualization": "52d7a13ad68a150c4525b292d23e12cc"
-        }
-      },
-      "dynamic": "strict",
-      "properties": {
-        "action": {
-          "properties": {
-            "actionTypeId": {
-              "type": "keyword"
-            },
-            "config": {
-              "enabled": false,
-              "type": "object"
-            },
-            "description": {
-              "type": "text"
-            },
-            "secrets": {
-              "type": "binary"
-            }
-          }
-        },
-        "action_task_params": {
-          "properties": {
-            "actionId": {
-              "type": "keyword"
-            },
-            "apiKey": {
-              "type": "binary"
-            },
-            "params": {
-              "enabled": false,
-              "type": "object"
-            }
-          }
-        },
-        "alert": {
-          "properties": {
-            "actions": {
-              "properties": {
-                "actionRef": {
-                  "type": "keyword"
-                },
-                "group": {
-                  "type": "keyword"
-                },
-                "params": {
-                  "enabled": false,
-                  "type": "object"
-                }
-              },
-              "type": "nested"
-            },
-            "alertTypeId": {
-              "type": "keyword"
-            },
-            "params": {
-              "enabled": false,
-              "type": "object"
-            },
-            "apiKey": {
-              "type": "binary"
-            },
-            "apiKeyOwner": {
-              "type": "keyword"
-            },
-            "createdBy": {
-              "type": "keyword"
-            },
-            "enabled": {
-              "type": "boolean"
-            },
-            "interval": {
-              "type": "keyword"
-            },
-            "scheduledTaskId": {
-              "type": "keyword"
-            },
-            "updatedBy": {
-              "type": "keyword"
-            }
-          }
-        },
-        "apm-telemetry": {
-          "properties": {
-            "has_any_services": {
-              "type": "boolean"
-            },
-            "services_per_agent": {
-              "properties": {
-                "dotnet": {
-                  "null_value": 0,
-                  "type": "long"
-                },
-                "go": {
-                  "null_value": 0,
-                  "type": "long"
-                },
-                "java": {
-                  "null_value": 0,
-                  "type": "long"
-                },
-                "js-base": {
-                  "null_value": 0,
-                  "type": "long"
-                },
-                "nodejs": {
-                  "null_value": 0,
-                  "type": "long"
-                },
-                "python": {
-                  "null_value": 0,
-                  "type": "long"
-                },
-                "ruby": {
-                  "null_value": 0,
-                  "type": "long"
-                },
-                "rum-js": {
-                  "null_value": 0,
-                  "type": "long"
-                }
-              }
-            }
-          }
-        },
-        "canvas-element": {
-          "dynamic": "false",
-          "properties": {
-            "@created": {
-              "type": "date"
-            },
-            "@timestamp": {
-              "type": "date"
-            },
-            "content": {
-              "type": "text"
-            },
-            "help": {
-              "type": "text"
-            },
-            "image": {
-              "type": "text"
-            },
-            "name": {
-              "fields": {
-                "keyword": {
-                  "type": "keyword"
-                }
-              },
-              "type": "text"
-            }
-          }
-        },
-        "canvas-workpad": {
-          "dynamic": "false",
-          "properties": {
-            "@created": {
-              "type": "date"
-            },
-            "@timestamp": {
-              "type": "date"
-            },
-            "name": {
-              "fields": {
-                "keyword": {
-                  "type": "keyword"
-                }
-              },
-              "type": "text"
-            }
-          }
-        },
-        "config": {
-          "dynamic": "true",
-          "properties": {
-            "accessibility:disableAnimations": {
-              "type": "boolean"
-            },
-            "buildNum": {
-              "type": "keyword"
-            },
-            "dateFormat:tz": {
-              "fields": {
-                "keyword": {
-                  "ignore_above": 256,
-                  "type": "keyword"
-                }
-              },
-              "type": "text"
-            },
-            "defaultIndex": {
-              "fields": {
-                "keyword": {
-                  "ignore_above": 256,
-                  "type": "keyword"
-                }
-              },
-              "type": "text"
-            }
-          }
-        },
-        "dashboard": {
-          "properties": {
-            "description": {
-              "type": "text"
-            },
-            "hits": {
-              "type": "integer"
-            },
-            "kibanaSavedObjectMeta": {
-              "properties": {
-                "searchSourceJSON": {
-                  "type": "text"
-                }
-              }
-            },
-            "optionsJSON": {
-              "type": "text"
-            },
-            "panelsJSON": {
-              "type": "text"
-            },
-            "refreshInterval": {
-              "properties": {
-                "display": {
-                  "type": "keyword"
-                },
-                "pause": {
-                  "type": "boolean"
-                },
-                "section": {
-                  "type": "integer"
-                },
-                "value": {
-                  "type": "integer"
-                }
-              }
-            },
-            "timeFrom": {
-              "type": "keyword"
-            },
-            "timeRestore": {
-              "type": "boolean"
-            },
-            "timeTo": {
-              "type": "keyword"
-            },
-            "title": {
-              "type": "text"
-            },
-            "version": {
-              "type": "integer"
-            }
-          }
-        },
-        "file-upload-telemetry": {
-          "properties": {
-            "filesUploadedTotalCount": {
-              "type": "long"
-            }
-          }
-        },
-        "gis-map": {
-          "properties": {
-            "bounds": {
-              "dynamic": false,
-              "properties": {}
-            },
-            "description": {
-              "type": "text"
-            },
-            "layerListJSON": {
-              "type": "text"
-            },
-            "mapStateJSON": {
-              "type": "text"
-            },
-            "title": {
-              "type": "text"
-            },
-            "uiStateJSON": {
-              "type": "text"
-            },
-            "version": {
-              "type": "integer"
-            }
-          }
-        },
-        "graph-workspace": {
-          "properties": {
-            "description": {
-              "type": "text"
-            },
-            "kibanaSavedObjectMeta": {
-              "properties": {
-                "searchSourceJSON": {
-                  "type": "text"
-                }
-              }
-            },
-            "numLinks": {
-              "type": "integer"
-            },
-            "numVertices": {
-              "type": "integer"
-            },
-            "title": {
-              "type": "text"
-            },
-            "version": {
-              "type": "integer"
-            },
-            "wsState": {
-              "type": "text"
-            }
-          }
-        },
-        "index-pattern": {
-          "properties": {
-            "fieldFormatMap": {
-              "type": "text"
-            },
-            "fields": {
-              "type": "text"
-            },
-            "intervalName": {
-              "type": "keyword"
-            },
-            "notExpandable": {
-              "type": "boolean"
-            },
-            "sourceFilters": {
-              "type": "text"
-            },
-            "timeFieldName": {
-              "type": "keyword"
-            },
-            "title": {
-              "type": "text"
-            },
-            "type": {
-              "type": "keyword"
-            },
-            "typeMeta": {
-              "type": "keyword"
-            }
-          }
-        },
-        "infrastructure-ui-source": {
-          "properties": {
-            "description": {
-              "type": "text"
-            },
-            "fields": {
-              "properties": {
-                "container": {
-                  "type": "keyword"
-                },
-                "host": {
-                  "type": "keyword"
-                },
-                "pod": {
-                  "type": "keyword"
-                },
-                "tiebreaker": {
-                  "type": "keyword"
-                },
-                "timestamp": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "logAlias": {
-              "type": "keyword"
-            },
-            "logColumns": {
-              "properties": {
-                "fieldColumn": {
-                  "properties": {
-                    "field": {
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "messageColumn": {
-                  "properties": {
-                    "id": {
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "timestampColumn": {
-                  "properties": {
-                    "id": {
-                      "type": "keyword"
-                    }
-                  }
-                }
-              },
-              "type": "nested"
-            },
-            "metricAlias": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "text"
-            }
-          }
-        },
-        "inventory-view": {
-          "properties": {
-            "autoBounds": {
-              "type": "boolean"
-            },
-            "autoReload": {
-              "type": "boolean"
-            },
-            "boundsOverride": {
-              "properties": {
-                "max": {
-                  "type": "integer"
-                },
-                "min": {
-                  "type": "integer"
-                }
-              }
-            },
-            "customOptions": {
-              "properties": {
-                "field": {
-                  "type": "keyword"
-                },
-                "text": {
-                  "type": "keyword"
-                }
-              },
-              "type": "nested"
-            },
-            "filterQuery": {
-              "properties": {
-                "expression": {
-                  "type": "keyword"
-                },
-                "kind": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "groupBy": {
-              "properties": {
-                "field": {
-                  "type": "keyword"
-                },
-                "label": {
-                  "type": "keyword"
-                }
-              },
-              "type": "nested"
-            },
-            "metric": {
-              "properties": {
-                "type": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "type": "keyword"
-            },
-            "nodeType": {
-              "type": "keyword"
-            },
-            "time": {
-              "type": "integer"
-            },
-            "view": {
-              "type": "keyword"
-            }
-          }
-        },
-        "kql-telemetry": {
-          "properties": {
-            "optInCount": {
-              "type": "long"
-            },
-            "optOutCount": {
-              "type": "long"
-            }
-          }
-        },
-        "lens": {
-          "properties": {
-            "expression": {
-              "index": false,
-              "type": "keyword"
-            },
-            "state": {
-              "type": "flattened"
-            },
-            "title": {
-              "type": "text"
-            },
-            "visualizationType": {
-              "type": "keyword"
-            }
-          }
-        },
-        "map": {
-          "properties": {
-            "bounds": {
-              "dynamic": false,
-              "properties": {}
-            },
-            "description": {
-              "type": "text"
-            },
-            "layerListJSON": {
-              "type": "text"
-            },
-            "mapStateJSON": {
-              "type": "text"
-            },
-            "title": {
-              "type": "text"
-            },
-            "uiStateJSON": {
-              "type": "text"
-            },
-            "version": {
-              "type": "integer"
-            }
-          }
-        },
-        "maps-telemetry": {
-          "properties": {
-            "attributesPerMap": {
-              "properties": {
-                "dataSourcesCount": {
-                  "properties": {
-                    "avg": {
-                      "type": "long"
-                    },
-                    "max": {
-                      "type": "long"
-                    },
-                    "min": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "emsVectorLayersCount": {
-                  "dynamic": "true",
-                  "type": "object"
-                },
-                "layerTypesCount": {
-                  "dynamic": "true",
-                  "type": "object"
-                },
-                "layersCount": {
-                  "properties": {
-                    "avg": {
-                      "type": "long"
-                    },
-                    "max": {
-                      "type": "long"
-                    },
-                    "min": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "mapsTotalCount": {
-              "type": "long"
-            },
-            "timeCaptured": {
-              "type": "date"
-            }
-          }
-        },
-        "metrics-explorer-view": {
-          "properties": {
-            "chartOptions": {
-              "properties": {
-                "stack": {
-                  "type": "boolean"
-                },
-                "type": {
-                  "type": "keyword"
-                },
-                "yAxisMode": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "currentTimerange": {
-              "properties": {
-                "from": {
-                  "type": "keyword"
-                },
-                "interval": {
-                  "type": "keyword"
-                },
-                "to": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "name": {
-              "type": "keyword"
-            },
-            "options": {
-              "properties": {
-                "aggregation": {
-                  "type": "keyword"
-                },
-                "filterQuery": {
-                  "type": "keyword"
-                },
-                "groupBy": {
-                  "type": "keyword"
-                },
-                "limit": {
-                  "type": "integer"
-                },
-                "metrics": {
-                  "properties": {
-                    "aggregation": {
-                      "type": "keyword"
-                    },
-                    "color": {
-                      "type": "keyword"
-                    },
-                    "field": {
-                      "type": "keyword"
-                    },
-                    "label": {
-                      "type": "keyword"
-                    }
-                  },
-                  "type": "nested"
-                }
-              }
-            }
-          }
-        },
-        "migrationVersion": {
-          "dynamic": "true",
-          "properties": {
-            "index-pattern": {
-              "fields": {
-                "keyword": {
-                  "ignore_above": 256,
-                  "type": "keyword"
-                }
-              },
-              "type": "text"
-            },
-            "space": {
-              "fields": {
-                "keyword": {
-                  "ignore_above": 256,
-                  "type": "keyword"
-                }
-              },
-              "type": "text"
-            },
-            "visualization": {
-              "fields": {
-                "keyword": {
-                  "ignore_above": 256,
-                  "type": "keyword"
-                }
-              },
-              "type": "text"
-            }
-          }
-        },
-        "ml-telemetry": {
-          "properties": {
-            "file_data_visualizer": {
-              "properties": {
-                "index_creation_count": {
-                  "type": "long"
-                }
-              }
-            }
-          }
-        },
-        "namespace": {
-          "type": "keyword"
-        },
-        "query": {
-          "properties": {
-            "description": {
-              "type": "text"
-            },
-            "filters": {
-              "enabled": false,
-              "type": "object"
-            },
-            "query": {
-              "properties": {
-                "language": {
-                  "type": "keyword"
-                },
-                "query": {
-                  "index": false,
-                  "type": "keyword"
-                }
-              }
-            },
-            "timefilter": {
-              "enabled": false,
-              "type": "object"
-            },
-            "title": {
-              "type": "text"
-            }
-          }
-        },
-        "references": {
-          "properties": {
-            "id": {
-              "type": "keyword"
-            },
-            "name": {
-              "type": "keyword"
-            },
-            "type": {
-              "type": "keyword"
-            }
-          },
-          "type": "nested"
-        },
-        "sample-data-telemetry": {
-          "properties": {
-            "installCount": {
-              "type": "long"
-            },
-            "unInstallCount": {
-              "type": "long"
-            }
-          }
-        },
-        "search": {
-          "properties": {
-            "columns": {
-              "type": "keyword"
-            },
-            "description": {
-              "type": "text"
-            },
-            "hits": {
-              "type": "integer"
-            },
-            "kibanaSavedObjectMeta": {
-              "properties": {
-                "searchSourceJSON": {
-                  "type": "text"
-                }
-              }
-            },
-            "sort": {
-              "type": "keyword"
-            },
-            "title": {
-              "type": "text"
-            },
-            "version": {
-              "type": "integer"
-            }
-          }
-        },
-        "server": {
-          "properties": {
-            "uuid": {
-              "type": "keyword"
-            }
-          }
-        },
-        "siem-ui-timeline": {
-          "properties": {
-            "columns": {
-              "properties": {
-                "aggregatable": {
-                  "type": "boolean"
-                },
-                "category": {
-                  "type": "keyword"
-                },
-                "columnHeaderType": {
-                  "type": "keyword"
-                },
-                "description": {
-                  "type": "text"
-                },
-                "example": {
-                  "type": "text"
-                },
-                "id": {
-                  "type": "keyword"
-                },
-                "indexes": {
-                  "type": "keyword"
-                },
-                "name": {
-                  "type": "text"
-                },
-                "placeholder": {
-                  "type": "text"
-                },
-                "searchable": {
-                  "type": "boolean"
-                },
-                "type": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "created": {
-              "type": "date"
-            },
-            "createdBy": {
-              "type": "text"
-            },
-            "dataProviders": {
-              "properties": {
-                "and": {
-                  "properties": {
-                    "enabled": {
-                      "type": "boolean"
-                    },
-                    "excluded": {
-                      "type": "boolean"
-                    },
-                    "id": {
-                      "type": "keyword"
-                    },
-                    "kqlQuery": {
-                      "type": "text"
-                    },
-                    "name": {
-                      "type": "text"
-                    },
-                    "queryMatch": {
-                      "properties": {
-                        "displayField": {
-                          "type": "text"
-                        },
-                        "displayValue": {
-                          "type": "text"
-                        },
-                        "field": {
-                          "type": "text"
-                        },
-                        "operator": {
-                          "type": "text"
-                        },
-                        "value": {
-                          "type": "text"
-                        }
-                      }
-                    }
-                  }
-                },
-                "enabled": {
-                  "type": "boolean"
-                },
-                "excluded": {
-                  "type": "boolean"
-                },
-                "id": {
-                  "type": "keyword"
-                },
-                "kqlQuery": {
-                  "type": "text"
-                },
-                "name": {
-                  "type": "text"
-                },
-                "queryMatch": {
-                  "properties": {
-                    "displayField": {
-                      "type": "text"
-                    },
-                    "displayValue": {
-                      "type": "text"
-                    },
-                    "field": {
-                      "type": "text"
-                    },
-                    "operator": {
-                      "type": "text"
-                    },
-                    "value": {
-                      "type": "text"
-                    }
-                  }
-                }
-              }
-            },
-            "dateRange": {
-              "properties": {
-                "end": {
-                  "type": "date"
-                },
-                "start": {
-                  "type": "date"
-                }
-              }
-            },
-            "description": {
-              "type": "text"
-            },
-            "favorite": {
-              "properties": {
-                "favoriteDate": {
-                  "type": "date"
-                },
-                "fullName": {
-                  "type": "text"
-                },
-                "keySearch": {
-                  "type": "text"
-                },
-                "userName": {
-                  "type": "text"
-                }
-              }
-            },
-            "kqlMode": {
-              "type": "keyword"
-            },
-            "kqlQuery": {
-              "properties": {
-                "filterQuery": {
-                  "properties": {
-                    "kuery": {
-                      "properties": {
-                        "expression": {
-                          "type": "text"
-                        },
-                        "kind": {
-                          "type": "keyword"
-                        }
-                      }
-                    },
-                    "serializedQuery": {
-                      "type": "text"
-                    }
-                  }
-                }
-              }
-            },
-            "sort": {
-              "properties": {
-                "columnId": {
-                  "type": "keyword"
-                },
-                "sortDirection": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "title": {
-              "type": "text"
-            },
-            "updated": {
-              "type": "date"
-            },
-            "updatedBy": {
-              "type": "text"
-            }
-          }
-        },
-        "siem-ui-timeline-note": {
-          "properties": {
-            "created": {
-              "type": "date"
-            },
-            "createdBy": {
-              "type": "text"
-            },
-            "eventId": {
-              "type": "keyword"
-            },
-            "note": {
-              "type": "text"
-            },
-            "timelineId": {
-              "type": "keyword"
-            },
-            "updated": {
-              "type": "date"
-            },
-            "updatedBy": {
-              "type": "text"
-            }
-          }
-        },
-        "siem-ui-timeline-pinned-event": {
-          "properties": {
-            "created": {
-              "type": "date"
-            },
-            "createdBy": {
-              "type": "text"
-            },
-            "eventId": {
-              "type": "keyword"
-            },
-            "timelineId": {
-              "type": "keyword"
-            },
-            "updated": {
-              "type": "date"
-            },
-            "updatedBy": {
-              "type": "text"
-            }
-          }
-        },
-        "space": {
-          "properties": {
-            "_reserved": {
-              "type": "boolean"
-            },
-            "color": {
-              "type": "keyword"
-            },
-            "description": {
-              "type": "text"
-            },
-            "disabledFeatures": {
-              "type": "keyword"
-            },
-            "imageUrl": {
-              "index": false,
-              "type": "text"
-            },
-            "initials": {
-              "type": "keyword"
-            },
-            "name": {
-              "fields": {
-                "keyword": {
-                  "ignore_above": 2048,
-                  "type": "keyword"
-                }
-              },
-              "type": "text"
-            }
-          }
-        },
-        "spaceId": {
-          "type": "keyword"
-        },
-        "telemetry": {
-          "properties": {
-            "enabled": {
-              "type": "boolean"
-            }
-          }
-        },
-        "type": {
-          "type": "keyword"
-        },
-        "ui-metric": {
-          "properties": {
-            "count": {
-              "type": "integer"
-            }
-          }
-        },
-        "updated_at": {
-          "type": "date"
-        },
-        "upgrade-assistant-reindex-operation": {
-          "dynamic": "true",
-          "properties": {
-            "indexName": {
-              "type": "keyword"
-            },
-            "status": {
-              "type": "integer"
-            }
-          }
-        },
-        "upgrade-assistant-telemetry": {
-          "properties": {
-            "features": {
-              "properties": {
-                "deprecation_logging": {
-                  "properties": {
-                    "enabled": {
-                      "null_value": true,
-                      "type": "boolean"
-                    }
-                  }
-                }
-              }
-            },
-            "ui_open": {
-              "properties": {
-                "cluster": {
-                  "null_value": 0,
-                  "type": "long"
-                },
-                "indices": {
-                  "null_value": 0,
-                  "type": "long"
-                },
-                "overview": {
-                  "null_value": 0,
-                  "type": "long"
-                }
-              }
-            },
-            "ui_reindex": {
-              "properties": {
-                "close": {
-                  "null_value": 0,
-                  "type": "long"
-                },
-                "open": {
-                  "null_value": 0,
-                  "type": "long"
-                },
-                "start": {
-                  "null_value": 0,
-                  "type": "long"
-                },
-                "stop": {
-                  "null_value": 0,
-                  "type": "long"
-                }
-              }
-            }
-          }
-        },
-        "url": {
-          "properties": {
-            "accessCount": {
-              "type": "long"
-            },
-            "accessDate": {
-              "type": "date"
-            },
-            "createDate": {
-              "type": "date"
-            },
-            "url": {
-              "fields": {
-                "keyword": {
-                  "ignore_above": 2048,
-                  "type": "keyword"
-                }
-              },
-              "type": "text"
-            }
-          }
-        },
-        "visualization": {
-          "properties": {
-            "description": {
-              "type": "text"
-            },
-            "kibanaSavedObjectMeta": {
-              "properties": {
-                "searchSourceJSON": {
-                  "type": "text"
-                }
-              }
-            },
-            "savedSearchRefName": {
-              "type": "keyword"
-            },
-            "title": {
-              "type": "text"
-            },
-            "uiStateJSON": {
-              "type": "text"
-            },
-            "version": {
-              "type": "integer"
-            },
-            "visState": {
-              "type": "text"
-            }
-          }
-        }
-      }
-    },
-    "settings": {
-      "index": {
-        "auto_expand_replicas": "0-1",
-        "number_of_replicas": "0",
-        "number_of_shards": "1"
-      }
-    }
-  }
-}
diff --git a/x-pack/test/functional/fixtures/kbn_archiver/lens/lens_basic.json b/x-pack/test/functional/fixtures/kbn_archiver/lens/lens_basic.json
new file mode 100644
index 0000000000000..8f77950407841
--- /dev/null
+++ b/x-pack/test/functional/fixtures/kbn_archiver/lens/lens_basic.json
@@ -0,0 +1,433 @@
+{
+  "attributes": {
+    "fields": "[{\"name\":\"@message\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"@message.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"@tags\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"@tags.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"@timestamp\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_score\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_source\",\"type\":\"_source\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"agent\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"agent.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"clientip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"extension\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"extension.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.coordinates\",\"type\":\"geo_point\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.dest\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.src\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.srcdest\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"headings\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"headings.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"host.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"index.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"links\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"links.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"machine.os\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"machine.os.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"machine.ram\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"memory\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"meta.char\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"meta.related\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"meta.user.firstname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"meta.user.lastname\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"phpmemory\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"referer\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.article:modified_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.article:published_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.article:section\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.article:section.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.article:tag\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.article:tag.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:description\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:description.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:image\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:image.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:image:height\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:image:height.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:image:width\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:image:width.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:site_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:site_name.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:title\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:title.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:type.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.twitter:card\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:card.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.twitter:description\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:description.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.twitter:image\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:image.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.twitter:site\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:site.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.twitter:title\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:title.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"request\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"request.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"response\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"response.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"spaces\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"spaces.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"utc_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"xss\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"xss.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true}]",
+    "timeFieldName": "@timestamp",
+    "title": "logstash-*"
+  },
+  "coreMigrationVersion": "8.0.0",
+  "id": "logstash-*",
+  "migrationVersion": {
+    "index-pattern": "7.11.0"
+  },
+  "references": [],
+  "type": "index-pattern",
+  "updated_at": "2018-12-21T00:43:07.096Z",
+  "version": "WzEzLDJd"
+}
+
+{
+  "attributes": {
+    "state": {
+      "datasourceStates": {
+        "indexpattern": {
+          "layers": {
+            "c61a8afb-a185-4fae-a064-fb3846f6c451": {
+              "columnOrder": [
+                "2cd09808-3915-49f4-b3b0-82767eba23f7"
+              ],
+              "columns": {
+                "2cd09808-3915-49f4-b3b0-82767eba23f7": {
+                  "dataType": "number",
+                  "isBucketed": false,
+                  "label": "Maximum of bytes",
+                  "operationType": "max",
+                  "scale": "ratio",
+                  "sourceField": "bytes"
+                }
+              }
+            }
+          }
+        }
+      },
+      "filters": [],
+      "query": {
+        "language": "kuery",
+        "query": ""
+      },
+      "visualization": {
+        "accessor": "2cd09808-3915-49f4-b3b0-82767eba23f7",
+        "isHorizontal": false,
+        "layerId": "c61a8afb-a185-4fae-a064-fb3846f6c451",
+        "layers": [
+          {
+            "accessors": [
+              "d3e62a7a-c259-4fff-a2fc-eebf20b7008a",
+              "26ef70a9-c837-444c-886e-6bd905ee7335"
+            ],
+            "layerId": "c61a8afb-a185-4fae-a064-fb3846f6c451",
+            "seriesType": "area",
+            "splitAccessor": "54cd64ed-2a44-4591-af84-b2624504569a",
+            "xAccessor": "d6e40cea-6299-43b4-9c9d-b4ee305a2ce8"
+          }
+        ],
+        "legend": {
+          "isVisible": true,
+          "position": "right"
+        },
+        "preferredSeriesType": "area"
+      }
+    },
+    "title": "Artistpreviouslyknownaslens",
+    "visualizationType": "lnsMetric"
+  },
+  "coreMigrationVersion": "8.0.0",
+  "id": "76fc4200-cf44-11e9-b933-fd84270f3ac1",
+  "migrationVersion": {
+    "lens": "7.14.0"
+  },
+  "references": [
+    {
+      "id": "logstash-*",
+      "name": "indexpattern-datasource-current-indexpattern",
+      "type": "index-pattern"
+    },
+    {
+      "id": "logstash-*",
+      "name": "indexpattern-datasource-layer-c61a8afb-a185-4fae-a064-fb3846f6c451",
+      "type": "index-pattern"
+    }
+  ],
+  "type": "lens",
+  "updated_at": "2019-10-16T00:28:08.979Z",
+  "version": "WzIwLDJd"
+}
+
+{
+  "attributes": {
+    "state": {
+      "datasourceStates": {
+        "indexpattern": {
+          "layers": {
+            "4ba1a1be-6e67-434b-b3a0-f30db8ea5395": {
+              "columnOrder": [
+                "7a5d833b-ca6f-4e48-a924-d2a28d365dc3",
+                "3cf18f28-3495-4d45-a55f-d97f88022099",
+                "3dc0bd55-2087-4e60-aea2-f9910714f7db"
+              ],
+              "columns": {
+                "3cf18f28-3495-4d45-a55f-d97f88022099": {
+                  "dataType": "date",
+                  "isBucketed": true,
+                  "label": "@timestamp",
+                  "operationType": "date_histogram",
+                  "params": {
+                    "interval": "auto"
+                  },
+                  "scale": "interval",
+                  "sourceField": "@timestamp"
+                },
+                "3dc0bd55-2087-4e60-aea2-f9910714f7db": {
+                  "dataType": "number",
+                  "isBucketed": false,
+                  "label": "Average of bytes",
+                  "operationType": "average",
+                  "scale": "ratio",
+                  "sourceField": "bytes"
+                },
+                "7a5d833b-ca6f-4e48-a924-d2a28d365dc3": {
+                  "dataType": "ip",
+                  "isBucketed": true,
+                  "label": "Top values of ip",
+                  "operationType": "terms",
+                  "params": {
+                    "orderBy": {
+                      "columnId": "3dc0bd55-2087-4e60-aea2-f9910714f7db",
+                      "type": "column"
+                    },
+                    "orderDirection": "desc",
+                    "size": 3
+                  },
+                  "scale": "ordinal",
+                  "sourceField": "ip"
+                }
+              }
+            }
+          }
+        }
+      },
+      "filters": [],
+      "query": {
+        "language": "kuery",
+        "query": ""
+      },
+      "visualization": {
+        "layers": [
+          {
+            "accessors": [
+              "3dc0bd55-2087-4e60-aea2-f9910714f7db"
+            ],
+            "layerId": "4ba1a1be-6e67-434b-b3a0-f30db8ea5395",
+            "seriesType": "bar_stacked",
+            "splitAccessor": "7a5d833b-ca6f-4e48-a924-d2a28d365dc3",
+            "xAccessor": "3cf18f28-3495-4d45-a55f-d97f88022099"
+          }
+        ],
+        "legend": {
+          "isVisible": true,
+          "position": "right"
+        },
+        "preferredSeriesType": "bar_stacked"
+      }
+    },
+    "title": "lnsXYvis",
+    "visualizationType": "lnsXY"
+  },
+  "coreMigrationVersion": "8.0.0",
+  "id": "76fc4200-cf44-11e9-b933-fd84270f3ac2",
+  "migrationVersion": {
+    "lens": "7.14.0"
+  },
+  "references": [
+    {
+      "id": "logstash-*",
+      "name": "indexpattern-datasource-current-indexpattern",
+      "type": "index-pattern"
+    },
+    {
+      "id": "logstash-*",
+      "name": "indexpattern-datasource-layer-4ba1a1be-6e67-434b-b3a0-f30db8ea5395",
+      "type": "index-pattern"
+    }
+  ],
+  "type": "lens",
+  "updated_at": "2019-10-16T00:28:08.979Z",
+  "version": "WzIyLDJd"
+}
+
+{
+  "attributes": {
+    "state": {
+      "datasourceStates": {
+        "indexpattern": {
+          "layers": {
+            "4ba1a1be-6e67-434b-b3a0-f30db8ea5395": {
+              "columnOrder": [
+                "bafe3009-1776-4227-a0fe-b0d6ccbb4961",
+                "c1ebe4c9-f283-486c-ae95-6b3e99e83bd8",
+                "3dc0bd55-2087-4e60-aea2-f9910714f7db"
+              ],
+              "columns": {
+                "3dc0bd55-2087-4e60-aea2-f9910714f7db": {
+                  "dataType": "number",
+                  "isBucketed": false,
+                  "label": "Average of bytes",
+                  "operationType": "average",
+                  "scale": "ratio",
+                  "sourceField": "bytes"
+                },
+                "5bd1c078-e1dd-465b-8d25-7a6404befa88": {
+                  "dataType": "date",
+                  "isBucketed": true,
+                  "label": "@timestamp",
+                  "operationType": "date_histogram",
+                  "params": {
+                    "interval": "auto"
+                  },
+                  "scale": "interval",
+                  "sourceField": "@timestamp"
+                },
+                "65340cf3-8402-4494-96f2-293701c59571": {
+                  "dataType": "number",
+                  "isBucketed": true,
+                  "label": "Top values of bytes",
+                  "operationType": "terms",
+                  "params": {
+                    "orderBy": {
+                      "columnId": "3dc0bd55-2087-4e60-aea2-f9910714f7db",
+                      "type": "column"
+                    },
+                    "orderDirection": "desc",
+                    "size": 3
+                  },
+                  "scale": "ordinal",
+                  "sourceField": "bytes"
+                },
+                "87554e1d-3dbf-4c1c-a358-4c9d40424cfa": {
+                  "dataType": "string",
+                  "isBucketed": true,
+                  "label": "Top values of type",
+                  "operationType": "terms",
+                  "params": {
+                    "orderBy": {
+                      "columnId": "3dc0bd55-2087-4e60-aea2-f9910714f7db",
+                      "type": "column"
+                    },
+                    "orderDirection": "desc",
+                    "size": 3
+                  },
+                  "scale": "ordinal",
+                  "sourceField": "type"
+                },
+                "bafe3009-1776-4227-a0fe-b0d6ccbb4961": {
+                  "dataType": "string",
+                  "isBucketed": true,
+                  "label": "Top values of geo.dest",
+                  "operationType": "terms",
+                  "params": {
+                    "orderBy": {
+                      "columnId": "3dc0bd55-2087-4e60-aea2-f9910714f7db",
+                      "type": "column"
+                    },
+                    "orderDirection": "desc",
+                    "size": 7
+                  },
+                  "scale": "ordinal",
+                  "sourceField": "geo.dest"
+                },
+                "c1ebe4c9-f283-486c-ae95-6b3e99e83bd8": {
+                  "dataType": "string",
+                  "isBucketed": true,
+                  "label": "Top values of geo.src",
+                  "operationType": "terms",
+                  "params": {
+                    "orderBy": {
+                      "columnId": "3dc0bd55-2087-4e60-aea2-f9910714f7db",
+                      "type": "column"
+                    },
+                    "orderDirection": "desc",
+                    "size": 3
+                  },
+                  "scale": "ordinal",
+                  "sourceField": "geo.src"
+                }
+              }
+            }
+          }
+        }
+      },
+      "filters": [],
+      "query": {
+        "language": "kuery",
+        "query": ""
+      },
+      "visualization": {
+        "layers": [
+          {
+            "categoryDisplay": "default",
+            "groups": [
+              "bafe3009-1776-4227-a0fe-b0d6ccbb4961",
+              "c1ebe4c9-f283-486c-ae95-6b3e99e83bd8"
+            ],
+            "layerId": "4ba1a1be-6e67-434b-b3a0-f30db8ea5395",
+            "legendDisplay": "default",
+            "metric": "3dc0bd55-2087-4e60-aea2-f9910714f7db",
+            "nestedLegend": false,
+            "numberDisplay": "percent"
+          }
+        ],
+        "shape": "pie"
+      }
+    },
+    "title": "lnsPieVis",
+    "visualizationType": "lnsPie"
+  },
+  "coreMigrationVersion": "8.0.0",
+  "id": "9536bed0-d57e-11ea-b169-e3a222a76b9c",
+  "migrationVersion": {
+    "lens": "7.14.0"
+  },
+  "references": [
+    {
+      "id": "logstash-*",
+      "name": "indexpattern-datasource-current-indexpattern",
+      "type": "index-pattern"
+    },
+    {
+      "id": "logstash-*",
+      "name": "indexpattern-datasource-layer-4ba1a1be-6e67-434b-b3a0-f30db8ea5395",
+      "type": "index-pattern"
+    }
+  ],
+  "type": "lens",
+  "updated_at": "2020-08-03T11:43:43.421Z",
+  "version": "WzIxLDJd"
+}
+
+{
+  "attributes": {
+    "description": "",
+    "kibanaSavedObjectMeta": {
+      "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}"
+    },
+    "title": "A Pie",
+    "uiStateJSON": "{}",
+    "version": 1,
+    "visState": "{\"title\":\"A Pie\",\"type\":\"pie\",\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100},\"dimensions\":{\"metric\":{\"accessor\":0,\"format\":{\"id\":\"number\"},\"params\":{},\"aggType\":\"count\"}},\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"geo.src\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\"}}]}"
+  },
+  "coreMigrationVersion": "8.0.0",
+  "id": "i-exist",
+  "migrationVersion": {
+    "visualization": "7.14.0"
+  },
+  "references": [
+    {
+      "id": "logstash-*",
+      "name": "kibanaSavedObjectMeta.searchSourceJSON.index",
+      "type": "index-pattern"
+    }
+  ],
+  "type": "visualization",
+  "updated_at": "2019-01-22T19:32:31.206Z",
+  "version": "WzE2LDJd"
+}
+
+{
+  "attributes": {
+    "fields": "[{\"name\":\"@message\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"@message.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"@tags\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"@tags.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"@timestamp\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_score\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_source\",\"type\":\"_source\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"agent\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"agent.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"clientip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"extension\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"extension.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.coordinates\",\"type\":\"geo_point\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.dest\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.src\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.srcdest\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"headings\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"headings.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"host.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"index.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"links\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"links.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"machine.os\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"machine.os.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"machine.ram\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"memory\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"meta.char\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"meta.related\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"meta.user.firstname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"meta.user.lastname\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"phpmemory\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"referer\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.article:modified_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.article:published_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.article:section\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.article:section.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.article:tag\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.article:tag.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:description\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:description.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:image\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:image.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:image:height\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:image:height.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:image:width\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:image:width.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:site_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:site_name.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:title\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:title.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:type.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.og:url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.twitter:card\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:card.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.twitter:description\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:description.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.twitter:image\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:image.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.twitter:site\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:site.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.twitter:title\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:title.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"request\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"request.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"response\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"response.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"spaces\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"spaces.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"utc_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"xss\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"xss.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true}]",
+    "timeFieldName": "@timestamp",
+    "title": "log*"
+  },
+  "coreMigrationVersion": "8.0.0",
+  "id": "log*",
+  "migrationVersion": {
+    "index-pattern": "7.11.0"
+  },
+  "references": [],
+  "type": "index-pattern",
+  "updated_at": "2018-12-21T00:43:07.096Z",
+  "version": "WzE0LDJd"
+}
+
+{
+  "attributes": {
+    "description": "Ok responses for jpg files",
+    "filters": [
+      {
+        "$state": {
+          "store": "appState"
+        },
+        "meta": {
+          "alias": null,
+          "disabled": false,
+          "index": "b15b1d40-a8bb-11e9-98cf-2bb06ef63e0b",
+          "key": "extension.raw",
+          "negate": false,
+          "params": {
+            "query": "jpg"
+          },
+          "type": "phrase",
+          "value": "jpg"
+        },
+        "query": {
+          "match": {
+            "extension.raw": {
+              "query": "jpg",
+              "type": "phrase"
+            }
+          }
+        }
+      }
+    ],
+    "query": {
+      "language": "kuery",
+      "query": "response:200"
+    },
+    "title": "OKJpgs"
+  },
+  "coreMigrationVersion": "8.0.0",
+  "id": "okjpgs",
+  "references": [],
+  "type": "query",
+  "updated_at": "2019-07-17T17:54:26.378Z",
+  "version": "WzE4LDJd"
+}
\ No newline at end of file
diff --git a/x-pack/test/functional/page_objects/api_keys_page.ts b/x-pack/test/functional/page_objects/api_keys_page.ts
index 99c2aa01a4eda..9349eaa4bda0c 100644
--- a/x-pack/test/functional/page_objects/api_keys_page.ts
+++ b/x-pack/test/functional/page_objects/api_keys_page.ts
@@ -9,6 +9,7 @@ import { FtrProviderContext } from '../ftr_provider_context';
 
 export function ApiKeysPageProvider({ getService }: FtrProviderContext) {
   const testSubjects = getService('testSubjects');
+  const find = getService('find');
 
   return {
     async noAPIKeysHeading() {
@@ -26,5 +27,70 @@ export function ApiKeysPageProvider({ getService }: FtrProviderContext) {
     async apiKeysPermissionDeniedMessage() {
       return await testSubjects.getVisibleText('apiKeysPermissionDeniedMessage');
     },
+
+    async clickOnPromptCreateApiKey() {
+      return await testSubjects.click('apiKeysCreatePromptButton');
+    },
+
+    async clickOnTableCreateApiKey() {
+      return await testSubjects.click('apiKeysCreateTableButton');
+    },
+
+    async setApiKeyName(apiKeyName: string) {
+      return await testSubjects.setValue('apiKeyNameInput', apiKeyName);
+    },
+
+    async setApiKeyCustomExpiration(expirationTime: string) {
+      return await testSubjects.setValue('apiKeyCustomExpirationInput', expirationTime);
+    },
+
+    async submitOnCreateApiKey() {
+      return await testSubjects.click('formFlyoutSubmitButton');
+    },
+
+    async isApiKeyModalExists() {
+      return await find.existsByCssSelector('[role="dialog"]');
+    },
+
+    async getNewApiKeyCreation() {
+      const euiCallOutHeader = await find.byCssSelector('.euiCallOutHeader__title');
+      return euiCallOutHeader.getVisibleText();
+    },
+
+    async toggleCustomExpiration() {
+      return await testSubjects.click('apiKeyCustomExpirationSwitch');
+    },
+
+    async getErrorCallOutText() {
+      const alertElem = await find.byCssSelector('[role="dialog"] [role="alert"] .euiText');
+      return await alertElem.getVisibleText();
+    },
+
+    async getApiKeysFirstPromptTitle() {
+      const titlePromptElem = await find.byCssSelector('.euiEmptyPrompt .euiTitle');
+      return await titlePromptElem.getVisibleText();
+    },
+
+    async deleteAllApiKeyOneByOne() {
+      const hasApiKeysToDelete = await testSubjects.exists('apiKeysTableDeleteAction');
+      if (hasApiKeysToDelete) {
+        const apiKeysToDelete = await testSubjects.findAll('apiKeysTableDeleteAction');
+        for (const element of apiKeysToDelete) {
+          await element.click();
+          await testSubjects.click('confirmModalConfirmButton');
+        }
+      }
+    },
+
+    async bulkDeleteApiKeys() {
+      const hasApiKeysToDelete = await testSubjects.exists('checkboxSelectAll', {
+        allowHidden: true,
+      });
+      if (hasApiKeysToDelete) {
+        await testSubjects.click('checkboxSelectAll');
+        await testSubjects.click('bulkInvalidateActionButton');
+        await testSubjects.click('confirmModalConfirmButton');
+      }
+    },
   };
 }
diff --git a/x-pack/test/functional/page_objects/lens_page.ts b/x-pack/test/functional/page_objects/lens_page.ts
index 790ac3ede496f..266aa4955b6e8 100644
--- a/x-pack/test/functional/page_objects/lens_page.ts
+++ b/x-pack/test/functional/page_objects/lens_page.ts
@@ -797,6 +797,7 @@ export function LensPageProvider({ getService, getPageObjects }: FtrProviderCont
     },
 
     async getDatatableHeader(index = 0) {
+      log.debug(`All headers ${await testSubjects.getVisibleText('dataGridHeader')}`);
       return find.byCssSelector(
         `[data-test-subj="lnsDataTable"] [data-test-subj="dataGridHeader"] [role=columnheader]:nth-child(${
           index + 1
@@ -897,12 +898,18 @@ export function LensPageProvider({ getService, getPageObjects }: FtrProviderCont
       );
     },
 
-    async toggleColumnVisibility(dimension: string) {
+    async toggleColumnVisibility(dimension: string, no = 1) {
       await this.openDimensionEditor(dimension);
       const id = 'lns-table-column-hidden';
+      await PageObjects.common.sleep(500);
       const isChecked = await testSubjects.isEuiSwitchChecked(id);
+      log.debug(`switch status before the toggle = ${isChecked}`);
       await testSubjects.setEuiSwitch(id, isChecked ? 'uncheck' : 'check');
+      await PageObjects.common.sleep(500);
+      const isChecked2 = await testSubjects.isEuiSwitchChecked(id);
+      log.debug(`switch status after the toggle = ${isChecked2}`);
       await this.closeDimensionEditor();
+      await PageObjects.common.sleep(500);
       await PageObjects.header.waitUntilLoadingHasFinished();
     },
 
diff --git a/x-pack/test/functional/services/ml/dashboard_embeddables.ts b/x-pack/test/functional/services/ml/dashboard_embeddables.ts
index 0dc5cc8fae2d5..5c55a16698cb6 100644
--- a/x-pack/test/functional/services/ml/dashboard_embeddables.ts
+++ b/x-pack/test/functional/services/ml/dashboard_embeddables.ts
@@ -93,13 +93,21 @@ export function MachineLearningDashboardEmbeddablesProvider(
       });
     },
 
-    async openJobSelectionFlyout() {
+    async assertAnomalySwimlaneExists() {
+      await retry.tryForTime(60 * 1000, async () => {
+        await testSubjects.existOrFail(`mlAnomalySwimlaneEmbeddableWrapper`);
+      });
+    },
+
+    async openAnomalyJobSelectionFlyout(
+      mlEmbeddableType: 'ml_anomaly_swimlane' | 'ml_anomaly_charts'
+    ) {
       await retry.tryForTime(60 * 1000, async () => {
         await dashboardAddPanel.clickEditorMenuButton();
         await testSubjects.existOrFail('dashboardEditorContextMenu', { timeout: 2000 });
 
         await dashboardAddPanel.clickEmbeddableFactoryGroupButton('ml');
-        await dashboardAddPanel.clickAddNewEmbeddableLink('ml_anomaly_charts');
+        await dashboardAddPanel.clickAddNewEmbeddableLink(mlEmbeddableType);
 
         await mlDashboardJobSelectionTable.assertJobSelectionTableExists();
       });
diff --git a/x-pack/test/functional/services/ml/test_resources.ts b/x-pack/test/functional/services/ml/test_resources.ts
index 65a892d124edb..071db63125a55 100644
--- a/x-pack/test/functional/services/ml/test_resources.ts
+++ b/x-pack/test/functional/services/ml/test_resources.ts
@@ -128,6 +128,20 @@ export function MachineLearningTestResourcesProvider({ getService }: FtrProvider
       return createResponse.id;
     },
 
+    async createBulkSavedObjects(body: object[]): Promise<string> {
+      log.debug(`Creating bulk saved objects'`);
+
+      const createResponse = await supertest
+        .post(`/api/saved_objects/_bulk_create`)
+        .set(COMMON_REQUEST_HEADERS)
+        .send(body)
+        .expect(200)
+        .then((res: any) => res.body);
+
+      log.debug(` > Created bulk saved objects'`);
+      return createResponse;
+    },
+
     async createIndexPatternIfNeeded(title: string, timeFieldName?: string): Promise<string> {
       const indexPatternId = await this.getIndexPatternId(title);
       if (indexPatternId !== undefined) {
diff --git a/x-pack/test/functional_enterprise_search/services/app_search_service.ts b/x-pack/test/functional_enterprise_search/services/app_search_service.ts
index edb3957692f27..6cd3cac9f336b 100644
--- a/x-pack/test/functional_enterprise_search/services/app_search_service.ts
+++ b/x-pack/test/functional_enterprise_search/services/app_search_service.ts
@@ -22,7 +22,7 @@ export interface IUser {
   user: string;
   password: string;
 }
-export { IEngine };
+export type { IEngine };
 
 export class AppSearchService {
   getEnterpriseSearchUser(): IUser {
diff --git a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/alert_create_flyout.ts b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/alert_create_flyout.ts
index fa144bd5bf9f6..51a70026339c9 100644
--- a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/alert_create_flyout.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/alert_create_flyout.ts
@@ -7,6 +7,7 @@
 
 import expect from '@kbn/expect';
 import { asyncForEach } from '@kbn/std';
+import { omit } from 'lodash';
 import { FtrProviderContext } from '../../ftr_provider_context';
 import { generateUniqueKey } from '../../lib/get_test_data';
 
@@ -103,8 +104,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
     await testSubjects.click('test.always-firing-SelectOption');
   }
 
-  // FLAKY https://github.com/elastic/kibana/issues/112749
-  describe.skip('create alert', function () {
+  describe('create alert', function () {
     before(async () => {
       await pageObjects.common.navigateToApp('triggersActions');
       await testSubjects.click('rulesTab');
@@ -154,14 +154,13 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
       expect(toastTitle).to.eql(`Created rule "${alertName}"`);
       await pageObjects.triggersActionsUI.searchAlerts(alertName);
       const searchResultsAfterSave = await pageObjects.triggersActionsUI.getAlertsList();
-      expect(searchResultsAfterSave).to.eql([
-        {
-          name: alertName,
-          tagsText: '',
-          alertType: 'Index threshold',
-          interval: '1m',
-        },
-      ]);
+      const searchResultAfterSave = searchResultsAfterSave[0];
+      expect(omit(searchResultAfterSave, 'duration')).to.eql({
+        name: `${alertName}Index threshold`,
+        tags: '',
+        interval: '1 min',
+      });
+      expect(searchResultAfterSave.duration).to.match(/\d{2}:\d{2}:\d{2}.\d{3}/);
 
       // clean up created alert
       const alertsToDelete = await getAlertsByName(alertName);
@@ -205,14 +204,12 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
       expect(toastTitle).to.eql(`Created rule "${alertName}"`);
       await pageObjects.triggersActionsUI.searchAlerts(alertName);
       const searchResultsAfterSave = await pageObjects.triggersActionsUI.getAlertsList();
-      expect(searchResultsAfterSave).to.eql([
-        {
-          name: alertName,
-          tagsText: '',
-          alertType: 'Always Firing',
-          interval: '1m',
-        },
-      ]);
+      const searchResultAfterSave = searchResultsAfterSave[0];
+      expect(omit(searchResultAfterSave, 'duration')).to.eql({
+        name: `${alertName}Always Firing`,
+        tags: '',
+        interval: '1 min',
+      });
 
       // clean up created alert
       const alertsToDelete = await getAlertsByName(alertName);
@@ -239,14 +236,12 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
       await new Promise((resolve) => setTimeout(resolve, 1000));
       await pageObjects.triggersActionsUI.searchAlerts(alertName);
       const searchResultsAfterSave = await pageObjects.triggersActionsUI.getAlertsList();
-      expect(searchResultsAfterSave).to.eql([
-        {
-          name: alertName,
-          tagsText: '',
-          alertType: 'Always Firing',
-          interval: '1m',
-        },
-      ]);
+      const searchResultAfterSave = searchResultsAfterSave[0];
+      expect(omit(searchResultAfterSave, 'duration')).to.eql({
+        name: `${alertName}Always Firing`,
+        tags: '',
+        interval: '1 min',
+      });
 
       // clean up created alert
       const alertsToDelete = await getAlertsByName(alertName);
@@ -278,6 +273,15 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
       await testSubjects.existOrFail('testQuerySuccess');
       await testSubjects.missingOrFail('testQueryError');
 
+      await testSubjects.click('cancelSaveAlertButton');
+      await testSubjects.existOrFail('confirmAlertCloseModal');
+      await testSubjects.click('confirmAlertCloseModal > confirmModalConfirmButton');
+    });
+
+    it('should show error when es_query is invalid', async () => {
+      const alertName = generateUniqueKey();
+      await defineEsQueryAlert(alertName);
+
       // Invalid query
       await testSubjects.setValue('queryJsonEditor', '{"query":{"foo":{}}}', {
         clearWithKeyboard: true,
diff --git a/x-pack/test/lists_api_integration/security_and_spaces/tests/create_exception_list_items.ts b/x-pack/test/lists_api_integration/security_and_spaces/tests/create_exception_list_items.ts
index cb858a4791b71..7588d37d4b111 100644
--- a/x-pack/test/lists_api_integration/security_and_spaces/tests/create_exception_list_items.ts
+++ b/x-pack/test/lists_api_integration/security_and_spaces/tests/create_exception_list_items.ts
@@ -27,6 +27,7 @@ import { deleteAllExceptions } from '../../utils';
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('create_exception_list_items', () => {
     describe('validation errors', () => {
@@ -46,7 +47,7 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('creating exception list items', () => {
       afterEach(async () => {
-        await deleteAllExceptions(supertest);
+        await deleteAllExceptions(supertest, log);
       });
 
       it('should create a simple exception list item with a list item id', async () => {
diff --git a/x-pack/test/lists_api_integration/security_and_spaces/tests/create_exception_lists.ts b/x-pack/test/lists_api_integration/security_and_spaces/tests/create_exception_lists.ts
index e7f5d96bfb76a..346e5a1269f3a 100644
--- a/x-pack/test/lists_api_integration/security_and_spaces/tests/create_exception_lists.ts
+++ b/x-pack/test/lists_api_integration/security_and_spaces/tests/create_exception_lists.ts
@@ -21,11 +21,12 @@ import { deleteAllExceptions, removeExceptionListServerGeneratedProperties } fro
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('create_exception_lists', () => {
     describe('creating exception lists', () => {
       afterEach(async () => {
-        await deleteAllExceptions(supertest);
+        await deleteAllExceptions(supertest, log);
       });
 
       it('should create a simple exception list', async () => {
diff --git a/x-pack/test/lists_api_integration/security_and_spaces/tests/create_list_items.ts b/x-pack/test/lists_api_integration/security_and_spaces/tests/create_list_items.ts
index b084e423e88ee..29ea19940a480 100644
--- a/x-pack/test/lists_api_integration/security_and_spaces/tests/create_list_items.ts
+++ b/x-pack/test/lists_api_integration/security_and_spaces/tests/create_list_items.ts
@@ -27,6 +27,7 @@ import {
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('create_list_items', () => {
     describe('validation errors', () => {
@@ -46,11 +47,11 @@ export default ({ getService }: FtrProviderContext) => {
 
     describe('creating list items', () => {
       beforeEach(async () => {
-        await createListsIndex(supertest);
+        await createListsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteListsIndex(supertest);
+        await deleteListsIndex(supertest, log);
       });
 
       it('should create a simple list item with a list item id', async () => {
diff --git a/x-pack/test/lists_api_integration/security_and_spaces/tests/create_lists.ts b/x-pack/test/lists_api_integration/security_and_spaces/tests/create_lists.ts
index 599eaaa6bd0a4..fce6863d1adbe 100644
--- a/x-pack/test/lists_api_integration/security_and_spaces/tests/create_lists.ts
+++ b/x-pack/test/lists_api_integration/security_and_spaces/tests/create_lists.ts
@@ -24,15 +24,16 @@ import {
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('create_lists', () => {
     describe('creating lists', () => {
       beforeEach(async () => {
-        await createListsIndex(supertest);
+        await createListsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteListsIndex(supertest);
+        await deleteListsIndex(supertest, log);
       });
 
       it('should create a simple list with a list_id', async () => {
diff --git a/x-pack/test/lists_api_integration/security_and_spaces/tests/delete_exception_list_items.ts b/x-pack/test/lists_api_integration/security_and_spaces/tests/delete_exception_list_items.ts
index acf968c8b78af..7ff4870174300 100644
--- a/x-pack/test/lists_api_integration/security_and_spaces/tests/delete_exception_list_items.ts
+++ b/x-pack/test/lists_api_integration/security_and_spaces/tests/delete_exception_list_items.ts
@@ -22,11 +22,12 @@ import { deleteAllExceptions, removeExceptionListItemServerGeneratedProperties }
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('delete_exception_list_items', () => {
     describe('delete exception list items', () => {
       afterEach(async () => {
-        await deleteAllExceptions(supertest);
+        await deleteAllExceptions(supertest, log);
       });
 
       it('should delete a single exception list item by its item_id', async () => {
diff --git a/x-pack/test/lists_api_integration/security_and_spaces/tests/delete_exception_lists.ts b/x-pack/test/lists_api_integration/security_and_spaces/tests/delete_exception_lists.ts
index 0f8ca96e5383a..f1cc67f3dd430 100644
--- a/x-pack/test/lists_api_integration/security_and_spaces/tests/delete_exception_lists.ts
+++ b/x-pack/test/lists_api_integration/security_and_spaces/tests/delete_exception_lists.ts
@@ -21,11 +21,12 @@ import { deleteAllExceptions, removeExceptionListServerGeneratedProperties } fro
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('delete_exception_lists', () => {
     describe('delete exception lists', () => {
       afterEach(async () => {
-        await deleteAllExceptions(supertest);
+        await deleteAllExceptions(supertest, log);
       });
 
       it('should delete a single exception list by its list_id', async () => {
diff --git a/x-pack/test/lists_api_integration/security_and_spaces/tests/delete_list_items.ts b/x-pack/test/lists_api_integration/security_and_spaces/tests/delete_list_items.ts
index 9de5ec575ef32..57ca9a95ae7b7 100644
--- a/x-pack/test/lists_api_integration/security_and_spaces/tests/delete_list_items.ts
+++ b/x-pack/test/lists_api_integration/security_and_spaces/tests/delete_list_items.ts
@@ -22,15 +22,16 @@ import {
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('delete_list_items', () => {
     describe('deleting list items', () => {
       beforeEach(async () => {
-        await createListsIndex(supertest);
+        await createListsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteListsIndex(supertest);
+        await deleteListsIndex(supertest, log);
       });
 
       it('should delete a single list item with a list item id', async () => {
diff --git a/x-pack/test/lists_api_integration/security_and_spaces/tests/delete_lists.ts b/x-pack/test/lists_api_integration/security_and_spaces/tests/delete_lists.ts
index 3c01d93380736..939291d1e4a5d 100644
--- a/x-pack/test/lists_api_integration/security_and_spaces/tests/delete_lists.ts
+++ b/x-pack/test/lists_api_integration/security_and_spaces/tests/delete_lists.ts
@@ -33,15 +33,16 @@ import { DETECTION_TYPE, LIST_ID } from '../../../../plugins/lists/common/consta
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('delete_lists', () => {
     describe('deleting lists', () => {
       beforeEach(async () => {
-        await createListsIndex(supertest);
+        await createListsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteListsIndex(supertest);
+        await deleteListsIndex(supertest, log);
       });
 
       it('should delete a single list with a list id', async () => {
@@ -116,7 +117,7 @@ export default ({ getService }: FtrProviderContext) => {
 
       describe('deleting lists referenced in exceptions', () => {
         afterEach(async () => {
-          await deleteAllExceptions(supertest);
+          await deleteAllExceptions(supertest, log);
         });
 
         it('should return an error when deleting a list referenced within an exception list item', async () => {
diff --git a/x-pack/test/lists_api_integration/security_and_spaces/tests/export_exception_list.ts b/x-pack/test/lists_api_integration/security_and_spaces/tests/export_exception_list.ts
index c61f4a2b1d02f..54bd8f4d740cc 100644
--- a/x-pack/test/lists_api_integration/security_and_spaces/tests/export_exception_list.ts
+++ b/x-pack/test/lists_api_integration/security_and_spaces/tests/export_exception_list.ts
@@ -22,11 +22,12 @@ import { getCreateExceptionListItemMinimalSchemaMock } from '../../../../plugins
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext): void => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('export_exception_list_route', () => {
     describe('exporting exception lists', () => {
       afterEach(async () => {
-        await deleteAllExceptions(supertest);
+        await deleteAllExceptions(supertest, log);
       });
 
       it('should set the response content types to be expected', async () => {
diff --git a/x-pack/test/lists_api_integration/security_and_spaces/tests/export_list_items.ts b/x-pack/test/lists_api_integration/security_and_spaces/tests/export_list_items.ts
index efcc10518c6c0..ce2663cb96acb 100644
--- a/x-pack/test/lists_api_integration/security_and_spaces/tests/export_list_items.ts
+++ b/x-pack/test/lists_api_integration/security_and_spaces/tests/export_list_items.ts
@@ -18,15 +18,16 @@ import { createListsIndex, deleteListsIndex, binaryToString } from '../../utils'
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext): void => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('export_list_items', () => {
     describe('exporting lists', () => {
       beforeEach(async () => {
-        await createListsIndex(supertest);
+        await createListsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteListsIndex(supertest);
+        await deleteListsIndex(supertest, log);
       });
 
       it('should set the response content types to be expected', async () => {
diff --git a/x-pack/test/lists_api_integration/security_and_spaces/tests/find_exception_list_items.ts b/x-pack/test/lists_api_integration/security_and_spaces/tests/find_exception_list_items.ts
index bdacd674d7519..7cfb94451fbb1 100644
--- a/x-pack/test/lists_api_integration/security_and_spaces/tests/find_exception_list_items.ts
+++ b/x-pack/test/lists_api_integration/security_and_spaces/tests/find_exception_list_items.ts
@@ -18,11 +18,12 @@ import { deleteAllExceptions, removeExceptionListItemServerGeneratedProperties }
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext): void => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('find_exception_list_items', () => {
     describe('find exception list items', () => {
       afterEach(async () => {
-        await deleteAllExceptions(supertest);
+        await deleteAllExceptions(supertest, log);
       });
 
       it('should return an empty find body correctly if no exception list items are loaded', async () => {
diff --git a/x-pack/test/lists_api_integration/security_and_spaces/tests/find_exception_lists.ts b/x-pack/test/lists_api_integration/security_and_spaces/tests/find_exception_lists.ts
index 158d951b2bd68..f5ff59de8eeca 100644
--- a/x-pack/test/lists_api_integration/security_and_spaces/tests/find_exception_lists.ts
+++ b/x-pack/test/lists_api_integration/security_and_spaces/tests/find_exception_lists.ts
@@ -17,11 +17,12 @@ import { deleteAllExceptions, removeExceptionListServerGeneratedProperties } fro
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext): void => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('find_exception_lists', () => {
     describe('find exception lists', () => {
       afterEach(async () => {
-        await deleteAllExceptions(supertest);
+        await deleteAllExceptions(supertest, log);
       });
 
       it('should return an empty find body correctly if no exception lists are loaded', async () => {
diff --git a/x-pack/test/lists_api_integration/security_and_spaces/tests/find_list_items.ts b/x-pack/test/lists_api_integration/security_and_spaces/tests/find_list_items.ts
index 9708abba4e206..20dadcfda6f22 100644
--- a/x-pack/test/lists_api_integration/security_and_spaces/tests/find_list_items.ts
+++ b/x-pack/test/lists_api_integration/security_and_spaces/tests/find_list_items.ts
@@ -23,15 +23,16 @@ import {
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext): void => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('find_list_items', () => {
     describe('find list items', () => {
       beforeEach(async () => {
-        await createListsIndex(supertest);
+        await createListsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteListsIndex(supertest);
+        await deleteListsIndex(supertest, log);
       });
 
       it('should give a validation error if the list_id is not supplied', async () => {
diff --git a/x-pack/test/lists_api_integration/security_and_spaces/tests/find_lists.ts b/x-pack/test/lists_api_integration/security_and_spaces/tests/find_lists.ts
index b6677ec09cfeb..25b8c705633fc 100644
--- a/x-pack/test/lists_api_integration/security_and_spaces/tests/find_lists.ts
+++ b/x-pack/test/lists_api_integration/security_and_spaces/tests/find_lists.ts
@@ -21,15 +21,16 @@ import { getListResponseMockWithoutAutoGeneratedValues } from '../../../../plugi
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext): void => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('find_lists', () => {
     describe('find lists', () => {
       beforeEach(async () => {
-        await createListsIndex(supertest);
+        await createListsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteListsIndex(supertest);
+        await deleteListsIndex(supertest, log);
       });
 
       it('should return an empty find body correctly if no lists are loaded', async () => {
diff --git a/x-pack/test/lists_api_integration/security_and_spaces/tests/import_list_items.ts b/x-pack/test/lists_api_integration/security_and_spaces/tests/import_list_items.ts
index db8b35a805fbc..894dcdfbea02a 100644
--- a/x-pack/test/lists_api_integration/security_and_spaces/tests/import_list_items.ts
+++ b/x-pack/test/lists_api_integration/security_and_spaces/tests/import_list_items.ts
@@ -25,6 +25,7 @@ import { getImportListItemAsBuffer } from '../../../../plugins/lists/common/sche
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext): void => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('import_list_items', () => {
     describe('importing list items without an index', () => {
@@ -46,11 +47,11 @@ export default ({ getService }: FtrProviderContext): void => {
 
     describe('importing lists with an index', () => {
       beforeEach(async () => {
-        await createListsIndex(supertest);
+        await createListsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteListsIndex(supertest);
+        await deleteListsIndex(supertest, log);
       });
 
       it('should set the response content types to be expected when importing two items', async () => {
@@ -88,12 +89,16 @@ export default ({ getService }: FtrProviderContext): void => {
 
         // Although we try to be aggressive with waitFor in the lists code base, there is still not guarantees
         // that we will have the data just yet so we have to do a waitFor here for when it shows up
-        await waitFor(async () => {
-          const { status } = await supertest
-            .get(`${LIST_ITEM_URL}?list_id=list_items.txt&value=127.0.0.1`)
-            .send();
-          return status !== 404;
-        }, `${LIST_ITEM_URL}?list_id=list_items.txt&value=127.0.0.1`);
+        await waitFor(
+          async () => {
+            const { status } = await supertest
+              .get(`${LIST_ITEM_URL}?list_id=list_items.txt&value=127.0.0.1`)
+              .send();
+            return status !== 404;
+          },
+          `${LIST_ITEM_URL}?list_id=list_items.txt&value=127.0.0.1`,
+          log
+        );
         const { body } = await supertest
           .get(`${LIST_ITEM_URL}?list_id=list_items.txt&value=127.0.0.1`)
           .send()
diff --git a/x-pack/test/lists_api_integration/security_and_spaces/tests/read_exception_list_items.ts b/x-pack/test/lists_api_integration/security_and_spaces/tests/read_exception_list_items.ts
index 9345306e0c3e1..e0035a5ecf079 100644
--- a/x-pack/test/lists_api_integration/security_and_spaces/tests/read_exception_list_items.ts
+++ b/x-pack/test/lists_api_integration/security_and_spaces/tests/read_exception_list_items.ts
@@ -22,11 +22,12 @@ import { deleteAllExceptions, removeExceptionListItemServerGeneratedProperties }
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('read_exception_list_items', () => {
     describe('reading exception list items', () => {
       afterEach(async () => {
-        await deleteAllExceptions(supertest);
+        await deleteAllExceptions(supertest, log);
       });
 
       it('should be able to read a single exception list items using item_id', async () => {
diff --git a/x-pack/test/lists_api_integration/security_and_spaces/tests/read_exception_lists.ts b/x-pack/test/lists_api_integration/security_and_spaces/tests/read_exception_lists.ts
index b9f2b89a3e0ee..dd39ad9725287 100644
--- a/x-pack/test/lists_api_integration/security_and_spaces/tests/read_exception_lists.ts
+++ b/x-pack/test/lists_api_integration/security_and_spaces/tests/read_exception_lists.ts
@@ -21,11 +21,12 @@ import { deleteAllExceptions, removeExceptionListServerGeneratedProperties } fro
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('read_exception_lists', () => {
     describe('reading exception lists', () => {
       afterEach(async () => {
-        await deleteAllExceptions(supertest);
+        await deleteAllExceptions(supertest, log);
       });
 
       it('should be able to read a single exception list using list_id', async () => {
diff --git a/x-pack/test/lists_api_integration/security_and_spaces/tests/read_list_items.ts b/x-pack/test/lists_api_integration/security_and_spaces/tests/read_list_items.ts
index f53e9c7434e35..7292440e1a12a 100644
--- a/x-pack/test/lists_api_integration/security_and_spaces/tests/read_list_items.ts
+++ b/x-pack/test/lists_api_integration/security_and_spaces/tests/read_list_items.ts
@@ -22,15 +22,16 @@ import {
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('read_list_items', () => {
     describe('reading list items', () => {
       beforeEach(async () => {
-        await createListsIndex(supertest);
+        await createListsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteListsIndex(supertest);
+        await deleteListsIndex(supertest, log);
       });
 
       it('should be able to read a single list item using id', async () => {
diff --git a/x-pack/test/lists_api_integration/security_and_spaces/tests/read_lists.ts b/x-pack/test/lists_api_integration/security_and_spaces/tests/read_lists.ts
index af81801fb5e91..414177d268213 100644
--- a/x-pack/test/lists_api_integration/security_and_spaces/tests/read_lists.ts
+++ b/x-pack/test/lists_api_integration/security_and_spaces/tests/read_lists.ts
@@ -24,15 +24,16 @@ import { getListResponseMockWithoutAutoGeneratedValues } from '../../../../plugi
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('read_lists', () => {
     describe('reading lists', () => {
       beforeEach(async () => {
-        await createListsIndex(supertest);
+        await createListsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteListsIndex(supertest);
+        await deleteListsIndex(supertest, log);
       });
 
       it('should be able to read a single list using id', async () => {
diff --git a/x-pack/test/lists_api_integration/security_and_spaces/tests/summary_exception_lists.ts b/x-pack/test/lists_api_integration/security_and_spaces/tests/summary_exception_lists.ts
index b71a7dbe768d2..34d959a6f7103 100644
--- a/x-pack/test/lists_api_integration/security_and_spaces/tests/summary_exception_lists.ts
+++ b/x-pack/test/lists_api_integration/security_and_spaces/tests/summary_exception_lists.ts
@@ -21,15 +21,16 @@ interface SummaryResponseType {
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('summary_exception_lists', () => {
     describe('summary exception lists', () => {
       beforeEach(async () => {
-        await createListsIndex(supertest);
+        await createListsIndex(supertest, log);
       });
       afterEach(async () => {
-        await deleteListsIndex(supertest);
-        await deleteAllExceptions(supertest);
+        await deleteListsIndex(supertest, log);
+        await deleteAllExceptions(supertest, log);
       });
 
       it('should give a validation error if the list_id and the id are not supplied', async () => {
diff --git a/x-pack/test/lists_api_integration/security_and_spaces/tests/update_exception_list_items.ts b/x-pack/test/lists_api_integration/security_and_spaces/tests/update_exception_list_items.ts
index fa0466f14db28..37c997f686565 100644
--- a/x-pack/test/lists_api_integration/security_and_spaces/tests/update_exception_list_items.ts
+++ b/x-pack/test/lists_api_integration/security_and_spaces/tests/update_exception_list_items.ts
@@ -24,11 +24,12 @@ import { getUpdateMinimalExceptionListItemSchemaMock } from '../../../../plugins
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('update_exception_list_items', () => {
     describe('update exception list items', () => {
       afterEach(async () => {
-        await deleteAllExceptions(supertest);
+        await deleteAllExceptions(supertest, log);
       });
 
       it('should update a single exception list item property of name using an id', async () => {
diff --git a/x-pack/test/lists_api_integration/security_and_spaces/tests/update_exception_lists.ts b/x-pack/test/lists_api_integration/security_and_spaces/tests/update_exception_lists.ts
index 2eeaca7f0521b..6844c847e8d92 100644
--- a/x-pack/test/lists_api_integration/security_and_spaces/tests/update_exception_lists.ts
+++ b/x-pack/test/lists_api_integration/security_and_spaces/tests/update_exception_lists.ts
@@ -23,11 +23,12 @@ import { getUpdateMinimalExceptionListSchemaMock } from '../../../../plugins/lis
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('update_exception_lists', () => {
     describe('update exception lists', () => {
       afterEach(async () => {
-        await deleteAllExceptions(supertest);
+        await deleteAllExceptions(supertest, log);
       });
 
       it('should update a single exception list property of name using an id', async () => {
diff --git a/x-pack/test/lists_api_integration/security_and_spaces/tests/update_list_items.ts b/x-pack/test/lists_api_integration/security_and_spaces/tests/update_list_items.ts
index 38d36ba3d7eee..a4309d07a879d 100644
--- a/x-pack/test/lists_api_integration/security_and_spaces/tests/update_list_items.ts
+++ b/x-pack/test/lists_api_integration/security_and_spaces/tests/update_list_items.ts
@@ -28,15 +28,16 @@ import { getUpdateMinimalListItemSchemaMock } from '../../../../plugins/lists/co
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('update_list_items', () => {
     describe('update list items', () => {
       beforeEach(async () => {
-        await createListsIndex(supertest);
+        await createListsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteListsIndex(supertest);
+        await deleteListsIndex(supertest, log);
       });
 
       it('should update a single list item property of value using an id', async () => {
diff --git a/x-pack/test/lists_api_integration/security_and_spaces/tests/update_lists.ts b/x-pack/test/lists_api_integration/security_and_spaces/tests/update_lists.ts
index 2e3f48354b22a..1c3fe393caf0c 100644
--- a/x-pack/test/lists_api_integration/security_and_spaces/tests/update_lists.ts
+++ b/x-pack/test/lists_api_integration/security_and_spaces/tests/update_lists.ts
@@ -23,15 +23,16 @@ import { getUpdateMinimalListSchemaMock } from '../../../../plugins/lists/common
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
+  const log = getService('log');
 
   describe('update_lists', () => {
     describe('update lists', () => {
       beforeEach(async () => {
-        await createListsIndex(supertest);
+        await createListsIndex(supertest, log);
       });
 
       afterEach(async () => {
-        await deleteListsIndex(supertest);
+        await deleteListsIndex(supertest, log);
       });
 
       it('should update a single list property of name using an id', async () => {
diff --git a/x-pack/test/lists_api_integration/utils.ts b/x-pack/test/lists_api_integration/utils.ts
index 8a2a7a8ca65ff..6e0c13b21596d 100644
--- a/x-pack/test/lists_api_integration/utils.ts
+++ b/x-pack/test/lists_api_integration/utils.ts
@@ -20,6 +20,7 @@ import {
   LIST_INDEX,
   LIST_ITEM_URL,
 } from '@kbn/securitysolution-list-constants';
+import { ToolingLog } from '@kbn/dev-utils';
 import { getImportListItemAsBuffer } from '../../plugins/lists/common/schemas/request/import_list_item_schema.mock';
 import { countDownTest } from '../detection_engine_api_integration/utils';
 
@@ -29,12 +30,17 @@ import { countDownTest } from '../detection_engine_api_integration/utils';
  * @param supertest The supertest client library
  */
 export const createListsIndex = async (
-  supertest: SuperTest.SuperTest<SuperTest.Test>
+  supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog
 ): Promise<void> => {
-  return countDownTest(async () => {
-    await supertest.post(LIST_INDEX).set('kbn-xsrf', 'true').send();
-    return true;
-  }, 'createListsIndex');
+  return countDownTest(
+    async () => {
+      await supertest.post(LIST_INDEX).set('kbn-xsrf', 'true').send();
+      return true;
+    },
+    'createListsIndex',
+    log
+  );
 };
 
 /**
@@ -42,12 +48,17 @@ export const createListsIndex = async (
  * @param supertest The supertest client library
  */
 export const deleteListsIndex = async (
-  supertest: SuperTest.SuperTest<SuperTest.Test>
+  supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog
 ): Promise<void> => {
-  return countDownTest(async () => {
-    await supertest.delete(LIST_INDEX).set('kbn-xsrf', 'true').send();
-    return true;
-  }, 'deleteListsIndex');
+  return countDownTest(
+    async () => {
+      await supertest.delete(LIST_INDEX).set('kbn-xsrf', 'true').send();
+      return true;
+    },
+    'deleteListsIndex',
+    log
+  );
 };
 
 /**
@@ -56,12 +67,17 @@ export const deleteListsIndex = async (
  * @param supertest The supertest client library
  */
 export const createExceptionListsIndex = async (
-  supertest: SuperTest.SuperTest<SuperTest.Test>
+  supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog
 ): Promise<void> => {
-  return countDownTest(async () => {
-    await supertest.post(LIST_INDEX).set('kbn-xsrf', 'true').send();
-    return true;
-  }, 'createListsIndex');
+  return countDownTest(
+    async () => {
+      await supertest.post(LIST_INDEX).set('kbn-xsrf', 'true').send();
+      return true;
+    },
+    'createListsIndex',
+    log
+  );
 };
 
 /**
@@ -116,6 +132,7 @@ export const removeExceptionListServerGeneratedProperties = (
 export const waitFor = async (
   functionToTest: () => Promise<boolean>,
   functionName: string,
+  log: ToolingLog,
   maxTimeout: number = 800000,
   timeoutWait: number = 250
 ) => {
@@ -131,10 +148,7 @@ export const waitFor = async (
         if (itPasses) {
           found = true;
         } else {
-          // eslint-disable-next-line no-console
-          console.log(
-            `Try number ${numberOfTries} out of ${maxTries} for function ${functionName}`
-          );
+          log.debug(`Try number ${numberOfTries} out of ${maxTries} for function ${functionName}`);
           numberOfTries++;
         }
 
@@ -174,7 +188,8 @@ export const binaryToString = (res: any, callback: any): void => {
  * @param supertest The supertest handle
  */
 export const deleteAllExceptions = async (
-  supertest: SuperTest.SuperTest<SuperTest.Test>
+  supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog
 ): Promise<void> => {
   await countDownTest(
     async () => {
@@ -194,6 +209,7 @@ export const deleteAllExceptions = async (
       return finalCheck.data.length === 0;
     },
     'deleteAllExceptions',
+    log,
     50,
     1000
   );
@@ -210,6 +226,7 @@ export const deleteAllExceptions = async (
  */
 export const importFile = async (
   supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog,
   type: Type,
   contents: string[],
   fileName: string,
@@ -222,8 +239,7 @@ export const importFile = async (
     .expect('Content-Type', 'application/json; charset=utf-8');
 
   if (response.status !== 200) {
-    // eslint-disable-next-line no-console
-    console.log(
+    log.error(
       `Did not get an expected 200 "ok" When importing a file (importFile). CI issues could happen. Suspect this line if you are seeing CI issues. body: ${JSON.stringify(
         response.body
       )}, status: ${JSON.stringify(response.status)}`
@@ -233,7 +249,7 @@ export const importFile = async (
   // although we have pushed the list and its items, it is async so we
   // have to wait for the contents before continuing
   const testValuesOrContents = testValues ?? contents;
-  await waitForListItems(supertest, testValuesOrContents, fileName);
+  await waitForListItems(supertest, log, testValuesOrContents, fileName);
 };
 
 /**
@@ -247,6 +263,7 @@ export const importFile = async (
  */
 export const importTextFile = async (
   supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog,
   type: Type,
   contents: string[],
   fileName: string
@@ -258,8 +275,7 @@ export const importTextFile = async (
     .expect('Content-Type', 'application/json; charset=utf-8');
 
   if (response.status !== 200) {
-    // eslint-disable-next-line no-console
-    console.log(
+    log.error(
       `Did not get an expected 200 "ok" when importing a text file (importTextFile). CI issues could happen. Suspect this line if you are seeing CI issues. body: ${JSON.stringify(
         response.body
       )}, status: ${JSON.stringify(response.status)}`
@@ -268,7 +284,7 @@ export const importTextFile = async (
 
   // although we have pushed the list and its items, it is async so we
   // have to wait for the contents before continuing
-  await waitForTextListItems(supertest, contents, fileName);
+  await waitForTextListItems(supertest, log, contents, fileName);
 };
 
 /**
@@ -280,23 +296,27 @@ export const importTextFile = async (
  */
 export const waitForListItem = async (
   supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog,
   itemValue: string,
   fileName: string
 ): Promise<void> => {
-  await waitFor(async () => {
-    const { status, body } = await supertest
-      .get(`${LIST_ITEM_URL}?list_id=${fileName}&value=${itemValue}`)
-      .send();
-    if (status !== 200) {
-      // eslint-disable-next-line no-console
-      console.log(
-        `Did not get an expected 200 "ok" when waiting for a list item (waitForListItem) yet. Retrying until we get a 200 "ok". body: ${JSON.stringify(
-          body
-        )}, status: ${JSON.stringify(status)}`
-      );
-    }
-    return status === 200;
-  }, `waitForListItem fileName: "${fileName}" itemValue: "${itemValue}"`);
+  await waitFor(
+    async () => {
+      const { status, body } = await supertest
+        .get(`${LIST_ITEM_URL}?list_id=${fileName}&value=${itemValue}`)
+        .send();
+      if (status !== 200) {
+        log.debug(
+          `Did not get an expected 200 "ok" when waiting for a list item (waitForListItem) yet. Retrying until we get a 200 "ok". body: ${JSON.stringify(
+            body
+          )}, status: ${JSON.stringify(status)}`
+        );
+      }
+      return status === 200;
+    },
+    `waitForListItem fileName: "${fileName}" itemValue: "${itemValue}"`,
+    log
+  );
 };
 
 /**
@@ -308,10 +328,11 @@ export const waitForListItem = async (
  */
 export const waitForListItems = async (
   supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog,
   itemValues: string[],
   fileName: string
 ): Promise<void> => {
-  await Promise.all(itemValues.map((item) => waitForListItem(supertest, item, fileName)));
+  await Promise.all(itemValues.map((item) => waitForListItem(supertest, log, item, fileName)));
 };
 
 /**
@@ -323,29 +344,33 @@ export const waitForListItems = async (
  */
 export const waitForTextListItem = async (
   supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog,
   itemValue: string,
   fileName: string
 ): Promise<void> => {
   const tokens = itemValue.split(' ');
-  await waitFor(async () => {
-    const promises = await Promise.all(
-      tokens.map(async (token) => {
-        const { status, body } = await supertest
-          .get(`${LIST_ITEM_URL}?list_id=${fileName}&value=${token}`)
-          .send();
-        if (status !== 200) {
-          // eslint-disable-next-line no-console
-          console.log(
-            `Did not get an expected 200 "ok" when waiting for a text list item (waitForTextListItem) yet. Retrying until we get a 200 "ok". body: ${JSON.stringify(
-              body
-            )}, status: ${JSON.stringify(status)}`
-          );
-        }
-        return status === 200;
-      })
-    );
-    return promises.every((one) => one);
-  }, `waitForTextListItem fileName: "${fileName}" itemValue: "${itemValue}"`);
+  await waitFor(
+    async () => {
+      const promises = await Promise.all(
+        tokens.map(async (token) => {
+          const { status, body } = await supertest
+            .get(`${LIST_ITEM_URL}?list_id=${fileName}&value=${token}`)
+            .send();
+          if (status !== 200) {
+            log.error(
+              `Did not get an expected 200 "ok" when waiting for a text list item (waitForTextListItem) yet. Retrying until we get a 200 "ok". body: ${JSON.stringify(
+                body
+              )}, status: ${JSON.stringify(status)}`
+            );
+          }
+          return status === 200;
+        })
+      );
+      return promises.every((one) => one);
+    },
+    `waitForTextListItem fileName: "${fileName}" itemValue: "${itemValue}"`,
+    log
+  );
 };
 
 /**
@@ -358,8 +383,9 @@ export const waitForTextListItem = async (
  */
 export const waitForTextListItems = async (
   supertest: SuperTest.SuperTest<SuperTest.Test>,
+  log: ToolingLog,
   itemValues: string[],
   fileName: string
 ): Promise<void> => {
-  await Promise.all(itemValues.map((item) => waitForTextListItem(supertest, item, fileName)));
+  await Promise.all(itemValues.map((item) => waitForTextListItem(supertest, log, item, fileName)));
 };
diff --git a/x-pack/test/observability_api_integration/common/ftr_provider_context.ts b/x-pack/test/observability_api_integration/common/ftr_provider_context.ts
index 8f59a8d385281..2ea45b854eb28 100644
--- a/x-pack/test/observability_api_integration/common/ftr_provider_context.ts
+++ b/x-pack/test/observability_api_integration/common/ftr_provider_context.ts
@@ -5,4 +5,4 @@
  * 2.0.
  */
 
-export { FtrProviderContext } from '../../api_integration/ftr_provider_context';
+export type { FtrProviderContext } from '../../api_integration/ftr_provider_context';
diff --git a/x-pack/test/plugin_functional/plugins/global_search_test/public/index.ts b/x-pack/test/plugin_functional/plugins/global_search_test/public/index.ts
index 43adc3f1036e2..9450384458d09 100644
--- a/x-pack/test/plugin_functional/plugins/global_search_test/public/index.ts
+++ b/x-pack/test/plugin_functional/plugins/global_search_test/public/index.ts
@@ -21,7 +21,7 @@ export const plugin: PluginInitializer<
   GlobalSearchTestPluginStartDeps
 > = () => new GlobalSearchTestPlugin();
 
-export {
+export type {
   GlobalSearchTestPluginSetup,
   GlobalSearchTestPluginStart,
   GlobalSearchTestPluginSetupDeps,
diff --git a/x-pack/test/plugin_functional/plugins/timelines_test/public/applications/timelines_test/index.tsx b/x-pack/test/plugin_functional/plugins/timelines_test/public/applications/timelines_test/index.tsx
index a37c00144504d..48a17dc985003 100644
--- a/x-pack/test/plugin_functional/plugins/timelines_test/public/applications/timelines_test/index.tsx
+++ b/x-pack/test/plugin_functional/plugins/timelines_test/public/applications/timelines_test/index.tsx
@@ -91,6 +91,7 @@ const AppRoot = React.memo(
                   setRefetch,
                   start: '',
                   rowRenderers: [],
+                  runtimeMappings: {},
                   filterStatus: 'open',
                   unit: (n: number) => `${n}`,
                 })) ??
diff --git a/x-pack/test/saved_object_api_integration/common/fixtures/es_archiver/saved_objects/spaces/data.json b/x-pack/test/saved_object_api_integration/common/fixtures/es_archiver/saved_objects/spaces/data.json
index 84c31dc2b7db6..e7d2c630fc130 100644
--- a/x-pack/test/saved_object_api_integration/common/fixtures/es_archiver/saved_objects/spaces/data.json
+++ b/x-pack/test/saved_object_api_integration/common/fixtures/es_archiver/saved_objects/spaces/data.json
@@ -57,11 +57,12 @@
     "index": ".kibana",
     "source": {
       "index-pattern": {
-        "fields": "[{\"name\":\"@message\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"@message.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"@message\"}}},{\"name\":\"@tags\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"@tags.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"@tags\"}}},{\"name\":\"@timestamp\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_score\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_source\",\"type\":\"_source\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"agent\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"agent.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"agent\"}}},{\"name\":\"bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"clientip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"extension\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"extension.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"extension\"}}},{\"name\":\"geo.coordinates\",\"type\":\"geo_point\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.dest\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.src\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.srcdest\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"headings\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"headings.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"headings\"}}},{\"name\":\"host\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"host.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"host\"}}},{\"name\":\"id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"index.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"index\"}}},{\"name\":\"ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"links\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"links.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"links\"}}},{\"name\":\"machine.os\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"machine.os.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"machine.os\"}}},{\"name\":\"machine.ram\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"memory\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"meta.char\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"meta.related\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"meta.user.firstname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"meta.user.lastname\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"phpmemory\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"referer\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.article:modified_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.article:published_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.article:section\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.article:section.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.article:section\"}}},{\"name\":\"relatedContent.article:tag\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.article:tag.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.article:tag\"}}},{\"name\":\"relatedContent.og:description\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:description.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.og:description\"}}},{\"name\":\"relatedContent.og:image\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:image.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.og:image\"}}},{\"name\":\"relatedContent.og:image:height\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:image:height.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.og:image:height\"}}},{\"name\":\"relatedContent.og:image:width\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:image:width.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.og:image:width\"}}},{\"name\":\"relatedContent.og:site_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:site_name.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.og:site_name\"}}},{\"name\":\"relatedContent.og:title\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:title.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.og:title\"}}},{\"name\":\"relatedContent.og:type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:type.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.og:type\"}}},{\"name\":\"relatedContent.og:url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.og:url\"}}},{\"name\":\"relatedContent.twitter:card\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:card.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.twitter:card\"}}},{\"name\":\"relatedContent.twitter:description\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:description.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.twitter:description\"}}},{\"name\":\"relatedContent.twitter:image\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:image.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.twitter:image\"}}},{\"name\":\"relatedContent.twitter:site\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:site.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.twitter:site\"}}},{\"name\":\"relatedContent.twitter:title\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:title.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.twitter:title\"}}},{\"name\":\"relatedContent.url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.url\"}}},{\"name\":\"request\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"request.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"request\"}}},{\"name\":\"response\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"response.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"response\"}}},{\"name\":\"spaces\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"spaces.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"spaces\"}}},{\"name\":\"type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"url\"}}},{\"name\":\"utc_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"xss\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"xss.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"xss\"}}}]",
         "timeFieldName": "@timestamp",
         "title": "logstash-*"
       },
+      "namespaces": ["default"],
       "type": "index-pattern",
+      "migrationVersion": { "index-pattern": "8.0.0" },
       "updated_at": "2017-09-21T18:49:16.270Z"
     },
     "type": "doc"
@@ -145,16 +146,16 @@
 {
   "type": "doc",
   "value": {
-    "id": "space_1:index-pattern:space1-index-pattern-id",
+    "id": "index-pattern:space1-index-pattern-id",
     "index": ".kibana",
     "source": {
       "index-pattern": {
-        "fields": "[{\"name\":\"@message\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"@message.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"@message\"}}},{\"name\":\"@tags\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"@tags.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"@tags\"}}},{\"name\":\"@timestamp\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_score\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_source\",\"type\":\"_source\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"agent\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"agent.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"agent\"}}},{\"name\":\"bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"clientip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"extension\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"extension.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"extension\"}}},{\"name\":\"geo.coordinates\",\"type\":\"geo_point\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.dest\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.src\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.srcdest\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"headings\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"headings.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"headings\"}}},{\"name\":\"host\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"host.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"host\"}}},{\"name\":\"id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"index.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"index\"}}},{\"name\":\"ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"links\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"links.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"links\"}}},{\"name\":\"machine.os\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"machine.os.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"machine.os\"}}},{\"name\":\"machine.ram\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"memory\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"meta.char\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"meta.related\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"meta.user.firstname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"meta.user.lastname\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"phpmemory\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"referer\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.article:modified_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.article:published_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.article:section\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.article:section.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.article:section\"}}},{\"name\":\"relatedContent.article:tag\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.article:tag.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.article:tag\"}}},{\"name\":\"relatedContent.og:description\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:description.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.og:description\"}}},{\"name\":\"relatedContent.og:image\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:image.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.og:image\"}}},{\"name\":\"relatedContent.og:image:height\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:image:height.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.og:image:height\"}}},{\"name\":\"relatedContent.og:image:width\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:image:width.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.og:image:width\"}}},{\"name\":\"relatedContent.og:site_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:site_name.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.og:site_name\"}}},{\"name\":\"relatedContent.og:title\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:title.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.og:title\"}}},{\"name\":\"relatedContent.og:type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:type.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.og:type\"}}},{\"name\":\"relatedContent.og:url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.og:url\"}}},{\"name\":\"relatedContent.twitter:card\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:card.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.twitter:card\"}}},{\"name\":\"relatedContent.twitter:description\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:description.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.twitter:description\"}}},{\"name\":\"relatedContent.twitter:image\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:image.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.twitter:image\"}}},{\"name\":\"relatedContent.twitter:site\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:site.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.twitter:site\"}}},{\"name\":\"relatedContent.twitter:title\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:title.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.twitter:title\"}}},{\"name\":\"relatedContent.url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.url\"}}},{\"name\":\"request\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"request.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"request\"}}},{\"name\":\"response\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"response.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"response\"}}},{\"name\":\"spaces\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"spaces.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"spaces\"}}},{\"name\":\"type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"url\"}}},{\"name\":\"utc_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"xss\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"xss.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"xss\"}}}]",
         "timeFieldName": "@timestamp",
         "title": "logstash-*"
       },
-      "namespace": "space_1",
+      "namespaces": ["space_1"],
       "type": "index-pattern",
+      "migrationVersion": { "index-pattern": "8.0.0" },
       "updated_at": "2017-09-21T18:49:16.270Z"
     },
     "type": "doc"
@@ -240,16 +241,16 @@
 {
   "type": "doc",
   "value": {
-    "id": "space_2:index-pattern:space2-index-pattern-id",
+    "id": "index-pattern:space2-index-pattern-id",
     "index": ".kibana",
     "source": {
       "index-pattern": {
-        "fields": "[{\"name\":\"@message\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"@message.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"@message\"}}},{\"name\":\"@tags\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"@tags.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"@tags\"}}},{\"name\":\"@timestamp\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_score\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_source\",\"type\":\"_source\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"agent\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"agent.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"agent\"}}},{\"name\":\"bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"clientip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"extension\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"extension.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"extension\"}}},{\"name\":\"geo.coordinates\",\"type\":\"geo_point\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.dest\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.src\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"geo.srcdest\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"headings\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"headings.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"headings\"}}},{\"name\":\"host\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"host.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"host\"}}},{\"name\":\"id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"index.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"index\"}}},{\"name\":\"ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"links\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"links.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"links\"}}},{\"name\":\"machine.os\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"machine.os.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"machine.os\"}}},{\"name\":\"machine.ram\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"memory\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"meta.char\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"meta.related\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"meta.user.firstname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"meta.user.lastname\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"phpmemory\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"referer\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.article:modified_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.article:published_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"relatedContent.article:section\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.article:section.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.article:section\"}}},{\"name\":\"relatedContent.article:tag\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.article:tag.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.article:tag\"}}},{\"name\":\"relatedContent.og:description\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:description.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.og:description\"}}},{\"name\":\"relatedContent.og:image\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:image.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.og:image\"}}},{\"name\":\"relatedContent.og:image:height\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:image:height.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.og:image:height\"}}},{\"name\":\"relatedContent.og:image:width\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:image:width.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.og:image:width\"}}},{\"name\":\"relatedContent.og:site_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:site_name.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.og:site_name\"}}},{\"name\":\"relatedContent.og:title\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:title.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.og:title\"}}},{\"name\":\"relatedContent.og:type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:type.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.og:type\"}}},{\"name\":\"relatedContent.og:url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.og:url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.og:url\"}}},{\"name\":\"relatedContent.twitter:card\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:card.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.twitter:card\"}}},{\"name\":\"relatedContent.twitter:description\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:description.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.twitter:description\"}}},{\"name\":\"relatedContent.twitter:image\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:image.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.twitter:image\"}}},{\"name\":\"relatedContent.twitter:site\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:site.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.twitter:site\"}}},{\"name\":\"relatedContent.twitter:title\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.twitter:title.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.twitter:title\"}}},{\"name\":\"relatedContent.url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"relatedContent.url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"relatedContent.url\"}}},{\"name\":\"request\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"request.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"request\"}}},{\"name\":\"response\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"response.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"response\"}}},{\"name\":\"spaces\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"spaces.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"spaces\"}}},{\"name\":\"type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"url\"}}},{\"name\":\"utc_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"xss\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"xss.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true,\"subType\":{\"multi\":{\"parent\": \"xss\"}}}]",
         "timeFieldName": "@timestamp",
         "title": "logstash-*"
       },
-      "namespace": "space_2",
+      "namespaces": ["space_2"],
       "type": "index-pattern",
+      "migrationVersion": { "index-pattern": "8.0.0" },
       "updated_at": "2017-09-21T18:49:16.270Z"
     },
     "type": "doc"
@@ -554,6 +555,22 @@
   }
 }
 
+{
+  "type": "doc",
+  "value": {
+    "index": ".kibana",
+    "id": "resolvetype:all_spaces",
+    "source": {
+      "type": "resolvetype",
+      "updated_at": "2017-09-21T18:51:23.794Z",
+      "resolvetype": {
+        "title": "This is used to test that 1. the 'disabled' alias does not resolve to this target (because the alias is disabled), and 2. when this object that exists in all spaces is deleted, the alias that targets it is deleted too (even though the alias is disabled)"
+      },
+      "namespaces": ["*"]
+    }
+  }
+}
+
 {
   "type": "doc",
   "value": {
@@ -566,7 +583,7 @@
         "sourceId": "disabled",
         "targetNamespace": "space_1",
         "targetType": "resolvetype",
-        "targetId": "alias-match-newid",
+        "targetId": "disabled-newid",
         "disabled": true
       }
     }
@@ -585,7 +602,7 @@
         "sourceId": "alias-match",
         "targetNamespace": "space_x",
         "targetType": "resolvetype",
-        "targetId": "doesnt-matter"
+        "targetId": "alias-match-newid"
       }
     }
   }
@@ -603,7 +620,7 @@
         "sourceId": "alias-match",
         "targetNamespace": "space_y",
         "targetType": "resolvetype",
-        "targetId": "doesnt-matter",
+        "targetId": "alias-match-newid",
         "disabled": true
       }
     }
diff --git a/x-pack/test/saved_object_api_integration/common/suites/delete.ts b/x-pack/test/saved_object_api_integration/common/suites/delete.ts
index 844da51d16e80..4dbd7901a05c4 100644
--- a/x-pack/test/saved_object_api_integration/common/suites/delete.ts
+++ b/x-pack/test/saved_object_api_integration/common/suites/delete.ts
@@ -6,7 +6,9 @@
  */
 
 import { SuperTest } from 'supertest';
+import type { Client } from '@elastic/elasticsearch';
 import expect from '@kbn/expect';
+import type { SearchTotalHits } from '@elastic/elasticsearch/lib/api/types';
 import { SAVED_OBJECT_TEST_CASES as CASES } from '../lib/saved_object_test_cases';
 import { SPACES } from '../lib/spaces';
 import { expectResponses, getUrlPrefix, getTestTitle } from '../lib/saved_object_test_utils';
@@ -21,9 +23,13 @@ export interface DeleteTestCase extends TestCase {
   failure?: 400 | 403 | 404;
 }
 
+const ALIAS_DELETE_INCLUSIVE = Object.freeze({ type: 'resolvetype', id: 'alias-match-newid' }); // exists in three specific spaces; deleting this should also delete the alias that targets it in space 1
+const ALIAS_DELETE_EXCLUSIVE = Object.freeze({ type: 'resolvetype', id: 'all_spaces' }); // exists in all spaces; deleting this should also delete the alias that targets it in space 1
 const DOES_NOT_EXIST = Object.freeze({ type: 'dashboard', id: 'does-not-exist' });
 export const TEST_CASES: Record<string, DeleteTestCase> = Object.freeze({
   ...CASES,
+  ALIAS_DELETE_INCLUSIVE,
+  ALIAS_DELETE_EXCLUSIVE,
   DOES_NOT_EXIST,
 });
 
@@ -32,7 +38,7 @@ export const TEST_CASES: Record<string, DeleteTestCase> = Object.freeze({
  */
 const createRequest = ({ type, id, force }: DeleteTestCase) => ({ type, id, force });
 
-export function deleteTestSuiteFactory(esArchiver: any, supertest: SuperTest<any>) {
+export function deleteTestSuiteFactory(es: Client, esArchiver: any, supertest: SuperTest<any>) {
   const expectSavedObjectForbidden = expectResponses.forbiddenTypes('delete');
   const expectResponseBody =
     (testCase: DeleteTestCase): ExpectResponseBody =>
@@ -47,6 +53,25 @@ export function deleteTestSuiteFactory(esArchiver: any, supertest: SuperTest<any
         } else {
           // the success response for `delete` is an empty object
           expect(object).to.eql({});
+
+          // if we deleted an object that had an alias pointing to it, the alias should have been deleted as well
+          await es.indices.refresh({ index: '.kibana' }); // alias deletion uses refresh: false, so we need to manually refresh the index before searching
+          const searchResponse = await es.search({
+            index: '.kibana',
+            body: {
+              size: 0,
+              query: { terms: { type: ['legacy-url-alias'] } },
+              track_total_hits: true,
+            },
+          });
+          const expectAliasWasDeleted = !![ALIAS_DELETE_INCLUSIVE, ALIAS_DELETE_EXCLUSIVE].find(
+            ({ type, id }) => testCase.type === type && testCase.id === id
+          );
+          expect((searchResponse.hits.total as SearchTotalHits).value).to.eql(
+            // Five aliases exist but only one should be deleted in each case (for the "inclusive" case, this asserts that the aliases
+            // targeting that object in space x and space y were *not* deleted)
+            expectAliasWasDeleted ? 4 : 5
+          );
         }
       }
     };
diff --git a/x-pack/test/saved_object_api_integration/security_and_spaces/apis/delete.ts b/x-pack/test/saved_object_api_integration/security_and_spaces/apis/delete.ts
index 6a6fc8a15decf..8970070645f4d 100644
--- a/x-pack/test/saved_object_api_integration/security_and_spaces/apis/delete.ts
+++ b/x-pack/test/saved_object_api_integration/security_and_spaces/apis/delete.ts
@@ -51,6 +51,8 @@ const createTestCases = (spaceId: string) => {
     },
     { ...CASES.MULTI_NAMESPACE_ISOLATED_ONLY_SPACE_1, ...fail404(spaceId !== SPACE_1_ID) },
     CASES.NAMESPACE_AGNOSTIC,
+    { ...CASES.ALIAS_DELETE_INCLUSIVE, force: true },
+    { ...CASES.ALIAS_DELETE_EXCLUSIVE, force: true },
     { ...CASES.DOES_NOT_EXIST, ...fail404() },
   ];
   const hiddenType = [{ ...CASES.HIDDEN, ...fail404() }];
@@ -61,8 +63,9 @@ const createTestCases = (spaceId: string) => {
 export default function ({ getService }: FtrProviderContext) {
   const supertest = getService('supertestWithoutAuth');
   const esArchiver = getService('esArchiver');
+  const es = getService('es');
 
-  const { addTests, createTestDefinitions } = deleteTestSuiteFactory(esArchiver, supertest);
+  const { addTests, createTestDefinitions } = deleteTestSuiteFactory(es, esArchiver, supertest);
   const createTests = (spaceId: string) => {
     const { normalTypes, hiddenType, allTypes } = createTestCases(spaceId);
     return {
diff --git a/x-pack/test/saved_object_api_integration/spaces_only/apis/delete.ts b/x-pack/test/saved_object_api_integration/spaces_only/apis/delete.ts
index 1a168bac948be..28674e8fd45aa 100644
--- a/x-pack/test/saved_object_api_integration/spaces_only/apis/delete.ts
+++ b/x-pack/test/saved_object_api_integration/spaces_only/apis/delete.ts
@@ -45,6 +45,8 @@ const createTestCases = (spaceId: string) => [
   },
   { ...CASES.MULTI_NAMESPACE_ISOLATED_ONLY_SPACE_1, ...fail404(spaceId !== SPACE_1_ID) },
   CASES.NAMESPACE_AGNOSTIC,
+  { ...CASES.ALIAS_DELETE_INCLUSIVE, force: true },
+  { ...CASES.ALIAS_DELETE_EXCLUSIVE, force: true },
   { ...CASES.HIDDEN, ...fail404() },
   { ...CASES.DOES_NOT_EXIST, ...fail404() },
 ];
@@ -52,8 +54,9 @@ const createTestCases = (spaceId: string) => [
 export default function ({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
+  const es = getService('es');
 
-  const { addTests, createTestDefinitions } = deleteTestSuiteFactory(esArchiver, supertest);
+  const { addTests, createTestDefinitions } = deleteTestSuiteFactory(es, esArchiver, supertest);
   const createTests = (spaceId: string) => {
     const testCases = createTestCases(spaceId);
     return createTestDefinitions(testCases, false, { spaceId });
diff --git a/x-pack/test/saved_object_tagging/common/lib/index.ts b/x-pack/test/saved_object_tagging/common/lib/index.ts
index ae662def2459c..9d23dc2541f8c 100644
--- a/x-pack/test/saved_object_tagging/common/lib/index.ts
+++ b/x-pack/test/saved_object_tagging/common/lib/index.ts
@@ -5,6 +5,6 @@
  * 2.0.
  */
 
-export { Role, User, ExpectedResponse } from './types';
+export type { Role, User, ExpectedResponse } from './types';
 export { ROLES, USERS } from './authentication';
 export { createUsersAndRoles } from './create_users_and_roles';
diff --git a/x-pack/test/search_sessions_integration/tests/apps/dashboard/session_sharing/lens.ts b/x-pack/test/search_sessions_integration/tests/apps/dashboard/session_sharing/lens.ts
index b6dfc29bb1c6b..1027a44cd8b91 100644
--- a/x-pack/test/search_sessions_integration/tests/apps/dashboard/session_sharing/lens.ts
+++ b/x-pack/test/search_sessions_integration/tests/apps/dashboard/session_sharing/lens.ts
@@ -9,24 +9,28 @@ import expect from '@kbn/expect';
 import { FtrProviderContext } from '../../../../ftr_provider_context';
 
 export default function ({ getService, getPageObjects }: FtrProviderContext) {
-  const esArchiver = getService('esArchiver');
   const dashboardPanelActions = getService('dashboardPanelActions');
   const dashboardAddPanel = getService('dashboardAddPanel');
   const find = getService('find');
   const testSubjects = getService('testSubjects');
+  const kibanaServer = getService('kibanaServer');
   const PageObjects = getPageObjects(['header', 'common', 'dashboard', 'timePicker', 'lens']);
 
   // Dashboard shares a search session with lens when navigating to and from by value lens to hit search cache
   // https://github.com/elastic/kibana/issues/99310
   describe('Search session sharing with lens', () => {
     before(async () => {
-      await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/lens/basic');
+      await kibanaServer.importExport.load(
+        'x-pack/test/functional/fixtures/kbn_archiver/lens/lens_basic.json'
+      );
       await PageObjects.common.navigateToApp('dashboard');
       await PageObjects.dashboard.preserveCrossAppState();
     });
 
     after(async () => {
-      await esArchiver.unload('x-pack/test/functional/es_archives/lens/basic');
+      await kibanaServer.importExport.unload(
+        'x-pack/test/functional/fixtures/kbn_archiver/lens/lens_basic.json'
+      );
     });
 
     // NOTE: This test doesn't check if the cache was actually hit, but just checks if the same search session id is used
diff --git a/x-pack/test/search_sessions_integration/tests/apps/lens/search_sessions.ts b/x-pack/test/search_sessions_integration/tests/apps/lens/search_sessions.ts
index d95e117d1b033..9690f9be99fc6 100644
--- a/x-pack/test/search_sessions_integration/tests/apps/lens/search_sessions.ts
+++ b/x-pack/test/search_sessions_integration/tests/apps/lens/search_sessions.ts
@@ -13,14 +13,19 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
   const searchSession = getService('searchSessions');
   const PageObjects = getPageObjects(['visualize', 'lens', 'common', 'timePicker', 'header']);
   const listingTable = getService('listingTable');
+  const kibanaServer = getService('kibanaServer');
 
   describe('lens search sessions', () => {
     before(async () => {
       await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/logstash_functional');
-      await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/lens/basic');
+      await kibanaServer.importExport.load(
+        'x-pack/test/functional/fixtures/kbn_archiver/lens/lens_basic.json'
+      );
     });
     after(async () => {
-      await esArchiver.unload('x-pack/test/functional/es_archives/lens/basic');
+      await kibanaServer.importExport.unload(
+        'x-pack/test/functional/fixtures/kbn_archiver/lens/lens_basic.json'
+      );
     });
 
     it("doesn't shows search sessions indicator UI", async () => {
diff --git a/x-pack/test/spaces_api_integration/common/fixtures/es_archiver/saved_objects/spaces/data.json b/x-pack/test/spaces_api_integration/common/fixtures/es_archiver/saved_objects/spaces/data.json
index c9b09456a9a49..c5dc147b45123 100644
--- a/x-pack/test/spaces_api_integration/common/fixtures/es_archiver/saved_objects/spaces/data.json
+++ b/x-pack/test/spaces_api_integration/common/fixtures/es_archiver/saved_objects/spaces/data.json
@@ -582,6 +582,94 @@
   }
 }
 
+{
+  "type": "doc",
+  "value": {
+    "id": "sharedtype:alias_delete_inclusive",
+    "index": ".kibana",
+    "source": {
+      "sharedtype": {
+        "title": "This is used to test that when an object is unshared from a space, inbound aliases for just those spaces are removed"
+      },
+      "type": "sharedtype",
+      "namespaces": ["default", "space_1", "space_2"],
+      "updated_at": "2017-09-21T18:59:16.270Z"
+    },
+    "type": "doc"
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "id": "legacy-url-alias:space_1:sharedtype:doesnt-matter",
+    "index": ".kibana",
+    "source": {
+      "type": "legacy-url-alias",
+      "updated_at": "2017-09-21T18:51:23.794Z",
+      "legacy-url-alias": {
+        "sourceId": "doesnt-matter",
+        "targetNamespace": "space_1",
+        "targetType": "sharedtype",
+        "targetId": "alias_delete_inclusive"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "id": "legacy-url-alias:space_2:sharedtype:doesnt-matter",
+    "index": ".kibana",
+    "source": {
+      "type": "legacy-url-alias",
+      "updated_at": "2017-09-21T18:51:23.794Z",
+      "legacy-url-alias": {
+        "sourceId": "doesnt-matter",
+        "targetNamespace": "space_2",
+        "targetType": "sharedtype",
+        "targetId": "alias_delete_inclusive"
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "id": "sharedtype:alias_delete_exclusive",
+    "index": ".kibana",
+    "source": {
+      "sharedtype": {
+        "title": "This is used to test that when an object is unshared from all space, inbound aliases for all spaces are removed"
+      },
+      "type": "sharedtype",
+      "namespaces": ["*"],
+      "updated_at": "2017-09-21T18:59:16.270Z"
+    },
+    "type": "doc"
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "id": "legacy-url-alias:other_space:sharedtype:doesnt-matter",
+    "index": ".kibana",
+    "source": {
+      "type": "legacy-url-alias",
+      "updated_at": "2017-09-21T18:51:23.794Z",
+      "legacy-url-alias": {
+        "sourceId": "doesnt-matter",
+        "targetNamespace": "other_space",
+        "targetType": "sharedtype",
+        "targetId": "alias_delete_exclusive"
+      }
+    }
+  }
+}
+
 {
   "type": "doc",
   "value": {
diff --git a/x-pack/test/spaces_api_integration/common/lib/saved_object_test_cases.ts b/x-pack/test/spaces_api_integration/common/lib/saved_object_test_cases.ts
index ddbcf8f5f31c1..8d9af1170f288 100644
--- a/x-pack/test/spaces_api_integration/common/lib/saved_object_test_cases.ts
+++ b/x-pack/test/spaces_api_integration/common/lib/saved_object_test_cases.ts
@@ -38,6 +38,14 @@ export const MULTI_NAMESPACE_SAVED_OBJECT_TEST_CASES = Object.freeze({
     id: 'all_spaces',
     existingNamespaces: ['*'], // all current and future spaces
   }),
+  ALIAS_DELETE_INCLUSIVE: Object.freeze({
+    id: 'alias_delete_inclusive',
+    existingNamespaces: ['default', 'space_1', 'space_2'], // each individual space
+  }),
+  ALIAS_DELETE_EXCLUSIVE: Object.freeze({
+    id: 'alias_delete_exclusive',
+    existingNamespaces: ['*'], // all current and future spaces
+  }),
   DOES_NOT_EXIST: Object.freeze({
     id: 'does_not_exist',
     existingNamespaces: [] as string[],
diff --git a/x-pack/test/spaces_api_integration/common/suites/delete.ts b/x-pack/test/spaces_api_integration/common/suites/delete.ts
index e0f222af707c5..ae8b73535c2c6 100644
--- a/x-pack/test/spaces_api_integration/common/suites/delete.ts
+++ b/x-pack/test/spaces_api_integration/common/suites/delete.ts
@@ -53,8 +53,8 @@ export function deleteTestSuiteFactory(es: Client, esArchiver: any, supertest: S
     // @ts-expect-error @elastic/elasticsearch doesn't defined `count.buckets`.
     const buckets = response.aggregations?.count.buckets;
 
-    // The test fixture contains three legacy URL aliases:
-    // (1) one for "space_1", (2) one for "space_2", and (3) one for "other_space", which is a non-existent space.
+    // The test fixture contains six legacy URL aliases:
+    // (1) two for "space_1", (2) two for "space_2", and (3) two for "other_space", which is a non-existent space.
     // Each test deletes "space_2", so the agg buckets should reflect that aliases (1) and (3) still exist afterwards.
 
     // Space 2 deleted, all others should exist
@@ -75,26 +75,26 @@ export function deleteTestSuiteFactory(es: Client, esArchiver: any, supertest: S
         },
       },
       {
-        doc_count: 6,
+        doc_count: 7,
         key: 'space_1',
         countByType: {
           doc_count_error_upper_bound: 0,
           sum_other_doc_count: 0,
           buckets: [
             { key: 'visualization', doc_count: 3 },
+            { key: 'legacy-url-alias', doc_count: 2 }, // aliases (1)
             { key: 'dashboard', doc_count: 1 },
             { key: 'index-pattern', doc_count: 1 },
-            { key: 'legacy-url-alias', doc_count: 1 }, // alias (1)
           ],
         },
       },
       {
-        doc_count: 1,
+        doc_count: 2,
         key: 'other_space',
         countByType: {
           doc_count_error_upper_bound: 0,
           sum_other_doc_count: 0,
-          buckets: [{ key: 'legacy-url-alias', doc_count: 1 }], // alias (3)
+          buckets: [{ key: 'legacy-url-alias', doc_count: 2 }], // aliases (3)
         },
       },
     ];
@@ -110,8 +110,8 @@ export function deleteTestSuiteFactory(es: Client, esArchiver: any, supertest: S
       body: { query: { terms: { type: ['sharedtype'] } } },
     });
     const docs = multiNamespaceResponse.hits.hits;
-    // Just 12 results, since spaces_2_only, conflict_1_space_2 and conflict_2_space_2 got deleted.
-    expect(docs).length(12);
+    // Just 14 results, since spaces_2_only, conflict_1_space_2 and conflict_2_space_2 got deleted.
+    expect(docs).length(14);
     docs.forEach((doc) => () => {
       const containsSpace2 = doc?._source?.namespaces.includes('space_2');
       expect(containsSpace2).to.eql(false);
diff --git a/x-pack/test/spaces_api_integration/common/suites/update_objects_spaces.ts b/x-pack/test/spaces_api_integration/common/suites/update_objects_spaces.ts
index ecd0d15b522e1..3b795ae719db8 100644
--- a/x-pack/test/spaces_api_integration/common/suites/update_objects_spaces.ts
+++ b/x-pack/test/spaces_api_integration/common/suites/update_objects_spaces.ts
@@ -6,6 +6,8 @@
  */
 
 import expect from '@kbn/expect';
+import type { Client } from '@elastic/elasticsearch';
+import type { SearchTotalHits } from '@elastic/elasticsearch/lib/api/types';
 import { without, uniq } from 'lodash';
 import { SuperTest } from 'supertest';
 import {
@@ -35,6 +37,7 @@ export interface UpdateObjectsSpacesTestCase {
   objects: Array<{
     id: string;
     existingNamespaces: string[];
+    expectAliasDifference?: number;
     failure?: 400 | 404;
   }>;
   spacesToAdd: string[];
@@ -54,7 +57,11 @@ const getTestTitle = ({ objects, spacesToAdd, spacesToRemove }: UpdateObjectsSpa
   return `{objects: [${objStr}], spacesToAdd: [${addStr}], spacesToRemove: [${remStr}]}`;
 };
 
-export function updateObjectsSpacesTestSuiteFactory(esArchiver: any, supertest: SuperTest<any>) {
+export function updateObjectsSpacesTestSuiteFactory(
+  es: Client,
+  esArchiver: any,
+  supertest: SuperTest<any>
+) {
   const expectForbidden = expectResponses.forbiddenTypes('share_to_space');
   const expectResponseBody =
     (
@@ -68,7 +75,10 @@ export function updateObjectsSpacesTestSuiteFactory(esArchiver: any, supertest:
       } else {
         const { objects, spacesToAdd, spacesToRemove } = testCase;
         const apiResponse = response.body as SavedObjectsUpdateObjectsSpacesResponse;
-        objects.forEach(({ id, existingNamespaces, failure }, i) => {
+
+        let hasRefreshed = false;
+        for (let i = 0; i < objects.length; i++) {
+          const { id, existingNamespaces, expectAliasDifference, failure } = objects[i];
           const object = apiResponse.objects[i];
           if (failure === 404) {
             const error = SavedObjectsErrorHelpers.createGenericNotFoundError(TYPE, id);
@@ -84,8 +94,28 @@ export function updateObjectsSpacesTestSuiteFactory(esArchiver: any, supertest:
             expect(result.type).to.eql(TYPE);
             expect(result.id).to.eql(id);
             expect(result.spaces.sort()).to.eql(expectedSpaces.sort());
+
+            if (expectAliasDifference !== undefined) {
+              // if we deleted an object that had an alias pointing to it, the alias should have been deleted as well
+              if (!hasRefreshed) {
+                await es.indices.refresh({ index: '.kibana' }); // alias deletion uses refresh: false, so we need to manually refresh the index before searching
+                hasRefreshed = true;
+              }
+              const searchResponse = await es.search({
+                index: '.kibana',
+                body: {
+                  size: 0,
+                  query: { terms: { type: ['legacy-url-alias'] } },
+                  track_total_hits: true,
+                },
+              });
+              expect((searchResponse.hits.total as SearchTotalHits).value).to.eql(
+                // Six aliases exist in the test fixtures
+                6 + expectAliasDifference
+              );
+            }
           }
-        });
+        }
       }
     };
   const createTestDefinitions = (
diff --git a/x-pack/test/spaces_api_integration/security_and_spaces/apis/update_objects_spaces.ts b/x-pack/test/spaces_api_integration/security_and_spaces/apis/update_objects_spaces.ts
index 36f50aa165e72..c6a97337e6ad9 100644
--- a/x-pack/test/spaces_api_integration/security_and_spaces/apis/update_objects_spaces.ts
+++ b/x-pack/test/spaces_api_integration/security_and_spaces/apis/update_objects_spaces.ts
@@ -28,6 +28,8 @@ const { fail404 } = testCaseFailures;
 
 const createTestCases = (spaceId: string): UpdateObjectsSpacesTestCase[] => {
   const eachSpace = [DEFAULT_SPACE_ID, SPACE_1_ID, SPACE_2_ID];
+  // Note: we intentionally exclude ALIAS_DELETION test cases because they are already covered in spaces_only test suite, and there is no
+  // authZ-specific logic that affects alias deletion, all of that happens at the Saved Objects Repository level.
   return [
     // Test case to check adding and removing all spaces ("*") to a saved object
     {
@@ -125,8 +127,10 @@ const calculateSingleSpaceAuthZ = (testCases: UpdateObjectsSpacesTestCase[], spa
 export default function ({ getService }: FtrProviderContext) {
   const supertest = getService('supertestWithoutAuth');
   const esArchiver = getService('esArchiver');
+  const es = getService('es');
 
   const { addTests, createTestDefinitions } = updateObjectsSpacesTestSuiteFactory(
+    es,
     esArchiver,
     supertest
   );
diff --git a/x-pack/test/spaces_api_integration/spaces_only/apis/update_objects_spaces.ts b/x-pack/test/spaces_api_integration/spaces_only/apis/update_objects_spaces.ts
index 865d5eca22cbd..fc95f513f5519 100644
--- a/x-pack/test/spaces_api_integration/spaces_only/apis/update_objects_spaces.ts
+++ b/x-pack/test/spaces_api_integration/spaces_only/apis/update_objects_spaces.ts
@@ -11,6 +11,7 @@ import {
   getTestScenarios,
 } from '../../../saved_object_api_integration/common/lib/saved_object_test_utils';
 import { MULTI_NAMESPACE_SAVED_OBJECT_TEST_CASES as CASES } from '../../common/lib/saved_object_test_cases';
+import type { UpdateObjectsSpacesTestCase } from '../../common/suites/update_objects_spaces';
 import { updateObjectsSpacesTestSuiteFactory } from '../../common/suites/update_objects_spaces';
 import { FtrProviderContext } from '../../common/ftr_provider_context';
 
@@ -51,7 +52,55 @@ const createSinglePartTestCases = (spaceId: string) => {
 const createMultiPartTestCases = () => {
   const nonExistentSpace = 'does_not_exist'; // space that doesn't exist
   const eachSpace = [DEFAULT_SPACE_ID, SPACE_1_ID, SPACE_2_ID];
-  const group1 = [
+  const group1: UpdateObjectsSpacesTestCase[] = [
+    // These test cases ensure that aliases are deleted when objects are unshared.
+    // For simplicity these are done separately, before the others.
+    {
+      objects: [
+        {
+          id: CASES.ALIAS_DELETE_INCLUSIVE.id,
+          existingNamespaces: eachSpace,
+          expectAliasDifference: -1, // one alias should have been deleted from space_2
+        },
+      ],
+      spacesToAdd: [],
+      spacesToRemove: [SPACE_2_ID],
+    },
+    {
+      objects: [
+        {
+          id: CASES.ALIAS_DELETE_INCLUSIVE.id,
+          existingNamespaces: [DEFAULT_SPACE_ID, SPACE_1_ID],
+          expectAliasDifference: -2, // one alias should have been deleted from space_1
+        },
+      ],
+      spacesToAdd: [],
+      spacesToRemove: [SPACE_1_ID],
+    },
+    {
+      objects: [
+        {
+          id: CASES.ALIAS_DELETE_INCLUSIVE.id,
+          existingNamespaces: [DEFAULT_SPACE_ID],
+          expectAliasDifference: -2, // no aliases can exist in the default space, so no aliases were deleted
+        },
+      ],
+      spacesToAdd: [],
+      spacesToRemove: [DEFAULT_SPACE_ID],
+    },
+    {
+      objects: [
+        {
+          id: CASES.ALIAS_DELETE_EXCLUSIVE.id,
+          existingNamespaces: [SPACE_1_ID],
+          expectAliasDifference: -3, // one alias should have been deleted from other_space
+        },
+      ],
+      spacesToAdd: [SPACE_1_ID],
+      spacesToRemove: ['*'],
+    },
+  ];
+  const group2 = [
     // first, add this object to each space and remove it from nonExistentSpace
     // this will succeed even though the object already exists in the default space and it doesn't exist in nonExistentSpace
     { objects: [CASES.DEFAULT_ONLY], spacesToAdd: eachSpace, spacesToRemove: [nonExistentSpace] },
@@ -87,7 +136,7 @@ const createMultiPartTestCases = () => {
       spacesToRemove: [SPACE_1_ID],
     },
   ];
-  const group2 = [
+  const group3 = [
     // first, add this object to space_2 and remove it from space_1
     {
       objects: [CASES.DEFAULT_AND_SPACE_1],
@@ -111,15 +160,17 @@ const createMultiPartTestCases = () => {
       spacesToRemove: [],
     },
   ];
-  return [...group1, ...group2];
+  return [...group1, ...group2, ...group3];
 };
 
 // eslint-disable-next-line import/no-default-export
 export default function ({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
   const esArchiver = getService('esArchiver');
+  const es = getService('es');
 
   const { addTests, createTestDefinitions } = updateObjectsSpacesTestSuiteFactory(
+    es,
     esArchiver,
     supertest
   );
diff --git a/x-pack/test/stack_functional_integration/apps/apm/apm_smoke_test.js b/x-pack/test/stack_functional_integration/apps/apm/apm_smoke_test.js
index c7809e6abbf4a..6a653cc95921a 100644
--- a/x-pack/test/stack_functional_integration/apps/apm/apm_smoke_test.js
+++ b/x-pack/test/stack_functional_integration/apps/apm/apm_smoke_test.js
@@ -9,20 +9,32 @@ export default function ({ getService, getPageObjects }) {
   describe('APM smoke test', function ampsmokeTest() {
     const browser = getService('browser');
     const testSubjects = getService('testSubjects');
-    const PageObjects = getPageObjects(['common', 'timePicker']);
+    const PageObjects = getPageObjects(['common', 'timePicker', 'header']);
     const find = getService('find');
     const log = getService('log');
+    const retry = getService('retry');
 
     before(async () => {
       await browser.setWindowSize(1400, 1400);
       await PageObjects.common.navigateToApp('apm');
+      await PageObjects.header.waitUntilLoadingHasFinished();
       await PageObjects.timePicker.setCommonlyUsedTime('Last_1 year');
+      await PageObjects.header.waitUntilLoadingHasFinished();
     });
 
     it('can navigate to APM app', async () => {
       await testSubjects.existOrFail('apmMainContainer', {
         timeout: 10000,
       });
+      // wait for this last change on the page;
+      // <caption class="euiScreenReaderOnly euiTableCaption">This table contains 1 rows out of 1 rows; Page 1 of 1.</caption>
+      // but "<caption class="euiScreenReaderOnly euiTableCaption">" always exists so we have to wait until there's text
+      await retry.waitForWithTimeout('The APM table has a caption', 5000, async () => {
+        return (await (await find.byCssSelector('caption')).getAttribute('innerHTML')).includes(
+          'This table contains '
+        );
+      });
+
       await find.clickByDisplayedLinkText('apm-a-rum-test-e2e-general-usecase');
       log.debug('### apm smoke test passed');
       await find.clickByLinkText('general-usecase-initial-p-load');
diff --git a/x-pack/test/timeline/common/config.ts b/x-pack/test/timeline/common/config.ts
index 211f380b133a5..75f0eb24a6cd9 100644
--- a/x-pack/test/timeline/common/config.ts
+++ b/x-pack/test/timeline/common/config.ts
@@ -7,6 +7,7 @@
 
 import { CA_CERT_PATH } from '@kbn/dev-utils';
 import { FtrConfigProviderContext } from '@kbn/test';
+import { resolve } from 'path';
 
 import { services } from './services';
 import { getAllExternalServiceSimulatorPaths } from '../../alerting_api_integration/common/fixtures/plugins/actions_simulators/server/plugin';
@@ -40,6 +41,7 @@ const enabledActionTypes = [
 
 export function createTestConfig(name: string, options: CreateTestConfigOptions) {
   const { license = 'trial', disabledPlugins = [], ssl = false, testFiles = [] } = options;
+  const auditLogPath = resolve(__dirname, './audit.log');
 
   return async ({ readConfigFile }: FtrConfigProviderContext) => {
     const xPackApiIntegrationTestsConfig = await readConfigFile(
@@ -85,6 +87,10 @@ export function createTestConfig(name: string, options: CreateTestConfigOptions)
           // TO DO: Remove feature flags once we're good to go
           '--xpack.securitySolution.enableExperimental=["ruleRegistryEnabled"]',
           '--xpack.ruleRegistry.write.enabled=true',
+          '--xpack.security.audit.enabled=true',
+          '--xpack.security.audit.appender.type=file',
+          `--xpack.security.audit.appender.fileName=${auditLogPath}`,
+          '--xpack.security.audit.appender.layout.type=json',
           `--server.xsrf.allowlist=${JSON.stringify(getAllExternalServiceSimulatorPaths())}`,
           ...(ssl
             ? [
diff --git a/x-pack/test/timeline/security_and_spaces/tests/trial/events.ts b/x-pack/test/timeline/security_and_spaces/tests/trial/events.ts
index 91ad87737805f..a9ba7bd908a9e 100644
--- a/x-pack/test/timeline/security_and_spaces/tests/trial/events.ts
+++ b/x-pack/test/timeline/security_and_spaces/tests/trial/events.ts
@@ -5,9 +5,11 @@
  * 2.0.
  */
 
+import Path from 'path';
+import Fs from 'fs';
 import { JsonObject } from '@kbn/utility-types';
 import expect from '@kbn/expect';
-import { ALERT_UUID, ALERT_RULE_CONSUMER } from '@kbn/rule-data-utils';
+import { ALERT_RULE_CONSUMER } from '@kbn/rule-data-utils';
 
 import { User } from '../../../../rule_registry/common/lib/authentication/types';
 import { TimelineEdges, TimelineNonEcsData } from '../../../../../plugins/timelines/common/';
@@ -18,6 +20,7 @@ import {
   obsMinReadAlertsReadSpacesAll,
   obsMinRead,
   obsMinReadSpacesAll,
+  superUser,
 } from '../../../../rule_registry/common/lib/authentication/users';
 import {
   Direction,
@@ -25,6 +28,28 @@ import {
 } from '../../../../../plugins/security_solution/common/search_strategy';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
 
+class FileWrapper {
+  constructor(private readonly path: string) {}
+  async reset() {
+    // "touch" each file to ensure it exists and is empty before each test
+    await Fs.promises.writeFile(this.path, '');
+  }
+  async read() {
+    const content = await Fs.promises.readFile(this.path, { encoding: 'utf8' });
+    return content.trim().split('\n');
+  }
+  async readJSON() {
+    const content = await this.read();
+    return content.map((l) => JSON.parse(l));
+  }
+  // writing in a file is an async operation. we use this method to make sure logs have been written.
+  async isNotEmpty() {
+    const content = await this.read();
+    const line = content[0];
+    return line.length > 0;
+  }
+}
+
 interface TestCase {
   /** The space where the alert exists */
   space?: string;
@@ -44,6 +69,7 @@ const TO = '3000-01-01T00:00:00.000Z';
 const FROM = '2000-01-01T00:00:00.000Z';
 const TEST_URL = '/internal/search/timelineSearchStrategy/';
 const SPACE_1 = 'space1';
+const SPACE_2 = 'space2';
 
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext) => {
@@ -56,18 +82,9 @@ export default ({ getService }: FtrProviderContext) => {
       {
         field: '@timestamp',
       },
-      {
-        field: ALERT_RULE_CONSUMER,
-      },
-      {
-        field: ALERT_UUID,
-      },
-      {
-        field: 'event.kind',
-      },
     ],
     factoryQueryType: TimelineEventsQueries.all,
-    fieldRequested: ['@timestamp', 'message', ALERT_RULE_CONSUMER, ALERT_UUID, 'event.kind'],
+    fieldRequested: ['@timestamp'],
     fields: [],
     filterQuery: {
       bool: {
@@ -98,6 +115,10 @@ export default ({ getService }: FtrProviderContext) => {
   });
 
   describe('Timeline - Events', () => {
+    const logFilePath = Path.resolve(__dirname, '../../../common/audit.log');
+    const logFile = new FileWrapper(logFilePath);
+    const retry = getService('retry');
+
     before(async () => {
       await esArchiver.load('x-pack/test/functional/es_archives/rule_registry/alerts');
     });
@@ -162,14 +183,15 @@ export default ({ getService }: FtrProviderContext) => {
       });
     }
 
-    describe('alerts authentication', () => {
+    // TODO - tests need to be updated with new table logic
+    describe.skip('alerts authentication', () => {
       addTests({
         space: SPACE_1,
         featureIds: ['apm'],
         expectedNumberAlerts: 2,
         body: {
           ...getPostBody(),
-          defaultIndex: ['.alerts-*'],
+          defaultIndex: ['.alerts*'],
           entityType: 'alerts',
           alertConsumers: ['apm'],
         },
@@ -177,5 +199,81 @@ export default ({ getService }: FtrProviderContext) => {
         unauthorizedUsers: [obsMinRead, obsMinReadSpacesAll],
       });
     });
+
+    // FLAKY: https://github.com/elastic/kibana/issues/117462
+    describe.skip('logging', () => {
+      beforeEach(async () => {
+        await logFile.reset();
+      });
+
+      afterEach(async () => {
+        await logFile.reset();
+      });
+
+      it('logs success events when reading alerts', async () => {
+        await supertestWithoutAuth
+          .post(`${getSpaceUrlPrefix(SPACE_1)}${TEST_URL}`)
+          .auth(superUser.username, superUser.password)
+          .set('kbn-xsrf', 'true')
+          .set('Content-Type', 'application/json')
+          .send({
+            ...getPostBody(),
+            defaultIndex: ['.alerts-*'],
+            entityType: 'alerts',
+            alertConsumers: ['apm'],
+          })
+          .expect(200);
+        await retry.waitFor('logs event in the dest file', async () => await logFile.isNotEmpty());
+
+        const content = await logFile.readJSON();
+
+        const httpEvent = content.find((c) => c.event.action === 'http_request');
+        expect(httpEvent).to.be.ok();
+        expect(httpEvent.trace.id).to.be.ok();
+        expect(httpEvent.user.name).to.be(superUser.username);
+        expect(httpEvent.kibana.space_id).to.be('space1');
+        expect(httpEvent.http.request.method).to.be('post');
+        expect(httpEvent.url.path).to.be('/s/space1/internal/search/timelineSearchStrategy/');
+
+        const findEvents = content.filter((c) => c.event.action === 'alert_find');
+        expect(findEvents[0].trace.id).to.be.ok();
+        expect(findEvents[0].event.outcome).to.be('success');
+        expect(findEvents[0].user.name).to.be(superUser.username);
+        expect(findEvents[0].kibana.space_id).to.be('space1');
+      });
+
+      it('logs failure events when unauthorized to read alerts', async () => {
+        await supertestWithoutAuth
+          .post(`${getSpaceUrlPrefix(SPACE_2)}${TEST_URL}`)
+          .auth(obsMinRead.username, obsMinRead.password)
+          .set('kbn-xsrf', 'true')
+          .set('Content-Type', 'application/json')
+          .send({
+            ...getPostBody(),
+            defaultIndex: ['.alerts-*'],
+            entityType: 'alerts',
+            alertConsumers: ['apm'],
+          })
+          .expect(500);
+        await retry.waitFor('logs event in the dest file', async () => await logFile.isNotEmpty());
+
+        const content = await logFile.readJSON();
+
+        const httpEvent = content.find((c) => c.event.action === 'http_request');
+        expect(httpEvent).to.be.ok();
+        expect(httpEvent.trace.id).to.be.ok();
+        expect(httpEvent.user.name).to.be(obsMinRead.username);
+        expect(httpEvent.kibana.space_id).to.be(SPACE_2);
+        expect(httpEvent.http.request.method).to.be('post');
+        expect(httpEvent.url.path).to.be('/s/space2/internal/search/timelineSearchStrategy/');
+
+        const findEvents = content.filter((c) => c.event.action === 'alert_find');
+        expect(findEvents.length).to.equal(1);
+        expect(findEvents[0].trace.id).to.be.ok();
+        expect(findEvents[0].event.outcome).to.be('failure');
+        expect(findEvents[0].user.name).to.be(obsMinRead.username);
+        expect(findEvents[0].kibana.space_id).to.be(SPACE_2);
+      });
+    });
   });
 };
diff --git a/yarn.lock b/yarn.lock
index 0b3e852ff0d9b..805235f9e2ddd 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2592,7 +2592,7 @@
   dependencies:
     "@babel/plugin-syntax-jsx" "^7.2.0"
 
-"@emotion/babel-plugin@^11.2.0":
+"@emotion/babel-plugin@^11.0.0", "@emotion/babel-plugin@^11.2.0":
   version "11.2.0"
   resolved "https://registry.yarnpkg.com/@emotion/babel-plugin/-/babel-plugin-11.2.0.tgz#f25c6df8ec045dad5ae6ca63df0791673b98c920"
   integrity sha512-lsnQBnl3l4wu/FJoyHnYRpHJeIPNkOBMbtDUIXcO8luulwRKZXPvA10zd2eXVN6dABIWNX4E34en/jkejIg/yA==
@@ -2653,6 +2653,17 @@
     "@emotion/weak-memoize" "^0.2.5"
     stylis "^4.0.3"
 
+"@emotion/cache@^11.5.0":
+  version "11.5.0"
+  resolved "https://registry.yarnpkg.com/@emotion/cache/-/cache-11.5.0.tgz#a5eb78cbef8163939ee345e3ddf0af217b845e62"
+  integrity sha512-mAZ5QRpLriBtaj/k2qyrXwck6yeoz1V5lMt/jfj6igWU35yYlNKs2LziXVgvH81gnJZ+9QQNGelSsnuoAy6uIw==
+  dependencies:
+    "@emotion/memoize" "^0.7.4"
+    "@emotion/sheet" "^1.0.3"
+    "@emotion/utils" "^1.0.0"
+    "@emotion/weak-memoize" "^0.2.5"
+    stylis "^4.0.10"
+
 "@emotion/core@^10.0.9", "@emotion/core@^10.1.1":
   version "10.1.1"
   resolved "https://registry.yarnpkg.com/@emotion/core/-/core-10.1.1.tgz#c956c1365f2f2481960064bcb8c4732e5fb612c3"
@@ -2682,6 +2693,17 @@
     "@emotion/utils" "0.11.3"
     babel-plugin-emotion "^10.0.27"
 
+"@emotion/css@^11.4.0":
+  version "11.5.0"
+  resolved "https://registry.yarnpkg.com/@emotion/css/-/css-11.5.0.tgz#0a80017080cb44d47994fe576b9923bfc8b0f6ad"
+  integrity sha512-mqjz/3aqR9rp40M+pvwdKYWxlQK4Nj3cnNjo3Tx6SM14dSsEn7q/4W2/I7PlgG+mb27iITHugXuBIHH/QwUBVQ==
+  dependencies:
+    "@emotion/babel-plugin" "^11.0.0"
+    "@emotion/cache" "^11.5.0"
+    "@emotion/serialize" "^1.0.0"
+    "@emotion/sheet" "^1.0.3"
+    "@emotion/utils" "^1.0.0"
+
 "@emotion/hash@0.8.0", "@emotion/hash@^0.8.0":
   version "0.8.0"
   resolved "https://registry.yarnpkg.com/@emotion/hash/-/hash-0.8.0.tgz#bbbff68978fefdbe68ccb533bc8cbe1d1afb5413"
@@ -2780,6 +2802,11 @@
   resolved "https://registry.yarnpkg.com/@emotion/sheet/-/sheet-1.0.1.tgz#245f54abb02dfd82326e28689f34c27aa9b2a698"
   integrity sha512-GbIvVMe4U+Zc+929N1V7nW6YYJtidj31lidSmdYcWozwoBIObXBnaJkKNDjZrLm9Nc0BR+ZyHNaRZxqNZbof5g==
 
+"@emotion/sheet@^1.0.3":
+  version "1.0.3"
+  resolved "https://registry.yarnpkg.com/@emotion/sheet/-/sheet-1.0.3.tgz#00c326cd7985c5ccb8fe2c1b592886579dcfab8f"
+  integrity sha512-YoX5GyQ4db7LpbmXHMuc8kebtBGP6nZfRC5Z13OKJMixBEwdZrJ914D6yJv/P+ZH/YY3F5s89NYX2hlZAf3SRQ==
+
 "@emotion/styled-base@^10.0.27":
   version "10.0.31"
   resolved "https://registry.yarnpkg.com/@emotion/styled-base/-/styled-base-10.0.31.tgz#940957ee0aa15c6974adc7d494ff19765a2f742a"
@@ -6410,6 +6437,11 @@
   resolved "https://registry.yarnpkg.com/@types/js-cookie/-/js-cookie-2.2.6.tgz#f1a1cb35aff47bc5cfb05cb0c441ca91e914c26f"
   integrity sha512-+oY0FDTO2GYKEV0YPvSshGq9t7YozVkgvXLty7zogQNuCxBhT9/3INX9Q7H1aRZ4SUDRXAKlJuA4EA5nTt7SNw==
 
+"@types/js-levenshtein@^1.1.0":
+  version "1.1.0"
+  resolved "https://registry.yarnpkg.com/@types/js-levenshtein/-/js-levenshtein-1.1.0.tgz#9541eec4ad6e3ec5633270a3a2b55d981edc44a9"
+  integrity sha512-14t0v1ICYRtRVcHASzes0v/O+TIeASb8aD55cWF1PidtInhFWSXcmhzhHqGjUWf9SUq1w70cvd1cWKUULubAfQ==
+
 "@types/js-search@^1.4.0":
   version "1.4.0"
   resolved "https://registry.yarnpkg.com/@types/js-search/-/js-search-1.4.0.tgz#f2d4afa176a4fc7b17fb46a1593847887fa1fb7b"
@@ -6429,15 +6461,10 @@
     "@types/parse5" "*"
     "@types/tough-cookie" "*"
 
-"@types/json-schema@*", "@types/json-schema@^7.0.4":
-  version "7.0.5"
-  resolved "https://registry.yarnpkg.com/@types/json-schema/-/json-schema-7.0.5.tgz#dcce4430e64b443ba8945f0290fb564ad5bac6dd"
-  integrity sha512-7+2BITlgjgDhH0vvwZU/HZJVyk+2XUlvxXe8dFMedNX/aMkaOq++rMAFXc0tM7ij15QaWlbdQASBR9dihi+bDQ==
-
-"@types/json-schema@^7.0.6", "@types/json-schema@^7.0.7":
-  version "7.0.7"
-  resolved "https://registry.yarnpkg.com/@types/json-schema/-/json-schema-7.0.7.tgz#98a993516c859eb0d5c4c8f098317a9ea68db9ad"
-  integrity sha512-cxWFQVseBm6O9Gbw1IWb8r6OS4OhSt3hPZLkFApLjM8TEXROBuQGLAH2i2gZpcXdLBIrpXuTDhH7Vbm1iXmNGA==
+"@types/json-schema@*", "@types/json-schema@^7.0.4", "@types/json-schema@^7.0.6", "@types/json-schema@^7.0.7", "@types/json-schema@^7.0.9":
+  version "7.0.9"
+  resolved "https://registry.yarnpkg.com/@types/json-schema/-/json-schema-7.0.9.tgz#97edc9037ea0c38585320b28964dde3b39e4660d"
+  integrity sha512-qcUXuemtEu+E5wZSJHNxUXeCZhAfXKQ41D+duX+VYPde7xyEVZci+/oXKJL13tnRs9lR2pr4fod59GT6/X1/yQ==
 
 "@types/json-stable-stringify@^1.0.32":
   version "1.0.32"
@@ -6939,6 +6966,13 @@
     "@types/prop-types" "*"
     "@types/react" "*"
 
+"@types/react-vis@^1.11.9":
+  version "1.11.9"
+  resolved "https://registry.yarnpkg.com/@types/react-vis/-/react-vis-1.11.9.tgz#7d1534cf491d4563dd18c5ad0251d9ae66549323"
+  integrity sha512-n6sbTQuxpIzjf1FTIPhMdwBG0VNU96Oon7z3ASRSCnWT7ehL/zYJ/np0WAYFR/+c8OwNoSzny0OWlUmfvr/YCA==
+  dependencies:
+    "@types/react" "*"
+
 "@types/react-window@^1.8.2":
   version "1.8.2"
   resolved "https://registry.yarnpkg.com/@types/react-window/-/react-window-1.8.2.tgz#a5a6b2762ce73ffaab7911ee1397cf645f2459fe"
@@ -7350,20 +7384,33 @@
   resolved "https://registry.yarnpkg.com/@types/zen-observable/-/zen-observable-0.8.0.tgz#8b63ab7f1aa5321248aad5ac890a485656dcea4d"
   integrity sha512-te5lMAWii1uEJ4FwLjzdlbw3+n0FZNOvFXHxQDKeT0dilh7HOzdMzV2TrJVUzq8ep7J4Na8OUYPRLSQkJHAlrg==
 
-"@typescript-eslint/eslint-plugin@^4.31.2":
-  version "4.31.2"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/eslint-plugin/-/eslint-plugin-4.31.2.tgz#9f41efaee32cdab7ace94b15bd19b756dd099b0a"
-  integrity sha512-w63SCQ4bIwWN/+3FxzpnWrDjQRXVEGiTt9tJTRptRXeFvdZc/wLiz3FQUwNQ2CVoRGI6KUWMNUj/pk63noUfcA==
+"@typescript-eslint/eslint-plugin@^5.2.0":
+  version "5.2.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/eslint-plugin/-/eslint-plugin-5.2.0.tgz#2bdb247cc2e2afce7efbce09afb9a6f0a8a08434"
+  integrity sha512-qQwg7sqYkBF4CIQSyRQyqsYvP+g/J0To9ZPVNJpfxfekl5RmdvQnFFTVVwpRtaUDFNvjfe/34TgY/dpc3MgNTw==
   dependencies:
-    "@typescript-eslint/experimental-utils" "4.31.2"
-    "@typescript-eslint/scope-manager" "4.31.2"
-    debug "^4.3.1"
+    "@typescript-eslint/experimental-utils" "5.2.0"
+    "@typescript-eslint/scope-manager" "5.2.0"
+    debug "^4.3.2"
     functional-red-black-tree "^1.0.1"
-    regexpp "^3.1.0"
+    ignore "^5.1.8"
+    regexpp "^3.2.0"
     semver "^7.3.5"
     tsutils "^3.21.0"
 
-"@typescript-eslint/experimental-utils@4.31.2", "@typescript-eslint/experimental-utils@^4.0.1":
+"@typescript-eslint/experimental-utils@5.2.0":
+  version "5.2.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/experimental-utils/-/experimental-utils-5.2.0.tgz#e3b2cb9cd0aff9b50f68d9a414c299fd26b067e6"
+  integrity sha512-fWyT3Agf7n7HuZZRpvUYdFYbPk3iDCq6fgu3ulia4c7yxmPnwVBovdSOX7RL+k8u6hLbrXcdAehlWUVpGh6IEw==
+  dependencies:
+    "@types/json-schema" "^7.0.9"
+    "@typescript-eslint/scope-manager" "5.2.0"
+    "@typescript-eslint/types" "5.2.0"
+    "@typescript-eslint/typescript-estree" "5.2.0"
+    eslint-scope "^5.1.1"
+    eslint-utils "^3.0.0"
+
+"@typescript-eslint/experimental-utils@^4.0.1":
   version "4.31.2"
   resolved "https://registry.yarnpkg.com/@typescript-eslint/experimental-utils/-/experimental-utils-4.31.2.tgz#98727a9c1e977dd5d20c8705e69cd3c2a86553fa"
   integrity sha512-3tm2T4nyA970yQ6R3JZV9l0yilE2FedYg8dcXrTar34zC9r6JB7WyBQbpIVongKPlhEMjhQ01qkwrzWy38Bk1Q==
@@ -7375,15 +7422,15 @@
     eslint-scope "^5.1.1"
     eslint-utils "^3.0.0"
 
-"@typescript-eslint/parser@^4.31.2":
-  version "4.31.2"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/parser/-/parser-4.31.2.tgz#54aa75986e3302d91eff2bbbaa6ecfa8084e9c34"
-  integrity sha512-EcdO0E7M/sv23S/rLvenHkb58l3XhuSZzKf6DBvLgHqOYdL6YFMYVtreGFWirxaU2mS1GYDby3Lyxco7X5+Vjw==
+"@typescript-eslint/parser@^5.2.0":
+  version "5.2.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/parser/-/parser-5.2.0.tgz#dc081aa89de16b5676b10215519af3aa7b58fb72"
+  integrity sha512-Uyy4TjJBlh3NuA8/4yIQptyJb95Qz5PX//6p8n7zG0QnN4o3NF9Je3JHbVU7fxf5ncSXTmnvMtd/LDQWDk0YqA==
   dependencies:
-    "@typescript-eslint/scope-manager" "4.31.2"
-    "@typescript-eslint/types" "4.31.2"
-    "@typescript-eslint/typescript-estree" "4.31.2"
-    debug "^4.3.1"
+    "@typescript-eslint/scope-manager" "5.2.0"
+    "@typescript-eslint/types" "5.2.0"
+    "@typescript-eslint/typescript-estree" "5.2.0"
+    debug "^4.3.2"
 
 "@typescript-eslint/scope-manager@4.31.2":
   version "4.31.2"
@@ -7393,12 +7440,25 @@
     "@typescript-eslint/types" "4.31.2"
     "@typescript-eslint/visitor-keys" "4.31.2"
 
+"@typescript-eslint/scope-manager@5.2.0":
+  version "5.2.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/scope-manager/-/scope-manager-5.2.0.tgz#7ce8e4ab2baaa0ad5282913ea8e13ce03ec6a12a"
+  integrity sha512-RW+wowZqPzQw8MUFltfKYZfKXqA2qgyi6oi/31J1zfXJRpOn6tCaZtd9b5u9ubnDG2n/EMvQLeZrsLNPpaUiFQ==
+  dependencies:
+    "@typescript-eslint/types" "5.2.0"
+    "@typescript-eslint/visitor-keys" "5.2.0"
+
 "@typescript-eslint/types@4.31.2":
   version "4.31.2"
   resolved "https://registry.yarnpkg.com/@typescript-eslint/types/-/types-4.31.2.tgz#2aea7177d6d744521a168ed4668eddbd912dfadf"
   integrity sha512-kWiTTBCTKEdBGrZKwFvOlGNcAsKGJSBc8xLvSjSppFO88AqGxGNYtF36EuEYG6XZ9vT0xX8RNiHbQUKglbSi1w==
 
-"@typescript-eslint/typescript-estree@4.31.2", "@typescript-eslint/typescript-estree@^4.31.2":
+"@typescript-eslint/types@5.2.0":
+  version "5.2.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/types/-/types-5.2.0.tgz#7ad32d15abddb0ee968a330f0ea182ea544ef7cf"
+  integrity sha512-cTk6x08qqosps6sPyP2j7NxyFPlCNsJwSDasqPNjEQ8JMD5xxj2NHxcLin5AJQ8pAVwpQ8BMI3bTxR0zxmK9qQ==
+
+"@typescript-eslint/typescript-estree@4.31.2":
   version "4.31.2"
   resolved "https://registry.yarnpkg.com/@typescript-eslint/typescript-estree/-/typescript-estree-4.31.2.tgz#abfd50594d8056b37e7428df3b2d185ef2d0060c"
   integrity sha512-ieBq8U9at6PvaC7/Z6oe8D3czeW5d//Fo1xkF/s9394VR0bg/UaMYPdARiWyKX+lLEjY3w/FNZJxitMsiWv+wA==
@@ -7411,6 +7471,19 @@
     semver "^7.3.5"
     tsutils "^3.21.0"
 
+"@typescript-eslint/typescript-estree@5.2.0", "@typescript-eslint/typescript-estree@^5.2.0":
+  version "5.2.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/typescript-estree/-/typescript-estree-5.2.0.tgz#c22e0ff6f8a4a3f78504a80ebd686fe2870a68ae"
+  integrity sha512-RsdXq2XmVgKbm9nLsE3mjNUM7BTr/K4DYR9WfFVMUuozHWtH5gMpiNZmtrMG8GR385EOSQ3kC9HiEMJWimxd/g==
+  dependencies:
+    "@typescript-eslint/types" "5.2.0"
+    "@typescript-eslint/visitor-keys" "5.2.0"
+    debug "^4.3.2"
+    globby "^11.0.4"
+    is-glob "^4.0.3"
+    semver "^7.3.5"
+    tsutils "^3.21.0"
+
 "@typescript-eslint/visitor-keys@4.31.2":
   version "4.31.2"
   resolved "https://registry.yarnpkg.com/@typescript-eslint/visitor-keys/-/visitor-keys-4.31.2.tgz#7d5b4a4705db7fe59ecffb273c1d082760f635cc"
@@ -7419,6 +7492,14 @@
     "@typescript-eslint/types" "4.31.2"
     eslint-visitor-keys "^2.0.0"
 
+"@typescript-eslint/visitor-keys@5.2.0":
+  version "5.2.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/visitor-keys/-/visitor-keys-5.2.0.tgz#03522d35df98474f08e0357171a7d1b259a88f55"
+  integrity sha512-Nk7HizaXWWCUBfLA/rPNKMzXzWS8Wg9qHMuGtT+v2/YpPij4nVXrVJc24N/r5WrrmqK31jCrZxeHqIgqRzs0Xg==
+  dependencies:
+    "@typescript-eslint/types" "5.2.0"
+    eslint-visitor-keys "^3.0.0"
+
 "@ungap/promise-all-settled@1.1.2":
   version "1.1.2"
   resolved "https://registry.yarnpkg.com/@ungap/promise-all-settled/-/promise-all-settled-1.1.2.tgz#aa58042711d6e3275dd37dc597e5d31e8c290a44"
@@ -13962,16 +14043,16 @@ eslint-visitor-keys@^1.1.0, eslint-visitor-keys@^1.3.0:
   resolved "https://registry.yarnpkg.com/eslint-visitor-keys/-/eslint-visitor-keys-1.3.0.tgz#30ebd1ef7c2fdff01c3a4f151044af25fab0523e"
   integrity sha512-6J72N8UNa462wa/KFODt/PJ3IU60SDpC3QXC1Hjc1BXXpfL2C9R5+AU7jhe0F6GREqVMh4Juu+NY7xn+6dipUQ==
 
-eslint-visitor-keys@^2.0.0:
-  version "2.0.0"
-  resolved "https://registry.yarnpkg.com/eslint-visitor-keys/-/eslint-visitor-keys-2.0.0.tgz#21fdc8fbcd9c795cc0321f0563702095751511a8"
-  integrity sha512-QudtT6av5WXels9WjIM7qz1XD1cWGvX4gGXvp/zBn9nXG02D0utdU3Em2m/QjTnrsk6bBjmCygl3rmj118msQQ==
-
-eslint-visitor-keys@^2.1.0:
+eslint-visitor-keys@^2.0.0, eslint-visitor-keys@^2.1.0:
   version "2.1.0"
   resolved "https://registry.yarnpkg.com/eslint-visitor-keys/-/eslint-visitor-keys-2.1.0.tgz#f65328259305927392c938ed44eb0a5c9b2bd303"
   integrity sha512-0rSmRBzXgDzIsD6mGdJgevzgezI534Cer5L/vyMX0kHzT/jiB43jRhd9YUlMGYLQy2zprNmoT8qasCGtY+QaKw==
 
+eslint-visitor-keys@^3.0.0:
+  version "3.0.0"
+  resolved "https://registry.yarnpkg.com/eslint-visitor-keys/-/eslint-visitor-keys-3.0.0.tgz#e32e99c6cdc2eb063f204eda5db67bfe58bb4186"
+  integrity sha512-mJOZa35trBTb3IyRmo8xmKBZlxf+N7OnUl4+ZhJHs/r+0770Wh/LEACE2pqMGMe27G/4y8P2bYGk4J70IC5k1Q==
+
 eslint@^7.32.0:
   version "7.32.0"
   resolved "https://registry.yarnpkg.com/eslint/-/eslint-7.32.0.tgz#c6d328a14be3fb08c8d1d21e12c02fdb7a2a812d"
@@ -15659,10 +15740,10 @@ globby@^10.0.1:
     merge2 "^1.2.3"
     slash "^3.0.0"
 
-globby@^11.0.1, globby@^11.0.3:
-  version "11.0.3"
-  resolved "https://registry.yarnpkg.com/globby/-/globby-11.0.3.tgz#9b1f0cb523e171dd1ad8c7b2a9fb4b644b9593cb"
-  integrity sha512-ffdmosjA807y7+lA1NM0jELARVmYul/715xiILEjo3hBLPTcirgQNnXECn5g3mtR8TOLCVbkfua1Hpen25/Xcg==
+globby@^11.0.1, globby@^11.0.3, globby@^11.0.4:
+  version "11.0.4"
+  resolved "https://registry.yarnpkg.com/globby/-/globby-11.0.4.tgz#2cbaff77c2f2a62e71e9b2813a67b97a3a3001a5"
+  integrity sha512-9O4MVG9ioZJ08ffbcyVYyLOJLk5JQ688pJ4eMGLpdWLHq/Wr1D9BlriLQyL0E+jbkuePVZXYFj47QM/v093wHg==
   dependencies:
     array-union "^2.1.0"
     dir-glob "^3.0.1"
@@ -17289,10 +17370,10 @@ is-glob@^3.0.0, is-glob@^3.1.0:
   dependencies:
     is-extglob "^2.1.0"
 
-is-glob@^4.0.0, is-glob@^4.0.1, is-glob@~4.0.1:
-  version "4.0.1"
-  resolved "https://registry.yarnpkg.com/is-glob/-/is-glob-4.0.1.tgz#7567dbe9f2f5e2467bc77ab83c4a29482407a5dc"
-  integrity sha512-5G0tKtBTFImOqDnLB2hG6Bp2qcKEFduo4tZu9MT/H6NQv/ghhy30o55ufafxJ/LdH79LLs2Kfrn85TLKyA7BUg==
+is-glob@^4.0.0, is-glob@^4.0.1, is-glob@^4.0.3, is-glob@~4.0.1:
+  version "4.0.3"
+  resolved "https://registry.yarnpkg.com/is-glob/-/is-glob-4.0.3.tgz#64f61e42cbbb2eec2071a9dac0b28ba1e65d5084"
+  integrity sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==
   dependencies:
     is-extglob "^2.1.1"
 
@@ -24806,10 +24887,10 @@ regexp.prototype.flags@^1.2.0, regexp.prototype.flags@^1.3.0, regexp.prototype.f
     call-bind "^1.0.2"
     define-properties "^1.1.3"
 
-regexpp@^3.0.0, regexpp@^3.1.0:
-  version "3.1.0"
-  resolved "https://registry.yarnpkg.com/regexpp/-/regexpp-3.1.0.tgz#206d0ad0a5648cffbdb8ae46438f3dc51c9f78e2"
-  integrity sha512-ZOIzd8yVsQQA7j8GCSlPGXwg5PfmA1mrq0JP4nGhh54LaKN3xdai/vHUDu74pKwV8OxseMS65u2NImosQcSD0Q==
+regexpp@^3.0.0, regexpp@^3.1.0, regexpp@^3.2.0:
+  version "3.2.0"
+  resolved "https://registry.yarnpkg.com/regexpp/-/regexpp-3.2.0.tgz#0425a2768d8f23bad70ca4b90461fa2f1213e1b2"
+  integrity sha512-pq2bWo9mVD43nbts2wGv17XLiNLya+GklZ8kaDLV2Z08gDCsGpnKn9BFMepvWuHCbyVvY7J5o5+BVvoQbmlJLg==
 
 regexpu-core@^4.7.1:
   version "4.7.1"
@@ -27229,6 +27310,11 @@ stylis@^3.5.0:
   resolved "https://registry.yarnpkg.com/stylis/-/stylis-3.5.4.tgz#f665f25f5e299cf3d64654ab949a57c768b73fbe"
   integrity sha512-8/3pSmthWM7lsPBKv7NXkzn2Uc9W7NotcwGNpJaa3k7WMM1XDCA4MgT5k/8BIexd5ydZdboXtU90XH9Ec4Bv/Q==
 
+stylis@^4.0.10:
+  version "4.0.10"
+  resolved "https://registry.yarnpkg.com/stylis/-/stylis-4.0.10.tgz#446512d1097197ab3f02fb3c258358c3f7a14240"
+  integrity sha512-m3k+dk7QeJw660eIKRRn3xPF6uuvHs/FFzjX3HQ5ove0qYsiygoAhwn5a3IYKaZPo5LrYD0rfVmtv1gNY1uYwg==
+
 stylis@^4.0.3:
   version "4.0.7"
   resolved "https://registry.yarnpkg.com/stylis/-/stylis-4.0.7.tgz#412a90c28079417f3d27c028035095e4232d2904"