From 68b8ac3fefa99d5444bdbdd9b20d4935ef8fc7d9 Mon Sep 17 00:00:00 2001
From: Philippe Oberti <philippe.oberti@elastic.co>
Date: Tue, 18 Jul 2023 09:23:13 +0200
Subject: [PATCH 01/14] [Security Solution] expandable flyout - add status to
 flyout header (#161942)

---
 .../alert_details_right_panel.cy.ts           |  3 +
 .../alert_details_right_panel.ts              |  4 +
 .../__snapshots__/index.test.tsx.snap         |  1 +
 .../right/components/header_title.test.tsx    | 17 +++--
 .../flyout/right/components/header_title.tsx  | 16 +++-
 .../right/components/status.stories.tsx       | 59 +++++++++++++++
 .../flyout/right/components/status.test.tsx   | 75 +++++++++++++++++++
 .../public/flyout/right/components/status.tsx | 65 ++++++++++++++++
 .../flyout/right/components/test_ids.ts       |  1 +
 .../flyout/right/components/translations.ts   |  7 ++
 .../public/flyout/right/context.tsx           |  2 +
 .../timeline/body/renderers/rule_status.tsx   |  1 +
 12 files changed, 241 insertions(+), 10 deletions(-)
 create mode 100644 x-pack/plugins/security_solution/public/flyout/right/components/status.stories.tsx
 create mode 100644 x-pack/plugins/security_solution/public/flyout/right/components/status.test.tsx
 create mode 100644 x-pack/plugins/security_solution/public/flyout/right/components/status.tsx

diff --git a/x-pack/plugins/security_solution/cypress/e2e/investigations/alerts/expandable_flyout/alert_details_right_panel.cy.ts b/x-pack/plugins/security_solution/cypress/e2e/investigations/alerts/expandable_flyout/alert_details_right_panel.cy.ts
index fb21d9d5a445d..44a2326aebc8e 100644
--- a/x-pack/plugins/security_solution/cypress/e2e/investigations/alerts/expandable_flyout/alert_details_right_panel.cy.ts
+++ b/x-pack/plugins/security_solution/cypress/e2e/investigations/alerts/expandable_flyout/alert_details_right_panel.cy.ts
@@ -43,6 +43,7 @@ import {
   DOCUMENT_DETAILS_FLYOUT_HEADER_RISK_SCORE_VALUE,
   DOCUMENT_DETAILS_FLYOUT_HEADER_SEVERITY,
   DOCUMENT_DETAILS_FLYOUT_HEADER_SEVERITY_VALUE,
+  DOCUMENT_DETAILS_FLYOUT_HEADER_STATUS,
   DOCUMENT_DETAILS_FLYOUT_HEADER_TITLE,
   DOCUMENT_DETAILS_FLYOUT_JSON_TAB,
   DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB,
@@ -85,6 +86,8 @@ describe(
 
       cy.get(DOCUMENT_DETAILS_FLYOUT_HEADER_CHAT_BUTTON).should('be.visible');
 
+      cy.get(DOCUMENT_DETAILS_FLYOUT_HEADER_STATUS).should('be.visible');
+
       cy.get(DOCUMENT_DETAILS_FLYOUT_HEADER_RISK_SCORE).should('be.visible');
       cy.get(DOCUMENT_DETAILS_FLYOUT_HEADER_RISK_SCORE_VALUE)
         .should('be.visible')
diff --git a/x-pack/plugins/security_solution/cypress/screens/expandable_flyout/alert_details_right_panel.ts b/x-pack/plugins/security_solution/cypress/screens/expandable_flyout/alert_details_right_panel.ts
index 50de0eb348264..60ebbe7fdd071 100644
--- a/x-pack/plugins/security_solution/cypress/screens/expandable_flyout/alert_details_right_panel.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/expandable_flyout/alert_details_right_panel.ts
@@ -20,6 +20,7 @@ import {
   FLYOUT_HEADER_RISK_SCORE_VALUE_TEST_ID,
   FLYOUT_HEADER_SEVERITY_TITLE_TEST_ID,
   FLYOUT_HEADER_SEVERITY_VALUE_TEST_ID,
+  FLYOUT_HEADER_STATUS_BUTTON_TEST_ID,
   FLYOUT_HEADER_TITLE_TEST_ID,
 } from '../../../public/flyout/right/components/test_ids';
 
@@ -42,6 +43,9 @@ export const DOCUMENT_DETAILS_FLYOUT_OVERVIEW_TAB =
   getDataTestSubjectSelector(OVERVIEW_TAB_TEST_ID);
 export const DOCUMENT_DETAILS_FLYOUT_TABLE_TAB = getDataTestSubjectSelector(TABLE_TAB_TEST_ID);
 export const DOCUMENT_DETAILS_FLYOUT_JSON_TAB = getDataTestSubjectSelector(JSON_TAB_TEST_ID);
+export const DOCUMENT_DETAILS_FLYOUT_HEADER_STATUS = getDataTestSubjectSelector(
+  FLYOUT_HEADER_STATUS_BUTTON_TEST_ID
+);
 export const DOCUMENT_DETAILS_FLYOUT_HEADER_RISK_SCORE = getDataTestSubjectSelector(
   FLYOUT_HEADER_RISK_SCORE_TITLE_TEST_ID
 );
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/overview/__snapshots__/index.test.tsx.snap b/x-pack/plugins/security_solution/public/common/components/event_details/overview/__snapshots__/index.test.tsx.snap
index 6ee4557d2ee22..c676809c3c2a5 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/overview/__snapshots__/index.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/overview/__snapshots__/index.test.tsx.snap
@@ -91,6 +91,7 @@ exports[`Event Details Overview Cards renders rows and spacers correctly 1`] = `
                   <button
                     aria-label="Click to change alert status"
                     class="euiBadge c3 emotion-euiBadge-primary-clickable"
+                    data-test-subj="rule-status-badge"
                   >
                     <span
                       class="euiBadge__content emotion-euiBadge__content"
diff --git a/x-pack/plugins/security_solution/public/flyout/right/components/header_title.test.tsx b/x-pack/plugins/security_solution/public/flyout/right/components/header_title.test.tsx
index d710945e980be..010535ffc55c7 100644
--- a/x-pack/plugins/security_solution/public/flyout/right/components/header_title.test.tsx
+++ b/x-pack/plugins/security_solution/public/flyout/right/components/header_title.test.tsx
@@ -7,6 +7,7 @@
 
 import React from 'react';
 import { render } from '@testing-library/react';
+import { ExpandableFlyoutContext } from '@kbn/expandable-flyout/src/context';
 import { RightPanelContext } from '../context';
 import {
   FLYOUT_HEADER_CHAT_BUTTON_TEST_ID,
@@ -21,7 +22,7 @@ import moment from 'moment-timezone';
 import { useDateFormat, useTimeZone } from '../../../common/lib/kibana';
 import { mockDataFormattedForFieldBrowser, mockGetFieldsData } from '../mocks/mock_context';
 import { useAssistant } from '../hooks/use_assistant';
-import { MockAssistantProvider } from '../../../common/mock/mock_assistant_provider';
+import { TestProvidersComponent } from '../../../common/mock';
 
 jest.mock('../../../common/lib/kibana');
 jest.mock('../hooks/use_assistant');
@@ -31,13 +32,17 @@ moment.tz.setDefault('UTC');
 
 const dateFormat = 'MMM D, YYYY @ HH:mm:ss.SSS';
 
+const flyoutContextValue = {} as unknown as ExpandableFlyoutContext;
+
 const renderHeader = (contextValue: RightPanelContext) =>
   render(
-    <MockAssistantProvider>
-      <RightPanelContext.Provider value={contextValue}>
-        <HeaderTitle />
-      </RightPanelContext.Provider>
-    </MockAssistantProvider>
+    <TestProvidersComponent>
+      <ExpandableFlyoutContext.Provider value={flyoutContextValue}>
+        <RightPanelContext.Provider value={contextValue}>
+          <HeaderTitle />
+        </RightPanelContext.Provider>
+      </ExpandableFlyoutContext.Provider>
+    </TestProvidersComponent>
   );
 
 describe('<HeaderTitle />', () => {
diff --git a/x-pack/plugins/security_solution/public/flyout/right/components/header_title.tsx b/x-pack/plugins/security_solution/public/flyout/right/components/header_title.tsx
index 0dea8c76f64cb..810df9ee67bab 100644
--- a/x-pack/plugins/security_solution/public/flyout/right/components/header_title.tsx
+++ b/x-pack/plugins/security_solution/public/flyout/right/components/header_title.tsx
@@ -10,6 +10,7 @@ import React, { memo } from 'react';
 import { NewChatById } from '@kbn/elastic-assistant';
 import { EuiFlexGroup, EuiFlexItem, EuiSpacer, EuiTitle } from '@elastic/eui';
 import { isEmpty } from 'lodash';
+import { DocumentStatus } from './status';
 import { useAssistant } from '../hooks/use_assistant';
 import {
   ALERT_SUMMARY_CONVERSATION_ID,
@@ -67,10 +68,17 @@ export const HeaderTitle: FC = memo(() => {
           </EuiFlexItem>
         </EuiFlexGroup>
       </EuiTitle>
-      <EuiSpacer size="m" />
-      {timestamp && <PreferenceFormattedDate value={new Date(timestamp)} />}
-      <EuiSpacer size="m" />
-      <EuiFlexGroup direction="row" gutterSize="l">
+      <EuiSpacer size="xs" />
+      <EuiFlexGroup direction="row" gutterSize="m">
+        <EuiFlexItem grow={false}>
+          <DocumentStatus />
+        </EuiFlexItem>
+        <EuiFlexItem grow={false}>
+          {timestamp && <PreferenceFormattedDate value={new Date(timestamp)} />}
+        </EuiFlexItem>
+      </EuiFlexGroup>
+      <EuiSpacer size="xs" />
+      <EuiFlexGroup direction="row" gutterSize="m">
         <EuiFlexItem grow={false}>
           <DocumentSeverity />
         </EuiFlexItem>
diff --git a/x-pack/plugins/security_solution/public/flyout/right/components/status.stories.tsx b/x-pack/plugins/security_solution/public/flyout/right/components/status.stories.tsx
new file mode 100644
index 0000000000000..5de5bd7cd3625
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/flyout/right/components/status.stories.tsx
@@ -0,0 +1,59 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import type { Story } from '@storybook/react';
+import { ExpandableFlyoutContext } from '@kbn/expandable-flyout/src/context';
+import { StorybookProviders } from '../../../common/mock/storybook_providers';
+import { DocumentStatus } from './status';
+import { RightPanelContext } from '../context';
+import { mockBrowserFields, mockDataFormattedForFieldBrowser } from '../mocks/mock_context';
+
+export default {
+  component: DocumentStatus,
+  title: 'Flyout/Status',
+};
+
+const flyoutContextValue = {
+  closeFlyout: () => {},
+} as unknown as ExpandableFlyoutContext;
+
+export const Default: Story<void> = () => {
+  const contextValue = {
+    eventId: 'eventId',
+    browserFields: mockBrowserFields,
+    dataFormattedForFieldBrowser: mockDataFormattedForFieldBrowser,
+    scopeId: 'alerts-page',
+  } as unknown as RightPanelContext;
+
+  return (
+    <StorybookProviders>
+      <ExpandableFlyoutContext.Provider value={flyoutContextValue}>
+        <RightPanelContext.Provider value={contextValue}>
+          <DocumentStatus />
+        </RightPanelContext.Provider>
+      </ExpandableFlyoutContext.Provider>
+    </StorybookProviders>
+  );
+};
+
+export const Empty: Story<void> = () => {
+  const contextValue = {
+    eventId: 'eventId',
+    browserFields: {},
+    dataFormattedForFieldBrowser: [],
+    scopeId: 'scopeId',
+  } as unknown as RightPanelContext;
+
+  return (
+    <ExpandableFlyoutContext.Provider value={flyoutContextValue}>
+      <RightPanelContext.Provider value={contextValue}>
+        <DocumentStatus />
+      </RightPanelContext.Provider>
+    </ExpandableFlyoutContext.Provider>
+  );
+};
diff --git a/x-pack/plugins/security_solution/public/flyout/right/components/status.test.tsx b/x-pack/plugins/security_solution/public/flyout/right/components/status.test.tsx
new file mode 100644
index 0000000000000..379181d9691e7
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/flyout/right/components/status.test.tsx
@@ -0,0 +1,75 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { render } from '@testing-library/react';
+import { ExpandableFlyoutContext } from '@kbn/expandable-flyout/src/context';
+import { RightPanelContext } from '../context';
+import { DocumentStatus } from './status';
+import { mockDataFormattedForFieldBrowser } from '../mocks/mock_context';
+import { TestProviders } from '../../../common/mock';
+import { useAlertsActions } from '../../../detections/components/alerts_table/timeline_actions/use_alerts_actions';
+import { FLYOUT_HEADER_STATUS_BUTTON_TEST_ID } from './test_ids';
+
+jest.mock('../../../detections/components/alerts_table/timeline_actions/use_alerts_actions');
+
+const flyoutContextValue = {
+  closeFlyout: jest.fn(),
+} as unknown as ExpandableFlyoutContext;
+
+const renderStatus = (contextValue: RightPanelContext) =>
+  render(
+    <TestProviders>
+      <ExpandableFlyoutContext.Provider value={flyoutContextValue}>
+        <RightPanelContext.Provider value={contextValue}>
+          <DocumentStatus />
+        </RightPanelContext.Provider>
+      </ExpandableFlyoutContext.Provider>
+    </TestProviders>
+  );
+
+const actionItem = {
+  key: 'key',
+  name: 'name',
+  'data-test-subj': 'data-test-subj',
+};
+
+(useAlertsActions as jest.Mock).mockReturnValue({
+  actionItems: [actionItem],
+});
+
+describe('<DocumentStatus />', () => {
+  it('should render status information', () => {
+    const contextValue = {
+      eventId: 'eventId',
+      browserFields: {},
+      dataFormattedForFieldBrowser: mockDataFormattedForFieldBrowser,
+      scopeId: 'scopeId',
+    } as unknown as RightPanelContext;
+
+    const { getByTestId, getByText } = renderStatus(contextValue);
+
+    expect(getByTestId(FLYOUT_HEADER_STATUS_BUTTON_TEST_ID)).toBeInTheDocument();
+    expect(getByText('open')).toBeInTheDocument();
+
+    getByTestId(FLYOUT_HEADER_STATUS_BUTTON_TEST_ID).click();
+    expect(getByTestId('data-test-subj')).toBeInTheDocument();
+  });
+
+  it('should render empty component', () => {
+    const contextValue = {
+      eventId: 'eventId',
+      browserFields: {},
+      dataFormattedForFieldBrowser: [],
+      scopeId: 'scopeId',
+    } as unknown as RightPanelContext;
+
+    const { container } = renderStatus(contextValue);
+
+    expect(container).toBeEmptyDOMElement();
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/flyout/right/components/status.tsx b/x-pack/plugins/security_solution/public/flyout/right/components/status.tsx
new file mode 100644
index 0000000000000..b71bbfbdcf3af
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/flyout/right/components/status.tsx
@@ -0,0 +1,65 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { FC } from 'react';
+import React, { useMemo } from 'react';
+import { find } from 'lodash/fp';
+import { useExpandableFlyoutContext } from '@kbn/expandable-flyout';
+import type {
+  EnrichedFieldInfo,
+  EnrichedFieldInfoWithValues,
+} from '../../../common/components/event_details/types';
+import { SIGNAL_STATUS_FIELD_NAME } from '../../../timelines/components/timeline/body/renderers/constants';
+import { StatusPopoverButton } from '../../../common/components/event_details/overview/status_popover_button';
+import { useRightPanelContext } from '../context';
+import { getEnrichedFieldInfo } from '../../../common/components/event_details/helpers';
+
+/**
+ * Checks if the field info has data to convert EnrichedFieldInfo into EnrichedFieldInfoWithValues
+ */
+function hasData(fieldInfo?: EnrichedFieldInfo): fieldInfo is EnrichedFieldInfoWithValues {
+  return !!fieldInfo && Array.isArray(fieldInfo.values);
+}
+
+/**
+ * Document details status displayed in flyout right section header
+ */
+export const DocumentStatus: FC = () => {
+  const { closeFlyout } = useExpandableFlyoutContext();
+  const { eventId, browserFields, dataFormattedForFieldBrowser, scopeId } = useRightPanelContext();
+
+  const statusData = useMemo(() => {
+    const item = find(
+      { field: SIGNAL_STATUS_FIELD_NAME, category: 'kibana' },
+      dataFormattedForFieldBrowser
+    );
+    return (
+      item &&
+      getEnrichedFieldInfo({
+        eventId,
+        contextId: scopeId,
+        scopeId,
+        browserFields: browserFields || {},
+        item,
+      })
+    );
+  }, [browserFields, dataFormattedForFieldBrowser, eventId, scopeId]);
+
+  if (!statusData || !hasData(statusData)) return null;
+
+  return (
+    <StatusPopoverButton
+      eventId={eventId}
+      contextId={scopeId}
+      enrichedFieldInfo={statusData}
+      scopeId={scopeId}
+      handleOnEventClosed={closeFlyout}
+    />
+  );
+};
+
+DocumentStatus.displayName = 'DocumentStatus';
diff --git a/x-pack/plugins/security_solution/public/flyout/right/components/test_ids.ts b/x-pack/plugins/security_solution/public/flyout/right/components/test_ids.ts
index 2740ae4b160f4..6c5b8a12e030c 100644
--- a/x-pack/plugins/security_solution/public/flyout/right/components/test_ids.ts
+++ b/x-pack/plugins/security_solution/public/flyout/right/components/test_ids.ts
@@ -14,6 +14,7 @@ export const EXPAND_DETAILS_BUTTON_TEST_ID =
   'securitySolutionDocumentDetailsFlyoutHeaderExpandDetailButton';
 export const COLLAPSE_DETAILS_BUTTON_TEST_ID =
   'securitySolutionDocumentDetailsFlyoutHeaderCollapseDetailButton';
+export const FLYOUT_HEADER_STATUS_BUTTON_TEST_ID = 'rule-status-badge';
 export const FLYOUT_HEADER_SEVERITY_TITLE_TEST_ID =
   'securitySolutionAlertDetailsFlyoutHeaderSeverityTitle';
 export const FLYOUT_HEADER_SEVERITY_VALUE_TEST_ID = 'severity';
diff --git a/x-pack/plugins/security_solution/public/flyout/right/components/translations.ts b/x-pack/plugins/security_solution/public/flyout/right/components/translations.ts
index 1d503f082de67..950d2e848dfc8 100644
--- a/x-pack/plugins/security_solution/public/flyout/right/components/translations.ts
+++ b/x-pack/plugins/security_solution/public/flyout/right/components/translations.ts
@@ -31,6 +31,13 @@ export const SEVERITY_TITLE = i18n.translate(
   }
 );
 
+export const STATUS_TITLE = i18n.translate(
+  'xpack.securitySolution.flyout.documentDetails.statusTitle',
+  {
+    defaultMessage: 'Status',
+  }
+);
+
 export const RISK_SCORE_TITLE = i18n.translate(
   'xpack.securitySolution.flyout.documentDetails.riskScoreTitle',
   {
diff --git a/x-pack/plugins/security_solution/public/flyout/right/context.tsx b/x-pack/plugins/security_solution/public/flyout/right/context.tsx
index bb1ac1fd2b7ae..7b12fc3a3a6cb 100644
--- a/x-pack/plugins/security_solution/public/flyout/right/context.tsx
+++ b/x-pack/plugins/security_solution/public/flyout/right/context.tsx
@@ -77,6 +77,8 @@ export const RightPanelProvider = ({
   children,
 }: RightPanelProviderProps) => {
   const currentSpaceId = useSpaceId();
+  // TODO Replace getAlertIndexAlias way to retrieving the eventIndex with the GET /_alias
+  //  https://github.com/elastic/kibana/issues/113063
   const eventIndex = indexName ? getAlertIndexAlias(indexName, currentSpaceId) ?? indexName : '';
   const [{ pageName }] = useRouteSpy();
   const sourcererScope =
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/rule_status.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/rule_status.tsx
index ef205eb00be45..a3a2bb17cdd43 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/rule_status.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/rule_status.tsx
@@ -57,6 +57,7 @@ const RuleStatusComponent: React.FC<Props> = ({
       onClickAriaLabel={onClickAriaLabel}
       iconType={iconType}
       iconSide={iconSide}
+      data-test-subj="rule-status-badge"
     >
       {value}
     </StyledEuiBadge>

From a38de17c6e4f376444ba1ddbef4c2e4d569b9a80 Mon Sep 17 00:00:00 2001
From: Gloria Hornero <gloria.hornero@elastic.co>
Date: Tue, 18 Jul 2023 10:13:47 +0200
Subject: [PATCH 02/14] [Security Solution][Serverless] Adding screenshots
 folder to Cypress (#162107)

---
 .../functional/test_suites/security/cypress/cypress.config.ts    | 1 +
 1 file changed, 1 insertion(+)

diff --git a/x-pack/test_serverless/functional/test_suites/security/cypress/cypress.config.ts b/x-pack/test_serverless/functional/test_suites/security/cypress/cypress.config.ts
index b7a396652163b..5791794ce0c19 100644
--- a/x-pack/test_serverless/functional/test_suites/security/cypress/cypress.config.ts
+++ b/x-pack/test_serverless/functional/test_suites/security/cypress/cypress.config.ts
@@ -12,6 +12,7 @@ export default defineCypressConfig({
   execTimeout: 60000,
   pageLoadTimeout: 60000,
   responseTimeout: 60000,
+  screenshotsFolder: '../../../../../../target/kibana-security-solution/cypress/screenshots',
   trashAssetsBeforeRuns: false,
   video: false,
   viewportHeight: 946,

From e1352db526fdc33841823b378ceacbccaee4f9c7 Mon Sep 17 00:00:00 2001
From: Jill Guyonnet <jill.guyonnet@elastic.co>
Date: Tue, 18 Jul 2023 10:53:07 +0200
Subject: [PATCH 03/14] [Fleet] Exclude Synthetics from per-policy-outputs
 (#161949)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Summary

Closes https://github.com/elastic/kibana/issues/155725

### Context

Basic license users cannot use Synthetics private locations and a
default Logstash output (cf. [this
comment](https://github.com/elastic/kibana/issues/155725#issuecomment-1633391319)).
This is because under Basic license per policy output is not allowed.

There was a [similar
issue](https://github.com/elastic/kibana/issues/152234) with Fleet
server that was fixed by adding logic to exclude the fleet server
integration from the checks
([PR](https://github.com/elastic/kibana/pull/153226)).

This PR follows a very similar approach for the synthetics integration.

### Changes

Compare these to [the corresponding changes that were made for Fleet
server](https://github.com/elastic/kibana/pull/153226).

- If the user tries to change the default output from ES to Logstash and
there are agent policies using synthetics, then an error is thrown.
- If an existing Logstash output is made to be the default output and
there are agent policies using synthetics, then these policies will
still be using the previous default ES output.
- If the default output is of type Logstash with an agent policy using
synthetics and another ES output, then if the user tries to delete the
ES output an error is thrown.
- Logstash type outputs are disabled in the agent policy settings if the
policy uses synthetics.

### Steps for testing

⚠️ Ideally the complete scenario reported
[here](https://github.com/elastic/kibana/issues/155725#issuecomment-1633391319)
should be tested. I was having some issues running a dev setup with a
proper Logstash output, so the steps below are not end-to-end (similar
to https://github.com/elastic/kibana/pull/153226).

1. Start with a single default ES output, an agent policy (1) with
synthetics and another (2) without (NB: you can also test combinations
with fleet server; if an error is thrown, the error for fleet server
would be thrown before the one for synthetics).
2. Edit the default ES output to be a Logstash output; this should fail
and thrown the following error:
![Screenshot 2023-07-14 at 15 07
56](https://github.com/elastic/kibana/assets/23701614/bf716a7a-745b-4b89-aa49-0ced2cc825a2)
3. Create a new Logstash output and make it default on creation. Go the
agent policies and check the policies settings: the `Output for
integrations` setting should still be set to the previous ES default
output for policies with synthetics (and/or fleet server), and should
have switched to the new Logstash default for other policies.
4. Repeat the previous steps, but this time first create the Logstash
output and then edit it to make it default. This tests the update
behaviour as opposed to create. You will see the following warning:
![Screenshot 2023-07-14 at 15 06
35](https://github.com/elastic/kibana/assets/23701614/283ee6c2-6d84-4847-bd3d-3c4ff734b2d6)
5. Still with the default Logstash output, try to delete the ES output
(that is still used by policies with synthetics/fleet server(. This
should fail with the following error:
![Screenshot 2023-07-14 at 15 16
03](https://github.com/elastic/kibana/assets/23701614/62dfe4c1-aed6-4d85-83f0-92985eab9336)
6. (Basic license constraint) Create another ES output (not default). Go
the agent policies and check the policies settings: policies with
synthetics (or fleet server) should be allowed to switch the `Output for
integrations` setting to the new ES output:
![Screenshot 2023-07-14 at 15 18
56](https://github.com/elastic/kibana/assets/23701614/98deb4fc-abb1-40e2-9556-1a4ecfa96923)
In contrast, policies without these integrations should be constrained
to the default Logstash output:
![Screenshot 2023-07-14 at 15 19
19](https://github.com/elastic/kibana/assets/23701614/9856de1f-675b-47db-a471-9796239f0f85)

### Checklist

- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

---------

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../common/services/agent_policies_helpers.ts |  13 +-
 x-pack/plugins/fleet/common/services/index.ts |   6 +-
 .../fleet/common/services/output_helpers.ts   |  12 +-
 .../hooks.test.tsx                            |  16 +-
 .../agent_policy_advanced_fields/hooks.tsx    |  23 +-
 .../edit_output_flyout/confirm_update.tsx     |   4 +-
 .../agent_policies/output_helpers.test.ts     |   4 +-
 .../agent_policies/outputs_helpers.ts         |   5 +-
 .../fleet/server/services/agent_policy.ts     |   5 +
 .../fleet/server/services/output.test.ts      | 390 +++++++++++++-----
 .../plugins/fleet/server/services/output.ts   |  50 +--
 11 files changed, 377 insertions(+), 151 deletions(-)

diff --git a/x-pack/plugins/fleet/common/services/agent_policies_helpers.ts b/x-pack/plugins/fleet/common/services/agent_policies_helpers.ts
index 9db799997fad3..52ce24634886e 100644
--- a/x-pack/plugins/fleet/common/services/agent_policies_helpers.ts
+++ b/x-pack/plugins/fleet/common/services/agent_policies_helpers.ts
@@ -6,7 +6,7 @@
  */
 
 import type { AgentPolicy } from '../types';
-import { FLEET_SERVER_PACKAGE, FLEET_APM_PACKAGE } from '../constants';
+import { FLEET_SERVER_PACKAGE, FLEET_APM_PACKAGE, FLEET_SYNTHETICS_PACKAGE } from '../constants';
 
 export function policyHasFleetServer(agentPolicy: AgentPolicy) {
   if (!agentPolicy.package_policies) {
@@ -19,8 +19,17 @@ export function policyHasFleetServer(agentPolicy: AgentPolicy) {
 }
 
 export function policyHasAPMIntegration(agentPolicy: AgentPolicy) {
+  return policyHasIntegration(agentPolicy, FLEET_APM_PACKAGE);
+}
+
+export function policyHasSyntheticsIntegration(agentPolicy: AgentPolicy) {
+  return policyHasIntegration(agentPolicy, FLEET_SYNTHETICS_PACKAGE);
+}
+
+function policyHasIntegration(agentPolicy: AgentPolicy, packageName: string) {
   if (!agentPolicy.package_policies) {
     return false;
   }
-  return agentPolicy.package_policies?.some((p) => p.package?.name === FLEET_APM_PACKAGE);
+
+  return agentPolicy.package_policies?.some((p) => p.package?.name === packageName);
 }
diff --git a/x-pack/plugins/fleet/common/services/index.ts b/x-pack/plugins/fleet/common/services/index.ts
index 6b392f506b4c6..abf06ac54b07c 100644
--- a/x-pack/plugins/fleet/common/services/index.ts
+++ b/x-pack/plugins/fleet/common/services/index.ts
@@ -63,7 +63,11 @@ export {
 export { getAllowedOutputTypeForPolicy } from './output_helpers';
 export { agentStatusesToSummary } from './agent_statuses_to_summary';
 
-export { policyHasFleetServer, policyHasAPMIntegration } from './agent_policies_helpers';
+export {
+  policyHasFleetServer,
+  policyHasAPMIntegration,
+  policyHasSyntheticsIntegration,
+} from './agent_policies_helpers';
 
 export {
   generateNewAgentPolicyWithDefaults,
diff --git a/x-pack/plugins/fleet/common/services/output_helpers.ts b/x-pack/plugins/fleet/common/services/output_helpers.ts
index d0d8c826878fd..00b480c378b61 100644
--- a/x-pack/plugins/fleet/common/services/output_helpers.ts
+++ b/x-pack/plugins/fleet/common/services/output_helpers.ts
@@ -6,7 +6,12 @@
  */
 
 import type { AgentPolicy } from '../types';
-import { FLEET_APM_PACKAGE, FLEET_SERVER_PACKAGE, outputType } from '../constants';
+import {
+  FLEET_APM_PACKAGE,
+  FLEET_SERVER_PACKAGE,
+  FLEET_SYNTHETICS_PACKAGE,
+  outputType,
+} from '../constants';
 
 /**
  * Return allowed output type for a given agent policy,
@@ -16,7 +21,10 @@ export function getAllowedOutputTypeForPolicy(agentPolicy: AgentPolicy) {
   const isRestrictedToSameClusterES =
     agentPolicy.package_policies &&
     agentPolicy.package_policies.some(
-      (p) => p.package?.name === FLEET_APM_PACKAGE || p.package?.name === FLEET_SERVER_PACKAGE
+      (p) =>
+        p.package?.name === FLEET_APM_PACKAGE ||
+        p.package?.name === FLEET_SERVER_PACKAGE ||
+        p.package?.name === FLEET_SYNTHETICS_PACKAGE
     );
 
   if (isRestrictedToSameClusterES) {
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/components/agent_policy_advanced_fields/hooks.test.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/components/agent_policy_advanced_fields/hooks.test.tsx
index 1a415e51e23a6..2d7eef6b864bf 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/components/agent_policy_advanced_fields/hooks.test.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/components/agent_policy_advanced_fields/hooks.test.tsx
@@ -130,7 +130,7 @@ describe('useOutputOptions', () => {
               size="s"
             >
               <FormattedMessage
-                defaultMessage="{outputType} output for agent integration is not supported for Fleet Server or APM."
+                defaultMessage="{outputType} output for agent integration is not supported for Fleet Server, Synthetics or APM."
                 id="xpack.fleet.agentPolicyForm.outputOptionDisabledTypeNotSupportedText"
                 values={
                   Object {
@@ -157,7 +157,7 @@ describe('useOutputOptions', () => {
               size="s"
             >
               <FormattedMessage
-                defaultMessage="{outputType} output for agent integration is not supported for Fleet Server or APM."
+                defaultMessage="{outputType} output for agent integration is not supported for Fleet Server, Synthetics or APM."
                 id="xpack.fleet.agentPolicyForm.outputOptionDisabledTypeNotSupportedText"
                 values={
                   Object {
@@ -184,7 +184,7 @@ describe('useOutputOptions', () => {
               size="s"
             >
               <FormattedMessage
-                defaultMessage="{outputType} output for agent integration is not supported for Fleet Server or APM."
+                defaultMessage="{outputType} output for agent integration is not supported for Fleet Server, Synthetics or APM."
                 id="xpack.fleet.agentPolicyForm.outputOptionDisabledTypeNotSupportedText"
                 values={
                   Object {
@@ -258,7 +258,7 @@ describe('useOutputOptions', () => {
               size="s"
             >
               <FormattedMessage
-                defaultMessage="{outputType} output for agent integration is not supported for Fleet Server or APM."
+                defaultMessage="{outputType} output for agent integration is not supported for Fleet Server, Synthetics or APM."
                 id="xpack.fleet.agentPolicyForm.outputOptionDisabledTypeNotSupportedText"
                 values={
                   Object {
@@ -285,7 +285,7 @@ describe('useOutputOptions', () => {
               size="s"
             >
               <FormattedMessage
-                defaultMessage="{outputType} output for agent integration is not supported for Fleet Server or APM."
+                defaultMessage="{outputType} output for agent integration is not supported for Fleet Server, Synthetics or APM."
                 id="xpack.fleet.agentPolicyForm.outputOptionDisabledTypeNotSupportedText"
                 values={
                   Object {
@@ -312,7 +312,7 @@ describe('useOutputOptions', () => {
               size="s"
             >
               <FormattedMessage
-                defaultMessage="{outputType} output for agent integration is not supported for Fleet Server or APM."
+                defaultMessage="{outputType} output for agent integration is not supported for Fleet Server, Synthetics or APM."
                 id="xpack.fleet.agentPolicyForm.outputOptionDisabledTypeNotSupportedText"
                 values={
                   Object {
@@ -441,7 +441,7 @@ describe('useOutputOptions', () => {
               size="s"
             >
               <FormattedMessage
-                defaultMessage="{outputType} output for agent integration is not supported for Fleet Server or APM."
+                defaultMessage="{outputType} output for agent integration is not supported for Fleet Server, Synthetics or APM."
                 id="xpack.fleet.agentPolicyForm.outputOptionDisableOutputTypeText"
                 values={
                   Object {
@@ -473,7 +473,7 @@ describe('useOutputOptions', () => {
               size="s"
             >
               <FormattedMessage
-                defaultMessage="{outputType} output for agent integration is not supported for Fleet Server or APM."
+                defaultMessage="{outputType} output for agent integration is not supported for Fleet Server, Synthetics or APM."
                 id="xpack.fleet.agentPolicyForm.outputOptionDisabledTypeNotSupportedText"
                 values={
                   Object {
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/components/agent_policy_advanced_fields/hooks.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/components/agent_policy_advanced_fields/hooks.tsx
index 869034dca74c5..15681ea1dfbb6 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/components/agent_policy_advanced_fields/hooks.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/components/agent_policy_advanced_fields/hooks.tsx
@@ -20,6 +20,7 @@ import { LICENCE_FOR_PER_POLICY_OUTPUT } from '../../../../../../../common/const
 import {
   getAllowedOutputTypeForPolicy,
   policyHasFleetServer,
+  policyHasSyntheticsIntegration,
 } from '../../../../../../../common/services';
 import type { NewAgentPolicy, AgentPolicy } from '../../../../types';
 
@@ -62,11 +63,11 @@ export function useOutputOptions(agentPolicy: Partial<NewAgentPolicy | AgentPoli
   const outputsRequest = useGetOutputs();
   const licenseService = useLicense();
 
-  const hasFleetServer = policyHasFleetServer(agentPolicy as AgentPolicy);
-
-  // Allow changing output when agent policy has fleet server
-  const isLicenceAllowingPolicyPerOutput =
-    licenseService.hasAtLeast(LICENCE_FOR_PER_POLICY_OUTPUT) || hasFleetServer;
+  // Allow changing output when agent policy has fleet server or synthetics integrations
+  const isPolicyPerOutputAllowed =
+    licenseService.hasAtLeast(LICENCE_FOR_PER_POLICY_OUTPUT) ||
+    policyHasFleetServer(agentPolicy as AgentPolicy) ||
+    policyHasSyntheticsIntegration(agentPolicy as AgentPolicy);
   const allowedOutputTypes = useMemo(
     () => getAllowedOutputTypeForPolicy(agentPolicy as AgentPolicy),
     [agentPolicy]
@@ -89,7 +90,7 @@ export function useOutputOptions(agentPolicy: Partial<NewAgentPolicy | AgentPoli
     const defaultOutputDisabledMessage = defaultOutputDisabled ? (
       <FormattedMessage
         id="xpack.fleet.agentPolicyForm.outputOptionDisableOutputTypeText"
-        defaultMessage="{outputType} output for agent integration is not supported for Fleet Server or APM."
+        defaultMessage="{outputType} output for agent integration is not supported for Fleet Server, Synthetics or APM."
         values={{
           outputType: defaultOutput.type,
         }}
@@ -108,18 +109,18 @@ export function useOutputOptions(agentPolicy: Partial<NewAgentPolicy | AgentPoli
             isOutputTypeUnsupported ? (
               <FormattedMessage
                 id="xpack.fleet.agentPolicyForm.outputOptionDisabledTypeNotSupportedText"
-                defaultMessage="{outputType} output for agent integration is not supported for Fleet Server or APM."
+                defaultMessage="{outputType} output for agent integration is not supported for Fleet Server, Synthetics or APM."
                 values={{
                   outputType: item.type,
                 }}
               />
             ) : undefined
           ),
-          disabled: !isLicenceAllowingPolicyPerOutput || isOutputTypeUnsupported,
+          disabled: !isPolicyPerOutputAllowed || isOutputTypeUnsupported,
         };
       }),
     ];
-  }, [outputsRequest, isLicenceAllowingPolicyPerOutput, allowedOutputTypes]);
+  }, [outputsRequest, isPolicyPerOutputAllowed, allowedOutputTypes]);
 
   const monitoringOutputOptions = useMemo(() => {
     if (outputsRequest.isLoading || !outputsRequest.data) {
@@ -135,11 +136,11 @@ export function useOutputOptions(agentPolicy: Partial<NewAgentPolicy | AgentPoli
         return {
           value: item.id,
           inputDisplay: item.name,
-          disabled: !isLicenceAllowingPolicyPerOutput,
+          disabled: !isPolicyPerOutputAllowed,
         };
       }),
     ];
-  }, [outputsRequest, isLicenceAllowingPolicyPerOutput]);
+  }, [outputsRequest, isPolicyPerOutputAllowed]);
 
   return useMemo(
     () => ({
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/settings/components/edit_output_flyout/confirm_update.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/settings/components/edit_output_flyout/confirm_update.tsx
index 8d96c5f314547..4157c6964f79a 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/settings/components/edit_output_flyout/confirm_update.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/settings/components/edit_output_flyout/confirm_update.tsx
@@ -73,13 +73,13 @@ const ConfirmDescription: React.FunctionComponent<ConfirmDescriptionProps> = ({
           title={
             <FormattedMessage
               id="xpack.fleet.settings.updateOutput.warningTitle"
-              defaultMessage="Logstash output for agent integration is not supported for fleet server."
+              defaultMessage="Logstash output for agent integration is not supported for fleet server and synthetics."
             />
           }
         >
           <FormattedMessage
             id="xpack.fleet.settings.updateOutput.warningMessage"
-            defaultMessage="Fleet server policies will keep using the existing ES output."
+            defaultMessage="Fleet server and synthetics policies will keep using the existing ES output."
           />
         </EuiCallOut>{' '}
       </>
diff --git a/x-pack/plugins/fleet/server/services/agent_policies/output_helpers.test.ts b/x-pack/plugins/fleet/server/services/agent_policies/output_helpers.test.ts
index 29d48d5d595ef..e43bc275a9c4d 100644
--- a/x-pack/plugins/fleet/server/services/agent_policies/output_helpers.test.ts
+++ b/x-pack/plugins/fleet/server/services/agent_policies/output_helpers.test.ts
@@ -196,7 +196,7 @@ describe('validateOutputForPolicy', () => {
       );
     });
 
-    it('should not allow logstash output to be used with a policy using fleet server or APM', async () => {
+    it('should not allow logstash output to be used with a policy using fleet server, synthetics or APM', async () => {
       mockHasLicence(true);
       mockedOutputService.get.mockResolvedValue({
         type: 'logstash',
@@ -217,7 +217,7 @@ describe('validateOutputForPolicy', () => {
       );
     });
 
-    it('should allow elasticsearch output to be used with a policy using fleet server or APM', async () => {
+    it('should allow elasticsearch output to be used with a policy using fleet server, synthetics or APM', async () => {
       mockHasLicence(true);
       mockedOutputService.get.mockResolvedValue({
         type: 'elasticsearch',
diff --git a/x-pack/plugins/fleet/server/services/agent_policies/outputs_helpers.ts b/x-pack/plugins/fleet/server/services/agent_policies/outputs_helpers.ts
index d93bb965295ef..bbe00c49b414f 100644
--- a/x-pack/plugins/fleet/server/services/agent_policies/outputs_helpers.ts
+++ b/x-pack/plugins/fleet/server/services/agent_policies/outputs_helpers.ts
@@ -9,7 +9,7 @@ import type { SavedObjectsClientContract } from '@kbn/core/server';
 
 import type { AgentPolicySOAttributes, AgentPolicy } from '../../types';
 import { LICENCE_FOR_PER_POLICY_OUTPUT, outputType } from '../../../common/constants';
-import { policyHasFleetServer } from '../../../common/services';
+import { policyHasFleetServer, policyHasSyntheticsIntegration } from '../../../common/services';
 import { appContextService } from '..';
 import { outputService } from '../output';
 import { OutputInvalidError, OutputLicenceError } from '../../errors';
@@ -80,6 +80,9 @@ export async function validateOutputForPolicy(
   // Validate output when the policy has fleet server
   if (policyHasFleetServer(data as AgentPolicy)) return;
 
+  // Validate output when the policy has synthetics integration
+  if (policyHasSyntheticsIntegration(data as AgentPolicy)) return;
+
   const hasLicence = appContextService
     .getSecurityLicense()
     .hasAtLeast(LICENCE_FOR_PER_POLICY_OUTPUT);
diff --git a/x-pack/plugins/fleet/server/services/agent_policy.ts b/x-pack/plugins/fleet/server/services/agent_policy.ts
index d32737e0eb5c1..6958ea80c00d6 100644
--- a/x-pack/plugins/fleet/server/services/agent_policy.ts
+++ b/x-pack/plugins/fleet/server/services/agent_policy.ts
@@ -48,6 +48,7 @@ import {
   packageToPackagePolicy,
   policyHasFleetServer,
   policyHasAPMIntegration,
+  policyHasSyntheticsIntegration,
 } from '../../common/services';
 import {
   agentPolicyStatuses,
@@ -211,6 +212,10 @@ class AgentPolicyService {
     return policyHasFleetServer(agentPolicy);
   }
 
+  public hasSyntheticsIntegration(agentPolicy: AgentPolicy) {
+    return policyHasSyntheticsIntegration(agentPolicy);
+  }
+
   public async create(
     soClient: SavedObjectsClientContract,
     esClient: ElasticsearchClient,
diff --git a/x-pack/plugins/fleet/server/services/output.test.ts b/x-pack/plugins/fleet/server/services/output.test.ts
index 7c0076abfc653..5ecd3a4a29a40 100644
--- a/x-pack/plugins/fleet/server/services/output.test.ts
+++ b/x-pack/plugins/fleet/server/services/output.test.ts
@@ -201,7 +201,7 @@ function getMockedSoClient(
 describe('Output Service', () => {
   const esClientMock = elasticsearchServiceMock.createElasticsearchClient();
 
-  const mockedAgentPolicyResolvedValue = {
+  const mockedAgentPolicyWithFleetServerResolvedValue = {
     items: [
       {
         name: 'fleet server policy',
@@ -232,18 +232,50 @@ describe('Output Service', () => {
     ],
   } as unknown as ReturnType<typeof mockedAgentPolicyService.list>;
 
+  const mockedAgentPolicyWithSyntheticsResolvedValue = {
+    items: [
+      {
+        name: 'synthetics policy',
+        id: 'synthetics_policy',
+        package_policies: [
+          {
+            name: 'synthetics-123',
+            package: {
+              name: 'synthetics',
+            },
+          },
+        ],
+      },
+      {
+        name: 'agent policy 1',
+        id: 'agent_policy_1',
+        is_managed: false,
+        package_policies: [
+          {
+            name: 'nginx',
+            package: {
+              name: 'nginx',
+            },
+          },
+        ],
+      },
+    ],
+  } as unknown as ReturnType<typeof mockedAgentPolicyService.list>;
+
   beforeEach(() => {
     mockedAgentPolicyService.list.mockClear();
     mockedAgentPolicyService.hasAPMIntegration.mockClear();
     mockedAgentPolicyService.hasFleetServerIntegration.mockClear();
+    mockedAgentPolicyService.hasSyntheticsIntegration.mockClear();
     mockedAgentPolicyService.removeOutputFromAll.mockReset();
     mockedAppContextService.getInternalUserSOClient.mockReset();
     mockedAppContextService.getEncryptedSavedObjectsSetup.mockReset();
     mockedAuditLoggingService.writeCustomSoAuditLog.mockReset();
     mockedAgentPolicyService.update.mockReset();
   });
+
   describe('create', () => {
-    it('work with a predefined id', async () => {
+    it('works with a predefined id', async () => {
       const soClient = getMockedSoClient();
 
       await outputService.create(
@@ -446,7 +478,9 @@ describe('Output Service', () => {
       mockedAppContextService.getEncryptedSavedObjectsSetup.mockReturnValue({
         canEncrypt: true,
       } as any);
-      mockedAgentPolicyService.list.mockResolvedValue(mockedAgentPolicyResolvedValue);
+      mockedAgentPolicyService.list.mockResolvedValue(
+        mockedAgentPolicyWithFleetServerResolvedValue
+      );
       mockedAgentPolicyService.hasFleetServerIntegration.mockReturnValue(true);
 
       await outputService.create(
@@ -470,6 +504,37 @@ describe('Output Service', () => {
       );
     });
 
+    it('should update synthetics policies with data_output_id=default_output_id if a new default logstash output is created', async () => {
+      const soClient = getMockedSoClient({
+        defaultOutputId: 'output-test',
+      });
+      mockedAppContextService.getEncryptedSavedObjectsSetup.mockReturnValue({
+        canEncrypt: true,
+      } as any);
+      mockedAgentPolicyService.list.mockResolvedValue(mockedAgentPolicyWithSyntheticsResolvedValue);
+      mockedAgentPolicyService.hasSyntheticsIntegration.mockReturnValue(true);
+
+      await outputService.create(
+        soClient,
+        esClientMock,
+        {
+          is_default: true,
+          is_default_monitoring: false,
+          name: 'Test',
+          type: 'logstash',
+        },
+        { id: 'output-1' }
+      );
+
+      expect(mockedAgentPolicyService.update).toBeCalledWith(
+        expect.anything(),
+        expect.anything(),
+        'synthetics_policy',
+        { data_output_id: 'output-test' },
+        { force: false }
+      );
+    });
+
     it('Should allow to create a new logstash output with no errors if is not set as default', async () => {
       const soClient = getMockedSoClient({
         defaultOutputId: 'output-test',
@@ -477,7 +542,9 @@ describe('Output Service', () => {
       mockedAppContextService.getEncryptedSavedObjectsSetup.mockReturnValue({
         canEncrypt: true,
       } as any);
-      mockedAgentPolicyService.list.mockResolvedValue(mockedAgentPolicyResolvedValue);
+      mockedAgentPolicyService.list.mockResolvedValue(
+        mockedAgentPolicyWithFleetServerResolvedValue
+      );
       mockedAgentPolicyService.hasFleetServerIntegration.mockReturnValue(true);
 
       await outputService.create(
@@ -523,7 +590,9 @@ describe('Output Service', () => {
       mockedAppContextService.getEncryptedSavedObjectsSetup.mockReturnValue({
         canEncrypt: true,
       } as any);
-      mockedAgentPolicyService.list.mockResolvedValue(mockedAgentPolicyResolvedValue);
+      mockedAgentPolicyService.list.mockResolvedValue(
+        mockedAgentPolicyWithFleetServerResolvedValue
+      );
       mockedAgentPolicyService.hasFleetServerIntegration.mockReturnValue(true);
 
       await outputService.create(
@@ -547,6 +616,37 @@ describe('Output Service', () => {
       );
     });
 
+    it('Should update synthetics policies with data_output_id=default_output_id if a new default kafka output is created', async () => {
+      const soClient = getMockedSoClient({
+        defaultOutputId: 'output-test',
+      });
+      mockedAppContextService.getEncryptedSavedObjectsSetup.mockReturnValue({
+        canEncrypt: true,
+      } as any);
+      mockedAgentPolicyService.list.mockResolvedValue(mockedAgentPolicyWithSyntheticsResolvedValue);
+      mockedAgentPolicyService.hasSyntheticsIntegration.mockReturnValue(true);
+
+      await outputService.create(
+        soClient,
+        esClientMock,
+        {
+          is_default: true,
+          is_default_monitoring: false,
+          name: 'Test',
+          type: 'kafka',
+        },
+        { id: 'output-1' }
+      );
+
+      expect(mockedAgentPolicyService.update).toBeCalledWith(
+        expect.anything(),
+        expect.anything(),
+        'synthetics_policy',
+        { data_output_id: 'output-test' },
+        { force: false }
+      );
+    });
+
     it('Should allow to create a new kafka output with no errors if is not set as default', async () => {
       const soClient = getMockedSoClient({
         defaultOutputId: 'output-test',
@@ -554,7 +654,9 @@ describe('Output Service', () => {
       mockedAppContextService.getEncryptedSavedObjectsSetup.mockReturnValue({
         canEncrypt: true,
       } as any);
-      mockedAgentPolicyService.list.mockResolvedValue(mockedAgentPolicyResolvedValue);
+      mockedAgentPolicyService.list.mockResolvedValue(
+        mockedAgentPolicyWithFleetServerResolvedValue
+      );
       mockedAgentPolicyService.hasFleetServerIntegration.mockReturnValue(true);
 
       await outputService.create(
@@ -878,6 +980,7 @@ describe('Output Service', () => {
       } as unknown as ReturnType<typeof mockedAgentPolicyService.list>);
       mockedAgentPolicyService.hasAPMIntegration.mockReturnValue(false);
       mockedAgentPolicyService.hasFleetServerIntegration.mockReturnValue(false);
+      mockedAgentPolicyService.hasSyntheticsIntegration.mockReturnValue(false);
 
       await outputService.update(soClient, esClientMock, 'existing-es-output', {
         type: 'logstash',
@@ -936,36 +1039,9 @@ describe('Output Service', () => {
       const soClient = getMockedSoClient({
         defaultOutputId: 'output-test',
       });
-      mockedAgentPolicyService.list.mockResolvedValue({
-        items: [
-          {
-            name: 'fleet server policy',
-            id: 'fleet_server_policy',
-            is_default_fleet_server: true,
-            package_policies: [
-              {
-                name: 'fleet-server-123',
-                package: {
-                  name: 'fleet_server',
-                },
-              },
-            ],
-          },
-          {
-            name: 'agent policy 1',
-            id: 'agent_policy_1',
-            is_managed: false,
-            package_policies: [
-              {
-                name: 'nginx',
-                package: {
-                  name: 'nginx',
-                },
-              },
-            ],
-          },
-        ],
-      } as unknown as ReturnType<typeof mockedAgentPolicyService.list>);
+      mockedAgentPolicyService.list.mockResolvedValue(
+        mockedAgentPolicyWithFleetServerResolvedValue
+      );
       mockedAgentPolicyService.hasFleetServerIntegration.mockReturnValue(true);
 
       await outputService.update(soClient, esClientMock, 'output-test', {
@@ -994,36 +1070,9 @@ describe('Output Service', () => {
       const soClient = getMockedSoClient({
         defaultOutputId: 'output-test',
       });
-      mockedAgentPolicyService.list.mockResolvedValue({
-        items: [
-          {
-            name: 'fleet server policy',
-            id: 'fleet_server_policy',
-            is_default_fleet_server: true,
-            package_policies: [
-              {
-                name: 'fleet-server-123',
-                package: {
-                  name: 'fleet_server',
-                },
-              },
-            ],
-          },
-          {
-            name: 'agent policy 1',
-            id: 'agent_policy_1',
-            is_managed: false,
-            package_policies: [
-              {
-                name: 'nginx',
-                package: {
-                  name: 'nginx',
-                },
-              },
-            ],
-          },
-        ],
-      } as unknown as ReturnType<typeof mockedAgentPolicyService.list>);
+      mockedAgentPolicyService.list.mockResolvedValue(
+        mockedAgentPolicyWithFleetServerResolvedValue
+      );
       mockedAgentPolicyService.hasFleetServerIntegration.mockReturnValue(true);
 
       await outputService.update(
@@ -1056,38 +1105,77 @@ describe('Output Service', () => {
       );
     });
 
+    it('should update synthetics policies with data_output_id=default_output_id if a default ES output is changed to logstash', async () => {
+      const soClient = getMockedSoClient({
+        defaultOutputId: 'output-test',
+      });
+      mockedAgentPolicyService.list.mockResolvedValue(mockedAgentPolicyWithSyntheticsResolvedValue);
+      mockedAgentPolicyService.hasSyntheticsIntegration.mockReturnValue(true);
+
+      await outputService.update(soClient, esClientMock, 'output-test', {
+        type: 'logstash',
+        hosts: ['test:4343'],
+        is_default: true,
+      });
+
+      expect(soClient.update).toBeCalledWith(expect.anything(), expect.anything(), {
+        type: 'logstash',
+        hosts: ['test:4343'],
+        is_default: true,
+        ca_sha256: null,
+        ca_trusted_fingerprint: null,
+      });
+      expect(mockedAgentPolicyService.update).toBeCalledWith(
+        expect.anything(),
+        expect.anything(),
+        'synthetics_policy',
+        { data_output_id: 'output-test' },
+        { force: false }
+      );
+    });
+
+    it('should update synthetics policies with data_output_id=default_output_id and force=true if a default ES output is changed to logstash, from preconfiguration', async () => {
+      const soClient = getMockedSoClient({
+        defaultOutputId: 'output-test',
+      });
+      mockedAgentPolicyService.list.mockResolvedValue(mockedAgentPolicyWithSyntheticsResolvedValue);
+      mockedAgentPolicyService.hasSyntheticsIntegration.mockReturnValue(true);
+
+      await outputService.update(
+        soClient,
+        esClientMock,
+        'output-test',
+        {
+          type: 'logstash',
+          hosts: ['test:4343'],
+          is_default: true,
+        },
+        {
+          fromPreconfiguration: true,
+        }
+      );
+
+      expect(soClient.update).toBeCalledWith(expect.anything(), expect.anything(), {
+        type: 'logstash',
+        hosts: ['test:4343'],
+        is_default: true,
+        ca_sha256: null,
+        ca_trusted_fingerprint: null,
+      });
+      expect(mockedAgentPolicyService.update).toBeCalledWith(
+        expect.anything(),
+        expect.anything(),
+        'synthetics_policy',
+        { data_output_id: 'output-test' },
+        { force: true }
+      );
+    });
+
     it('Should return an error if trying to change the output to logstash for fleet server policy', async () => {
       const soClient = getMockedSoClient({});
-      mockedAgentPolicyService.list.mockResolvedValue({
-        items: [
-          {
-            name: 'fleet server policy',
-            id: 'fleet_server_policy',
-            is_default_fleet_server: true,
-            package_policies: [
-              {
-                name: 'fleet-server-123',
-                package: {
-                  name: 'fleet_server',
-                },
-              },
-            ],
-          },
-          {
-            name: 'agent policy 1',
-            id: 'agent_policy_1',
-            is_managed: false,
-            package_policies: [
-              {
-                name: 'nginx',
-                package: {
-                  name: 'nginx',
-                },
-              },
-            ],
-          },
-        ],
-      } as unknown as ReturnType<typeof mockedAgentPolicyService.list>);
+      mockedAgentPolicyService.list.mockResolvedValue(
+        mockedAgentPolicyWithFleetServerResolvedValue
+      );
       mockedAgentPolicyService.hasFleetServerIntegration.mockReturnValue(true);
 
       await expect(
@@ -1100,6 +1188,22 @@ describe('Output Service', () => {
       );
     });
 
+    it('Should return an error if trying to change the output to logstash for synthetics policy', async () => {
+      const soClient = getMockedSoClient({});
+      mockedAgentPolicyService.list.mockResolvedValue(mockedAgentPolicyWithSyntheticsResolvedValue);
+      mockedAgentPolicyService.hasFleetServerIntegration.mockReturnValue(false);
+      mockedAgentPolicyService.hasSyntheticsIntegration.mockReturnValue(true);
+
+      await expect(
+        outputService.update(soClient, esClientMock, 'existing-es-output', {
+          type: 'logstash',
+          hosts: ['test:4343'],
+        })
+      ).rejects.toThrowError(
+        'Logstash output cannot be used with Synthetics integration in synthetics policy. Please create a new ElasticSearch output.'
+      );
+    });
+
     it('should call audit logger', async () => {
       const soClient = getMockedSoClient({ defaultOutputId: 'existing-es-output' });
 
@@ -1115,7 +1219,6 @@ describe('Output Service', () => {
     });
 
     // With Kafka output
-
     it('Should delete ES specific fields if the output type changes to kafka', async () => {
       const soClient = getMockedSoClient({});
       mockedAgentPolicyService.list.mockResolvedValue({
@@ -1123,6 +1226,7 @@ describe('Output Service', () => {
       } as unknown as ReturnType<typeof mockedAgentPolicyService.list>);
       mockedAgentPolicyService.hasAPMIntegration.mockReturnValue(false);
       mockedAgentPolicyService.hasFleetServerIntegration.mockReturnValue(false);
+      mockedAgentPolicyService.hasSyntheticsIntegration.mockReturnValue(false);
 
       await outputService.update(soClient, esClientMock, 'existing-es-output', {
         type: 'kafka',
@@ -1180,7 +1284,9 @@ describe('Output Service', () => {
       const soClient = getMockedSoClient({
         defaultOutputId: 'output-test',
       });
-      mockedAgentPolicyService.list.mockResolvedValue(mockedAgentPolicyResolvedValue);
+      mockedAgentPolicyService.list.mockResolvedValue(
+        mockedAgentPolicyWithFleetServerResolvedValue
+      );
       mockedAgentPolicyService.hasFleetServerIntegration.mockReturnValue(true);
 
       await outputService.update(soClient, esClientMock, 'output-test', {
@@ -1218,7 +1324,9 @@ describe('Output Service', () => {
       const soClient = getMockedSoClient({
         defaultOutputId: 'output-test',
       });
-      mockedAgentPolicyService.list.mockResolvedValue(mockedAgentPolicyResolvedValue);
+      mockedAgentPolicyService.list.mockResolvedValue(
+        mockedAgentPolicyWithFleetServerResolvedValue
+      );
       mockedAgentPolicyService.hasFleetServerIntegration.mockReturnValue(true);
 
       await outputService.update(
@@ -1259,6 +1367,90 @@ describe('Output Service', () => {
         { force: true }
       );
     });
+
+    it('should update synthetics policies with data_output_id=default_output_id if a default ES output is changed to kafka', async () => {
+      const soClient = getMockedSoClient({
+        defaultOutputId: 'output-test',
+      });
+      mockedAgentPolicyService.list.mockResolvedValue(mockedAgentPolicyWithSyntheticsResolvedValue);
+      mockedAgentPolicyService.hasSyntheticsIntegration.mockReturnValue(true);
+
+      await outputService.update(soClient, esClientMock, 'output-test', {
+        type: 'kafka',
+        hosts: ['http://test:4343'],
+        is_default: true,
+      });
+
+      expect(soClient.update).toBeCalledWith(expect.anything(), expect.anything(), {
+        type: 'kafka',
+        hosts: ['http://test:4343'],
+        is_default: true,
+        ca_sha256: null,
+        ca_trusted_fingerprint: null,
+        client_id: 'Elastic Agent',
+        compression: 'gzip',
+        compression_level: 4,
+        partition: 'hash',
+        timeout: 30,
+        version: '1.0.0',
+        broker_timeout: 10,
+        broker_ack_reliability: 'Wait for local commit',
+        broker_buffer_size: 256,
+      });
+      expect(mockedAgentPolicyService.update).toBeCalledWith(
+        expect.anything(),
+        expect.anything(),
+        'synthetics_policy',
+        { data_output_id: 'output-test' },
+        { force: false }
+      );
+    });
+
+    it('should update synthetics policies with data_output_id=default_output_id and force=true if a default ES output is changed to kafka, from preconfiguration', async () => {
+      const soClient = getMockedSoClient({
+        defaultOutputId: 'output-test',
+      });
+      mockedAgentPolicyService.list.mockResolvedValue(mockedAgentPolicyWithSyntheticsResolvedValue);
+      mockedAgentPolicyService.hasSyntheticsIntegration.mockReturnValue(true);
+
+      await outputService.update(
+        soClient,
+        esClientMock,
+        'output-test',
+        {
+          type: 'kafka',
+          hosts: ['http://test:4343'],
+          is_default: true,
+        },
+        {
+          fromPreconfiguration: true,
+        }
+      );
+
+      expect(soClient.update).toBeCalledWith(expect.anything(), expect.anything(), {
+        type: 'kafka',
+        hosts: ['http://test:4343'],
+        is_default: true,
+        ca_sha256: null,
+        ca_trusted_fingerprint: null,
+        client_id: 'Elastic Agent',
+        compression: 'gzip',
+        compression_level: 4,
+        partition: 'hash',
+        timeout: 30,
+        version: '1.0.0',
+        broker_timeout: 10,
+        broker_ack_reliability: 'Wait for local commit',
+        broker_buffer_size: 256,
+      });
+      expect(mockedAgentPolicyService.update).toBeCalledWith(
+        expect.anything(),
+        expect.anything(),
+        'synthetics_policy',
+        { data_output_id: 'output-test' },
+        { force: true }
+      );
+    });
   });
 
   describe('delete', () => {
diff --git a/x-pack/plugins/fleet/server/services/output.ts b/x-pack/plugins/fleet/server/services/output.ts
index a9e546d878fb5..ec5f63cbe3566 100644
--- a/x-pack/plugins/fleet/server/services/output.ts
+++ b/x-pack/plugins/fleet/server/services/output.ts
@@ -148,7 +148,7 @@ async function validateLogstashOutputNotUsedInAPMPolicy(
   }
 }
 
-async function findPoliciesWithFleetServer(
+async function findPoliciesWithFleetServerOrSynthetics(
   soClient: SavedObjectsClientContract,
   outputId?: string,
   isDefault?: boolean
@@ -159,23 +159,24 @@ async function findPoliciesWithFleetServer(
     ? await getAgentPoliciesPerOutput(soClient, outputId, isDefault)
     : (await agentPolicyService.list(soClient, { withPackagePolicies: true }))?.items;
 
-  if (agentPolicies) {
-    const policiesWithFleetServer = agentPolicies.filter((policy) =>
-      agentPolicyService.hasFleetServerIntegration(policy)
-    );
-    return policiesWithFleetServer;
-  }
-  return [];
+  const policiesWithFleetServer =
+    agentPolicies?.filter((policy) => agentPolicyService.hasFleetServerIntegration(policy)) || [];
+  const policiesWithSynthetics =
+    agentPolicies?.filter((policy) => agentPolicyService.hasSyntheticsIntegration(policy)) || [];
+  return { policiesWithFleetServer, policiesWithSynthetics };
 }
 
-function validateOutputNotUsedInFleetServerPolicy(
+function validateOutputNotUsedInPolicy(
   agentPolicies: AgentPolicy[],
-  dataOutputType: OutputType['Logstash'] | OutputType['Kafka']
+  dataOutputType: OutputType['Logstash'] | OutputType['Kafka'],
+  integrationName: string
 ) {
-  // Validate no policy with fleet server use that policy
+  // Validate no policy with this integration uses that output
   for (const agentPolicy of agentPolicies) {
     throw new OutputInvalidError(
-      `${_.capitalize(dataOutputType)} output cannot be used with Fleet Server integration in ${
+      `${_.capitalize(
+        dataOutputType
+      )} output cannot be used with ${integrationName} integration in ${
         agentPolicy.name
       }. Please create a new ElasticSearch output.`
     );
@@ -192,44 +193,46 @@ async function validateTypeChanges(
   fromPreconfiguration: boolean
 ) {
   const mergedIsDefault = data.is_default ?? originalOutput.is_default;
-  const fleetServerPolicies = await findPoliciesWithFleetServer(soClient, id, mergedIsDefault);
+  const { policiesWithFleetServer, policiesWithSynthetics } =
+    await findPoliciesWithFleetServerOrSynthetics(soClient, id, mergedIsDefault);
 
   if (data.type === outputType.Logstash || originalOutput.type === outputType.Logstash) {
     await validateLogstashOutputNotUsedInAPMPolicy(soClient, id, mergedIsDefault);
   }
-  // prevent changing an ES output to logstash or kafka if it's used by fleet server policies
+  // prevent changing an ES output to logstash or kafka if it's used by fleet server or synthetics policies
   if (
     originalOutput.type === outputType.Elasticsearch &&
     (data?.type === outputType.Logstash || data?.type === outputType.Kafka)
   ) {
     // Validate no policy with fleet server use that policy
-    validateOutputNotUsedInFleetServerPolicy(fleetServerPolicies, data.type);
+    validateOutputNotUsedInPolicy(policiesWithFleetServer, data.type, 'Fleet Server');
+    validateOutputNotUsedInPolicy(policiesWithSynthetics, data.type, 'Synthetics');
   }
-  await updateFleetServerPoliciesDataOutputId(
+  await updateAgentPoliciesDataOutputId(
     soClient,
     esClient,
     data,
     mergedIsDefault,
     defaultDataOutputId,
-    fleetServerPolicies,
+    _.uniq([...policiesWithFleetServer, ...policiesWithSynthetics]),
     fromPreconfiguration
   );
 }
 
-async function updateFleetServerPoliciesDataOutputId(
+async function updateAgentPoliciesDataOutputId(
   soClient: SavedObjectsClientContract,
   esClient: ElasticsearchClient,
   data: Nullable<Partial<OutputSOAttributes>>,
   isDefault: boolean,
   defaultDataOutputId: string | null,
-  fleetServerPolicies: AgentPolicy[],
+  agentPolicies: AgentPolicy[],
   fromPreconfiguration: boolean
 ) {
   // if a logstash output is updated to become default
   // if fleet server policies don't have data_output_id
   // update them to use the default output
   if ((data?.type === outputType.Logstash || data?.type === outputType.Kafka) && isDefault) {
-    for (const policy of fleetServerPolicies) {
+    for (const policy of agentPolicies) {
       if (!policy.data_output_id) {
         await agentPolicyService.update(
           soClient,
@@ -415,14 +418,15 @@ class OutputService {
         );
       }
     }
-    const fleetServerPolicies = await findPoliciesWithFleetServer(soClient);
-    await updateFleetServerPoliciesDataOutputId(
+    const { policiesWithFleetServer, policiesWithSynthetics } =
+      await findPoliciesWithFleetServerOrSynthetics(soClient);
+    await updateAgentPoliciesDataOutputId(
       soClient,
       esClient,
       data,
       data.is_default,
       defaultDataOutputId,
-      fleetServerPolicies,
+      _.uniq([...policiesWithFleetServer, ...policiesWithSynthetics]),
       options?.fromPreconfiguration ?? false
     );
 

From 303575544a71887b4d431d0fe67b58cbaa3f2683 Mon Sep 17 00:00:00 2001
From: Aleh Zasypkin <aleh.zasypkin@elastic.co>
Date: Tue, 18 Jul 2023 10:56:07 +0200
Subject: [PATCH 04/14] Updates header filters for request logs. (#162062)

## Summary

Updates
[header](https://www.elastic.co/guide/en/elasticsearch/reference/master/jwt-auth-realm.html#hmac-oidc-example-request-headers)
filters for request logs.

/cc @elastic/kibana-security
---
 .../src/get_ecs_response_log.test.ts            | 17 +++++++++++++++++
 .../src/get_ecs_response_log.ts                 |  8 +++++++-
 .../src/logging/get_response_log.test.ts        | 15 +++++++++++++++
 .../src/logging/get_response_log.ts             |  8 +++++++-
 4 files changed, 46 insertions(+), 2 deletions(-)

diff --git a/packages/core/elasticsearch/core-elasticsearch-client-server-internal/src/get_ecs_response_log.test.ts b/packages/core/elasticsearch/core-elasticsearch-client-server-internal/src/get_ecs_response_log.test.ts
index 03c8c118edcf2..af9470d18e892 100644
--- a/packages/core/elasticsearch/core-elasticsearch-client-server-internal/src/get_ecs_response_log.test.ts
+++ b/packages/core/elasticsearch/core-elasticsearch-client-server-internal/src/get_ecs_response_log.test.ts
@@ -91,6 +91,23 @@ describe('getEcsResponseLog', () => {
       `);
     });
 
+    test('redacts es-client-authentication headers by default', () => {
+      const event = createResponseEvent({
+        requestParams: {
+          headers: { 'es-client-authentication': 'ae3fda37-xxx', 'user-agent': 'world' },
+        },
+        response: { headers: { 'content-length': '123' } },
+      });
+      const log = getEcsResponseLog(event);
+      // @ts-expect-error ECS custom field
+      expect(log.http.request.headers).toMatchInlineSnapshot(`
+        Object {
+          "es-client-authentication": "[REDACTED]",
+          "user-agent": "world",
+        }
+      `);
+    });
+
     test('does not mutate original headers', () => {
       const reqHeaders = { a: 'foo', b: ['hello', 'world'] };
       const resHeaders = { c: 'bar' };
diff --git a/packages/core/elasticsearch/core-elasticsearch-client-server-internal/src/get_ecs_response_log.ts b/packages/core/elasticsearch/core-elasticsearch-client-server-internal/src/get_ecs_response_log.ts
index fa122166ada08..6b44c48925438 100644
--- a/packages/core/elasticsearch/core-elasticsearch-client-server-internal/src/get_ecs_response_log.ts
+++ b/packages/core/elasticsearch/core-elasticsearch-client-server-internal/src/get_ecs_response_log.ts
@@ -12,7 +12,13 @@ import { type LogMeta } from '@kbn/logging';
 
 // If you are updating these, consider whether they should also be updated in the
 // http service `getResponseLog`
-const FORBIDDEN_HEADERS = ['authorization', 'cookie', 'set-cookie', 'x-elastic-app-auth'];
+const FORBIDDEN_HEADERS = [
+  'authorization',
+  'cookie',
+  'set-cookie',
+  'x-elastic-app-auth',
+  'es-client-authentication',
+];
 const REDACTED_HEADER_TEXT = '[REDACTED]';
 
 // We are excluding sensitive headers by default, until we have a log filtering mechanism.
diff --git a/packages/core/http/core-http-server-internal/src/logging/get_response_log.test.ts b/packages/core/http/core-http-server-internal/src/logging/get_response_log.test.ts
index a8f607c5c6865..a77283b6575ff 100644
--- a/packages/core/http/core-http-server-internal/src/logging/get_response_log.test.ts
+++ b/packages/core/http/core-http-server-internal/src/logging/get_response_log.test.ts
@@ -211,6 +211,21 @@ describe('getEcsResponseLog', () => {
       `);
     });
 
+    test('redacts es-client-authentication headers by default', () => {
+      const req = createMockHapiRequest({
+        headers: { 'es-client-authentication': 'ae3fda37-xxx', 'user-agent': 'world' },
+        response: { headers: { 'content-length': '123' } },
+      });
+      const result = getEcsResponseLog(req, logger);
+      // @ts-expect-error ECS custom field
+      expect(result.meta.http.request.headers).toMatchInlineSnapshot(`
+        Object {
+          "es-client-authentication": "[REDACTED]",
+          "user-agent": "world",
+        }
+      `);
+    });
+
     test('does not mutate original headers', () => {
       const reqHeaders = { a: 'foo', b: ['hello', 'world'] };
       const resHeaders = { headers: { c: 'bar' } };
diff --git a/packages/core/http/core-http-server-internal/src/logging/get_response_log.ts b/packages/core/http/core-http-server-internal/src/logging/get_response_log.ts
index f356bf077095a..2cc9c50a1b319 100644
--- a/packages/core/http/core-http-server-internal/src/logging/get_response_log.ts
+++ b/packages/core/http/core-http-server-internal/src/logging/get_response_log.ts
@@ -16,7 +16,13 @@ import { getResponsePayloadBytes } from './get_payload_size';
 
 // If you are updating these, consider whether they should also be updated in the
 // elasticsearch service `getEcsResponseLog`
-const FORBIDDEN_HEADERS = ['authorization', 'cookie', 'set-cookie', 'x-elastic-app-auth'];
+const FORBIDDEN_HEADERS = [
+  'authorization',
+  'cookie',
+  'set-cookie',
+  'x-elastic-app-auth',
+  'es-client-authentication',
+];
 const REDACTED_HEADER_TEXT = '[REDACTED]';
 
 type HapiHeaders = Record<string, string | string[]>;

From 0516caed1de3b72efa3f5c1282975c34962f7999 Mon Sep 17 00:00:00 2001
From: Jatin Kathuria <jatin.kathuria@elastic.co>
Date: Tue, 18 Jul 2023 01:57:12 -0700
Subject: [PATCH 05/14] [Security Solution][Fix] Empty Alert Table when
 upgrading from 8.8.x -> 8.9 (#162063)

## Summary

When users upgrade from `8.8.x` -> `8.9` version, users observe empty
table as shown below.


![image](https://github.com/elastic/kibana/assets/7485038/20549edb-07b9-4124-a0ac-7515cf0e2796)


Below are steps to reproduce this issue and test it:

1. Boot Kibana@v8.8.1
2. Clear Local storage.
3. Go to Security -> Alerts
4. Add Columns `_id` or any other column
5. Upgrade to `8.9`
6. The table will empty as shown in above screenshot.


## Fix

This fix saperates out the migraton from 8.7 -> 8.8 and add a new
migration for upgrading from 8.8 -> 8.9

`migrateAlertTableStateToTriggerActionsState` migrates table from `v8.7
-> v8.8`,

`migrateTriggerActionsVisibleColumnsAlertTable88xTo89` migrates from
`v8.8.x` -> `v8.9`

Combining both of them may lead to issues when users are migrating from
`v8.7` -> `v8.9` or `v8.8` -> `v8.9`
---
 .../containers/local_storage/index.test.ts    | 186 +++++-
 .../containers/local_storage/index.tsx        |  59 +-
 .../containers/local_storage/test.data.ts     | 579 ++++++++++++++++++
 3 files changed, 798 insertions(+), 26 deletions(-)
 create mode 100644 x-pack/plugins/security_solution/public/timelines/containers/local_storage/test.data.ts

diff --git a/x-pack/plugins/security_solution/public/timelines/containers/local_storage/index.test.ts b/x-pack/plugins/security_solution/public/timelines/containers/local_storage/index.test.ts
index e9482e0c152e6..f715169e2abb9 100644
--- a/x-pack/plugins/security_solution/public/timelines/containers/local_storage/index.test.ts
+++ b/x-pack/plugins/security_solution/public/timelines/containers/local_storage/index.test.ts
@@ -15,6 +15,7 @@ import {
   getAllDataTablesInStorage,
   addTableInStorage,
   migrateAlertTableStateToTriggerActionsState,
+  migrateTriggerActionsVisibleColumnsAlertTable88xTo89,
 } from '.';
 
 import { mockDataTableModel, createSecuritySolutionStorageMock } from '../../../common/mock';
@@ -22,6 +23,7 @@ import { useKibana } from '../../../common/lib/kibana';
 import { VIEW_SELECTION } from '../../../../common/constants';
 import type { DataTableModel, DataTableState } from '@kbn/securitysolution-data-table';
 import { TableId } from '@kbn/securitysolution-data-table';
+import { v88xAlertOrignalData, v89xAlertsOriginalData } from './test.data';
 
 jest.mock('../../../common/lib/kibana');
 
@@ -788,7 +790,7 @@ describe('SiemLocalStorage', () => {
     });
   });
 
-  describe('Trigger Actions Alert Table Migration', () => {
+  describe('Trigger Actions Alert Table Migration -> Migration from 8.7', () => {
     const legacyDataTableState: DataTableState['dataTable']['tableById'] = {
       'alerts-page': {
         queryFields: [],
@@ -1261,17 +1263,66 @@ describe('SiemLocalStorage', () => {
           ],
           sort: [{ '@timestamp': { order: 'desc' } }],
           visibleColumns: [
-            '@timestamp',
-            'kibana.alert.rule.name',
-            'kibana.alert.severity',
-            'kibana.alert.risk_score',
-            'kibana.alert.reason',
-            'host.name',
-            'user.name',
-            'process.name',
-            'file.name',
-            'source.ip',
-            'destination.ip',
+            {
+              columnHeaderType: 'not-filtered',
+              id: '@timestamp',
+              initialWidth: 180,
+            },
+            {
+              columnHeaderType: 'not-filtered',
+              displayAsText: 'Rule',
+              id: 'kibana.alert.rule.name',
+              initialWidth: 180,
+              linkField: 'kibana.alert.rule.uuid',
+            },
+            {
+              columnHeaderType: 'not-filtered',
+              displayAsText: 'Severity',
+              id: 'kibana.alert.severity',
+              initialWidth: 180,
+            },
+            {
+              columnHeaderType: 'not-filtered',
+              displayAsText: 'Risk Score',
+              id: 'kibana.alert.risk_score',
+              initialWidth: 180,
+            },
+            {
+              columnHeaderType: 'not-filtered',
+              displayAsText: 'Reason',
+              id: 'kibana.alert.reason',
+              initialWidth: 180,
+            },
+            {
+              columnHeaderType: 'not-filtered',
+              id: 'host.name',
+              initialWidth: 180,
+            },
+            {
+              columnHeaderType: 'not-filtered',
+              id: 'user.name',
+              initialWidth: 180,
+            },
+            {
+              columnHeaderType: 'not-filtered',
+              id: 'process.name',
+              initialWidth: 180,
+            },
+            {
+              columnHeaderType: 'not-filtered',
+              id: 'file.name',
+              initialWidth: 180,
+            },
+            {
+              columnHeaderType: 'not-filtered',
+              id: 'source.ip',
+              initialWidth: 180,
+            },
+            {
+              columnHeaderType: 'not-filtered',
+              id: 'destination.ip',
+              initialWidth: 180,
+            },
           ],
         },
       },
@@ -1344,17 +1395,66 @@ describe('SiemLocalStorage', () => {
             { 'kibana.alert.rule.name': { order: 'desc' } },
           ],
           visibleColumns: [
-            '@timestamp',
-            'kibana.alert.rule.name',
-            'kibana.alert.severity',
-            'kibana.alert.risk_score',
-            'kibana.alert.reason',
-            'host.name',
-            'user.name',
-            'process.name',
-            'file.name',
-            'source.ip',
-            'destination.ip',
+            {
+              columnHeaderType: 'not-filtered',
+              id: '@timestamp',
+              initialWidth: 180,
+            },
+            {
+              columnHeaderType: 'not-filtered',
+              displayAsText: 'Rule',
+              id: 'kibana.alert.rule.name',
+              initialWidth: 180,
+              linkField: 'kibana.alert.rule.uuid',
+            },
+            {
+              columnHeaderType: 'not-filtered',
+              displayAsText: 'Severity',
+              id: 'kibana.alert.severity',
+              initialWidth: 180,
+            },
+            {
+              columnHeaderType: 'not-filtered',
+              displayAsText: 'Risk Score',
+              id: 'kibana.alert.risk_score',
+              initialWidth: 180,
+            },
+            {
+              columnHeaderType: 'not-filtered',
+              displayAsText: 'Reason',
+              id: 'kibana.alert.reason',
+              initialWidth: 180,
+            },
+            {
+              columnHeaderType: 'not-filtered',
+              id: 'host.name',
+              initialWidth: 180,
+            },
+            {
+              columnHeaderType: 'not-filtered',
+              id: 'user.name',
+              initialWidth: 180,
+            },
+            {
+              columnHeaderType: 'not-filtered',
+              id: 'process.name',
+              initialWidth: 180,
+            },
+            {
+              columnHeaderType: 'not-filtered',
+              id: 'file.name',
+              initialWidth: 180,
+            },
+            {
+              columnHeaderType: 'not-filtered',
+              id: 'source.ip',
+              initialWidth: 180,
+            },
+            {
+              columnHeaderType: 'not-filtered',
+              id: 'destination.ip',
+              initialWidth: 180,
+            },
           ],
         },
       },
@@ -1387,4 +1487,44 @@ describe('SiemLocalStorage', () => {
       }
     });
   });
+
+  describe('should migrate Alert Table visible columns from v8.8.x', () => {
+    // PR: https://github.com/elastic/kibana/pull/161054
+    beforeEach(() => storage.clear());
+    it('should migrate correctly when upgrading from 8.8.x -> 8.9', () => {
+      Object.keys(v88xAlertOrignalData).forEach((k) => {
+        storage.set(k, v88xAlertOrignalData[k as keyof typeof v88xAlertOrignalData]);
+      });
+
+      migrateTriggerActionsVisibleColumnsAlertTable88xTo89(storage);
+
+      Object.keys(v89xAlertsOriginalData).forEach((k) => {
+        const expectedResult = v89xAlertsOriginalData[k as keyof typeof v89xAlertsOriginalData];
+        expect(storage.get(k)).toMatchObject(expectedResult);
+      });
+    });
+    it('should be a no-op when reinstalling from 8.9 when data is already present.', () => {
+      Object.keys(v89xAlertsOriginalData).forEach((k) => {
+        storage.set(k, v89xAlertsOriginalData[k as keyof typeof v89xAlertsOriginalData]);
+      });
+
+      migrateTriggerActionsVisibleColumnsAlertTable88xTo89(storage);
+
+      Object.keys(v89xAlertsOriginalData).forEach((k) => {
+        const expectedResult = v89xAlertsOriginalData[k as keyof typeof v89xAlertsOriginalData];
+        expect(storage.get(k)).toMatchObject(expectedResult);
+      });
+    });
+
+    it('should be a no-op when installing 8.9 for the first time', () => {
+      migrateTriggerActionsVisibleColumnsAlertTable88xTo89(storage);
+
+      expect(
+        storage.get('detection-engine-alert-table-securitySolution-alerts-page-gridView')
+      ).toBeNull();
+      expect(
+        storage.get('detection-engine-alert-table-securitySolution-rule-details-gridView')
+      ).toBeNull();
+    });
+  });
 });
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/local_storage/index.tsx b/x-pack/plugins/security_solution/public/timelines/containers/local_storage/index.tsx
index c0bab6bfce78b..bab84294e0a67 100644
--- a/x-pack/plugins/security_solution/public/timelines/containers/local_storage/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/containers/local_storage/index.tsx
@@ -77,6 +77,18 @@ export const migrateLegacyTimelinesToSecurityDataTable = (legacyTimelineTables:
   }, {} as { [K in TableIdLiteral]: DataTableModel });
 };
 
+/*
+ *
+ *  This migraiton only works for upgrading from
+ *  8.7 -> 8.8. Please do not edit this migration for any
+ *  future release.
+ *
+ *  If there is a migration that is required to be done for
+ *  any future release. It should written as a saperate piece of code
+ *  and should be called after this migration
+ *
+ * **/
+
 export const migrateAlertTableStateToTriggerActionsState = (
   storage: Storage,
   legacyDataTableState: DataTableState['dataTable']['tableById']
@@ -100,7 +112,7 @@ export const migrateAlertTableStateToTriggerActionsState = (
           sort: legacyDataTableState[tableKey].sort.map((sortCandidate) => ({
             [sortCandidate.columnId]: { order: sortCandidate.sortDirection },
           })),
-          visibleColumns: legacyDataTableState[tableKey].columns.map((c) => c.id),
+          visibleColumns: legacyDataTableState[tableKey].columns,
         },
       };
     });
@@ -110,7 +122,47 @@ export const migrateAlertTableStateToTriggerActionsState = (
       storage.set(key, stateObj[key]);
     })
   );
-  return Object.assign(legacyDataTableState, triggersActionsState);
+};
+
+/*
+ *
+ * Used for migrating Alert Table from 8.8 => 8.9
+ * */
+export const migrateTriggerActionsVisibleColumnsAlertTable88xTo89 = (storage: Storage) => {
+  const localStorageKeys = [
+    `detection-engine-alert-table-${ALERTS_TABLE_REGISTRY_CONFIG_IDS.ALERTS_PAGE}-gridView`,
+    `detection-engine-alert-table-${ALERTS_TABLE_REGISTRY_CONFIG_IDS.RULE_DETAILS}-gridView`,
+  ];
+
+  localStorageKeys.forEach((key) => {
+    const alertTableData = storage.get(key);
+    if (!alertTableData) {
+      return;
+    }
+    if ('visibleColumns' in alertTableData) {
+      const visibleColumns =
+        alertTableData.visibleColumns as DataTableState['dataTable']['tableById'][string]['columns'];
+      const v89CompliantFormat = visibleColumns.every((val: unknown) => typeof val === 'string');
+      if (v89CompliantFormat) {
+        return;
+      }
+      const newVisibleColumns = visibleColumns
+        .map((visibleCol) => {
+          if (typeof visibleCol === 'string') {
+            // if column format is 8.9 compliant already
+            return visibleCol;
+          }
+          // if column format is 8.8
+          return visibleCol.id;
+        })
+        .filter(Boolean);
+
+      storage.set(key, {
+        ...alertTableData,
+        visibleColumns: newVisibleColumns,
+      });
+    }
+  });
 };
 
 /**
@@ -155,7 +207,8 @@ export const getDataTablesInStorageByIds = (storage: Storage, tableIds: TableIdL
     }
   }
 
-  allDataTables = migrateAlertTableStateToTriggerActionsState(storage, allDataTables);
+  migrateAlertTableStateToTriggerActionsState(storage, allDataTables);
+  migrateTriggerActionsVisibleColumnsAlertTable88xTo89(storage);
 
   return tableIds.reduce((acc, tableId) => {
     const tableModel = allDataTables[tableId];
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/local_storage/test.data.ts b/x-pack/plugins/security_solution/public/timelines/containers/local_storage/test.data.ts
new file mode 100644
index 0000000000000..2d77315ae84e3
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/timelines/containers/local_storage/test.data.ts
@@ -0,0 +1,579 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export const v88xAlertOrignalData = {
+  'detection-engine-alert-table-securitySolution-rule-details-gridView': {
+    columns: [
+      {
+        initialWidth: 200,
+        columnHeaderType: 'not-filtered',
+        id: '@timestamp',
+        schema: 'datetime',
+      },
+      {
+        id: '_id',
+        schema: 'string',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        displayAsText: 'Rule',
+        id: 'kibana.alert.rule.name',
+        linkField: 'kibana.alert.rule.uuid',
+        schema: 'string',
+      },
+      {
+        initialWidth: 105,
+        columnHeaderType: 'not-filtered',
+        displayAsText: 'Severity',
+        id: 'kibana.alert.severity',
+        schema: 'string',
+      },
+      {
+        initialWidth: 100,
+        columnHeaderType: 'not-filtered',
+        displayAsText: 'Risk Score',
+        id: 'kibana.alert.risk_score',
+        schema: 'numeric',
+      },
+      {
+        initialWidth: 450,
+        columnHeaderType: 'not-filtered',
+        displayAsText: 'Reason',
+        id: 'kibana.alert.reason',
+        schema: 'string',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'host.name',
+        schema: 'string',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'host.risk.calculated_level',
+        schema: 'string',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'user.name',
+        schema: 'string',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'user.risk.calculated_level',
+        schema: 'string',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'process.name',
+        schema: 'string',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'file.name',
+        schema: 'string',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'source.ip',
+        schema: 'ip',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'destination.ip',
+        schema: 'ip',
+      },
+    ],
+    sort: [
+      {
+        '@timestamp': {
+          order: 'desc',
+        },
+      },
+    ],
+    visibleColumns: [
+      {
+        initialWidth: 200,
+        columnHeaderType: 'not-filtered',
+        id: '@timestamp',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        displayAsText: 'Rule',
+        id: 'kibana.alert.rule.name',
+        linkField: 'kibana.alert.rule.uuid',
+      },
+      {
+        initialWidth: 105,
+        columnHeaderType: 'not-filtered',
+        displayAsText: 'Severity',
+        id: 'kibana.alert.severity',
+      },
+      {
+        initialWidth: 100,
+        columnHeaderType: 'not-filtered',
+        displayAsText: 'Risk Score',
+        id: 'kibana.alert.risk_score',
+      },
+      {
+        initialWidth: 450,
+        columnHeaderType: 'not-filtered',
+        displayAsText: 'Reason',
+        id: 'kibana.alert.reason',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'host.name',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'host.risk.calculated_level',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'user.name',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'user.risk.calculated_level',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'process.name',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'file.name',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'source.ip',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'destination.ip',
+      },
+    ],
+  },
+  'detection-engine-alert-table-securitySolution-alerts-page-gridView': {
+    columns: [
+      {
+        initialWidth: 200,
+        columnHeaderType: 'not-filtered',
+        id: '@timestamp',
+        schema: 'datetime',
+      },
+      {
+        id: '_id',
+        schema: 'string',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        displayAsText: 'Rule',
+        id: 'kibana.alert.rule.name',
+        linkField: 'kibana.alert.rule.uuid',
+        schema: 'string',
+      },
+      {
+        initialWidth: 105,
+        columnHeaderType: 'not-filtered',
+        displayAsText: 'Severity',
+        id: 'kibana.alert.severity',
+        schema: 'string',
+      },
+      {
+        initialWidth: 100,
+        columnHeaderType: 'not-filtered',
+        displayAsText: 'Risk Score',
+        id: 'kibana.alert.risk_score',
+        schema: 'numeric',
+      },
+      {
+        initialWidth: 450,
+        columnHeaderType: 'not-filtered',
+        displayAsText: 'Reason',
+        id: 'kibana.alert.reason',
+        schema: 'string',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'host.name',
+        schema: 'string',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'host.risk.calculated_level',
+        schema: 'string',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'user.name',
+        schema: 'string',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'user.risk.calculated_level',
+        schema: 'string',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'process.name',
+        schema: 'string',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'file.name',
+        schema: 'string',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'source.ip',
+        schema: 'ip',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'destination.ip',
+        schema: 'ip',
+      },
+    ],
+    sort: [
+      {
+        '@timestamp': {
+          order: 'desc',
+        },
+      },
+    ],
+    visibleColumns: [
+      {
+        initialWidth: 200,
+        columnHeaderType: 'not-filtered',
+        id: '@timestamp',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        displayAsText: 'Rule',
+        id: 'kibana.alert.rule.name',
+        linkField: 'kibana.alert.rule.uuid',
+      },
+      {
+        initialWidth: 105,
+        columnHeaderType: 'not-filtered',
+        displayAsText: 'Severity',
+        id: 'kibana.alert.severity',
+      },
+      {
+        initialWidth: 100,
+        columnHeaderType: 'not-filtered',
+        displayAsText: 'Risk Score',
+        id: 'kibana.alert.risk_score',
+      },
+      {
+        initialWidth: 450,
+        columnHeaderType: 'not-filtered',
+        displayAsText: 'Reason',
+        id: 'kibana.alert.reason',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'host.name',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'host.risk.calculated_level',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'user.name',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'user.risk.calculated_level',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'process.name',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'file.name',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'source.ip',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'destination.ip',
+      },
+    ],
+  },
+};
+
+// when upgrading from 8.9.x => 8.9.y
+export const v89xAlertsOriginalData = {
+  'detection-engine-alert-table-securitySolution-rule-details-gridView': {
+    columns: [
+      {
+        initialWidth: 200,
+        columnHeaderType: 'not-filtered',
+        id: '@timestamp',
+        schema: 'datetime',
+      },
+      {
+        id: '_id',
+        schema: 'string',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        displayAsText: 'Rule',
+        id: 'kibana.alert.rule.name',
+        linkField: 'kibana.alert.rule.uuid',
+        schema: 'string',
+      },
+      {
+        initialWidth: 105,
+        columnHeaderType: 'not-filtered',
+        displayAsText: 'Severity',
+        id: 'kibana.alert.severity',
+        schema: 'string',
+      },
+      {
+        initialWidth: 100,
+        columnHeaderType: 'not-filtered',
+        displayAsText: 'Risk Score',
+        id: 'kibana.alert.risk_score',
+        schema: 'numeric',
+      },
+      {
+        initialWidth: 450,
+        columnHeaderType: 'not-filtered',
+        displayAsText: 'Reason',
+        id: 'kibana.alert.reason',
+        schema: 'string',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'host.name',
+        schema: 'string',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'host.risk.calculated_level',
+        schema: 'string',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'user.name',
+        schema: 'string',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'user.risk.calculated_level',
+        schema: 'string',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'process.name',
+        schema: 'string',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'file.name',
+        schema: 'string',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'source.ip',
+        schema: 'ip',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'destination.ip',
+        schema: 'ip',
+      },
+    ],
+    sort: [
+      {
+        '@timestamp': {
+          order: 'desc',
+        },
+      },
+    ],
+    visibleColumns: [
+      '@timestamp',
+      'kibana.alert.rule.name',
+      'kibana.alert.severity',
+      'kibana.alert.risk_score',
+      'kibana.alert.reason',
+      'host.name',
+      'host.risk.calculated_level',
+      'user.name',
+      'user.risk.calculated_level',
+      'process.name',
+      'file.name',
+      'source.ip',
+      'destination.ip',
+    ],
+  },
+  'detection-engine-alert-table-securitySolution-alerts-page-gridView': {
+    columns: [
+      {
+        initialWidth: 200,
+        columnHeaderType: 'not-filtered',
+        id: '@timestamp',
+        schema: 'datetime',
+      },
+      {
+        id: '_id',
+        schema: 'string',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        displayAsText: 'Rule',
+        id: 'kibana.alert.rule.name',
+        linkField: 'kibana.alert.rule.uuid',
+        schema: 'string',
+      },
+      {
+        initialWidth: 105,
+        columnHeaderType: 'not-filtered',
+        displayAsText: 'Severity',
+        id: 'kibana.alert.severity',
+        schema: 'string',
+      },
+      {
+        initialWidth: 100,
+        columnHeaderType: 'not-filtered',
+        displayAsText: 'Risk Score',
+        id: 'kibana.alert.risk_score',
+        schema: 'numeric',
+      },
+      {
+        initialWidth: 450,
+        columnHeaderType: 'not-filtered',
+        displayAsText: 'Reason',
+        id: 'kibana.alert.reason',
+        schema: 'string',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'host.name',
+        schema: 'string',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'host.risk.calculated_level',
+        schema: 'string',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'user.name',
+        schema: 'string',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'user.risk.calculated_level',
+        schema: 'string',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'process.name',
+        schema: 'string',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'file.name',
+        schema: 'string',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'source.ip',
+        schema: 'ip',
+      },
+      {
+        initialWidth: 180,
+        columnHeaderType: 'not-filtered',
+        id: 'destination.ip',
+        schema: 'ip',
+      },
+    ],
+    sort: [
+      {
+        '@timestamp': {
+          order: 'desc',
+        },
+      },
+    ],
+    visibleColumns: [
+      '@timestamp',
+      'kibana.alert.rule.name',
+      'kibana.alert.severity',
+      'kibana.alert.risk_score',
+      'kibana.alert.reason',
+      'host.name',
+      'host.risk.calculated_level',
+      'user.name',
+      'user.risk.calculated_level',
+      'process.name',
+      'file.name',
+      'source.ip',
+      'destination.ip',
+    ],
+  },
+};

From 2e1d36a10a0f718a59672b21858c430648831322 Mon Sep 17 00:00:00 2001
From: Stratoula Kalafateli <efstratia.kalafateli@elastic.co>
Date: Tue, 18 Jul 2023 12:08:34 +0300
Subject: [PATCH 06/14] Fix bug on null description (#162106)

## Summary

Closes https://github.com/elastic/kibana/issues/162069

Fixes the validation error on the content management service if the
description is set to null.

I am not sure how the description can be set to null. If I create a Lens
so in 7.17 and I don't set the description then it is automatically set
to '' (empty string)

I can think of 2 ways:
- It was possible in older kibana versions
- Someone changed the SO manually and set this to null

This change fixes it with allowing the schema to also set nullable
values.

Note: Maybe covers the undefined case.

To test it just import the SO given by Bhavya here
https://github.com/elastic/kibana/issues/162069

<img width="2496" alt="image"
src="https://github.com/elastic/kibana/assets/17003240/481ef105-2efb-47c0-9d06-94f7fddbf703">
---
 .../visualizations/common/content_management/v1/cm_services.ts  | 2 +-
 x-pack/plugins/lens/common/content_management/v1/cm_services.ts | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/plugins/visualizations/common/content_management/v1/cm_services.ts b/src/plugins/visualizations/common/content_management/v1/cm_services.ts
index 62ae0afc97830..4b1165d357203 100644
--- a/src/plugins/visualizations/common/content_management/v1/cm_services.ts
+++ b/src/plugins/visualizations/common/content_management/v1/cm_services.ts
@@ -29,7 +29,7 @@ const referencesSchema = schema.arrayOf(referenceSchema);
 const visualizeAttributesSchema = schema.object(
   {
     title: schema.string(),
-    description: schema.maybe(schema.string()),
+    description: schema.maybe(schema.nullable(schema.string())),
     version: schema.maybe(schema.number()),
     kibanaSavedObjectMeta: schema.maybe(schema.object({ searchSourceJSON: schema.string() })),
     uiStateJSON: schema.maybe(schema.string()),
diff --git a/x-pack/plugins/lens/common/content_management/v1/cm_services.ts b/x-pack/plugins/lens/common/content_management/v1/cm_services.ts
index c0e09f5041110..22e1af6272978 100644
--- a/x-pack/plugins/lens/common/content_management/v1/cm_services.ts
+++ b/x-pack/plugins/lens/common/content_management/v1/cm_services.ts
@@ -28,7 +28,7 @@ const referencesSchema = schema.arrayOf(referenceSchema);
 const lensAttributesSchema = schema.object(
   {
     title: schema.string(),
-    description: schema.maybe(schema.string()),
+    description: schema.maybe(schema.nullable(schema.string())),
     visualizationType: schema.maybe(schema.string()),
     state: schema.maybe(schema.any()),
     uiStateJSON: schema.maybe(schema.string()),

From 7485343af2b1c94ff11877c2912a0c5caba858e8 Mon Sep 17 00:00:00 2001
From: Julia Bardi <90178898+juliaElastic@users.noreply.github.com>
Date: Tue, 18 Jul 2023 11:40:59 +0200
Subject: [PATCH 07/14] [Fleet] ignore json order in cloud preconfig test
 (#162110)

## Summary

Fix https://github.com/elastic/kibana/issues/133470
---
 .../cloud_preconfiguration.test.ts.snap       | 258 ------------------
 .../cloud_preconfiguration.test.ts            | 196 ++++++++++++-
 2 files changed, 195 insertions(+), 259 deletions(-)
 delete mode 100644 x-pack/plugins/fleet/server/integration_tests/__snapshots__/cloud_preconfiguration.test.ts.snap

diff --git a/x-pack/plugins/fleet/server/integration_tests/__snapshots__/cloud_preconfiguration.test.ts.snap b/x-pack/plugins/fleet/server/integration_tests/__snapshots__/cloud_preconfiguration.test.ts.snap
deleted file mode 100644
index 6a9de18956e43..0000000000000
--- a/x-pack/plugins/fleet/server/integration_tests/__snapshots__/cloud_preconfiguration.test.ts.snap
+++ /dev/null
@@ -1,258 +0,0 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
-
-exports[`Fleet preconfiguration reset Preconfigured cloud policy With a full preconfigured cloud policy Create correct .fleet-policies 1`] = `
-Object {
-  "agent": Object {
-    "download": Object {
-      "sourceURI": "https://artifacts.elastic.co/downloads/",
-    },
-    "features": Object {},
-    "monitoring": Object {
-      "enabled": false,
-      "logs": false,
-      "metrics": false,
-    },
-    "protection": Object {
-      "enabled": false,
-      "signing_key": "",
-      "uninstall_token_hash": "",
-    },
-  },
-  "id": "policy-elastic-agent-on-cloud",
-  "inputs": Array [
-    Object {
-      "data_stream": Object {
-        "namespace": "default",
-      },
-      "id": "fleet-server-fleet_server-elastic-cloud-fleet-server",
-      "meta": Object {
-        "package": Object {
-          "name": "fleet_server",
-        },
-      },
-      "name": "Fleet Server",
-      "package_policy_id": "elastic-cloud-fleet-server",
-      "revision": 1,
-      "server.runtime": Object {
-        "gc_percent": 20,
-      },
-      "type": "fleet-server",
-      "unused_key": "not_used",
-      "use_output": "es-containerhost",
-    },
-    Object {
-      "apm-server": Object {
-        "agent": Object {
-          "config": Object {
-            "elasticsearch": Object {
-              "api_key": "",
-            },
-          },
-        },
-        "agent_config": Array [],
-        "auth": Object {
-          "anonymous": Object {
-            "allow_agent": Array [
-              "rum-js",
-              "js-base",
-              "iOS/swift",
-            ],
-            "allow_service": null,
-            "enabled": true,
-            "rate_limit": Object {
-              "event_limit": 300,
-              "ip_limit": 1000,
-            },
-          },
-          "api_key": Object {
-            "enabled": true,
-            "limit": 100,
-          },
-          "secret_token": "CLOUD_SECRET_TOKEN",
-        },
-        "capture_personal_data": true,
-        "default_service_environment": null,
-        "expvar.enabled": false,
-        "host": "0.0.0.0:8200",
-        "idle_timeout": "45s",
-        "java_attacher": Object {
-          "discovery-rules": null,
-          "download-agent-version": null,
-          "enabled": false,
-        },
-        "max_connections": 0,
-        "max_event_size": 307200,
-        "max_header_size": 1048576,
-        "pprof.enabled": false,
-        "read_timeout": "3600s",
-        "response_headers": null,
-        "rum": Object {
-          "allow_headers": null,
-          "allow_origins": Array [
-            "*",
-          ],
-          "enabled": true,
-          "exclude_from_grouping": "^/webpack",
-          "library_pattern": "node_modules|bower_components|~",
-          "response_headers": null,
-          "source_mapping": Object {
-            "elasticsearch": Object {
-              "api_key": "",
-            },
-            "metadata": Array [],
-          },
-        },
-        "sampling": Object {
-          "tail": Object {
-            "enabled": false,
-            "interval": "1m",
-            "policies": Array [
-              Object {
-                "sample_rate": 0.1,
-              },
-            ],
-            "storage_limit": "3GB",
-          },
-        },
-        "shutdown_timeout": "30s",
-        "ssl": Object {
-          "certificate": "/app/config/certs/node.crt",
-          "cipher_suites": null,
-          "curve_types": null,
-          "enabled": true,
-          "key": "/app/config/certs/node.key",
-          "key_passphrase": null,
-          "supported_protocols": Array [
-            "TLSv1.1",
-            "TLSv1.2",
-            "TLSv1.3",
-          ],
-        },
-        "write_timeout": "30s",
-      },
-      "data_stream": Object {
-        "namespace": "default",
-      },
-      "id": "elastic-cloud-apm",
-      "meta": Object {
-        "package": Object {
-          "name": "apm",
-        },
-      },
-      "name": "Elastic APM",
-      "package_policy_id": "elastic-cloud-apm",
-      "revision": 2,
-      "type": "apm",
-      "use_output": "es-containerhost",
-    },
-  ],
-  "output_permissions": Object {
-    "es-containerhost": Object {
-      "_elastic_agent_checks": Object {
-        "cluster": Array [
-          "monitor",
-        ],
-      },
-      "_elastic_agent_monitoring": Object {
-        "indices": Array [],
-      },
-      "elastic-cloud-apm": Object {
-        "cluster": Array [
-          "cluster:monitor/main",
-        ],
-        "indices": Array [
-          Object {
-            "names": Array [
-              "logs-apm.app-default",
-            ],
-            "privileges": Array [
-              "auto_configure",
-              "create_doc",
-            ],
-          },
-          Object {
-            "names": Array [
-              "metrics-apm.app.*-default",
-            ],
-            "privileges": Array [
-              "auto_configure",
-              "create_doc",
-            ],
-          },
-          Object {
-            "names": Array [
-              "logs-apm.error-default",
-            ],
-            "privileges": Array [
-              "auto_configure",
-              "create_doc",
-            ],
-          },
-          Object {
-            "names": Array [
-              "metrics-apm.internal-default",
-            ],
-            "privileges": Array [
-              "auto_configure",
-              "create_doc",
-            ],
-          },
-          Object {
-            "names": Array [
-              "metrics-apm.profiling-default",
-            ],
-            "privileges": Array [
-              "auto_configure",
-              "create_doc",
-            ],
-          },
-          Object {
-            "names": Array [
-              "traces-apm.rum-default",
-            ],
-            "privileges": Array [
-              "auto_configure",
-              "create_doc",
-            ],
-          },
-          Object {
-            "names": Array [
-              "traces-apm.sampled-default",
-            ],
-            "privileges": Array [
-              "auto_configure",
-              "create_doc",
-              "maintenance",
-              "monitor",
-              "read",
-            ],
-          },
-          Object {
-            "names": Array [
-              "traces-apm-default",
-            ],
-            "privileges": Array [
-              "auto_configure",
-              "create_doc",
-            ],
-          },
-        ],
-      },
-    },
-  },
-  "outputs": Object {
-    "es-containerhost": Object {
-      "hosts": Array [
-        "https://cloudinternales:9200",
-      ],
-      "type": "elasticsearch",
-    },
-  },
-  "revision": 5,
-  "secret_references": Array [],
-  "signed": Object {
-    "data": "",
-    "signature": "",
-  },
-}
-`;
diff --git a/x-pack/plugins/fleet/server/integration_tests/cloud_preconfiguration.test.ts b/x-pack/plugins/fleet/server/integration_tests/cloud_preconfiguration.test.ts
index 7c18ef95997f6..7da8edb68f9f7 100644
--- a/x-pack/plugins/fleet/server/integration_tests/cloud_preconfiguration.test.ts
+++ b/x-pack/plugins/fleet/server/integration_tests/cloud_preconfiguration.test.ts
@@ -164,7 +164,201 @@ describe('Fleet preconfiguration reset', () => {
         data.signed.data = '';
         data.signed.signature = '';
 
-        expect(data).toMatchSnapshot();
+        expect(data).toEqual({
+          agent: {
+            download: {
+              sourceURI: 'https://artifacts.elastic.co/downloads/',
+            },
+            features: {},
+            monitoring: {
+              enabled: false,
+              logs: false,
+              metrics: false,
+            },
+            protection: {
+              enabled: false,
+              signing_key: '',
+              uninstall_token_hash: '',
+            },
+          },
+          id: 'policy-elastic-agent-on-cloud',
+          inputs: [
+            {
+              data_stream: {
+                namespace: 'default',
+              },
+              id: 'fleet-server-fleet_server-elastic-cloud-fleet-server',
+              meta: {
+                package: {
+                  name: 'fleet_server',
+                },
+              },
+              name: 'Fleet Server',
+              package_policy_id: 'elastic-cloud-fleet-server',
+              revision: 1,
+              'server.runtime': {
+                gc_percent: 20,
+              },
+              type: 'fleet-server',
+              unused_key: 'not_used',
+              use_output: 'es-containerhost',
+            },
+            {
+              'apm-server': {
+                agent: {
+                  config: {
+                    elasticsearch: {
+                      api_key: '',
+                    },
+                  },
+                },
+                agent_config: [],
+                auth: {
+                  anonymous: {
+                    allow_agent: ['rum-js', 'js-base', 'iOS/swift'],
+                    allow_service: null,
+                    enabled: true,
+                    rate_limit: {
+                      event_limit: 300,
+                      ip_limit: 1000,
+                    },
+                  },
+                  api_key: {
+                    enabled: true,
+                    limit: 100,
+                  },
+                  secret_token: 'CLOUD_SECRET_TOKEN',
+                },
+                capture_personal_data: true,
+                default_service_environment: null,
+                'expvar.enabled': false,
+                host: '0.0.0.0:8200',
+                idle_timeout: '45s',
+                java_attacher: {
+                  'discovery-rules': null,
+                  'download-agent-version': null,
+                  enabled: false,
+                },
+                max_connections: 0,
+                max_event_size: 307200,
+                max_header_size: 1048576,
+                'pprof.enabled': false,
+                read_timeout: '3600s',
+                response_headers: null,
+                rum: {
+                  allow_headers: null,
+                  allow_origins: ['*'],
+                  enabled: true,
+                  exclude_from_grouping: '^/webpack',
+                  library_pattern: 'node_modules|bower_components|~',
+                  response_headers: null,
+                  source_mapping: {
+                    elasticsearch: {
+                      api_key: '',
+                    },
+                    metadata: [],
+                  },
+                },
+                sampling: {
+                  tail: {
+                    enabled: false,
+                    interval: '1m',
+                    policies: [
+                      {
+                        sample_rate: 0.1,
+                      },
+                    ],
+                    storage_limit: '3GB',
+                  },
+                },
+                shutdown_timeout: '30s',
+                ssl: {
+                  certificate: '/app/config/certs/node.crt',
+                  cipher_suites: null,
+                  curve_types: null,
+                  enabled: true,
+                  key: '/app/config/certs/node.key',
+                  key_passphrase: null,
+                  supported_protocols: ['TLSv1.1', 'TLSv1.2', 'TLSv1.3'],
+                },
+                write_timeout: '30s',
+              },
+              data_stream: {
+                namespace: 'default',
+              },
+              id: 'elastic-cloud-apm',
+              meta: {
+                package: {
+                  name: 'apm',
+                },
+              },
+              name: 'Elastic APM',
+              package_policy_id: 'elastic-cloud-apm',
+              revision: 2,
+              type: 'apm',
+              use_output: 'es-containerhost',
+            },
+          ],
+          output_permissions: {
+            'es-containerhost': {
+              _elastic_agent_checks: {
+                cluster: ['monitor'],
+              },
+              _elastic_agent_monitoring: {
+                indices: [],
+              },
+              'elastic-cloud-apm': {
+                cluster: ['cluster:monitor/main'],
+                indices: [
+                  {
+                    names: ['logs-apm.app-default'],
+                    privileges: ['auto_configure', 'create_doc'],
+                  },
+                  {
+                    names: ['metrics-apm.app.*-default'],
+                    privileges: ['auto_configure', 'create_doc'],
+                  },
+                  {
+                    names: ['logs-apm.error-default'],
+                    privileges: ['auto_configure', 'create_doc'],
+                  },
+                  {
+                    names: ['metrics-apm.internal-default'],
+                    privileges: ['auto_configure', 'create_doc'],
+                  },
+                  {
+                    names: ['metrics-apm.profiling-default'],
+                    privileges: ['auto_configure', 'create_doc'],
+                  },
+                  {
+                    names: ['traces-apm.rum-default'],
+                    privileges: ['auto_configure', 'create_doc'],
+                  },
+                  {
+                    names: ['traces-apm.sampled-default'],
+                    privileges: ['auto_configure', 'create_doc', 'maintenance', 'monitor', 'read'],
+                  },
+                  {
+                    names: ['traces-apm-default'],
+                    privileges: ['auto_configure', 'create_doc'],
+                  },
+                ],
+              },
+            },
+          },
+          outputs: {
+            'es-containerhost': {
+              hosts: ['https://cloudinternales:9200'],
+              type: 'elasticsearch',
+            },
+          },
+          revision: 5,
+          secret_references: [],
+          signed: {
+            data: '',
+            signature: '',
+          },
+        });
       });
 
       it('Create correct package policies', async () => {

From 82eaddd86c243035962ea960f2c2dd90aedc8c0f Mon Sep 17 00:00:00 2001
From: Julia Bardi <90178898+juliaElastic@users.noreply.github.com>
Date: Tue, 18 Jul 2023 11:41:10 +0200
Subject: [PATCH 08/14] [Fleet] fix multi space test (#162113)

## Summary

Fixes https://github.com/elastic/kibana/issues/161624

Test failed due to an unrelated endpoint installation error, loading
empty ES to make sure endpoint doesn't cause trouble, as the test
installs system integration.
---
 .../apis/epm/install_integration_in_multiple_spaces.ts         | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/x-pack/test/fleet_api_integration/apis/epm/install_integration_in_multiple_spaces.ts b/x-pack/test/fleet_api_integration/apis/epm/install_integration_in_multiple_spaces.ts
index 1202f73e35cf9..d6023ae0492e1 100644
--- a/x-pack/test/fleet_api_integration/apis/epm/install_integration_in_multiple_spaces.ts
+++ b/x-pack/test/fleet_api_integration/apis/epm/install_integration_in_multiple_spaces.ts
@@ -16,6 +16,7 @@ export default function (providerContext: FtrProviderContext) {
   const kibanaServer = getService('kibanaServer');
   const supertest = getService('supertest');
   const dockerServers = getService('dockerServers');
+  const esArchiver = getService('esArchiver');
   const server = dockerServers.get('registry');
   const pkgName = 'system';
   const pkgVersion = '1.27.0';
@@ -72,6 +73,7 @@ export default function (providerContext: FtrProviderContext) {
 
     before(async () => {
       if (!server.enabled) return;
+      await esArchiver.load('x-pack/test/functional/es_archives/fleet/empty_fleet_server');
       await installPackage(pkgName, pkgVersion);
 
       await createSpace(testSpaceId);
@@ -81,6 +83,7 @@ export default function (providerContext: FtrProviderContext) {
 
     after(async () => {
       await deleteSpace(testSpaceId);
+      await esArchiver.unload('x-pack/test/functional/es_archives/fleet/empty_fleet_server');
     });
 
     it('should install kibana assets', async function () {

From 37521304afe283a5132cbaf771d8b95fcbe96188 Mon Sep 17 00:00:00 2001
From: Abdul Wahab Zahid <awahab07@yahoo.com>
Date: Tue, 18 Jul 2023 12:19:47 +0200
Subject: [PATCH 09/14] [Synthetics] Fix date format for Waterfall and TLS
 Certificates (#162099)

Fixes #161499

## Summary
The PR adjusts date format in waterfall flyout and TLS Certificates page
to the common date format used in Synthetics (via `useDateFormat` hook).

|Before|After|
|:---:|:---:|
|<img width="438" alt="Screenshot 2023-07-18 at 00 25 48"
src="https://github.com/elastic/kibana/assets/2748376/f671c5f0-042d-4fa1-910e-bc9deb85d1dd">|<img
width="438" alt="Screenshot 2023-07-17 at 23 40 59"
src="https://github.com/elastic/kibana/assets/2748376/bf19344f-e82e-4188-97a2-65d045544245">|

|Before|After|
|:---:|:---:|
|<img width="1545" alt="Screenshot 2023-07-18 at 00 25 05"
src="https://github.com/elastic/kibana/assets/2748376/ddeb4186-c1e1-4eff-b8ed-4ea6755b3e09">|<img
width="1544" alt="Screenshot 2023-07-17 at 23 53 55"
src="https://github.com/elastic/kibana/assets/2748376/b35a34ea-3d16-4479-82db-0a2f808d0a6c">|
---
 .../certificates/certificates_list.tsx        |  4 +-
 .../network_data/data_formatting.test.ts      | 37 +++++++++++++------
 .../common/network_data/data_formatting.ts    | 13 ++++---
 .../waterfall/waterfall_chart_wrapper.tsx     | 13 ++++++-
 .../public/hooks/use_date_format.ts           |  3 +-
 5 files changed, 48 insertions(+), 22 deletions(-)

diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/certificates/certificates_list.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/certificates/certificates_list.tsx
index 3bde6cd1a88b1..67d9b29b9024b 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/components/certificates/certificates_list.tsx
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/certificates/certificates_list.tsx
@@ -9,6 +9,7 @@ import React from 'react';
 import moment from 'moment';
 import { Direction, EuiBasicTable } from '@elastic/eui';
 import { Cert, CertMonitor, CertResult } from '../../../../../common/runtime_types';
+import { useDateFormat } from '../../../../hooks/use_date_format';
 import { CertStatus } from './cert_status';
 import { CertMonitors } from './cert_monitors';
 import * as labels from './translations';
@@ -46,6 +47,7 @@ interface Props {
 }
 
 export const CertificateList: React.FC<Props> = ({ page, certificates, sort, onChange }) => {
+  const dateFormatter = useDateFormat();
   const pagination = {
     pageIndex: page.index,
     pageSize: page.size,
@@ -80,7 +82,7 @@ export const CertificateList: React.FC<Props> = ({ page, certificates, sort, onC
       name: labels.VALID_UNTIL_COL,
       field: 'not_after',
       sortable: true,
-      render: (value: string) => moment(value).format('L LT'),
+      render: dateFormatter,
     },
     {
       name: labels.AGE_COL,
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/common/network_data/data_formatting.test.ts b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/common/network_data/data_formatting.test.ts
index 1e1112603e67f..2f4136d425963 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/common/network_data/data_formatting.test.ts
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/common/network_data/data_formatting.test.ts
@@ -14,6 +14,7 @@ import {
 } from './data_formatting';
 import { MimeType, FriendlyFlyoutLabels, FriendlyTimingLabels, Timings, Metadata } from './types';
 import { WaterfallDataEntry } from './types';
+import type { DateFormatter } from '../../../../../../hooks/use_date_format';
 import { mockMoment } from '../../../../utils/formatting/test_helpers';
 import { NetworkEvent } from '../../../../../../../common/runtime_types';
 
@@ -231,12 +232,14 @@ describe('Palettes', () => {
 });
 
 describe('getSeriesAndDomain', () => {
+  let mockDateFormatter: DateFormatter;
   beforeEach(() => {
     mockMoment();
+    mockDateFormatter = (dateStr?: string) => (dateStr ? moment(dateStr).format() : '');
   });
 
   it('formats series timings', () => {
-    const actual = getSeriesAndDomain(networkItems);
+    const actual = getSeriesAndDomain(networkItems, false, mockDateFormatter);
     expect(actual.series).toMatchInlineSnapshot(`
       Array [
         Object {
@@ -409,7 +412,7 @@ describe('getSeriesAndDomain', () => {
   });
 
   it('handles series formatting when only total timing values are available', () => {
-    const { series } = getSeriesAndDomain(networkItemsWithoutFullTimings);
+    const { series } = getSeriesAndDomain(networkItemsWithoutFullTimings, false, mockDateFormatter);
     expect(series).toMatchInlineSnapshot(`
       Array [
         Object {
@@ -536,7 +539,7 @@ describe('getSeriesAndDomain', () => {
   });
 
   it('handles series formatting when there is no timing information available', () => {
-    const { series } = getSeriesAndDomain(networkItemsWithoutAnyTimings);
+    const { series } = getSeriesAndDomain(networkItemsWithoutAnyTimings, false, mockDateFormatter);
     expect(series).toMatchInlineSnapshot(`
       Array [
         Object {
@@ -555,7 +558,7 @@ describe('getSeriesAndDomain', () => {
   });
 
   it('handles formatting when there is no timing information available', () => {
-    const actual = getSeriesAndDomain(networkItemsWithoutAnyTimings);
+    const actual = getSeriesAndDomain(networkItemsWithoutAnyTimings, false, mockDateFormatter);
     expect(actual).toMatchInlineSnapshot(`
       Object {
         "domain": Object {
@@ -636,7 +639,11 @@ describe('getSeriesAndDomain', () => {
   });
 
   it('handles formatting when the timings object is undefined', () => {
-    const { series } = getSeriesAndDomain(networkItemsWithoutTimingsObject);
+    const { series } = getSeriesAndDomain(
+      networkItemsWithoutTimingsObject,
+      false,
+      mockDateFormatter
+    );
     expect(series).toMatchInlineSnapshot(`
       Array [
         Object {
@@ -653,7 +660,11 @@ describe('getSeriesAndDomain', () => {
   });
 
   it('handles formatting when mime type is not mapped to a specific mime type bucket', () => {
-    const { series } = getSeriesAndDomain(networkItemsWithUnknownMimeType);
+    const { series } = getSeriesAndDomain(
+      networkItemsWithUnknownMimeType,
+      false,
+      mockDateFormatter
+    );
     /* verify that raw mime type appears in the tooltip config and that
      * the colour is mapped to mime type other */
     const contentDownloadingConfigItem = series.find((item: WaterfallDataEntry) => {
@@ -682,7 +693,7 @@ describe('getSeriesAndDomain', () => {
     [FriendlyFlyoutLabels[Metadata.ResourceSize], '1.000 KB'],
     [FriendlyFlyoutLabels[Metadata.IP], '104.18.8.22'],
   ])('handles metadata details formatting', (name, value) => {
-    const { metadata } = getSeriesAndDomain(networkItems);
+    const { metadata } = getSeriesAndDomain(networkItems, false, mockDateFormatter);
     const metadataEntry = metadata[0];
     expect(
       metadataEntry.details.find((item) => item.value === value && item.name === name)
@@ -690,7 +701,7 @@ describe('getSeriesAndDomain', () => {
   });
 
   it('handles metadata headers formatting', () => {
-    const { metadata } = getSeriesAndDomain(networkItems);
+    const { metadata } = getSeriesAndDomain(networkItems, false, mockDateFormatter);
     const metadataEntry = metadata[0];
     metadataEntry.requestHeaders?.forEach((header) => {
       expect(header).toEqual({ name: header.name, value: header.value });
@@ -701,7 +712,7 @@ describe('getSeriesAndDomain', () => {
   });
 
   it('handles certificate formatting', () => {
-    const { metadata } = getSeriesAndDomain([networkItems[0]]);
+    const { metadata } = getSeriesAndDomain([networkItems[0]], false, mockDateFormatter);
     const metadataEntry = metadata[0];
     expect(metadataEntry.certificates).toEqual([
       { name: 'Issuer', value: networkItems[0].certificates?.issuer },
@@ -715,13 +726,15 @@ describe('getSeriesAndDomain', () => {
   });
   it('counts the total number of highlighted items', () => {
     // only one CSS file in this array of network Items
-    const actual = getSeriesAndDomain(networkItems, false, '', ['stylesheet']);
+    const actual = getSeriesAndDomain(networkItems, false, mockDateFormatter, '', ['stylesheet']);
     expect(actual.totalHighlightedRequests).toBe(1);
   });
 
   it('adds isHighlighted to waterfall entry when filter matches', () => {
     // only one CSS file in this array of network Items
-    const { series } = getSeriesAndDomain(networkItems, false, '', ['stylesheet']);
+    const { series } = getSeriesAndDomain(networkItems, false, mockDateFormatter, '', [
+      'stylesheet',
+    ]);
     series.forEach((item) => {
       if (item.x === 0) {
         expect(item.config.isHighlighted).toBe(true);
@@ -733,7 +746,7 @@ describe('getSeriesAndDomain', () => {
 
   it('adds isHighlighted to waterfall entry when query matches', () => {
     // only the second item matches this query
-    const { series } = getSeriesAndDomain(networkItems, false, 'director', []);
+    const { series } = getSeriesAndDomain(networkItems, false, mockDateFormatter, 'director', []);
     series.forEach((item) => {
       if (item.x === 1) {
         expect(item.config.isHighlighted).toBe(true);
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/common/network_data/data_formatting.ts b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/common/network_data/data_formatting.ts
index 9e300e5576671..8e87bbe657193 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/common/network_data/data_formatting.ts
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/common/network_data/data_formatting.ts
@@ -6,9 +6,9 @@
  */
 
 import { euiPaletteColorBlind } from '@elastic/eui';
-import moment from 'moment';
 
 import { MarkerItems } from '../../step_waterfall_chart/waterfall/context/waterfall_context';
+import type { DateFormatter } from '../../../../../../hooks/use_date_format';
 import { NetworkEvent } from '../../../../../../../common/runtime_types';
 import { WaterfallData, WaterfallMetadata } from './types';
 import {
@@ -128,6 +128,7 @@ export const getFilterMatcher = (filters: string[] | undefined): ItemMatcher =>
 export const getSeriesAndDomain = (
   items: NetworkEvent[],
   onlyHighlighted = false,
+  dateFormatter: DateFormatter,
   query?: string,
   activeFilters?: string[],
   markerItems?: MarkerItems
@@ -159,7 +160,7 @@ export const getSeriesAndDomain = (
     const mimeTypeColour = getColourForMimeType(item.mimeType);
     const offsetValue = getValueForOffset(item);
     let currentOffset = offsetValue - zeroOffset;
-    metadata.push(formatMetadata({ item, index, requestStart: currentOffset }));
+    metadata.push(formatMetadata({ item, index, requestStart: currentOffset, dateFormatter }));
     const isHighlighted = isHighlightedItem(item, queryMatcher, filterMatcher);
     if (isHighlighted) {
       totalHighlightedRequests++;
@@ -270,10 +271,12 @@ const formatMetadata = ({
   item,
   index,
   requestStart,
+  dateFormatter,
 }: {
   item: NetworkEvent;
   index: number;
   requestStart: number;
+  dateFormatter: DateFormatter;
 }) => {
   const {
     certificates,
@@ -301,13 +304,11 @@ const formatMetadata = ({
           },
           {
             name: FriendlyFlyoutLabels[Metadata.CertificateIssueDate],
-            value: certificates.validFrom
-              ? moment(certificates.validFrom).format('L LT')
-              : undefined,
+            value: certificates.validFrom ? dateFormatter(certificates.validFrom) : undefined,
           },
           {
             name: FriendlyFlyoutLabels[Metadata.CertificateExpiryDate],
-            value: certificates.validTo ? moment(certificates.validTo).format('L LT') : undefined,
+            value: certificates.validTo ? dateFormatter(certificates.validTo) : undefined,
           },
           {
             name: FriendlyFlyoutLabels[Metadata.CertificateSubject],
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_waterfall_chart/waterfall/waterfall_chart_wrapper.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_waterfall_chart/waterfall/waterfall_chart_wrapper.tsx
index 5a6cc596068d3..ed5a6b73d411e 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_waterfall_chart/waterfall/waterfall_chart_wrapper.tsx
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_waterfall_chart/waterfall/waterfall_chart_wrapper.tsx
@@ -9,6 +9,7 @@ import React, { useCallback, useMemo, useState } from 'react';
 import useLocalStorage from 'react-use/lib/useLocalStorage';
 import { EuiHealth } from '@elastic/eui';
 import { JourneyStep, NetworkEvent } from '../../../../../../../common/runtime_types';
+import { useDateFormat } from '../../../../../../hooks/use_date_format';
 import { getSeriesAndDomain, getSidebarItems } from '../../common/network_data/data_formatting';
 import { SidebarItem, LegendItem } from '../../common/network_data/types';
 import { RenderItem, WaterfallDataEntry } from '../../common/network_data/types';
@@ -54,9 +55,17 @@ export const WaterfallChartWrapper: React.FC<Props> = ({
 
   const hasFilters = activeFilters.length > 0;
 
+  const dateFormatter = useDateFormat();
   const { series, domain, metadata, totalHighlightedRequests } = useMemo(() => {
-    return getSeriesAndDomain(networkData, onlyHighlighted, query, activeFilters, markerItems);
-  }, [networkData, query, activeFilters, onlyHighlighted, markerItems]);
+    return getSeriesAndDomain(
+      networkData,
+      onlyHighlighted,
+      dateFormatter,
+      query,
+      activeFilters,
+      markerItems
+    );
+  }, [networkData, dateFormatter, query, activeFilters, onlyHighlighted, markerItems]);
 
   const sidebarItems = useMemo(() => {
     return getSidebarItems(networkData, onlyHighlighted ?? false, query, activeFilters);
diff --git a/x-pack/plugins/synthetics/public/hooks/use_date_format.ts b/x-pack/plugins/synthetics/public/hooks/use_date_format.ts
index 4b402cc2367cd..6214deb9be4a8 100644
--- a/x-pack/plugins/synthetics/public/hooks/use_date_format.ts
+++ b/x-pack/plugins/synthetics/public/hooks/use_date_format.ts
@@ -9,7 +9,8 @@ import moment from 'moment';
 import { useEffect } from 'react';
 import { i18n } from '@kbn/i18n';
 
-export function useDateFormat(): (timestamp?: string) => string {
+export type DateFormatter = (timestamp?: string) => string;
+export function useDateFormat(): DateFormatter {
   const kibanaLocale = i18n.getLocale();
   const clientLocale = navigator.language;
 

From 75f68da623c122f7458f00b8dc60cec4449af568 Mon Sep 17 00:00:00 2001
From: Alison Goryachev <alison.goryachev@elastic.co>
Date: Tue, 18 Jul 2023 07:21:37 -0400
Subject: [PATCH 10/14] Disable management plugins using contextRef (#160671)

---
 .../cloud_data_migration/server/config.ts     |  9 ++-
 .../server/config.ts                          |  9 ++-
 .../server/config.ts                          |  9 ++-
 .../license_management/server/config.ts       |  9 ++-
 .../plugins/remote_clusters/server/config.ts  |  9 ++-
 x-pack/plugins/rollup/server/config.ts        |  9 ++-
 .../plugins/snapshot_restore/server/config.ts |  9 ++-
 .../upgrade_assistant/server/config.ts        |  9 ++-
 .../functional/test_suites/common/index.ts    |  1 +
 .../test_suites/common/management.ts          | 66 +++++++++++++++++++
 10 files changed, 131 insertions(+), 8 deletions(-)
 create mode 100644 x-pack/test_serverless/functional/test_suites/common/management.ts

diff --git a/x-pack/plugins/cloud_integrations/cloud_data_migration/server/config.ts b/x-pack/plugins/cloud_integrations/cloud_data_migration/server/config.ts
index d1b9842857d47..e6a7fce2541f2 100644
--- a/x-pack/plugins/cloud_integrations/cloud_data_migration/server/config.ts
+++ b/x-pack/plugins/cloud_integrations/cloud_data_migration/server/config.ts
@@ -9,7 +9,14 @@ import { schema, TypeOf } from '@kbn/config-schema';
 import { PluginConfigDescriptor } from '@kbn/core-plugins-server';
 
 const configSchema = schema.object({
-  enabled: schema.boolean({ defaultValue: true }),
+  enabled: schema.conditional(
+    schema.contextRef('serverless'),
+    true,
+    // cloud_data_migration is disabled in serverless; refer to the serverless.yml file as the source of truth
+    // We take this approach in order to have a central place (serverless.yml) to view disabled plugins across Kibana
+    schema.boolean({ defaultValue: true }),
+    schema.never()
+  ),
 });
 
 export type CloudDataMigrationConfig = TypeOf<typeof configSchema>;
diff --git a/x-pack/plugins/cross_cluster_replication/server/config.ts b/x-pack/plugins/cross_cluster_replication/server/config.ts
index 4cba6d0707abb..1d83f53920576 100644
--- a/x-pack/plugins/cross_cluster_replication/server/config.ts
+++ b/x-pack/plugins/cross_cluster_replication/server/config.ts
@@ -26,7 +26,14 @@ const schemaLatest = schema.object(
      * Disables the plugin.
      * Added back in 8.8.
      */
-    enabled: schema.boolean({ defaultValue: true }),
+    enabled: schema.conditional(
+      schema.contextRef('serverless'),
+      true,
+      // CCR is disabled in serverless; refer to the serverless.yml file as the source of truth
+      // We take this approach in order to have a central place (serverless.yml) to view disabled plugins across Kibana
+      schema.boolean({ defaultValue: true }),
+      schema.never()
+    ),
   },
   { defaultValue: undefined }
 );
diff --git a/x-pack/plugins/index_lifecycle_management/server/config.ts b/x-pack/plugins/index_lifecycle_management/server/config.ts
index 7fdec20bbb050..5a02e404ad2b7 100644
--- a/x-pack/plugins/index_lifecycle_management/server/config.ts
+++ b/x-pack/plugins/index_lifecycle_management/server/config.ts
@@ -28,7 +28,14 @@ const schemaLatest = schema.object(
      * Disables the plugin.
      * Added back in 8.8.
      */
-    enabled: schema.boolean({ defaultValue: true }),
+    enabled: schema.conditional(
+      schema.contextRef('serverless'),
+      true,
+      // ILM is disabled in serverless; refer to the serverless.yml file as the source of truth
+      // We take this approach in order to have a central place (serverless.yml) to view disabled plugins across Kibana
+      schema.boolean({ defaultValue: true }),
+      schema.never()
+    ),
   },
   { defaultValue: undefined }
 );
diff --git a/x-pack/plugins/license_management/server/config.ts b/x-pack/plugins/license_management/server/config.ts
index 23449bc19e793..f413335cc23ef 100644
--- a/x-pack/plugins/license_management/server/config.ts
+++ b/x-pack/plugins/license_management/server/config.ts
@@ -26,7 +26,14 @@ const schemaLatest = schema.object(
      * Disables the plugin.
      * Added back in 8.8.
      */
-    enabled: schema.boolean({ defaultValue: true }),
+    enabled: schema.conditional(
+      schema.contextRef('serverless'),
+      true,
+      // License Management is disabled in serverless; refer to the serverless.yml file as the source of truth
+      // We take this approach in order to have a central place (serverless.yml) to view disabled plugins across Kibana
+      schema.boolean({ defaultValue: true }),
+      schema.never()
+    ),
   },
   { defaultValue: undefined }
 );
diff --git a/x-pack/plugins/remote_clusters/server/config.ts b/x-pack/plugins/remote_clusters/server/config.ts
index 4f6c56191cd89..12275985a3aa9 100644
--- a/x-pack/plugins/remote_clusters/server/config.ts
+++ b/x-pack/plugins/remote_clusters/server/config.ts
@@ -26,7 +26,14 @@ const schemaLatest = schema.object(
      * Disables the plugin.
      * Added back in 8.8.
      */
-    enabled: schema.boolean({ defaultValue: true }),
+    enabled: schema.conditional(
+      schema.contextRef('serverless'),
+      true,
+      // Remote Clusters is disabled in serverless; refer to the serverless.yml file as the source of truth
+      // We take this approach in order to have a central place (serverless.yml) to view disabled plugins across Kibana
+      schema.boolean({ defaultValue: true }),
+      schema.never()
+    ),
   },
   { defaultValue: undefined }
 );
diff --git a/x-pack/plugins/rollup/server/config.ts b/x-pack/plugins/rollup/server/config.ts
index 953cd4b283f97..c0d5c1fbe92ee 100644
--- a/x-pack/plugins/rollup/server/config.ts
+++ b/x-pack/plugins/rollup/server/config.ts
@@ -26,7 +26,14 @@ const schemaLatest = schema.object(
      * Disables the plugin.
      * Added back in 8.8.
      */
-    enabled: schema.boolean({ defaultValue: true }),
+    enabled: schema.conditional(
+      schema.contextRef('serverless'),
+      true,
+      // Rollups is disabled in serverless; refer to the serverless.yml file as the source of truth
+      // We take this approach in order to have a central place (serverless.yml) to view disabled plugins across Kibana
+      schema.boolean({ defaultValue: true }),
+      schema.never()
+    ),
   },
   { defaultValue: undefined }
 );
diff --git a/x-pack/plugins/snapshot_restore/server/config.ts b/x-pack/plugins/snapshot_restore/server/config.ts
index e2452e5b58e54..e712f33eb0cbd 100644
--- a/x-pack/plugins/snapshot_restore/server/config.ts
+++ b/x-pack/plugins/snapshot_restore/server/config.ts
@@ -29,7 +29,14 @@ const schemaLatest = schema.object(
      * Disables the plugin.
      * Added back in 8.8.
      */
-    enabled: schema.boolean({ defaultValue: true }),
+    enabled: schema.conditional(
+      schema.contextRef('serverless'),
+      true,
+      // Snapshot & Restore is disabled in serverless; refer to the serverless.yml file as the source of truth
+      // We take this approach in order to have a central place (serverless.yml) to view disabled plugins across Kibana
+      schema.boolean({ defaultValue: true }),
+      schema.never()
+    ),
   },
   { defaultValue: undefined }
 );
diff --git a/x-pack/plugins/upgrade_assistant/server/config.ts b/x-pack/plugins/upgrade_assistant/server/config.ts
index bf872f50b5222..76820c5121765 100644
--- a/x-pack/plugins/upgrade_assistant/server/config.ts
+++ b/x-pack/plugins/upgrade_assistant/server/config.ts
@@ -15,7 +15,14 @@ const configSchema = schema.object({
   /**
    * Disables the plugin.
    */
-  enabled: schema.boolean({ defaultValue: true }),
+  enabled: schema.conditional(
+    schema.contextRef('serverless'),
+    true,
+    // Upgrade Assistant is disabled in serverless; refer to the serverless.yml file as the source of truth
+    // We take this approach in order to have a central place (serverless.yml) to view disabled plugins across Kibana
+    schema.boolean({ defaultValue: true }),
+    schema.never()
+  ),
 
   featureSet: schema.object({
     /**
diff --git a/x-pack/test_serverless/functional/test_suites/common/index.ts b/x-pack/test_serverless/functional/test_suites/common/index.ts
index c49b2fcf91bcb..d0adbf04e23b4 100644
--- a/x-pack/test_serverless/functional/test_suites/common/index.ts
+++ b/x-pack/test_serverless/functional/test_suites/common/index.ts
@@ -10,5 +10,6 @@ import { FtrProviderContext } from '../../ftr_provider_context';
 export default function ({ loadTestFile }: FtrProviderContext) {
   describe('serverless common UI', function () {
     loadTestFile(require.resolve('./home_page'));
+    loadTestFile(require.resolve('./management'));
   });
 }
diff --git a/x-pack/test_serverless/functional/test_suites/common/management.ts b/x-pack/test_serverless/functional/test_suites/common/management.ts
new file mode 100644
index 0000000000000..0b2f2cab24716
--- /dev/null
+++ b/x-pack/test_serverless/functional/test_suites/common/management.ts
@@ -0,0 +1,66 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrProviderContext } from '../../ftr_provider_context';
+
+export default function ({ getPageObject, getService }: FtrProviderContext) {
+  const commonPage = getPageObject('common');
+  const testSubjects = getService('testSubjects');
+
+  describe('Management', function () {
+    describe('Disabled UIs', () => {
+      const DISABLED_PLUGINS = [
+        {
+          appName: 'Upgrade Assistant',
+          url: 'stack/upgrade_assistant',
+        },
+        {
+          appName: 'Advanced Settings',
+          url: 'kibana/settings',
+        },
+        {
+          appName: 'Migrate',
+          url: 'data/migrate_data',
+        },
+        {
+          appName: 'Remote Clusters',
+          url: 'data/remote_clusters',
+        },
+        {
+          appName: 'Cross-Cluster Replication',
+          url: 'data/cross_cluster_replication',
+        },
+        {
+          appName: 'Snapshot and Restore',
+          url: 'data/snapshot_restore',
+        },
+        {
+          appName: 'Index Lifecycle Management',
+          url: 'data/index_lifecycle_management',
+        },
+        {
+          appName: 'Rollup Jobs',
+          url: 'data/rollup_jobs',
+        },
+        {
+          appName: 'License Management',
+          url: 'stack/license_management',
+        },
+      ];
+
+      DISABLED_PLUGINS.forEach(({ appName, url }) => {
+        it(`${appName} is not accessible`, async () => {
+          await commonPage.navigateToUrl('management', url, {
+            shouldUseHashForSubUrl: false,
+          });
+          // If the route doesn't exist, the user will be redirected back to the Management landing page
+          await testSubjects.exists('managementHome');
+        });
+      });
+    });
+  });
+}

From 72907cfe1eca4019a2ba6565e690d15a7dbab49d Mon Sep 17 00:00:00 2001
From: Dzmitry Lemechko <dzmitry.lemechko@elastic.co>
Date: Tue, 18 Jul 2023 13:27:47 +0200
Subject: [PATCH 11/14] convert more tests to use uiSettings for timePicker
 (#161737)

While searching in test files, I found few more places to replace
`PageObjects.timePicker.setAbsoluteRange` with
`PageObjects.common.setTime`.

Before changing I reviewed tests if it is not important to select
datePicker via UI component, but please double check scenarios because I
might miss the context.
---
 .../dashboard/group1/embeddable_rendering.ts     |  8 ++++----
 test/functional/apps/dashboard/group5/share.ts   |  8 ++++----
 .../controls/common/range_slider.ts              | 12 ++++++------
 .../embeddable/_saved_search_embeddable.ts       |  9 +++++----
 .../visualize/group3/_linked_saved_searches.ts   |  7 +++++--
 .../apps/visualize/group6/_tsvb_markdown.ts      | 16 ++++++++++------
 .../dashboard/group3/reporting/download_csv.ts   | 10 ++++------
 7 files changed, 38 insertions(+), 32 deletions(-)

diff --git a/test/functional/apps/dashboard/group1/embeddable_rendering.ts b/test/functional/apps/dashboard/group1/embeddable_rendering.ts
index 93b111f072443..d7addf89ac404 100644
--- a/test/functional/apps/dashboard/group1/embeddable_rendering.ts
+++ b/test/functional/apps/dashboard/group1/embeddable_rendering.ts
@@ -102,6 +102,8 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
 
   // FLAKY: https://github.com/elastic/kibana/issues/158529
   describe.skip('dashboard embeddable rendering', function describeIndexTests() {
+    const from = 'Jan 1, 2018 @ 00:00:00.000';
+    const to = 'Apr 13, 2018 @ 00:00:00.000';
     before(async () => {
       await security.testUser.setRoles(['kibana_admin', 'animals', 'test_logstash_reader']);
       await kibanaServer.savedObjects.cleanStandardList();
@@ -111,14 +113,11 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await kibanaServer.uiSettings.replace({
         defaultIndex: '0bf35f60-3dc9-11e8-8660-4d65aa086b3c',
       });
+      await PageObjects.common.setTime({ from, to });
       await PageObjects.common.navigateToApp('dashboard');
       await PageObjects.dashboard.preserveCrossAppState();
       await PageObjects.dashboard.clickNewDashboard();
       await elasticChart.setNewChartUiDebugFlag(true);
-
-      const fromTime = 'Jan 1, 2018 @ 00:00:00.000';
-      const toTime = 'Apr 13, 2018 @ 00:00:00.000';
-      await PageObjects.timePicker.setAbsoluteRange(fromTime, toTime);
     });
 
     after(async () => {
@@ -127,6 +126,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       const newUrl = currentUrl.replace(/\?.*$/, '');
       await browser.get(newUrl, false);
       await security.testUser.restoreDefaults();
+      await PageObjects.common.unsetTime();
       await kibanaServer.savedObjects.cleanStandardList();
     });
 
diff --git a/test/functional/apps/dashboard/group5/share.ts b/test/functional/apps/dashboard/group5/share.ts
index b6a2e9811e51f..a6d9289313e62 100644
--- a/test/functional/apps/dashboard/group5/share.ts
+++ b/test/functional/apps/dashboard/group5/share.ts
@@ -106,19 +106,19 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await kibanaServer.uiSettings.replace({
         defaultIndex: '0bf35f60-3dc9-11e8-8660-4d65aa086b3c',
       });
+      const from = 'Sep 19, 2017 @ 06:31:44.000';
+      const to = 'Sep 23, 2018 @ 18:31:44.000';
+      await PageObjects.common.setTime({ from, to });
       await PageObjects.common.navigateToApp('dashboard');
       await PageObjects.dashboard.preserveCrossAppState();
       await PageObjects.dashboard.loadSavedDashboard('few panels');
-
       await PageObjects.dashboard.switchToEditMode();
-      const from = 'Sep 19, 2017 @ 06:31:44.000';
-      const to = 'Sep 23, 2018 @ 18:31:44.000';
-      await PageObjects.timePicker.setAbsoluteRange(from, to);
       await PageObjects.dashboard.waitForRenderComplete();
     });
 
     after(async () => {
       await kibanaServer.savedObjects.cleanStandardList();
+      await PageObjects.common.unsetTime();
     });
 
     describe('snapshot share', async () => {
diff --git a/test/functional/apps/dashboard_elements/controls/common/range_slider.ts b/test/functional/apps/dashboard_elements/controls/common/range_slider.ts
index d6cd7388987fe..9140c23573c3f 100644
--- a/test/functional/apps/dashboard_elements/controls/common/range_slider.ts
+++ b/test/functional/apps/dashboard_elements/controls/common/range_slider.ts
@@ -19,9 +19,8 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const filterBar = getService('filterBar');
   const testSubjects = getService('testSubjects');
   const kibanaServer = getService('kibanaServer');
-  const { dashboardControls, timePicker, common, dashboard, header } = getPageObjects([
+  const { dashboardControls, common, dashboard, header } = getPageObjects([
     'dashboardControls',
-    'timePicker',
     'dashboard',
     'common',
     'header',
@@ -46,16 +45,16 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await kibanaServer.uiSettings.replace({
         defaultIndex: '0bf35f60-3dc9-11e8-8660-4d65aa086b3c',
       });
+      await common.setTime({
+        from: 'Oct 22, 2018 @ 00:00:00.000',
+        to: 'Dec 3, 2018 @ 00:00:00.000',
+      });
       await common.navigateToApp('dashboard');
       await dashboardControls.enableControlsLab();
       await common.navigateToApp('dashboard');
       await dashboard.preserveCrossAppState();
       await dashboard.gotoDashboardLandingPage();
       await dashboard.clickNewDashboard();
-      await timePicker.setAbsoluteRange(
-        'Oct 22, 2018 @ 00:00:00.000',
-        'Dec 3, 2018 @ 00:00:00.000'
-      );
       await dashboard.saveDashboard(DASHBOARD_NAME, { exitFromEditMode: false });
     });
 
@@ -66,6 +65,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       );
       await esArchiver.unload('test/functional/fixtures/es_archiver/kibana_sample_data_flights');
       await kibanaServer.uiSettings.unset('defaultIndex');
+      await common.unsetTime();
       await security.testUser.restoreDefaults();
     });
 
diff --git a/test/functional/apps/discover/embeddable/_saved_search_embeddable.ts b/test/functional/apps/discover/embeddable/_saved_search_embeddable.ts
index 1bfdc9143ad4c..8961af57a4ad2 100644
--- a/test/functional/apps/discover/embeddable/_saved_search_embeddable.ts
+++ b/test/functional/apps/discover/embeddable/_saved_search_embeddable.ts
@@ -32,10 +32,15 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await kibanaServer.uiSettings.replace({
         defaultIndex: '0bf35f60-3dc9-11e8-8660-4d65aa086b3c',
       });
+      await PageObjects.common.setTime({
+        from: 'Sep 22, 2015 @ 00:00:00.000',
+        to: 'Sep 23, 2015 @ 00:00:00.000',
+      });
     });
 
     after(async () => {
       await kibanaServer.savedObjects.cleanStandardList();
+      await PageObjects.common.unsetTime();
     });
 
     beforeEach(async () => {
@@ -43,10 +48,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await filterBar.ensureFieldEditorModalIsClosed();
       await PageObjects.dashboard.gotoDashboardLandingPage();
       await PageObjects.dashboard.clickNewDashboard();
-      await PageObjects.timePicker.setAbsoluteRange(
-        'Sep 22, 2015 @ 00:00:00.000',
-        'Sep 23, 2015 @ 00:00:00.000'
-      );
     });
 
     const addSearchEmbeddableToDashboard = async () => {
diff --git a/test/functional/apps/visualize/group3/_linked_saved_searches.ts b/test/functional/apps/visualize/group3/_linked_saved_searches.ts
index c27d5725e50ac..f97a4c86e4560 100644
--- a/test/functional/apps/visualize/group3/_linked_saved_searches.ts
+++ b/test/functional/apps/visualize/group3/_linked_saved_searches.ts
@@ -31,19 +31,22 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
 
       before(async () => {
         await PageObjects.visualize.initTests();
+        await PageObjects.timePicker.setDefaultAbsoluteRangeViaUiSettings();
         await PageObjects.common.navigateToApp('discover');
-        await PageObjects.timePicker.setDefaultAbsoluteRange();
         await filterBar.addFilter({ field: 'extension.raw', operation: 'is', value: 'jpg' });
         await PageObjects.header.waitUntilLoadingHasFinished();
         await PageObjects.discover.saveSearch(savedSearchName);
         discoverSavedSearchUrlPath = (await browser.getCurrentUrl()).split('?')[0];
       });
 
+      after(async () => {
+        await PageObjects.common.unsetTime();
+      });
+
       it('should create a visualization from a saved search', async () => {
         await PageObjects.visualize.navigateToNewAggBasedVisualization();
         await PageObjects.visualize.clickDataTable();
         await PageObjects.visualize.clickSavedSearch(savedSearchName);
-        await PageObjects.timePicker.setDefaultAbsoluteRange();
         await retry.waitFor('wait for count to equal 9,109', async () => {
           const data = await PageObjects.visChart.getTableVisContent();
           return data[0][0] === '9,109';
diff --git a/test/functional/apps/visualize/group6/_tsvb_markdown.ts b/test/functional/apps/visualize/group6/_tsvb_markdown.ts
index 9f259ff005364..f015a0a010748 100644
--- a/test/functional/apps/visualize/group6/_tsvb_markdown.ts
+++ b/test/functional/apps/visualize/group6/_tsvb_markdown.ts
@@ -11,9 +11,9 @@ import expect from '@kbn/expect';
 import { FtrProviderContext } from '../../../ftr_provider_context';
 
 export default function ({ getPageObjects, getService }: FtrProviderContext) {
-  const { visualBuilder, timePicker, visualize, visChart } = getPageObjects([
+  const { visualBuilder, common, visualize, visChart } = getPageObjects([
     'visualBuilder',
-    'timePicker',
+    'common',
     'visualize',
     'visChart',
   ]);
@@ -37,20 +37,24 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
     describe('markdown', () => {
       before(async () => {
         await visualize.initTests();
+        await common.setTime({
+          to: 'Sep 22, 2015 @ 06:00:00.000',
+          from: 'Sep 22, 2015 @ 11:00:00.000',
+        });
         await visualize.navigateToNewVisualization();
         await visualize.clickVisualBuilder();
         await visualBuilder.checkVisualBuilderIsPresent();
         await visualBuilder.clickMarkdown();
-        await timePicker.setAbsoluteRange(
-          'Sep 22, 2015 @ 06:00:00.000',
-          'Sep 22, 2015 @ 11:00:00.000'
-        );
         await visualBuilder.markdownSwitchSubTab('options');
         await visualBuilder.setMetricsDataTimerangeMode('Last value');
         await visualBuilder.setDropLastBucket(true);
         await visualBuilder.markdownSwitchSubTab('markdown');
       });
 
+      after(async () => {
+        await common.unsetTime();
+      });
+
       it('should render subtabs and table variables markdown components', async () => {
         const tabs = await visualBuilder.getSubTabs();
         expect(tabs).to.have.length(3);
diff --git a/x-pack/test/functional/apps/dashboard/group3/reporting/download_csv.ts b/x-pack/test/functional/apps/dashboard/group3/reporting/download_csv.ts
index d062eb8feb432..766e7ecd882fb 100644
--- a/x-pack/test/functional/apps/dashboard/group3/reporting/download_csv.ts
+++ b/x-pack/test/functional/apps/dashboard/group3/reporting/download_csv.ts
@@ -134,18 +134,15 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
     describe('Filtered Saved Search', () => {
       const TEST_SEARCH_TITLE = 'Customer Betty';
       const TEST_DASHBOARD_TITLE = 'Filtered Search Data';
-      const setTimeRange = async () => {
-        const fromTime = 'Jun 20, 2019 @ 23:56:51.374';
-        const toTime = 'Jun 25, 2019 @ 16:18:51.821';
-        await PageObjects.timePicker.setAbsoluteRange(fromTime, toTime);
-      };
+      const from = 'Jun 20, 2019 @ 23:56:51.374';
+      const to = 'Jun 25, 2019 @ 16:18:51.821';
 
       before(async () => {
         await reporting.initEcommerce();
+        await PageObjects.common.setTime({ from, to });
         await navigateToDashboardApp();
         log.info(`Creating empty dashboard`);
         await PageObjects.dashboard.clickNewDashboard();
-        await setTimeRange();
         log.info(`Adding "${TEST_SEARCH_TITLE}" to dashboard`);
         await dashboardAddPanel.addSavedSearch(TEST_SEARCH_TITLE);
         await PageObjects.dashboard.saveDashboard(TEST_DASHBOARD_TITLE);
@@ -154,6 +151,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       after(async () => {
         await reporting.teardownEcommerce();
         await esArchiver.emptyKibanaIndex();
+        await PageObjects.common.unsetTime();
       });
 
       it('Downloads filtered Discover saved search report', async () => {

From c6deb252b2a2830ad1d689c476517f783247206b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Loix?= <sebastien.loix@elastic.co>
Date: Tue, 18 Jul 2023 12:47:01 +0100
Subject: [PATCH 12/14] [TableListView] Fix regression when resetting search
 (#162034)

---
 .../src/tabbed_table_list_view.tsx            |  12 +-
 .../table_list_view/src/table_list_view.tsx   |   6 +-
 .../table_list_view_table/src/reducer.tsx     |  10 +
 .../src/table_list_view.test.helpers.ts       |  64 ++++
 .../src/table_list_view.test.tsx              | 325 +++++++++++++++---
 .../src/table_list_view_table.tsx             |  26 +-
 .../public/components/table_list.tsx          |   4 +-
 test/functional/apps/management/_files.ts     |   3 +-
 8 files changed, 370 insertions(+), 80 deletions(-)
 create mode 100644 packages/content-management/table_list_view_table/src/table_list_view.test.helpers.ts

diff --git a/packages/content-management/tabbed_table_list_view/src/tabbed_table_list_view.tsx b/packages/content-management/tabbed_table_list_view/src/tabbed_table_list_view.tsx
index 9872e35d90c88..e1cd59f9a1378 100644
--- a/packages/content-management/tabbed_table_list_view/src/tabbed_table_list_view.tsx
+++ b/packages/content-management/tabbed_table_list_view/src/tabbed_table_list_view.tsx
@@ -47,23 +47,23 @@ export const TabbedTableListView = ({
     [activeTabId, tabs]
   );
 
+  const onFetchSuccess = useCallback(() => {
+    setHasInitialFetchReturned(true);
+  }, []);
+
   const [tableList, setTableList] = useState<React.ReactNode>(null);
 
   useEffect(() => {
     async function loadTableList() {
       const newTableList = await getActiveTab().getTableList({
-        onFetchSuccess: () => {
-          if (!hasInitialFetchReturned) {
-            setHasInitialFetchReturned(true);
-          }
-        },
+        onFetchSuccess,
         setPageDataTestSubject,
       });
       setTableList(newTableList);
     }
 
     loadTableList();
-  }, [hasInitialFetchReturned, activeTabId, tabs, getActiveTab]);
+  }, [activeTabId, tabs, getActiveTab, onFetchSuccess]);
 
   return (
     <KibanaPageTemplate panelled data-test-subj={pageDataTestSubject}>
diff --git a/packages/content-management/table_list_view/src/table_list_view.tsx b/packages/content-management/table_list_view/src/table_list_view.tsx
index 71b08f82174bb..71e9f95bbf581 100644
--- a/packages/content-management/table_list_view/src/table_list_view.tsx
+++ b/packages/content-management/table_list_view/src/table_list_view.tsx
@@ -82,10 +82,8 @@ export const TableListView = <T extends UserContentCommonSchema>({
   const [pageDataTestSubject, setPageDataTestSubject] = useState<string>();
 
   const onFetchSuccess = useCallback(() => {
-    if (!hasInitialFetchReturned) {
-      setHasInitialFetchReturned(true);
-    }
-  }, [hasInitialFetchReturned]);
+    setHasInitialFetchReturned(true);
+  }, []);
 
   return (
     <PageTemplate panelled data-test-subj={pageDataTestSubject}>
diff --git a/packages/content-management/table_list_view_table/src/reducer.tsx b/packages/content-management/table_list_view_table/src/reducer.tsx
index c8486d92caced..0a8a89db80d92 100644
--- a/packages/content-management/table_list_view_table/src/reducer.tsx
+++ b/packages/content-management/table_list_view_table/src/reducer.tsx
@@ -39,11 +39,21 @@ export function getReducer<T extends UserContentCommonSchema>() {
           }
         }
 
+        let hasNoItems = state.hasNoItems;
+
+        const hasQuery = state.searchQuery.text !== '';
+        if (hasQuery) {
+          hasNoItems = undefined;
+        } else {
+          hasNoItems = items.length === 0;
+        }
+
         return {
           ...state,
           hasInitialFetchReturned: true,
           isFetchingItems: false,
           items,
+          hasNoItems,
           totalItems: action.data.response.total,
           hasUpdatedAtMetadata,
           tableSort: tableSort ?? state.tableSort,
diff --git a/packages/content-management/table_list_view_table/src/table_list_view.test.helpers.ts b/packages/content-management/table_list_view_table/src/table_list_view.test.helpers.ts
new file mode 100644
index 0000000000000..cbfa96198cc9d
--- /dev/null
+++ b/packages/content-management/table_list_view_table/src/table_list_view.test.helpers.ts
@@ -0,0 +1,64 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { TestBed } from '@kbn/test-jest-helpers';
+import { act } from 'react-dom/test-utils';
+
+export const getActions = ({ find, form, component }: TestBed) => {
+  /** Open the sort select drop down menu */
+  const openSortSelect = () => {
+    find('tableSortSelectBtn').at(0).simulate('click');
+  };
+
+  // --- Search Box ---
+
+  /** Set the search box value */
+  const updateSearchText = async (value: string) => {
+    await act(async () => {
+      find('tableListSearchBox').simulate('keyup', {
+        key: 'Enter',
+        target: { value },
+      });
+    });
+    component.update();
+  };
+
+  /** Get the Search box value */
+  const getSearchBoxValue = () => find('tableListSearchBox').props().defaultValue;
+
+  // --- Row Actions ---
+  const selectRow = (rowId: string) => {
+    act(() => {
+      form.selectCheckBox(`checkboxSelectRow-${rowId}`);
+    });
+    component.update();
+  };
+
+  const clickDeleteSelectedItemsButton = () => {
+    act(() => {
+      find('deleteSelectedItems').simulate('click');
+    });
+    component.update();
+  };
+
+  const clickConfirmModalButton = async () => {
+    await act(async () => {
+      find('confirmModalConfirmButton').simulate('click');
+    });
+    component.update();
+  };
+
+  return {
+    openSortSelect,
+    updateSearchText,
+    getSearchBoxValue,
+    selectRow,
+    clickDeleteSelectedItemsButton,
+    clickConfirmModalButton,
+  };
+};
diff --git a/packages/content-management/table_list_view_table/src/table_list_view.test.tsx b/packages/content-management/table_list_view_table/src/table_list_view.test.tsx
index 0fc1840f26613..94c1ca5ab6753 100644
--- a/packages/content-management/table_list_view_table/src/table_list_view.test.tsx
+++ b/packages/content-management/table_list_view_table/src/table_list_view.test.tsx
@@ -22,6 +22,7 @@ import {
   type TableListViewTableProps,
   type UserContentCommonSchema,
 } from './table_list_view_table';
+import { getActions } from './table_list_view.test.helpers';
 
 const mockUseEffect = useEffect;
 
@@ -54,12 +55,6 @@ const twoDaysAgoToString = new Date(twoDaysAgo.getTime()).toDateString();
 const yesterday = new Date(new Date().setDate(new Date().getDate() - 1));
 const yesterdayToString = new Date(yesterday.getTime()).toDateString();
 
-const getActions = (testBed: TestBed) => ({
-  openSortSelect() {
-    testBed.find('tableSortSelectBtn').at(0).simulate('click');
-  },
-});
-
 describe('TableListView', () => {
   const requiredProps: TableListViewTableProps = {
     entityName: 'test',
@@ -91,50 +86,102 @@ describe('TableListView', () => {
     }
   );
 
-  test('render default empty prompt', async () => {
-    let testBed: TestBed;
+  describe('empty prompt', () => {
+    test('render default empty prompt', async () => {
+      let testBed: TestBed;
 
-    await act(async () => {
-      testBed = await setup();
+      await act(async () => {
+        testBed = await setup();
+      });
+
+      const { component, exists } = testBed!;
+      component.update();
+
+      expect(component.find(EuiEmptyPrompt).length).toBe(1);
+      expect(exists('newItemButton')).toBe(false);
     });
 
-    const { component, exists } = testBed!;
-    component.update();
+    // avoid trapping users in empty prompt that can not create new items
+    test('render default empty prompt with create action when createItem supplied', async () => {
+      let testBed: TestBed;
 
-    expect(component.find(EuiEmptyPrompt).length).toBe(1);
-    expect(exists('newItemButton')).toBe(false);
-  });
+      await act(async () => {
+        testBed = await setup({ createItem: () => undefined });
+      });
 
-  // avoid trapping users in empty prompt that can not create new items
-  test('render default empty prompt with create action when createItem supplied', async () => {
-    let testBed: TestBed;
+      const { component, exists } = testBed!;
+      component.update();
 
-    await act(async () => {
-      testBed = await setup({ createItem: () => undefined });
+      expect(component.find(EuiEmptyPrompt).length).toBe(1);
+      expect(exists('newItemButton')).toBe(true);
     });
 
-    const { component, exists } = testBed!;
-    component.update();
+    test('render custom empty prompt', async () => {
+      let testBed: TestBed;
 
-    expect(component.find(EuiEmptyPrompt).length).toBe(1);
-    expect(exists('newItemButton')).toBe(true);
-  });
+      const CustomEmptyPrompt = () => {
+        return <EuiEmptyPrompt data-test-subj="custom-empty-prompt" title={<h1>Table empty</h1>} />;
+      };
 
-  test('render custom empty prompt', async () => {
-    let testBed: TestBed;
+      await act(async () => {
+        testBed = await setup({ emptyPrompt: <CustomEmptyPrompt /> });
+      });
 
-    const CustomEmptyPrompt = () => {
-      return <EuiEmptyPrompt data-test-subj="custom-empty-prompt" title={<h1>Table empty</h1>} />;
-    };
+      const { component, exists } = testBed!;
+      component.update();
 
-    await act(async () => {
-      testBed = await setup({ emptyPrompt: <CustomEmptyPrompt /> });
+      expect(exists('custom-empty-prompt')).toBe(true);
     });
 
-    const { component, exists } = testBed!;
-    component.update();
+    test('render empty prompt after deleting all items from table', async () => {
+      // NOTE: this test is using helpers that are being tested in the
+      // "should allow select items to be deleted" test below.
+      // If this test fails, check that one first.
+
+      const hits: UserContentCommonSchema[] = [
+        {
+          id: 'item-1',
+          type: 'dashboard',
+          updatedAt: '2020-01-01T00:00:00Z',
+          attributes: {
+            title: 'Item 1',
+          },
+          references: [],
+        },
+      ];
 
-    expect(exists('custom-empty-prompt')).toBe(true);
+      const findItems = jest.fn().mockResolvedValue({ total: 1, hits });
+      const deleteItems = jest.fn();
+
+      let testBed: TestBed;
+
+      const EmptyPrompt = () => {
+        return <EuiEmptyPrompt data-test-subj="custom-empty-prompt" title={<h1>Table empty</h1>} />;
+      };
+
+      await act(async () => {
+        testBed = await setup({ emptyPrompt: <EmptyPrompt />, findItems, deleteItems });
+      });
+
+      const { component, exists, table } = testBed!;
+      const { selectRow, clickConfirmModalButton, clickDeleteSelectedItemsButton } = getActions(
+        testBed!
+      );
+      component.update();
+
+      expect(exists('custom-empty-prompt')).toBe(false);
+      const { tableCellsValues } = table.getMetaData('itemsInMemTable');
+      const [row] = tableCellsValues;
+      expect(row[1]).toBe('Item 1'); // Note: row[0] is the checkbox
+
+      // We delete the item in the table and expect the empty prompt to show
+      findItems.mockResolvedValue({ total: 0, hits: [] });
+      selectRow('item-1');
+      clickDeleteSelectedItemsButton();
+      await clickConfirmModalButton();
+
+      expect(exists('custom-empty-prompt')).toBe(true);
+    });
   });
 
   describe('default columns', () => {
@@ -798,7 +845,20 @@ describe('TableListView', () => {
       let testBed: TestBed;
 
       const initialFilter = 'tag:(tag-1)';
-      const findItems = jest.fn().mockResolvedValue({ total: 0, hits: [] });
+      const findItems = jest.fn().mockResolvedValue({
+        total: 1,
+        hits: [
+          {
+            id: 'item-1',
+            type: 'dashboard',
+            updatedAt: new Date('2023-07-15').toISOString(),
+            attributes: {
+              title: 'Item 1',
+            },
+            references: [],
+          },
+        ],
+      });
 
       await act(async () => {
         testBed = await setupInitialFilter({
@@ -824,6 +884,173 @@ describe('TableListView', () => {
     });
   });
 
+  describe('search', () => {
+    const updatedAt = new Date('2023-07-15').toISOString();
+
+    const hits: UserContentCommonSchema[] = [
+      {
+        id: 'item-1',
+        type: 'dashboard',
+        updatedAt,
+        attributes: {
+          title: 'Item 1',
+        },
+        references: [],
+      },
+      {
+        id: 'item-2',
+        type: 'dashboard',
+        updatedAt,
+        attributes: {
+          title: 'Item 2',
+        },
+        references: [],
+      },
+    ];
+
+    const findItems = jest.fn();
+
+    const setupSearch = (...args: Parameters<ReturnType<typeof registerTestBed>>) => {
+      const testBed = registerTestBed<string, TableListViewTableProps>(
+        WithServices<TableListViewTableProps>(TableListViewTable),
+        {
+          defaultProps: {
+            ...requiredProps,
+            findItems,
+            urlStateEnabled: false,
+            entityName: 'Foo',
+            entityNamePlural: 'Foos',
+          },
+          memoryRouter: { wrapComponent: true },
+        }
+      )(...args);
+
+      const { updateSearchText, getSearchBoxValue } = getActions(testBed);
+
+      return {
+        testBed,
+        updateSearchText,
+        getSearchBoxValue,
+        getLastCallArgsFromFindItems: () => findItems.mock.calls[findItems.mock.calls.length - 1],
+      };
+    };
+
+    beforeEach(() => {
+      findItems.mockReset().mockResolvedValue({ total: hits.length, hits });
+    });
+
+    test('should search the table items', async () => {
+      let testBed: TestBed;
+      let updateSearchText: (value: string) => Promise<void>;
+      let getLastCallArgsFromFindItems: () => Parameters<typeof findItems>;
+      let getSearchBoxValue: () => string;
+
+      await act(async () => {
+        ({ testBed, getLastCallArgsFromFindItems, getSearchBoxValue, updateSearchText } =
+          await setupSearch());
+      });
+
+      const { component, table } = testBed!;
+      component.update();
+
+      let searchTerm = '';
+      let expected = '';
+      [searchTerm] = getLastCallArgsFromFindItems!();
+      expect(getSearchBoxValue!()).toBe(expected);
+      expect(searchTerm).toBe(expected);
+
+      const { tableCellsValues } = table.getMetaData('itemsInMemTable');
+      expect(tableCellsValues).toMatchInlineSnapshot(`
+        Array [
+          Array [
+            "Item 1",
+            "Sat Jul 15 2023",
+          ],
+          Array [
+            "Item 2",
+            "Sat Jul 15 2023",
+          ],
+        ]
+      `);
+
+      findItems.mockResolvedValueOnce({
+        total: 1,
+        hits: [
+          {
+            id: 'item-from-search',
+            type: 'dashboard',
+            updatedAt: new Date('2023-07-01').toISOString(),
+            attributes: {
+              title: 'Item from search',
+            },
+            references: [],
+          },
+        ],
+      });
+
+      expected = 'foo';
+      await updateSearchText!(expected);
+      [searchTerm] = getLastCallArgsFromFindItems!();
+      expect(getSearchBoxValue!()).toBe(expected);
+      expect(searchTerm).toBe(expected);
+
+      expect(table.getMetaData('itemsInMemTable').tableCellsValues).toMatchInlineSnapshot(`
+        Array [
+          Array [
+            "Item from search",
+            "July 1, 2023",
+          ],
+        ]
+      `);
+    });
+
+    test('should search and render empty list if no result', async () => {
+      let testBed: TestBed;
+      let updateSearchText: (value: string) => Promise<void>;
+
+      await act(async () => {
+        ({ testBed, updateSearchText } = await setupSearch());
+      });
+
+      const { component, table, find } = testBed!;
+      component.update();
+
+      findItems.mockResolvedValueOnce({
+        total: 0,
+        hits: [],
+      });
+
+      await updateSearchText!('unknown items');
+
+      expect(table.getMetaData('itemsInMemTable').tableCellsValues).toMatchInlineSnapshot(`
+        Array [
+          Array [
+            "No Foos matched your search.",
+          ],
+        ]
+      `);
+
+      await act(async () => {
+        find('clearSearchButton').simulate('click');
+      });
+      component.update();
+
+      // We should get back the initial 2 items (Item 1 and Item 2)
+      expect(table.getMetaData('itemsInMemTable').tableCellsValues).toMatchInlineSnapshot(`
+        Array [
+          Array [
+            "Item 1",
+            "Sat Jul 15 2023",
+          ],
+          Array [
+            "Item 2",
+            "Sat Jul 15 2023",
+          ],
+        ]
+      `);
+    });
+  });
+
   describe('url state', () => {
     let router: Router | undefined;
 
@@ -1153,10 +1380,11 @@ describe('TableListView', () => {
     };
 
     test('should allow select items to be deleted', async () => {
-      const {
-        testBed: { table, find, exists, component, form },
-        deleteItems,
-      } = await setupTest();
+      const { testBed, deleteItems } = await setupTest();
+
+      const { table, exists, component } = testBed;
+      const { selectRow, clickDeleteSelectedItemsButton, clickConfirmModalButton } =
+        getActions(testBed);
 
       const { tableCellsValues } = table.getMetaData('itemsInMemTable');
 
@@ -1165,28 +1393,21 @@ describe('TableListView', () => {
         ['', 'Item 1Item 1 description', twoDaysAgoToString],
       ]);
 
+      // Select the second item
       const selectedHit = hits[1];
 
       expect(exists('deleteSelectedItems')).toBe(false);
-      act(() => {
-        // Select the second item
-        form.selectCheckBox(`checkboxSelectRow-${selectedHit.id}`);
-      });
-      component.update();
+
+      selectRow(selectedHit.id);
       // Delete button is now visible
       expect(exists('deleteSelectedItems')).toBe(true);
 
       // Click delete and validate that confirm modal opens
       expect(component.exists('.euiModal--confirmation')).toBe(false);
-      act(() => {
-        find('deleteSelectedItems').simulate('click');
-      });
-      component.update();
+      clickDeleteSelectedItemsButton();
       expect(component.exists('.euiModal--confirmation')).toBe(true);
 
-      await act(async () => {
-        find('confirmModalConfirmButton').simulate('click');
-      });
+      await clickConfirmModalButton();
       expect(deleteItems).toHaveBeenCalledWith([selectedHit]);
     });
 
diff --git a/packages/content-management/table_list_view_table/src/table_list_view_table.tsx b/packages/content-management/table_list_view_table/src/table_list_view_table.tsx
index 33ef91dc65e4b..9d7613c6a122d 100644
--- a/packages/content-management/table_list_view_table/src/table_list_view_table.tsx
+++ b/packages/content-management/table_list_view_table/src/table_list_view_table.tsx
@@ -108,6 +108,7 @@ export interface TableListViewTableProps<
   contentEditor?: ContentEditorConfig;
 
   tableCaption: string;
+  /** Flag to force a new fetch of the table items. Whenever it changes, the `findItems()` will be called. */
   refreshListBouncer?: boolean;
   onFetchSuccess: () => void;
   setPageDataTestSubject: (subject: string) => void;
@@ -115,6 +116,12 @@ export interface TableListViewTableProps<
 
 export interface State<T extends UserContentCommonSchema = UserContentCommonSchema> {
   items: T[];
+  /**
+   * Flag to indicate if there aren't any item when **no filteres are applied**.
+   * When there are no item we render an empty prompt.
+   * Default to `undefined` to indicate that we don't know yet if there are items or not.
+   */
+  hasNoItems: boolean | undefined;
   hasInitialFetchReturned: boolean;
   isFetchingItems: boolean;
   isDeletingItems: boolean;
@@ -293,6 +300,7 @@ function TableListViewTableComp<T extends UserContentCommonSchema>({
 
   const isMounted = useRef(false);
   const fetchIdx = useRef(0);
+
   /**
    * The "onTableSearchChange()" handler has an async behavior. We want to be able to discard
    * previsous search changes and only handle the last one. For that we keep a counter of the changes.
@@ -335,9 +343,10 @@ function TableListViewTableComp<T extends UserContentCommonSchema>({
   const initialState = useMemo<State<T>>(
     () => ({
       items: [],
+      hasNoItems: undefined,
       totalItems: 0,
       hasInitialFetchReturned: false,
-      isFetchingItems: false,
+      isFetchingItems: true,
       isDeletingItems: false,
       showDeleteModal: false,
       hasUpdatedAtMetadata: false,
@@ -364,6 +373,7 @@ function TableListViewTableComp<T extends UserContentCommonSchema>({
     hasInitialFetchReturned,
     isFetchingItems,
     items,
+    hasNoItems,
     fetchError,
     showDeleteModal,
     isDeletingItems,
@@ -374,8 +384,6 @@ function TableListViewTableComp<T extends UserContentCommonSchema>({
     tableSort,
   } = state;
 
-  const hasQuery = searchQuery.text !== '';
-  const hasNoItems = hasInitialFetchReturned && items.length === 0 && !hasQuery;
   const showFetchError = Boolean(fetchError);
   const showLimitError = !showFetchError && totalItems > listingLimit;
 
@@ -857,17 +865,7 @@ function TableListViewTableComp<T extends UserContentCommonSchema>({
   // ------------
   // Effects
   // ------------
-  useDebounce(
-    () => {
-      // Do not call fetchItems on dependency changes when initial fetch does not load any items
-      // to avoid flashing between empty table and no items view
-      if (!hasNoItems) {
-        fetchItems();
-      }
-    },
-    300,
-    [fetchItems, refreshListBouncer]
-  );
+  useDebounce(fetchItems, 300, [fetchItems, refreshListBouncer]);
 
   useEffect(() => {
     if (!urlStateEnabled) {
diff --git a/src/plugins/event_annotation/public/components/table_list.tsx b/src/plugins/event_annotation/public/components/table_list.tsx
index afc94b11e8fc6..2e172c4a9daed 100644
--- a/src/plugins/event_annotation/public/components/table_list.tsx
+++ b/src/plugins/event_annotation/public/components/table_list.tsx
@@ -77,8 +77,8 @@ export const EventAnnotationGroupTableList = ({
   const [refreshListBouncer, setRefreshListBouncer] = useState(false);
 
   const refreshList = useCallback(() => {
-    setRefreshListBouncer(!refreshListBouncer);
-  }, [refreshListBouncer]);
+    setRefreshListBouncer((prev) => !prev);
+  }, []);
 
   const fetchItems = useCallback(
     (
diff --git a/test/functional/apps/management/_files.ts b/test/functional/apps/management/_files.ts
index 54b22028275d7..deebdb18f374b 100644
--- a/test/functional/apps/management/_files.ts
+++ b/test/functional/apps/management/_files.ts
@@ -13,8 +13,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
   const PageObjects = getPageObjects(['common', 'filesManagement']);
   const testSubjects = getService('testSubjects');
 
-  // FLAKY: https://github.com/elastic/kibana/issues/160178
-  describe.skip('Files management', () => {
+  describe('Files management', () => {
     before(async () => {
       await PageObjects.filesManagement.navigateTo();
     });

From c5763bfe1a72d83a30b3104b112727c497fdf429 Mon Sep 17 00:00:00 2001
From: Pablo Machado <pablo.nevesmachado@elastic.co>
Date: Tue, 18 Jul 2023 14:17:05 +0200
Subject: [PATCH 13/14] [Security Solution]  Attempt to fix flaky anomalies
 test on entity analytics page (#161453)

## Summary

 Attempt to fix flaky anomalies test on entity analytics page.
Test:
`x-pack/plugins/security_solution/cypress/e2e/explore/dashboards/entity_analytics.cy.ts:324`

The test was flaky because it took too long to load the table content. I
added some extra waiting points so that the rest of the application has
already loaded when the table loading starts. It reduced the flakiness,
but to prevent it from happening at all I also increase the default
timeout to 15sec.

Tested it 100 times on CI:

https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/2579#_
<img width="786" alt="Screenshot 2023-07-07 at 16 01 35"
src="https://github.com/elastic/kibana/assets/1490444/370b1df8-f6b6-4d27-a509-b149a831a4f7">
---
 .../e2e/explore/dashboards/entity_analytics.cy.ts   | 13 +++++++++++--
 .../cypress/e2e/explore/host_details/risk_tab.cy.ts |  7 +------
 .../security_solution/cypress/tasks/common.ts       |  6 ++++++
 3 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/x-pack/plugins/security_solution/cypress/e2e/explore/dashboards/entity_analytics.cy.ts b/x-pack/plugins/security_solution/cypress/e2e/explore/dashboards/entity_analytics.cy.ts
index a8d2146e4433b..4829a8d939331 100644
--- a/x-pack/plugins/security_solution/cypress/e2e/explore/dashboards/entity_analytics.cy.ts
+++ b/x-pack/plugins/security_solution/cypress/e2e/explore/dashboards/entity_analytics.cy.ts
@@ -10,7 +10,12 @@ import { login, visit } from '../../../tasks/login';
 import { ALERTS_URL, ENTITY_ANALYTICS_URL } from '../../../urls/navigation';
 
 import { esArchiverLoad, esArchiverUnload } from '../../../tasks/es_archiver';
-import { cleanKibana, deleteAlertsAndRules } from '../../../tasks/common';
+import {
+  cleanKibana,
+  deleteAlertsAndRules,
+  waitForPageToBeLoaded,
+  waitForTableToLoad,
+} from '../../../tasks/common';
 import {
   ANOMALIES_TABLE,
   ANOMALIES_TABLE_ROWS,
@@ -313,11 +318,15 @@ describe('Entity Analytics Dashboard', () => {
     beforeEach(() => {
       login();
       visit(ENTITY_ANALYTICS_URL);
+      waitForPageToBeLoaded();
     });
 
     it('renders table with pagination', () => {
       cy.get(ANOMALIES_TABLE).should('be.visible');
-      cy.get(ANOMALIES_TABLE_ROWS).should('have.length', 10);
+      waitForTableToLoad();
+
+      // Increase default timeout because anomalies table takes a while to load
+      cy.get(ANOMALIES_TABLE_ROWS, { timeout: 20000 }).should('have.length', 10);
 
       // navigates to next page
       cy.get(ANOMALIES_TABLE_NEXT_PAGE_BUTTON).click();
diff --git a/x-pack/plugins/security_solution/cypress/e2e/explore/host_details/risk_tab.cy.ts b/x-pack/plugins/security_solution/cypress/e2e/explore/host_details/risk_tab.cy.ts
index 6bcb5cd9532ee..a57d49a602c53 100644
--- a/x-pack/plugins/security_solution/cypress/e2e/explore/host_details/risk_tab.cy.ts
+++ b/x-pack/plugins/security_solution/cypress/e2e/explore/host_details/risk_tab.cy.ts
@@ -7,7 +7,7 @@
 
 import { login, visitHostDetailsPage } from '../../../tasks/login';
 
-import { cleanKibana } from '../../../tasks/common';
+import { cleanKibana, waitForTableToLoad } from '../../../tasks/common';
 import { esArchiverLoad, esArchiverUnload } from '../../../tasks/es_archiver';
 import { TABLE_CELL, TABLE_ROWS } from '../../../screens/alerts_details';
 
@@ -49,8 +49,3 @@ describe('risk tab', () => {
     );
   });
 });
-
-export const waitForTableToLoad = () => {
-  cy.get('.euiBasicTable-loading').should('exist');
-  cy.get('.euiBasicTable-loading').should('not.exist');
-};
diff --git a/x-pack/plugins/security_solution/cypress/tasks/common.ts b/x-pack/plugins/security_solution/cypress/tasks/common.ts
index 1767b70fe33fe..fc6a7096e1814 100644
--- a/x-pack/plugins/security_solution/cypress/tasks/common.ts
+++ b/x-pack/plugins/security_solution/cypress/tasks/common.ts
@@ -12,6 +12,7 @@ import {
   LOADING_INDICATOR,
   LOADING_INDICATOR_HIDDEN,
 } from '../screens/security_header';
+import { EUI_BASIC_TABLE_LOADING } from '../screens/common/controls';
 
 const primaryButton = 0;
 
@@ -280,3 +281,8 @@ export const waitForWelcomePanelToBeLoaded = () => {
   cy.get(KIBANA_LOADING_ICON).should('exist');
   cy.get(KIBANA_LOADING_ICON).should('not.exist');
 };
+
+export const waitForTableToLoad = () => {
+  cy.get(EUI_BASIC_TABLE_LOADING).should('exist');
+  cy.get(EUI_BASIC_TABLE_LOADING).should('not.exist');
+};

From 731f5879799b6d2e1e35a4c24cf6440fc60a631a Mon Sep 17 00:00:00 2001
From: Ievgen Sorokopud <ievgen.sorokopud@elastic.co>
Date: Tue, 18 Jul 2023 14:36:07 +0200
Subject: [PATCH 14/14] [Security Solution] Default Risk score slide bar values
 are overlaid on Rule Creation page (#161793)

## Summary

Original ticket: #161456

These changes do workaround to display EuiRange component which is
broken due to memoization (see more details in
https://github.com/elastic/kibana/issues/160561 and
https://github.com/elastic/eui/issues/6846)

Before the fix:

<img width="435" alt="Screenshot 2023-07-12 at 19 06 01"
src="https://github.com/elastic/kibana/assets/2700761/8deeb59a-712e-4990-9bda-cba31da8f23f">

After the fix:

<img width="426" alt="Screenshot 2023-07-12 at 19 05 46"
src="https://github.com/elastic/kibana/assets/2700761/7556cca0-d78b-453a-ac47-8a2cd3ef73d7">

---------

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Vitalii Dmyterko <92328789+vitaliidm@users.noreply.github.com>
---
 .../rule_creation_ui/pages/rule_creation/index.tsx       | 1 +
 .../rule_creation_ui/pages/rule_editing/index.tsx        | 1 +
 .../components/rules/step_about_rule/index.test.tsx      | 1 +
 .../components/rules/step_about_rule/index.tsx           | 9 +++++++++
 4 files changed, 12 insertions(+)

diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/pages/rule_creation/index.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/pages/rule_creation/index.tsx
index c721e4f27a7d0..321725359e7b3 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/pages/rule_creation/index.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/pages/rule_creation/index.tsx
@@ -579,6 +579,7 @@ const CreateRulePageComponent: React.FC = () => {
             dataViewId={defineStepData.dataViewId}
             timestampOverride={aboutStepData.timestampOverride}
             isLoading={isCreateRuleLoading || loading}
+            isActive={activeStep === RuleStep.aboutRule}
             form={aboutStepForm}
           />
 
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/pages/rule_editing/index.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/pages/rule_editing/index.tsx
index b7b7b4e7e0ea4..822a90cb0af6e 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/pages/rule_editing/index.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/pages/rule_editing/index.tsx
@@ -269,6 +269,7 @@ const EditRulePageComponent: FC<{ rule: Rule }> = ({ rule }) => {
                 <StepAboutRule
                   isLoading={isLoading}
                   isUpdateView
+                  isActive={activeStep === RuleStep.aboutRule}
                   ruleType={defineStepData.ruleType}
                   machineLearningJobId={defineStepData.machineLearningJobId}
                   index={defineStepData.index}
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/index.test.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/index.test.tsx
index 3fd3247307fd2..096de7b836a0b 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/index.test.tsx
@@ -99,6 +99,7 @@ describe('StepAboutRuleComponent', () => {
         dataViewId={defineStepDefault.dataViewId}
         timestampOverride={stepAboutDefaultValue.timestampOverride}
         isLoading={false}
+        isActive={true}
         form={aboutStepForm}
       />
     );
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/index.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/index.tsx
index 369d05939cd62..cd2d8a3fa6e51 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/index.tsx
@@ -43,6 +43,14 @@ interface StepAboutRuleProps extends RuleStepProps {
   dataViewId: string | undefined;
   timestampOverride: string;
   form: FormHook<AboutStepRule>;
+
+  // TODO: https://github.com/elastic/kibana/issues/161456
+  // The About step page contains EuiRange component which does not work properly within memoized parents.
+  // EUI team suggested not to memoize EuiRange/EuiDualRange: https://github.com/elastic/eui/issues/6846
+  // Workaround: We introduced this additional property to be able to do extra re-render on switching to/from the About step page.
+  // NOTE: We should remove this workaround once EUI team fixed EuiRange.
+  // Related ticket: https://github.com/elastic/kibana/issues/160561
+  isActive: boolean;
 }
 
 interface StepAboutRuleReadOnlyProps {
@@ -69,6 +77,7 @@ const StepAboutRuleComponent: FC<StepAboutRuleProps> = ({
   index,
   dataViewId,
   timestampOverride,
+  isActive = false,
   isUpdateView = false,
   isLoading,
   form,