diff --git a/.backportrc.json b/.backportrc.json
index 8f458343c51af..3f1d639e9a480 100644
--- a/.backportrc.json
+++ b/.backportrc.json
@@ -3,6 +3,7 @@
   "targetBranchChoices": [
     { "name": "master", "checked": true },
     { "name": "7.x", "checked": true },
+    "7.9",
     "7.8",
     "7.7",
     "7.6",
@@ -26,7 +27,7 @@
   "targetPRLabels": ["backport"],
   "branchLabelMapping": {
     "^v8.0.0$": "master",
-    "^v7.9.0$": "7.x",
+    "^v7.10.0$": "7.x",
     "^v(\\d+).(\\d+).\\d+$": "$1.$2"
   }
 }
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index f053c6da9c29b..2ad82ded6cb38 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -24,29 +24,20 @@
 /src/plugins/vis_type_xy/ @elastic/kibana-app
 /src/plugins/visualize/ @elastic/kibana-app
 
-# Core UI
-# Exclude tutorials folder for now because they are not owned by Kibana app and most will move out soon
-/src/plugins/home/public @elastic/kibana-core-ui
-/src/plugins/home/server/*.ts @elastic/kibana-core-ui
-/src/plugins/home/server/services/ @elastic/kibana-core-ui
-# Exclude tutorial resources folder for now because they are not owned by Kibana app and most will move out soon
-/src/legacy/core_plugins/kibana/public/home/*.ts @elastic/kibana-core-ui
-/src/legacy/core_plugins/kibana/public/home/*.scss @elastic/kibana-core-ui
-/src/legacy/core_plugins/kibana/public/home/np_ready/ @elastic/kibana-core-ui
-
 # App Architecture
+/examples/bfetch_explorer/ @elastic/kibana-app-arch
+/examples/dashboard_embeddable_examples/ @elastic/kibana-app-arch
+/examples/demo_search/ @elastic/kibana-app-arch
 /examples/developer_examples/ @elastic/kibana-app-arch
+/examples/embeddable_examples/ @elastic/kibana-app-arch
+/examples/embeddable_explorer/ @elastic/kibana-app-arch
+/examples/state_container_examples/ @elastic/kibana-app-arch
+/examples/ui_actions_examples/ @elastic/kibana-app-arch
+/examples/ui_actions_explorer/ @elastic/kibana-app-arch
 /examples/url_generators_examples/ @elastic/kibana-app-arch
 /examples/url_generators_explorer/ @elastic/kibana-app-arch
-/packages/kbn-interpreter/ @elastic/kibana-app-arch
 /packages/elastic-datemath/ @elastic/kibana-app-arch
-/src/legacy/core_plugins/embeddable_api/ @elastic/kibana-app-arch
-/src/legacy/core_plugins/interpreter/ @elastic/kibana-app-arch
-/src/legacy/core_plugins/kibana_react/ @elastic/kibana-app-arch
-/src/legacy/core_plugins/kibana/public/management/ @elastic/kibana-app-arch
-/src/legacy/core_plugins/kibana/server/routes/api/management/ @elastic/kibana-app-arch
-/src/legacy/core_plugins/visualizations/ @elastic/kibana-app-arch
-/src/legacy/server/index_patterns/ @elastic/kibana-app-arch
+/packages/kbn-interpreter/ @elastic/kibana-app-arch
 /src/plugins/advanced_settings/ @elastic/kibana-app-arch
 /src/plugins/bfetch/ @elastic/kibana-app-arch
 /src/plugins/data/ @elastic/kibana-app-arch
@@ -61,9 +52,10 @@
 /src/plugins/share/ @elastic/kibana-app-arch
 /src/plugins/ui_actions/ @elastic/kibana-app-arch
 /src/plugins/visualizations/ @elastic/kibana-app-arch
-/x-pack/plugins/advanced_ui_actions/ @elastic/kibana-app-arch
+/x-pack/examples/ui_actions_enhanced_examples/ @elastic/kibana-app-arch
 /x-pack/plugins/data_enhanced/ @elastic/kibana-app-arch
-/x-pack/plugins/drilldowns/ @elastic/kibana-app-arch
+/x-pack/plugins/embeddable_enhanced/ @elastic/kibana-app-arch
+/x-pack/plugins/ui_actions_enhanced/ @elastic/kibana-app-arch
 
 # APM
 /x-pack/plugins/apm/  @elastic/apm-ui
@@ -79,6 +71,16 @@
 /x-pack/plugins/canvas/  @elastic/kibana-canvas
 /x-pack/test/functional/apps/canvas/  @elastic/kibana-canvas
 
+# Core UI
+# Exclude tutorials folder for now because they are not owned by Kibana app and most will move out soon
+/src/plugins/home/public @elastic/kibana-core-ui
+/src/plugins/home/server/*.ts @elastic/kibana-core-ui
+/src/plugins/home/server/services/ @elastic/kibana-core-ui
+# Exclude tutorial resources folder for now because they are not owned by Kibana app and most will move out soon
+/src/legacy/core_plugins/kibana/public/home/*.ts @elastic/kibana-core-ui
+/src/legacy/core_plugins/kibana/public/home/*.scss @elastic/kibana-core-ui
+/src/legacy/core_plugins/kibana/public/home/np_ready/ @elastic/kibana-core-ui
+
 # Observability UIs
 /x-pack/legacy/plugins/infra/ @elastic/logs-metrics-ui
 /x-pack/plugins/infra/ @elastic/logs-metrics-ui
diff --git a/docs/developer/advanced/development-basepath.asciidoc b/docs/developer/advanced/development-basepath.asciidoc
index f0b760a21ea0c..cb341b9591174 100644
--- a/docs/developer/advanced/development-basepath.asciidoc
+++ b/docs/developer/advanced/development-basepath.asciidoc
@@ -1,5 +1,5 @@
 [[development-basepath]]
-=== Considerations for basepath
+== Considerations for basepath
 
 In dev mode, {kib} by default runs behind a proxy which adds a random path component to its URL.
 
diff --git a/docs/developer/advanced/development-es-snapshots.asciidoc b/docs/developer/advanced/development-es-snapshots.asciidoc
index 92fae7a241edf..4c801bf750979 100644
--- a/docs/developer/advanced/development-es-snapshots.asciidoc
+++ b/docs/developer/advanced/development-es-snapshots.asciidoc
@@ -1,32 +1,32 @@
 [[development-es-snapshots]]
-=== Daily Elasticsearch Snapshots
+== Daily {es} Snapshots
 
-For local development and CI, {kib}, by default, uses Elasticsearch snapshots that are built daily when running tasks that require Elasticsearch (e.g. functional tests).
+For local development and CI, {kib}, by default, uses {es} snapshots that are built daily when running tasks that require {es} (e.g. functional tests).
 
-A snapshot is just a group of tarballs, one for each supported distribution/architecture/os of Elasticsearch, and a JSON-based manifest file containing metadata about the distributions.
+A snapshot is just a group of tarballs, one for each supported distribution/architecture/os of {es}, and a JSON-based manifest file containing metadata about the distributions.
 
-https://ci.kibana.dev/es-snapshots[A dashboard] is available that shows the current status and compatibility of the latest Elasticsearch snapshots.
+https://ci.kibana.dev/es-snapshots[A dashboard] is available that shows the current status and compatibility of the latest {es} snapshots.
 
-==== Process Overview
+=== Process Overview
 
-1. Elasticsearch snapshots are built for each current tracked branch of {kib}.
+1. {es} snapshots are built for each current tracked branch of {kib}.
 2. Each snapshot is uploaded to a public Google Cloud Storage bucket, `kibana-ci-es-snapshots-daily`.
 ** At this point, the snapshot is not automatically used in CI or local development. It needs to be tested/verified first.
 3. Each snapshot is tested with the latest commit of the corresponding {kib} branch, using the full CI suite.
 4. After CI
 ** If the snapshot passes, it is promoted and automatically used in CI and local development.
-** If the snapshot fails, the issue must be investigated and resolved. A new incompatibility may exist between Elasticsearch and {kib}.
+** If the snapshot fails, the issue must be investigated and resolved. A new incompatibility may exist between {es} and {kib}.
 
-==== Using the latest snapshot
+=== Using the latest snapshot
 
-When developing locally, you may wish to use the most recent Elasticsearch snapshot, even if it's failing CI. To do so, prefix your commands with the follow environment variable:
+When developing locally, you may wish to use the most recent {es} snapshot, even if it's failing CI. To do so, prefix your commands with the follow environment variable:
 
 ["source","bash"]
 -----------
 KBN_ES_SNAPSHOT_USE_UNVERIFIED=true
 -----------
 
-You can use this flag with any command that downloads and runs Elasticsearch snapshots, such as `scripts/es` or the FTR.
+You can use this flag with any command that downloads and runs {es} snapshots, such as `scripts/es` or the FTR.
 
 For example, to run functional tests with the latest snapshot:
 
@@ -35,7 +35,7 @@ For example, to run functional tests with the latest snapshot:
 KBN_ES_SNAPSHOT_USE_UNVERIFIED=true node scripts/functional_tests_server
 -----------
 
-===== For Pull Requests
+==== For Pull Requests
 
 Currently, there is not a way to run your pull request with the latest unverified snapshot without a code change. You can, however, do it with a small code change.
 
@@ -45,9 +45,9 @@ Currently, there is not a way to run your pull request with the latest unverifie
 
 Your pull request should then use the latest snapshot the next time that it runs. Just don't merge the change to `Jenkinsfile`!
 
-==== Google Cloud Storage buckets
+=== Google Cloud Storage buckets
 
-===== kibana-ci-es-snapshots-daily
+==== kibana-ci-es-snapshots-daily
 
 This bucket stores snapshots that are created on a daily basis, and is the primary location used by `kbn-es` to download snapshots.
 
@@ -61,7 +61,7 @@ The file structure for this bucket looks like this:
 * `<version>/archives/<unique id>/*.tar.gz.sha512`
 * `<version>/archives/<unique id>/manifest.json`
 
-===== kibana-ci-es-snapshots-permanent
+==== kibana-ci-es-snapshots-permanent
 
 This bucket stores only the most recently promoted snapshot for each version. Old snapshots are only deleted when new ones are uploaded.
 
@@ -73,18 +73,18 @@ The file structure for this bucket looks like this:
 * `<version>/*.tar.gz.sha512`
 * `<version>/manifest.json`
 
-==== How snapshots are built, tested, and promoted
+=== How snapshots are built, tested, and promoted
 
-Each day, a https://kibana-ci.elastic.co/job/elasticsearch+snapshots+trigger/[Jenkins job] runs that triggers Elasticsearch builds for each currently tracked branch/version. This job is automatically updated with the correct branches whenever we release new versions of {kib}.
+Each day, a https://kibana-ci.elastic.co/job/elasticsearch+snapshots+trigger/[Jenkins job] runs that triggers {es} builds for each currently tracked branch/version. This job is automatically updated with the correct branches whenever we release new versions of {kib}.
 
-===== Build
+==== Build
 
-https://kibana-ci.elastic.co/job/elasticsearch+snapshots+build/[This Jenkins job] builds the Elasticsearch snapshots and uploads them to GCS.
+https://kibana-ci.elastic.co/job/elasticsearch+snapshots+build/[This Jenkins job] builds the {es} snapshots and uploads them to GCS.
 
 The Jenkins job pipeline definition is https://github.com/elastic/kibana/blob/master/.ci/es-snapshots/Jenkinsfile_build_es[in the {kib} repo].
 
-1. Checkout Elasticsearch repo for the given branch/version.
-2. Run `./gradlew -p distribution/archives assemble --parallel` to create all of the Elasticsearch distributions.
+1. Checkout {es} repo for the given branch/version.
+2. Run `./gradlew -p distribution/archives assemble --parallel` to create all of the {es} distributions.
 3. Create a tarball for each distribution.
 4. Create a manifest JSON file containing info about the distribution, as well as its download URL.
 5. Upload the tarballs and manifest to a unique location in the GCS bucket `kibana-ci-es-snapshots-daily`.
@@ -93,9 +93,9 @@ The Jenkins job pipeline definition is https://github.com/elastic/kibana/blob/ma
 ** This allows the `KBN_ES_SNAPSHOT_USE_UNVERIFIED` flag to work.
 7. Trigger the verification job, to run the full {kib} CI test suite with this snapshot.
 
-===== Verification and Promotion
+==== Verification and Promotion
 
-https://kibana-ci.elastic.co/job/elasticsearch+snapshots+verify/[This Jenkins job] tests the latest Elasticsearch snapshot with the full {kib} CI pipeline, and promotes if it there are no test failures.
+https://kibana-ci.elastic.co/job/elasticsearch+snapshots+verify/[This Jenkins job] tests the latest {es} snapshot with the full {kib} CI pipeline, and promotes if it there are no test failures.
 
 The Jenkins job pipeline definition is https://github.com/elastic/kibana/blob/master/.ci/es-snapshots/Jenkinsfile_verify_es[in the {kib} repo].
 
diff --git a/docs/developer/advanced/index.asciidoc b/docs/developer/advanced/index.asciidoc
index 139940ee42fe2..5c53bedd95e72 100644
--- a/docs/developer/advanced/index.asciidoc
+++ b/docs/developer/advanced/index.asciidoc
@@ -5,8 +5,8 @@
 * <<development-es-snapshots>>
 * <<development-basepath>>
 
-include::development-es-snapshots.asciidoc[]
+include::development-es-snapshots.asciidoc[leveloffset=+1]
 
-include::running-elasticsearch.asciidoc[]
+include::running-elasticsearch.asciidoc[leveloffset=+1]
 
-include::development-basepath.asciidoc[]
\ No newline at end of file
+include::development-basepath.asciidoc[leveloffset=+1]
\ No newline at end of file
diff --git a/docs/developer/advanced/running-elasticsearch.asciidoc b/docs/developer/advanced/running-elasticsearch.asciidoc
index b03c231678eee..2361f805c7635 100644
--- a/docs/developer/advanced/running-elasticsearch.asciidoc
+++ b/docs/developer/advanced/running-elasticsearch.asciidoc
@@ -1,13 +1,13 @@
 [[running-elasticsearch]]
-=== Running elasticsearch during development
+== Running {es} during development
 
-There are many ways to run Elasticsearch while you are developing.
+There are many ways to run {es} while you are developing.
 
-[float]
+[discrete]
 
-==== By snapshot
+=== By snapshot
 
-This will run a snapshot of elasticsearch that is usually built nightly. Read more about <<development-es-snapshots>>.
+This will run a snapshot of {es} that is usually built nightly. Read more about <<development-es-snapshots>>.
 
 [source,bash]
 ----
@@ -25,36 +25,36 @@ yarn es snapshot --help
 
 **Keeping data between snapshots**
 
-If you want to keep the data inside your Elasticsearch between usages of this command, you should use the following command, to keep your data folder outside the downloaded snapshot folder:
+If you want to keep the data inside your {es} between usages of this command, you should use the following command, to keep your data folder outside the downloaded snapshot folder:
 
 [source,bash]
 ----
 yarn es snapshot -E path.data=../data
 ----
 
-==== By source
+=== By source
 
-If you have the Elasticsearch repo checked out locally and wish to run against that, use `source`. By default, it will reference an elasticsearch checkout which is a sibling to the {kib} directory named elasticsearch. If you wish to use a checkout in another location you can provide that by supplying --source-path 
+If you have the {es} repo checked out locally and wish to run against that, use `source`. By default, it will reference an {es} checkout which is a sibling to the {kib} directory named elasticsearch. If you wish to use a checkout in another location you can provide that by supplying --source-path 
 
 [source,bash]
 ----
 yarn es source
 ----
 
-==== From an archive
+=== From an archive
 
-Use this if you already have a distributable. For released versions, one can be obtained on the Elasticsearch downloads page.
+Use this if you already have a distributable. For released versions, one can be obtained on the {es} downloads page.
 
 [source,bash]
 ----
 yarn es archive <full_path_to_archive>
 ----
 
-Each of these will run Elasticsearch with a basic license. Additional options are available, pass --help for more information.
+Each of these will run {es} with a basic license. Additional options are available, pass --help for more information.
 
-==== From a remote host
+=== From a remote host
 
-You can save some system resources, and the effort of generating sample data, if you have a remote Elasticsearch cluster to connect to. (Elasticians: you do! Check with your team about where to find credentials)
+You can save some system resources, and the effort of generating sample data, if you have a remote {es} cluster to connect to. (Elasticians: you do! Check with your team about where to find credentials)
 
 You'll need to create a kibana.dev.yml (<<customize-kibana-yml>>) and add the following to it:
 
@@ -75,7 +75,7 @@ kibana.index: '.{YourGitHubHandle}-kibana'
 xpack.task_manager.index: '.{YourGitHubHandle}-task-manager-kibana'
 ----
 
-===== Running remote clusters
+==== Running remote clusters
 
 Setup remote clusters for cross cluster search (CCS) and cross cluster replication (CCR).
 
@@ -95,7 +95,7 @@ yarn es snapshot -E transport.port=9500 -E http.port=9201 -E path.data=../data_p
 
 Once both clusters are running, start {kib}. {kib} will connect to the primary cluster.
 
-Setup the remote cluster in {kib} from either Management -> Elasticsearch -> Remote Clusters UI or by running the following script in Console.
+Setup the remote cluster in {kib} from either Management -> {es} -> Remote Clusters UI or by running the following script in Console.
 
 [source,bash]
 ----
diff --git a/docs/developer/architecture/add-data-tutorials.asciidoc b/docs/developer/architecture/add-data-tutorials.asciidoc
index e16b1bc039a10..3891b87a00e64 100644
--- a/docs/developer/architecture/add-data-tutorials.asciidoc
+++ b/docs/developer/architecture/add-data-tutorials.asciidoc
@@ -1,16 +1,16 @@
 [[add-data-tutorials]]
-=== Add data tutorials
+== Add data tutorials
 
 `Add Data` in the {kib} Home application contains tutorials for setting up data flows in the Elastic stack.
 
 Each tutorial contains three sets of instructions:
 
-* `On Premise.` Set up a data flow when both {kib} and Elasticsearch are running on premise.
-* `On Premise Elastic Cloud.` Set up a data flow when {kib} is running on premise and Elasticsearch is running on Elastic Cloud.
-* `Elastic Cloud.` Set up a data flow when both {kib} and Elasticsearch are running on Elastic Cloud.
+* `On Premise.` Set up a data flow when both {kib} and {es} are running on premise.
+* `On Premise Elastic Cloud.` Set up a data flow when {kib} is running on premise and {es} is running on Elastic Cloud.
+* `Elastic Cloud.` Set up a data flow when both {kib} and {es} are running on Elastic Cloud.
 
-[float]
-==== Creating a new tutorial
+[discrete]
+=== Creating a new tutorial
 1. Create a new directory in the link:https://github.com/elastic/kibana/tree/master/src/plugins/home/server/tutorials[tutorials directory].
 2. In the new directory, create a file called `index.ts` that exports a function.
 The function must return a function object that conforms to the `TutorialSchema` interface link:{kib-repo}tree/{branch}/src/plugins/home/server/services/tutorials/lib/tutorial_schema.ts[tutorial schema].
@@ -23,15 +23,15 @@ The function must return a function object that conforms to the `TutorialSchema`
 If you are creating a new plugin and the tutorial is only related to that plugin, you can also place the `TutorialSchema` object into your plugin folder. Add `home` to the `requiredPlugins` list in your `kibana.json` file.
 Then register the tutorial object by calling `home.tutorials.registerTutorial(tutorialObject)` in the `setup` lifecycle of your server plugin.
 
-[float]
-===== Variables
+[discrete]
+==== Variables
 String values can contain variables that are substituted when rendered. Variables are specified by `{}`.
 For example: `{config.docs.version}` is rendered as `6.2` when running the tutorial in {kib} 6.2.
 
 link:{kib-repo}tree/{branch}/src/legacy/core_plugins/kibana/public/home/np_ready/components/tutorial/replace_template_strings.js#L23[Provided variables]
 
-[float]
-===== Markdown
+[discrete]
+==== Markdown
 String values can contain limited Markdown syntax.
 
 link:{kib-repo}tree/{branch}/src/legacy/core_plugins/kibana/public/home/components/tutorial/content.js#L8[Enabled Markdown grammars]
diff --git a/docs/developer/architecture/development-visualize-index.asciidoc b/docs/developer/architecture/development-visualize-index.asciidoc
index 551c41833fb72..d41ee32c1fb27 100644
--- a/docs/developer/architecture/development-visualize-index.asciidoc
+++ b/docs/developer/architecture/development-visualize-index.asciidoc
@@ -1,5 +1,5 @@
 [[development-visualize-index]]
-=== Developing Visualizations
+== Developing Visualizations
 
 [IMPORTANT]
 ==============================================
diff --git a/docs/developer/architecture/index.asciidoc b/docs/developer/architecture/index.asciidoc
index d726a8bd3642d..b7ca1cb352b0b 100644
--- a/docs/developer/architecture/index.asciidoc
+++ b/docs/developer/architecture/index.asciidoc
@@ -18,8 +18,8 @@ A few notable services are called out below.
 * <<add-data-tutorials>>
 * <<development-visualize-index>>
 
-include::add-data-tutorials.asciidoc[]
+include::add-data-tutorials.asciidoc[leveloffset=+1]
 
-include::development-visualize-index.asciidoc[]
+include::development-visualize-index.asciidoc[leveloffset=+1]
 
-include::security/index.asciidoc[]
+include::security/index.asciidoc[leveloffset=+1]
diff --git a/docs/developer/architecture/security/feature-registration.asciidoc b/docs/developer/architecture/security/feature-registration.asciidoc
index 164f6d1cf9c74..3724624dbb917 100644
--- a/docs/developer/architecture/security/feature-registration.asciidoc
+++ b/docs/developer/architecture/security/feature-registration.asciidoc
@@ -1,13 +1,13 @@
 [[development-plugin-feature-registration]]
-==== Plugin feature registration
+== Plugin feature registration
 
 If your plugin will be used with {kib}'s default distribution, then you have the ability to register the features that your plugin provides. Features are typically apps in {kib}; once registered, you can toggle them via Spaces, and secure them via Roles when security is enabled.
 
-===== UI Capabilities
+=== UI Capabilities
 
 Registering features also gives your plugin access to “UI Capabilities”. These capabilities are boolean flags that you can use to conditionally render your interface, based on the current user's permissions. For example, you can  hide or disable a Save button if the current user is not authorized.
 
-===== Registering a feature
+=== Registering a feature
 
 Feature registration is controlled via the built-in `xpack_main` plugin. To register a feature, call `xpack_main`'s `registerFeature` function from your plugin's `init` function, and provide the appropriate details:
 
@@ -21,7 +21,7 @@ init(server) {
 }
 -----------
 
-===== Feature details
+=== Feature details
 Registering a feature consists of the following fields. For more information, consult the {kib-repo}blob/{branch}/x-pack/plugins/features/server/feature_registry.ts[feature registry interface].
 
 
@@ -65,12 +65,12 @@ Registering a feature consists of the following fields. For more information, co
 |The ID of the navigation link associated with your feature.
 |===
 
-====== Privilege definition
+==== Privilege definition
 The `privileges` section of feature registration allows plugins to implement read/write and read-only modes for their applications.
 
 For a full explanation of fields and options, consult the {kib-repo}blob/{branch}/x-pack/plugins/features/server/feature_registry.ts[feature registry interface].
 
-===== Using UI Capabilities
+=== Using UI Capabilities
 
 UI Capabilities are available to your public (client) plugin code. These capabilities are read-only, and are used to inform the UI. This object is namespaced by feature id. For example, if your feature id is “foo”, then your UI Capabilities are stored at `uiCapabilities.foo`.
 To access capabilities, import them from `ui/capabilities`:
@@ -86,7 +86,7 @@ if (canUserSave) {
 -----------
 
 [[example-1-canvas]]
-===== Example 1: Canvas Application
+=== Example 1: Canvas Application
 ["source","javascript"]
 -----------
 init(server) {
@@ -141,7 +141,7 @@ if (canUserSave) {
 Because the `read` privilege does not define the `save` capability, users with read-only access will have their `uiCapabilities.canvas.save` flag set to `false`.
 
 [[example-2-dev-tools]]
-===== Example 2: Dev Tools
+=== Example 2: Dev Tools
 
 ["source","javascript"]
 -----------
@@ -176,7 +176,7 @@ init(server) {
     },
     privilegesTooltip: i18n.translate('xpack.features.devToolsPrivilegesTooltip', {
      defaultMessage:
-       'User should also be granted the appropriate Elasticsearch cluster and index privileges',
+       'User should also be granted the appropriate {es} cluster and index privileges',
    }),
   });
 }
@@ -199,7 +199,7 @@ server.route({
 -----------
 
 [[example-3-discover]]
-===== Example 3: Discover
+=== Example 3: Discover
 
 Discover takes advantage of subfeature privileges to allow fine-grained access control. In this example,
 a single "Create Short URLs" subfeature privilege is defined, which allows users to grant access to this feature without having to grant the `all` privilege to Discover. In other words, you can grant `read` access to Discover, and also grant the ability to create short URLs.
diff --git a/docs/developer/architecture/security/index.asciidoc b/docs/developer/architecture/security/index.asciidoc
index 55b2450caf7a7..09739142c8f79 100644
--- a/docs/developer/architecture/security/index.asciidoc
+++ b/docs/developer/architecture/security/index.asciidoc
@@ -1,12 +1,14 @@
 [[development-security]]
-=== Security
+== Security
 
-{kib} has generally been able to implement security transparently to core and plugin developers, and this largely remains the case. {kib} on two methods that the elasticsearch `Cluster` provides: `callWithRequest` and `callWithInternalUser`. 
+{kib} has generally been able to implement security transparently to core and plugin developers, and this largely remains the case. {kib} on two methods that the {es} `Cluster` provides: `callWithRequest` and `callWithInternalUser`. 
 
-`callWithRequest` executes requests against Elasticsearch using the authentication credentials of the {kib} end-user. So, if you log into {kib} with the user of `foo` when `callWithRequest` is used, {kib} execute the request against Elasticsearch as the user `foo`. Historically, `callWithRequest` has been used extensively to perform actions that are initiated at the request of {kib} end-users.
+`callWithRequest` executes requests against {es} using the authentication credentials of the {kib} end-user. So, if you log into {kib} with the user of `foo` when `callWithRequest` is used, {kib} execute the request against {es} as the user `foo`. Historically, `callWithRequest` has been used extensively to perform actions that are initiated at the request of {kib} end-users.
 
-`callWithInternalUser` executes requests against Elasticsearch using the internal {kib} server user, and has historically been used for performing actions that aren't initiated by {kib} end users; for example, creating the initial `.kibana` index or performing health checks against Elasticsearch.
+`callWithInternalUser` executes requests against {es} using the internal {kib} server user, and has historically been used for performing actions that aren't initiated by {kib} end users; for example, creating the initial `.kibana` index or performing health checks against {es}.
 
-However, with the changes that role-based access control (RBAC) introduces, this is no longer cut and dry. {kib} now requires all access to the `.kibana` index goes through the `SavedObjectsClient`. This used to be a best practice, as the `SavedObjectsClient` was responsible for translating the documents stored in Elasticsearch to and from Saved Objects, but RBAC is now taking advantage of this abstraction to implement access control and determine when to use `callWithRequest` versus `callWithInternalUser`.
+However, with the changes that role-based access control (RBAC) introduces, this is no longer cut and dry. {kib} now requires all access to the `.kibana` index goes through the `SavedObjectsClient`. This used to be a best practice, as the `SavedObjectsClient` was responsible for translating the documents stored in {es} to and from Saved Objects, but RBAC is now taking advantage of this abstraction to implement access control and determine when to use `callWithRequest` versus `callWithInternalUser`.
 
-include::rbac.asciidoc[]
+include::rbac.asciidoc[leveloffset=+1]
+
+include::feature-registration.asciidoc[leveloffset=+1]
diff --git a/docs/developer/architecture/security/rbac.asciidoc b/docs/developer/architecture/security/rbac.asciidoc
index ae1979e856e23..7b35a91ca73d0 100644
--- a/docs/developer/architecture/security/rbac.asciidoc
+++ b/docs/developer/architecture/security/rbac.asciidoc
@@ -1,9 +1,9 @@
 [[development-security-rbac]]
-==== Role-based access control
+== Role-based access control
 
 Role-based access control (RBAC) in {kib} relies upon the
 {ref}/security-privileges.html#application-privileges[application privileges]
-that Elasticsearch exposes. This allows {kib} to define the privileges that
+that {es} exposes. This allows {kib} to define the privileges that
 {kib} wishes to grant to users, assign them to the relevant users using roles,
 and then authorize the user to perform a specific action. This is handled within
 a secured instance of the `SavedObjectsClient` and available transparently to
@@ -11,7 +11,7 @@ consumers when using `request.getSavedObjectsClient()` or
 `savedObjects.getScopedSavedObjectsClient()`.
 
 [[development-rbac-privileges]]
-===== {kib} Privileges
+=== {kib} Privileges
 
 When {kib} first starts up, it executes the following `POST` request against {es}. This synchronizes the definition of the privileges with various `actions` which are later used to authorize a user:
 
@@ -56,7 +56,7 @@ The application is created by concatenating the prefix of `kibana-` with the val
 ==============================================
 
 [[development-rbac-assigning-privileges]]
-===== Assigning {kib} Privileges
+=== Assigning {kib} Privileges
 
 {kib} privileges are assigned to specific roles using the `applications` element. For example, the following role assigns the <<kibana-privileges-all, all>> privilege at `*` `resources` (which will in the future be used to secure spaces) to the default {kib} `application`:
 
@@ -81,7 +81,7 @@ Roles that grant <<kibana-privileges>> should be managed using the <<role-manage
 {ref}/security-api.html#security-user-apis[user management APIs].
 
 [[development-rbac-authorization]]
-===== Authorization
+=== Authorization
 
 The {es} {ref}/security-api-has-privileges.html[has privileges API] determines whether the user is authorized to perform a specific action:
 
diff --git a/docs/developer/best-practices/index.asciidoc b/docs/developer/best-practices/index.asciidoc
index 43022c259a592..90b0092d835a8 100644
--- a/docs/developer/best-practices/index.asciidoc
+++ b/docs/developer/best-practices/index.asciidoc
@@ -4,7 +4,7 @@
 Consider these best practices, whether developing code directly to the {kib} repo or building your own plugins.
 They are intended to support our https://github.com/elastic/engineering/blob/master/kibana_dev_principles.md[{kib} development principals].
 
-[float]
+[discrete]
 === Performance
 
 Are you planning with scalability in mind?
@@ -15,7 +15,7 @@ Are you planning with scalability in mind?
 * Do you make lots of requests to the server?
 ** If so, have you considered using the streaming {kib-repo}tree/{branch}/src/plugins/bfetch[bfetch service]?
 
-[float]
+[discrete]
 === Accessibility
 
 Did you know {kib} makes a public statement about our commitment to
@@ -28,7 +28,7 @@ tackles accessibility]
 * If you don’t use EUI, follow the same EUI accessibility standards
 
 [[kibana-localization-best-practices]]
-[float]
+[discrete]
 === Localization
 
 {kib} is translated into other languages. Use our i18n utilities to
@@ -39,7 +39,7 @@ ensure your public facing strings will be translated to ensure all
 {kib-repo}blob/{branch}/packages/kbn-i18n/GUIDELINE.md[i18n
 guidelines]
 
-[float]
+[discrete]
 === Conventions
 
 * Become familiar with our
@@ -58,7 +58,7 @@ them.
 * Use https://elastic.github.io/eui[EUI] for all your basic UI
 components to create a consistent UI experience.
 
-[float]
+[discrete]
 === Re-inventing the wheel
 
 Over-refactoring can be a problem in it’s own right, but it’s still
@@ -96,7 +96,7 @@ for react specific helpers
 Re-using these services will help create a consistent experience across
 {kib} from every solution.
 
-[float]
+[discrete]
 === Backward compatibility
 
 Eventually we want to garauntee to our plugin developers that their plugins will not break from minor to minor.
@@ -122,7 +122,7 @@ In addition, if users are relying on state stored in your app’s URL as
 part of your public contract, keep in mind that you may also need to
 provide backwards compatibility for bookmarked URLs.
 
-[float]
+[discrete]
 === Testing & stability
 
 Review:
@@ -131,6 +131,6 @@ Review:
 * <<stability>>
 * <<security-best-practices>>
 
-include::stability.asciidoc[]
+include::stability.asciidoc[leveloffset=+1]
 
-include::security.asciidoc[]
+include::security.asciidoc[leveloffset=+1]
diff --git a/docs/developer/best-practices/security.asciidoc b/docs/developer/best-practices/security.asciidoc
index 26fcc73ce2b90..79ecb08295064 100644
--- a/docs/developer/best-practices/security.asciidoc
+++ b/docs/developer/best-practices/security.asciidoc
@@ -1,5 +1,5 @@
 [[security-best-practices]]
-=== Security best practices
+== Security best practices
 
 * XSS
 ** Check for usages of `dangerouslySetInnerHtml`, `Element.innerHTML`,
@@ -44,7 +44,7 @@ sensitive information which end up in the HTTP Response
 ** Ensure no sensitive cookies are forwarded to external resources.
 ** Ensure that all user controllable variables that are used in
 constructing a URL are escaped properly. This is relevant when using
-`transport.request` with the Elasticsearch client as no automatic
+`transport.request` with the {es} client as no automatic
 escaping is performed.
 * Reverse tabnabbing -
 https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/HTML5_Security_Cheat_Sheet.md#tabnabbing
diff --git a/docs/developer/best-practices/stability.asciidoc b/docs/developer/best-practices/stability.asciidoc
index 68237a034be52..f4b7ae1229909 100644
--- a/docs/developer/best-practices/stability.asciidoc
+++ b/docs/developer/best-practices/stability.asciidoc
@@ -1,10 +1,10 @@
 [[stability]]
-=== Stability
+== Stability
 
 Ensure your feature will work under all possible {kib} scenarios.
 
-[float]
-==== Environmental configuration scenarios
+[discrete]
+=== Environmental configuration scenarios
 
 * Cloud
 ** Does the feature work on *cloud environment*?
@@ -32,16 +32,16 @@ non-standard {kib} indices. (create their own custom roles)
 sessions. (we have had many discuss/SDH tickets around this)
 * If a proxy/loadbalancer is running between ES and {kib}
 
-[float]
-==== Kibana.yml settings
+[discrete]
+=== Kibana.yml settings
 
 * Using a custom {kib} index alias
 * When optional dependencies are disabled
 ** Ensure all your required dependencies are listed in kibana.json
 dependency list!
 
-[float]
-==== Test coverage
+[discrete]
+=== Test coverage
 
 * Does the feature have sufficient unit test coverage? (does it handle
 storeinSessions?)
@@ -49,16 +49,16 @@ storeinSessions?)
 * Does the feature have sufficient Rest API coverage test coverage?
 * Does the feature have sufficient Integration test coverage?
 
-[float]
-==== Browser coverage
+[discrete]
+=== Browser coverage
 
 Refer to the list of browsers and OS {kib} supports
 https://www.elastic.co/support/matrix
 
 Does the feature work efficiently on the list of supported browsers? 
 
-[float]
-==== Upgrade Scenarios - Migration scenarios- 
+[discrete]
+=== Upgrade Scenarios - Migration scenarios- 
 
 Does the feature affect old
 indices, saved objects ? - Has the feature been tested with {kib}
diff --git a/docs/developer/contributing/development-accessibility-tests.asciidoc b/docs/developer/contributing/development-accessibility-tests.asciidoc
index a3ffefb94cd2a..facf7ff14a6c1 100644
--- a/docs/developer/contributing/development-accessibility-tests.asciidoc
+++ b/docs/developer/contributing/development-accessibility-tests.asciidoc
@@ -1,5 +1,5 @@
 [[development-accessibility-tests]]
-==== Automated Accessibility Testing
+== Automated Accessibility Testing
 
 To run the tests locally:
 
diff --git a/docs/developer/contributing/development-documentation.asciidoc b/docs/developer/contributing/development-documentation.asciidoc
index d9fae42eef87e..99e55963f57af 100644
--- a/docs/developer/contributing/development-documentation.asciidoc
+++ b/docs/developer/contributing/development-documentation.asciidoc
@@ -1,18 +1,18 @@
 [[development-documentation]]
-=== Documentation during development
+== Documentation during development
 
 Docs should be written during development and accompany PRs when relevant. There are multiple types of documentation, and different places to add each.
 
-[float]
-==== Developer services documentation
+[discrete]
+=== Developer services documentation
 
 Documentation about specific services a plugin offers should be encapsulated in:
 
 * README.asciidoc at the base of the plugin folder.
 * Typescript comments for all public services.
 
-[float]
-==== End user documentation
+[discrete]
+=== End user documentation
 
 Documentation about user facing features should be written in http://asciidoc.org/[asciidoc] at
 {kib-repo}/tree/master/docs[https://github.com/elastic/kibana/tree/master/docs]
@@ -27,8 +27,8 @@ README for getting the docs tooling set up.
 node scripts/docs.js --open
 ```
 
-[float]
-==== General developer documentation and guidelines
+[discrete]
+=== General developer documentation and guidelines
 
 General developer guildlines and documentation, like this right here, should be written in http://asciidoc.org/[asciidoc]
 at {kib-repo}/tree/master/docs/developer[https://github.com/elastic/kibana/tree/master/docs/developer]
diff --git a/docs/developer/contributing/development-functional-tests.asciidoc b/docs/developer/contributing/development-functional-tests.asciidoc
index 442fc1ac755d3..580a5a000f391 100644
--- a/docs/developer/contributing/development-functional-tests.asciidoc
+++ b/docs/developer/contributing/development-functional-tests.asciidoc
@@ -1,10 +1,10 @@
 [[development-functional-tests]]
-=== Functional Testing
+== Functional Testing
 
 We use functional tests to make sure the {kib} UI works as expected. It replaces hours of manual testing by automating user interaction. To have better control over our functional test environment, and to make it more accessible to plugin authors, {kib} uses a tool called the `FunctionalTestRunner`.
 
-[float]
-==== Running functional tests
+[discrete]
+=== Running functional tests
 
 The `FunctionalTestRunner` is very bare bones and gets most of its functionality from its config file, located at {blob}test/functional/config.js[test/functional/config.js]. If you’re writing a plugin outside the {kib} repo, you will have your own config file.
  See <<external-plugin-functional-tests>> for more info.
@@ -12,27 +12,27 @@ The `FunctionalTestRunner` is very bare bones and gets most of its functionality
 There are three ways to run the tests depending on your goals:
 
 1. Easiest option:
-** Description: Starts up {kib} & Elasticsearch servers, followed by running tests. This is much slower when running the tests multiple times because slow startup time for the servers. Recommended for single-runs.
+** Description: Starts up {kib} & {es} servers, followed by running tests. This is much slower when running the tests multiple times because slow startup time for the servers. Recommended for single-runs.
 ** `node scripts/functional_tests`
-*** does everything in a single command, including running Elasticsearch and {kib} locally
+*** does everything in a single command, including running {es} and {kib} locally
 *** tears down everything after the tests run
 *** exit code reports success/failure of the tests
 
 2. Best for development:
-** Description: Two commands, run in separate terminals, separate the components that are long-running and slow from those that are ephemeral and fast. Tests can be re-run much faster, and this still runs Elasticsearch & {kib} locally.
+** Description: Two commands, run in separate terminals, separate the components that are long-running and slow from those that are ephemeral and fast. Tests can be re-run much faster, and this still runs {es} & {kib} locally.
 ** `node scripts/functional_tests_server`
-*** starts Elasticsearch and {kib} servers
+*** starts {es} and {kib} servers
 *** slow to start
 *** can be reused for multiple executions of the tests, thereby saving some time when re-running tests
 *** automatically restarts the {kib} server when relevant changes are detected
 ** `node scripts/functional_test_runner`
-*** runs the tests against {kib} & Elasticsearch servers that were started by `node scripts/functional_tests_server`
+*** runs the tests against {kib} & {es} servers that were started by `node scripts/functional_tests_server`
 *** exit code reports success or failure of the tests
 
 3. Custom option:
-** Description: Runs tests against instances of Elasticsearch & {kib} started some other way (like Elastic Cloud, or an instance you are managing in some other way).
+** Description: Runs tests against instances of {es} & {kib} started some other way (like Elastic Cloud, or an instance you are managing in some other way).
 ** just executes the functional tests
-** url, credentials, etc. for Elasticsearch and {kib} are specified via environment variables
+** url, credentials, etc. for {es} and {kib} are specified via environment variables
 ** Here's an example that runs against an Elastic Cloud instance. Note that you must run the same branch of tests as the version of {kib} you're testing.
 +
 ["source","shell"]
@@ -91,15 +91,15 @@ export TEST_THROTTLE_NETWORK=1
 node scripts/functional_test_runner --exclude-tag skipCloud
 ----------
 
-[float]
-===== More about `node scripts/functional_test_runner`
+[discrete]
+==== More about `node scripts/functional_test_runner`
 
 When run without any arguments the `FunctionalTestRunner` automatically loads the configuration in the standard location, but you can override that behavior with the `--config` flag. List configs with multiple --config arguments.
 
-* `--config test/functional/config.js` starts Elasticsearch and {kib} servers with the WebDriver tests configured to run in Chrome.
-* `--config test/functional/config.firefox.js` starts Elasticsearch and {kib} servers with the WebDriver tests configured to run in Firefox.
-* `--config test/api_integration/config.js` starts Elasticsearch and {kib} servers with the api integration tests configuration.
-* `--config test/accessibility/config.ts` starts Elasticsearch and {kib} servers with the WebDriver tests configured to run an accessibility audit using https://www.deque.com/axe/[axe].
+* `--config test/functional/config.js` starts {es} and {kib} servers with the WebDriver tests configured to run in Chrome.
+* `--config test/functional/config.firefox.js` starts {es} and {kib} servers with the WebDriver tests configured to run in Firefox.
+* `--config test/api_integration/config.js` starts {es} and {kib} servers with the api integration tests configuration.
+* `--config test/accessibility/config.ts` starts {es} and {kib} servers with the WebDriver tests configured to run an accessibility audit using https://www.deque.com/axe/[axe].
 
 There are also command line flags for `--bail` and `--grep`, which behave just like their mocha counterparts. For instance, use `--grep=foo` to run only tests that match a regular expression.
 
@@ -108,11 +108,11 @@ Logging can also be customized with `--quiet`, `--debug`, or `--verbose` flags.
 Use the `--help` flag for more options.
 
 
-[float]
-==== Writing functional tests
+[discrete]
+=== Writing functional tests
 
-[float]
-===== Environment
+[discrete]
+==== Environment
 
 The tests are written in https://mochajs.org[mocha] using https://github.com/elastic/kibana/tree/master/packages/kbn-expect[@kbn/expect] for assertions.
 
@@ -120,8 +120,8 @@ We use https://www.w3.org/TR/webdriver1/[WebDriver Protocol] to run tests in bot
 
 The `FunctionalTestRunner` automatically transpiles functional tests using babel, so that tests can use the same ECMAScript features that {kib} source code uses. See {blob}style_guides/js_style_guide.md[style_guides/js_style_guide.md].
 
-[float]
-===== Definitions
+[discrete]
+==== Definitions
 
 **Provider:**
 
@@ -179,8 +179,8 @@ To run tests on Firefox locally, use `config.firefox.js`:
 node scripts/functional_test_runner --config test/functional/config.firefox.js
 -----------
 
-[float]
-===== Using the test_user service
+[discrete]
+==== Using the test_user service
 
 Tests should run at the positive security boundry condition, meaning that they should be run with the mimimum privileges required (and documented) and not as the superuser.
  This prevents the type of regression where additional privleges accidentally become required to perform the same action. 
@@ -198,8 +198,8 @@ Here we are setting the `test_user` to have the `kibana_user` role and also role
 Tests should normally setRoles() in the before() and restoreDefaults() in the after().
 
 
-[float]
-===== Anatomy of a test file
+[discrete]
+==== Anatomy of a test file
 
 This annotated example file shows the basic structure every test suite uses. It starts by importing https://github.com/elastic/kibana/tree/master/packages/kbn-expect[`@kbn/expect`] and defining its default export: an anonymous Test Provider. The test provider then destructures the Provider API for the `getService()` and `getPageObjects()` functions. It uses these functions to collect the dependencies of this suite. The rest of the test file will look pretty normal to mocha.js users. `describe()`, `it()`, `before()` and the lot are used to define suites that happen to automate a browser via services and objects of type `PageObject`.
 
@@ -222,7 +222,7 @@ export default function ({ getService, getPageObject }) {
   describe('My Test Suite', () => {
 
     // most suites start with a before hook that navigates to a specific
-    // app/page and restores some archives into elasticsearch with esArchiver
+    // app/page and restores some archives into {es} with esArchiver
     before(async () => {
       await Promise.all([
         // start with an empty .kibana index
@@ -235,7 +235,7 @@ export default function ({ getService, getPageObject }) {
     });
 
     // right after the before() hook definition, add the teardown steps
-    // that will tidy up elasticsearch for other test suites
+    // that will tidy up {es} for other test suites
     after(async () => {
       // we unload the empty_kibana archive but not the makelogs
       // archive because we don't make any changes to it, and subsequent
@@ -257,9 +257,9 @@ export default function ({ getService, getPageObject }) {
 }
 ----
 
-[float]
+[discrete]
 [[functional_test_runner_provider_api]]
-==== Provider API
+=== Provider API
 
 The first and only argument to all providers is a Provider API Object. This object can be used to load service/page objects and config/test files.
 
@@ -280,11 +280,11 @@ Within a test Provider the API is exactly the same as the service providers API
 [horizontal]
 `loadTestFile(path)`::: Load the test file at path in place. Use this method to nest suites from other files into a higher-level suite
 
-[float]
-==== Service Index
+[discrete]
+=== Service Index
 
-[float]
-===== Built-in Services
+[discrete]
+==== Built-in Services
 
 The `FunctionalTestRunner` comes with three built-in services:
 
@@ -304,8 +304,8 @@ The `FunctionalTestRunner` comes with three built-in services:
 * Exposes lifecycle events for basic coordination. Handlers can return a promise and resolve/fail asynchronously
 * Phases include: `beforeLoadTests`, `beforeTests`, `beforeEachTest`, `cleanup`
 
-[float]
-===== {kib} Services
+[discrete]
+==== {kib} Services
 
 The {kib} functional tests define the vast majority of the actual functionality used by tests.
 
@@ -377,7 +377,7 @@ Full list of services that are used in functional tests can be found here: {blob
 **Low-level utilities:**:::
 * es
 ** Source: {blob}test/common/services/es.ts[test/common/services/es.ts]
-** Elasticsearch client
+** {es} client
 ** Higher level options: `kibanaServer.uiSettings` or `esArchiver`
 * remote
 ** Source: {blob}test/functional/services/remote/remote.ts[test/functional/services/remote/remote.ts]
@@ -387,8 +387,8 @@ Full list of services that are used in functional tests can be found here: {blob
 ** For searching and manipulating with DOM elements, use `testSubjects` and `find` services
 ** See the https://seleniumhq.github.io/selenium/docs/api/javascript/[selenium-webdriver docs] for the full API.
 
-[float]
-===== Custom Services
+[discrete]
+==== Custom Services
 
 Services are intentionally generic. They can be literally anything (even nothing). Some services have helpers for interacting with a specific types of UI elements, like `pointSeriesVis`, and others are more foundational, like `log` or `config`. Whenever you want to provide some functionality in a reusable package, consider making a custom service.
 
@@ -427,8 +427,8 @@ export default function () {
 }
 -----------
 
-[float]
-==== PageObjects
+[discrete]
+=== PageObjects
 
 The purpose for each PageObject is pretty self-explanatory. The visualize PageObject provides helpers for interacting with the visualize app, dashboard is the same for the dashboard app, and so on.
 
@@ -436,13 +436,13 @@ One exception is the "common" PageObject. A holdover from the intern implementat
 
 Please add new methods to existing or new services rather than further expanding the CommonPage class.
 
-[float]
-==== Gotchas
+[discrete]
+=== Gotchas
 
 Remember that you can’t run an individual test in the file (`it` block) because the whole `describe` needs to be run in order. There should only be one top level `describe` in a file.
 
-[float]
-===== Functional Test Timing
+[discrete]
+==== Functional Test Timing
 
 Another important gotcha is writing stable tests by being mindful of timing. All methods on `remote` run asynchronously. It’s better to write interactions that wait for changes on the UI to appear before moving onto the next step.
 
@@ -480,8 +480,8 @@ class AppPage {
 
 Writing in this way will ensure your test timings are not flaky or based on assumptions about UI updates after interactions.
 
-[float]
-==== Debugging
+[discrete]
+=== Debugging
 
 From the command line run:
 
@@ -503,8 +503,8 @@ const log = getService(‘log’);
 log.debug(‘done clicking menu’);
 -----------
 
-[float]
-==== MacOS testing performance tip
+[discrete]
+=== MacOS testing performance tip
 
 macOS users on a machine with a discrete graphics card may see significant speedups (up to 2x) when running tests by changing your terminal emulator's GPU settings. In iTerm2:
 * Open Preferences (Command + ,)
diff --git a/docs/developer/contributing/development-github.asciidoc b/docs/developer/contributing/development-github.asciidoc
index 027b4e73aa9de..a6d4e29940487 100644
--- a/docs/developer/contributing/development-github.asciidoc
+++ b/docs/developer/contributing/development-github.asciidoc
@@ -1,16 +1,16 @@
 [[development-github]]
-=== How we use git and github
+== How we use git and github
 
-[float]
-==== Forking
+[discrete]
+=== Forking
 
 We follow the https://help.github.com/articles/fork-a-repo/[GitHub
 forking model] for collaborating on {kib} code. This model assumes that
 you have a remote called `upstream` which points to the official {kib}
 repo, which we'll refer to in later code snippets.
 
-[float]
-==== Branching
+[discrete]
+=== Branching
 
 * All work on the next major release goes into master.
 * Past major release branches are named `{majorVersion}.x`. They contain
@@ -24,8 +24,8 @@ if the next patch release is `5.3.1`, work for it should go into the
 branches.
 * Where appropriate, we'll backport changes into older release branches.
 
-[float]
-==== Commits and Merging
+[discrete]
+=== Commits and Merging
 
 * Feel free to make as many commits as you want, while working on a
 branch.
@@ -38,8 +38,8 @@ explanation of _why_ you made the changes that you did.
 feature branch, and force-pushing (see below for instructions).
 * When merging, we'll squash your commits into a single commit.
 
-[float]
-===== Rebasing and fixing merge conflicts
+[discrete]
+==== Rebasing and fixing merge conflicts
 
 Rebasing can be tricky, and fixing merge conflicts can be even trickier
 because it involves force pushing. This is all compounded by the fact
@@ -106,7 +106,7 @@ hint: See the 'Note about fast-forwards' in 'git push --help' for details.
 
 Assuming you've successfully rebased and you're happy with the code, you should force push instead.
 
-[float]
-==== Creating a pull request
+[discrete]
+=== Creating a pull request
 
 See <<development-pull-request>> for the next steps on getting your code changes merged into {kib}.
\ No newline at end of file
diff --git a/docs/developer/contributing/development-pull-request.asciidoc b/docs/developer/contributing/development-pull-request.asciidoc
index 5d3c30fec7383..070eff449af5b 100644
--- a/docs/developer/contributing/development-pull-request.asciidoc
+++ b/docs/developer/contributing/development-pull-request.asciidoc
@@ -1,16 +1,16 @@
 [[development-pull-request]]
-=== Submitting a pull request
+== Submitting a pull request
 
-[float]
-==== What Goes Into a Pull Request
+[discrete]
+=== What Goes Into a Pull Request
 
 * Please include an explanation of your changes in your PR description.
 * Links to relevant issues, external resources, or related PRs are very important and useful.
 * Please update any tests that pertain to your code, and add new tests where appropriate.
 * Update or add docs when appropriate. Read more about <<development-documentation>>.
 
-[float]
-==== Submitting a Pull Request
+[discrete]
+=== Submitting a Pull Request
 
  1. Push your local changes to your forked copy of the repository and submit a pull request.
  2. Describe what your changes do and mention the number of the issue where discussion has taken place, e.g., “Closes #123″.
@@ -22,8 +22,8 @@ Always submit your pull against master unless the bug is only present in an olde
 
 Then sit back and wait. There will probably be discussion about the Pull Request and, if any changes are needed, we'll work with you to get your Pull Request merged into {kib}.
 
-[float]
-==== What to expect during the pull request review process
+[discrete]
+=== What to expect during the pull request review process
 
 Most PRs go through several iterations of feedback and updates. Depending on the scope and complexity of the PR, the process can take weeks. Please
 be patient and understand we hold our code base to a high standard.
diff --git a/docs/developer/contributing/development-tests.asciidoc b/docs/developer/contributing/development-tests.asciidoc
index b470ea61669b2..78a2a90b69ce5 100644
--- a/docs/developer/contributing/development-tests.asciidoc
+++ b/docs/developer/contributing/development-tests.asciidoc
@@ -1,10 +1,10 @@
 [[development-tests]]
-=== Testing
+== Testing
 
 To ensure that your changes will not break other functionality, please run the test suite and build (<<building-kibana>>) before submitting your Pull Request.
 
-[float]
-==== Running specific {kib} tests
+[discrete]
+=== Running specific {kib} tests
 
 The following table outlines possible test file locations and how to
 invoke them:
@@ -47,8 +47,8 @@ Examples: - Run the entire elasticsearch_service test suite:
 string: ``` yarn test:ftr:server –config test/api_integration/config.js
 yarn test:ftr:runner –config test/api_integration/config
 
-[float]
-==== Cross-browser compatibility
+[discrete]
+=== Cross-browser compatibility
 
 **Testing IE on OS X**
 
@@ -71,8 +71,8 @@ your computer name).
 `http://computer.local:5601` to test {kib}.
 * Alternatively you can use browserstack
 
-[float]
-==== Running browser automation tests
+[discrete]
+=== Running browser automation tests
 
 Check out <<development-functional-tests>> to learn more about how you can run
 and develop functional tests for {kib} core and plugins.
@@ -80,17 +80,17 @@ and develop functional tests for {kib} core and plugins.
 You can also look into the {kib-repo}tree/{branch}/scripts/README.md[Scripts README.md]
 to learn more about using the node scripts we provide for building
 {kib}, running integration tests, and starting up {kib} and
-Elasticsearch while you develop.
+{es} while you develop.
 
-[float]
+[discrete]
 ==== More testing information:
 
 * <<development-functional-tests>>
 * <<development-unit-tests>>
 * <<development-accessibility-tests>>
 
-include::development-functional-tests.asciidoc[]
+include::development-functional-tests.asciidoc[leveloffset=+1]
 
-include::development-unit-tests.asciidoc[]
+include::development-unit-tests.asciidoc[leveloffset=+1]
 
-include::development-accessibility-tests.asciidoc[]
\ No newline at end of file
+include::development-accessibility-tests.asciidoc[leveloffset=+1]
\ No newline at end of file
diff --git a/docs/developer/contributing/development-unit-tests.asciidoc b/docs/developer/contributing/development-unit-tests.asciidoc
index 0009533c9a7c4..8b4954150bb5b 100644
--- a/docs/developer/contributing/development-unit-tests.asciidoc
+++ b/docs/developer/contributing/development-unit-tests.asciidoc
@@ -1,11 +1,11 @@
 [[development-unit-tests]]
-==== Unit testing frameworks
+== Unit testing frameworks
 
 {kib} is migrating unit testing from `Mocha` to `Jest`. Legacy unit tests
 still exist in Mocha but all new unit tests should be written in Jest.
 
-[float]
-===== Mocha (legacy)
+[discrete]
+=== Mocha (legacy)
 
 Mocha tests are contained in `__tests__` directories.
 
@@ -16,8 +16,8 @@ Mocha tests are contained in `__tests__` directories.
 yarn test:mocha
 -----------
 
-[float]
-==== Jest
+[discrete]
+== Jest
 Jest tests are stored in the same directory as source code files with the `.test.{js,mjs,ts,tsx}` suffix.
 
 *Running Jest Unit Tests*
@@ -27,8 +27,8 @@ Jest tests are stored in the same directory as source code files with the `.test
 yarn test:jest
 -----------
 
-[float]
-====== Writing Jest Unit Tests
+[discrete]
+==== Writing Jest Unit Tests
 
 In order to write those tests there are two main things you need to be aware of.
 The first one is the different between `jest.mock` and `jest.doMock` 
@@ -37,8 +37,8 @@ test files with `babel-jest` both techniques are needed
 specially for the tests implemented on Typescript in order to benefit from the 
 auto-inference types feature.
 
-[float]
-====== Jest.mock vs Jest.doMock
+[discrete]
+==== Jest.mock vs Jest.doMock
 
 Both methods are essentially the same on their roots however the `jest.mock` 
 calls will get hoisted to the top of the file and can only reference variables 
@@ -47,8 +47,8 @@ reference pretty much any variable we want, however we have to assure those refe
 variables are instantiated at the time we need them which lead us to the next 
 section where we'll talk about our jest mock files pattern.
 
-[float]
-====== Jest Mock Files Pattern 
+[discrete]
+==== Jest Mock Files Pattern 
 
 Specially on typescript it is pretty common to have in unit tests 
 `jest.doMock` calls which reference for example imported types. Any error 
@@ -76,9 +76,9 @@ like: `import * as Mocks from './mymodule.test.mocks'`,
 or just `import './mymodule.test.mocks'` if there isn't anything 
 exported to be used.
 
-[float]
+[discrete]
 [[debugging-unit-tests]]
-===== Debugging Unit Tests
+=== Debugging Unit Tests
 
 The standard `yarn test` task runs several sub tasks and can take
 several minutes to complete, making debugging failures pretty painful.
@@ -127,8 +127,8 @@ description.
 
 image:http://i.imgur.com/DwHxgfq.png[Browser test debugging]
 
-[float]
-===== Unit Testing Plugins
+[discrete]
+=== Unit Testing Plugins
 
 This should work super if you’re using the
 https://github.com/elastic/kibana/tree/master/packages/kbn-plugin-generator[Kibana
diff --git a/docs/developer/contributing/index.asciidoc b/docs/developer/contributing/index.asciidoc
index 4f987f31cf1f6..99ab83bc2f073 100644
--- a/docs/developer/contributing/index.asciidoc
+++ b/docs/developer/contributing/index.asciidoc
@@ -23,7 +23,7 @@ Read <<development-getting-started>> to get your environment up and running, the
 
 Please make sure you have signed the [Contributor License Agreement](http://www.elastic.co/contributor-agreement/). We are not asking you to assign copyright to us, but to give us the right to distribute your code without restriction. We ask this of all contributors in order to assure our users of the origin and continuing existence of the code. You only need to sign the CLA once.
 
-[float]
+[discrete]
 [[kibana-localization]]
 === Localization
 
@@ -32,7 +32,7 @@ Read <<kibana-localization-best-practices>> for details on our localization prac
 Note that we cannot support accepting contributions to the translations from any source other than the translators we have engaged to do the work.
 We are still to develop a proper process to accept any contributed translations. We certainly appreciate that people care enough about the localization effort to want to help improve the quality. We aim to build out a more comprehensive localization process for the future and will notify you once contributions can be supported, but for the time being, we are not able to incorporate suggestions.
 
-[float]
+[discrete]
 [[kibana-release-notes-process]]
 === Release Notes Process
 
@@ -43,7 +43,7 @@ access to GitHub labels.
 The Release Notes summarize what the PRs accomplish in language that is meaningful to users.
  To generate the Release Notes, the team runs a script against this repo to collect the merged PRs against the release.
 
-[float]
+[discrete]
 ==== Create the Release Notes text
 
 The text that appears in the Release Notes is pulled directly from your PR title, or a single paragraph of text that you specify in the PR description.
@@ -59,7 +59,7 @@ When you create the Release Notes text, use the following best practices:
 * When you create a bug fix PR, start with `Fixes`.
 * When you create a deprecation PR, start with `Deprecates`.
 
-[float]
+[discrete]
 ==== Add your labels
 
 [arabic]
@@ -72,18 +72,18 @@ When you create the Release Notes text, use the following best practices:
   * To **NOT** include your changes in the Release Notes, use `release_note:skip`.
 
 
-include::development-github.asciidoc[]
+include::development-github.asciidoc[leveloffset=+1]
 
-include::development-tests.asciidoc[]
+include::development-tests.asciidoc[leveloffset=+1]
 
-include::interpreting-ci-failures.asciidoc[]
+include::interpreting-ci-failures.asciidoc[leveloffset=+1]
 
-include::development-documentation.asciidoc[]
+include::development-documentation.asciidoc[leveloffset=+1]
 
-include::development-pull-request.asciidoc[]
+include::development-pull-request.asciidoc[leveloffset=+1]
 
-include::kibana-issue-reporting.asciidoc[]
+include::kibana-issue-reporting.asciidoc[leveloffset=+1]
 
-include::pr-review.asciidoc[]
+include::pr-review.asciidoc[leveloffset=+1]
 
-include::linting.asciidoc[]
+include::linting.asciidoc[leveloffset=+1]
diff --git a/docs/developer/contributing/interpreting-ci-failures.asciidoc b/docs/developer/contributing/interpreting-ci-failures.asciidoc
index ba3999a310198..bb623bc7a541c 100644
--- a/docs/developer/contributing/interpreting-ci-failures.asciidoc
+++ b/docs/developer/contributing/interpreting-ci-failures.asciidoc
@@ -1,19 +1,19 @@
 [[interpreting-ci-failures]]
-=== Interpreting CI Failures
+== Interpreting CI Failures
 
 {kib} CI uses a Jenkins feature called "Pipelines" to automate testing of the code in pull requests and on tracked branches. Pipelines are defined within the repository via the `Jenkinsfile` at the root of the project.
 
 More information about Jenkins Pipelines can be found link:https://jenkins.io/doc/book/pipeline/[in the Jenkins book].
 
-[float]
-==== Github Checks
+[discrete]
+=== Github Checks
 
 When a test fails it will be reported to Github via Github Checks. We currently bucket tests into several categories which run in parallel to make CI faster. Groups like `ciGroup{X}` get a single check in Github, and other tests like linting, or type checks, get their own checks.
 
 Clicking the link next to the check in the conversation tab of a pull request will take you to the log output from that section of the tests. If that log output is truncated, or doesn't clearly identify what happened, you can usually get more complete information by visiting Jenkins directly.
 
-[float]
-==== Viewing Job Executions in Jenkins
+[discrete]
+=== Viewing Job Executions in Jenkins
 
 To view the results of a job execution in Jenkins, either click the link in the comment left by `@elasticmachine` or search for the `kibana-ci` check in the list at the bottom of the PR. This link will take you to the top-level page for the specific job execution that failed.
 
@@ -24,8 +24,8 @@ image::images/job_view.png[]
 3. *Google Cloud Storage (GCS) Upload Report:* Link to the screen which lists out the artifacts uploaded to GCS during this job execution.
 4. *Pipeline Steps:*: A breakdown of the pipline that was executed, along with individual log output for each step in the pipeline.
 
-[float]
-==== Viewing ciGroup/test Logs
+[discrete]
+=== Viewing ciGroup/test Logs
 
 To view the logs for a failed specific ciGroup, jest, mocha, type checkers, linters, etc., click on the *Pipeline Steps* link in from the Job page.
 
diff --git a/docs/developer/contributing/kibana-issue-reporting.asciidoc b/docs/developer/contributing/kibana-issue-reporting.asciidoc
index 36c50b612d675..63366ae2aa6bb 100644
--- a/docs/developer/contributing/kibana-issue-reporting.asciidoc
+++ b/docs/developer/contributing/kibana-issue-reporting.asciidoc
@@ -1,8 +1,8 @@
 [[kibana-issue-reporting]]
-=== Effective issue reporting in {kib}
+== Effective issue reporting in {kib}
 
-[float]
-==== Voicing the importance of an issue
+[discrete]
+=== Voicing the importance of an issue
 
 We seriously appreciate thoughtful comments. If an issue is important to
 you, add a comment with a solid write up of your use case and explain
@@ -17,8 +17,8 @@ https://github.com/blog/2119-add-reactions-to-pull-requests-issues-and-comments[
 thumbs up reaction] on the issue itself and on the comment which best
 summarizes your thoughts.
 
-[float]
-==== "`My issue isn’t getting enough attention`"
+[discrete]
+=== "`My issue isn’t getting enough attention`"
 
 First of all, *sorry about that!* We want you to have a great time with
 {kib}.
@@ -31,8 +31,8 @@ more pressing issues.
 Feel free to bump your issues if you think they’ve been neglected for a
 prolonged period.
 
-[float]
-==== "`I want to help!`"
+[discrete]
+=== "`I want to help!`"
 
 *Now we’re talking*. If you have a bug fix or new feature that you would
 like to contribute to {kib}, please *find or open an issue about it
diff --git a/docs/developer/contributing/linting.asciidoc b/docs/developer/contributing/linting.asciidoc
index 234bd90478907..0d05afa504538 100644
--- a/docs/developer/contributing/linting.asciidoc
+++ b/docs/developer/contributing/linting.asciidoc
@@ -1,5 +1,5 @@
 [[kibana-linting]]
-=== Linting
+== Linting
 
 A note about linting: We use http://eslint.org[eslint] to check that the
 link:STYLEGUIDE.md[styleguide] is being followed. It runs in a
@@ -34,8 +34,8 @@ for your editor, and browse our
 https://github.com/elastic/kibana/blob/master/.editorconfig[`.editorconfig`]
 file to see what config rules we set up.
 
-[float]
-==== Setup Guide for VS Code Users
+[discrete]
+== Setup Guide for VS Code Users
 
 Note that for VSCode, to enable "`live`" linting of TypeScript (and
 other) file types, you will need to modify your local settings, as shown
diff --git a/docs/developer/contributing/pr-review.asciidoc b/docs/developer/contributing/pr-review.asciidoc
index ebab3b24aaaee..885725795b0b9 100644
--- a/docs/developer/contributing/pr-review.asciidoc
+++ b/docs/developer/contributing/pr-review.asciidoc
@@ -1,5 +1,5 @@
 [[pr-review]]
-=== Pull request review guidelines
+== Pull request review guidelines
 
 Every change made to {kib} must be held to a high standard, and while the responsibility for quality in a pull request ultimately lies with the author, {kib} team members have the responsibility as reviewers to verify during their review process.
 
@@ -10,24 +10,24 @@ It is not expected nor intended for a PR review to take the shape of this docume
 While the review process is always done by Elastic staff members, these guidelines apply to all pull requests regardless of whether they are authored by community members or Elastic staff.
 
 
-[float]
-==== Target audience
+[discrete]
+=== Target audience
 
 The target audience for this document are pull request reviewers. For {kib} maintainers, the PR review is the only part of the contributing process in which we have complete control. The author of any given pull request may not be up to speed on the latest expectations we have for pull requests, and they may have never read our guidelines at all. It's our responsibility as reviewers to guide folks through this process, but it's hard to do that consistently without a common set of documented principles.
 
 Pull request authors can benefit from reading this document as well because it'll help establish a common set of expectations between authors and reviewers early.
 
 
-[float]
-==== Reject fast
+[discrete]
+=== Reject fast
 
 Every pull request is different, and before reviewing any given PR, reviewers should consider the optimal way to approach the PR review so that if the change is ultimately rejected, it is done so as early in the process as possible.
 
 For example, a reviewer may want to do a product level review as early as possible for a PR that includes a new UI feature. On the other hand, perhaps the author is submitting a new feature that has been rejected in the past due to key architectural decisions, in which case it may be appropriate for the reviewer to focus on the soundness of the architecture before diving into anything else.
 
 
-[float]
-==== The big three
+[discrete]
+=== The big three
 
 There are a lot of discrete requirements and guidelines we want to follow in all of our pull requests, but three things in particular stand out as important above all the rest.
 
@@ -58,20 +58,20 @@ This isn't simply a question of enough test files. The code in the tests themsel
 
 All of our code should have unit tests that verify its behaviors, including not only the "happy path", but also edge cases, error handling, etc.  When you change an existing API of a module, then there should always be at least one failing unit test, which in turn means we need to verify that all code consuming that API properly handles the change if necessary. For modules at a high enough level, this will mean we have breaking change in the product, which we'll need to handle accordingly.
 
-In addition to extensive unit test coverage, PRs should include relevant functional and integration tests. In some cases, we may simply be testing a programmatic interface (e.g. a service) that is integrating with the file system, the network, Elasticsearch, etc. In other cases, we'll be testing REST APIs over HTTP or comparing screenshots/snapshots with prior known acceptable state. In the worst case, we are doing browser-based functional testing on a running instance of {kib} using selenium.
+In addition to extensive unit test coverage, PRs should include relevant functional and integration tests. In some cases, we may simply be testing a programmatic interface (e.g. a service) that is integrating with the file system, the network, {es}, etc. In other cases, we'll be testing REST APIs over HTTP or comparing screenshots/snapshots with prior known acceptable state. In the worst case, we are doing browser-based functional testing on a running instance of {kib} using selenium.
 
 Enhancements are pretty much always going to have extensive unit tests as a base as well as functional and integration testing. Bug fixes should always include regression tests to ensure that same bug does not manifest again in the future.
 --
 
 
-[float]
-==== Product level review
+[discrete]
+=== Product level review
 
 Reviewers are not simply evaluating the code itself, they are also evaluating the quality of the user-facing change in the product. This generally means they need to check out the branch locally and "play around" with it. In addition to the "do we want this change in the product" details, the reviewer should be looking for bugs and evaluating how approachable and useful the feature is as implemented. Special attention should be given to error scenarios and edge cases to ensure they are all handled well within the product.
 
 
-[float]
-==== Consistency, style, readability
+[discrete]
+=== Consistency, style, readability
 
 Having a relatively consistent codebase is an important part of us building a sustainable project. With dozens of active contributors at any given time, we rely on automation to help ensure consistency - we enforce a comprehensive set of linting rules through CI. We're also rolling out prettier to make this even more automatic.
 
@@ -86,8 +86,8 @@ When in doubt, relying on "prior art" in the codebase, especially in and around
 There may also be times when a person is inspired by a particular contribution to introduce a new way to style code that we already have different style guidelines or "prior art" for. It's OK to bring this up in a pull request, but ultimately that discussion should branch off into a separate issue or pull request to update the appropriate guide. If this change is prompted by a reviewer, then the original PR should not be blocked on this.  If the change is prompted by the author, then they can either update the PR to be consistent with our existing guidelines (preferred) or they can choose to block the PR entirely on that separate styleguide discussion.
 
 
-[float]
-==== Nitpicking
+[discrete]
+=== Nitpicking
 
 Nitpicking is when a reviewer identifies trivial and unimportant details in a pull request and asks the author to change them. This is a completely subjective category that is impossible to define universally, and it's equally impractical to define a blanket policy on nitpicking that everyone will be happy with.
 
@@ -96,14 +96,14 @@ Reviewers should feel comfortable giving any feedback they have on a pull reques
 Often, reviewers have an opinion about whether the feedback they are about to give is a nitpick or not. While not required, it can be really helpful to identify that feedback as such, for example "nit: a newline after this would be helpful". This helps the author understand your intention.
 
 
-[float]
-==== Handling disagreements
+[discrete]
+=== Handling disagreements
 
 Conflicting opinions between reviewers and authors happen, and sometimes it is hard to reconcile those opinions. Ideally folks can work together in the spirit of these guidelines toward a consensus, but if that doesn't work out it may be best to bring a third person into the discussion. Our pull requests generally have two reviewers, so an appropriate third person may already be obvious. Otherwise, reach out to the functional area that is most appropriate or to technical leadership if an area isn't obvious.
 
 
-[float]
-==== Inappropriate review feedback
+[discrete]
+=== Inappropriate review feedback
 
 Whether or not a bit of feedback is appropriate for a pull request is often dependent on the motivation for giving the feedback in the first place.
 
@@ -112,8 +112,8 @@ _Demanding_ an author make changes based primarily on the mindset of "how would
 Inflammatory feedback such as "this is crap" isn't feedback at all. It's both mean and unhelpful, and it is never appropriate.
 
 
-[float]
-==== A checklist
+[discrete]
+=== A checklist
 
 Establishing a comprehensive checklist for all of the things that should happen in all possible pull requests is impractical, but that doesn't mean we lack a concrete set of minimum requirements that we can enumerate. The following items should be double checked for any pull request:
 
diff --git a/docs/developer/getting-started/building-kibana.asciidoc b/docs/developer/getting-started/building-kibana.asciidoc
index e1f1ca336a5da..72054b1628fc2 100644
--- a/docs/developer/getting-started/building-kibana.asciidoc
+++ b/docs/developer/getting-started/building-kibana.asciidoc
@@ -1,5 +1,5 @@
 [[building-kibana]]
-=== Building a {kib} distributable
+== Building a {kib} distributable
 
 The following commands will build a {kib} production distributable.
 
@@ -15,8 +15,8 @@ You can get all build options using the following command:
 yarn build --help
 ----
 
-[float]
-==== Building OS packages
+[discrete]
+=== Building OS packages
 
 Packages are built using fpm, dpkg, and rpm.  Package building has only been tested on Linux and is not supported on any other platform.
 
diff --git a/docs/developer/getting-started/debugging.asciidoc b/docs/developer/getting-started/debugging.asciidoc
index b369dcda748af..a3fb12ec1f6a3 100644
--- a/docs/developer/getting-started/debugging.asciidoc
+++ b/docs/developer/getting-started/debugging.asciidoc
@@ -1,15 +1,15 @@
 [[kibana-debugging]]
-=== Debugging {kib}
+== Debugging {kib}
 
 For information about how to debug unit tests, refer to <<debugging-unit-tests>>.
 
-[float]
-==== Server Code
+[discrete]
+=== Server Code
 
 `yarn debug` will start the server with Node's inspect flag. {kib}'s development mode will start three processes on ports `9229`, `9230`, and `9231`. Chrome's developer tools need to be configured to connect to all three connections. Add `localhost:<port>` for each {kib} process in Chrome's developer tools connection tab.
 
-[float]
-==== Instrumenting with Elastic APM
+[discrete]
+=== Instrumenting with Elastic APM
 
 {kib} ships with the
 https://github.com/elastic/apm-agent-nodejs[Elastic APM Node.js Agent]
@@ -18,7 +18,7 @@ built-in for debugging purposes.
 Its default configuration is meant to be used by core {kib} developers
 only, but it can easily be re-configured to your needs. In its default
 configuration it’s disabled and will, once enabled, send APM data to a
-centrally managed Elasticsearch cluster accessible only to Elastic
+centrally managed {es} cluster accessible only to Elastic
 employees.
 
 To change the location where data is sent, use the
diff --git a/docs/developer/getting-started/development-plugin-resources.asciidoc b/docs/developer/getting-started/development-plugin-resources.asciidoc
index dfe8efc4fef57..8f81138b81ed7 100644
--- a/docs/developer/getting-started/development-plugin-resources.asciidoc
+++ b/docs/developer/getting-started/development-plugin-resources.asciidoc
@@ -1,14 +1,14 @@
 [[development-plugin-resources]]
-=== Plugin Resources
+== Plugin Resources
 
 Here are some resources that are helpful for getting started with plugin development.
 
-[float]
-==== Some light reading
+[discrete]
+=== Some light reading
 If you haven't already, start with <<development-getting-started>>. If you are planning to add your plugin to the {kib} repo, read the <<contributing>> guide, if you are building a plugin externally, read <<external-plugin-development>>. In both cases, read up on our recommended <<development-best-practices>>.
 
-[float]
-==== Creating an empty plugin
+[discrete]
+=== Creating an empty plugin
 
 You can use the <<automatic-plugin-generator>> to get a basic structure for a new plugin. Plugins that are not part of the
 {kib} repo should be developed inside the `plugins` folder.  If you are building a new plugin to check in to the {kib} repo,
@@ -18,15 +18,15 @@ you will choose between a few locations:
  - {kib-repo}tree/{branch}/src/plugins[src/plugins] for open source licensed plugins
  - {kib-repo}tree/{branch}/examples[examples] for developer example plugins (these will not be included in the distributables)
 
-[float]
-==== Elastic UI Framework
+[discrete]
+=== Elastic UI Framework
 If you're developing a plugin that has a user interface, take a look at our https://elastic.github.io/eui[Elastic UI Framework].
 It documents the CSS and React components we use to build {kib}'s user interface.
 
 You're welcome to use these components, but be aware that they are rapidly evolving, and we might introduce breaking changes that will disrupt your plugin's UI.
 
-[float]
-==== TypeScript Support
+[discrete]
+=== TypeScript Support
 We recommend your plugin code is written in http://www.typescriptlang.org/[TypeScript].
 To enable TypeScript support, create a `tsconfig.json` file at the root of your plugin that looks something like this:
 
@@ -48,14 +48,14 @@ TypeScript code is automatically converted into JavaScript during development,
 but not in the distributable version of {kib}. If you use the
 {kib-repo}blob/{branch}/packages/kbn-plugin-helpers[@kbn/plugin-helpers] to build your plugin, then your `.ts` and `.tsx` files will be permanently transpiled before your plugin is archived. If you have your own build process, make sure to run the TypeScript compiler on your source files and ship the compilation output so that your plugin will work with the distributable version of {kib}.
 
-[float]
-==== {kib} platform migration guide
+[discrete]
+=== {kib} platform migration guide
 
 {kib-repo}blob/{branch}/src/core/MIGRATION.md#migrating-legacy-plugins-to-the-new-platform[This guide]
 provides an action plan for moving a legacy plugin to the new platform. 
 
-[float]
-==== Externally developed plugins
+[discrete]
+=== Externally developed plugins
 
 If you are building a plugin outside of the {kib} repo, read <<external-plugin-development>>.
 
diff --git a/docs/developer/getting-started/index.asciidoc b/docs/developer/getting-started/index.asciidoc
index 47c4a52daf303..2ac51b6cf86f8 100644
--- a/docs/developer/getting-started/index.asciidoc
+++ b/docs/developer/getting-started/index.asciidoc
@@ -3,7 +3,7 @@
 
 Get started building your own plugins, or contributing directly to the {kib} repo.
 
-[float]
+[discrete]
 [[get-kibana-code]]
 === Get the code
 
@@ -15,7 +15,7 @@ git clone https://github.com/[YOUR_USERNAME]/kibana.git kibana
 cd kibana
 ----
 
-[float]
+[discrete]
 === Install dependencies
 
 Install the version of Node.js listed in the `.node-version` file. This
@@ -67,11 +67,11 @@ corrupted packages in your yarn cache which you can clean with:
 yarn cache clean
 ----
 
-[float]
+[discrete]
 === Configure environmental settings
 
 [[increase-nodejs-heap-size]]
-[float]
+[discrete]
 ==== Increase node.js heap size
 
 {kib} is a big project and for some commands it can happen that the
@@ -81,10 +81,10 @@ by setting the `--max_old_space_size` option on the command line. To set
 the limit for all commands, simply add the following line to your shell
 config: `export NODE_OPTIONS="--max_old_space_size=2048"`.
 
-[float]
-=== Run Elasticsearch
+[discrete]
+=== Run {es}
 
-Run the latest Elasticsearch snapshot. Specify an optional license with the `--license` flag.
+Run the latest {es} snapshot. Specify an optional license with the `--license` flag.
 
 [source,bash]
 ----
@@ -96,7 +96,7 @@ yarn es snapshot --license trial
 Read about more options for <<running-elasticsearch>>, like connecting to a remote host, running from source,
 preserving data inbetween runs, running remote cluster, etc.
 
-[float]
+[discrete]
 === Run {kib}
 
 In another terminal window, start up {kib}. Include developer examples by adding an optional `--run-examples` flag.
@@ -110,13 +110,13 @@ View all available options by running `yarn start --help`
 
 Read about more advanced options for <<running-kibana-advanced>>.
 
-[float]
+[discrete]
 === Code away!
 
 You are now ready to start developing. Changes to your files should be picked up automatically. Server side changes will
 cause the {kib} server to reboot.
 
-[float]
+[discrete]
 === More information
 
 * <<running-kibana-advanced>>
@@ -129,12 +129,12 @@ cause the {kib} server to reboot.
 
 * <<development-plugin-resources>>
 
-include::running-kibana-advanced.asciidoc[]
+include::running-kibana-advanced.asciidoc[leveloffset=+1]
 
-include::sample-data.asciidoc[]
+include::sample-data.asciidoc[leveloffset=+1]
 
-include::debugging.asciidoc[]
+include::debugging.asciidoc[leveloffset=+1]
 
-include::building-kibana.asciidoc[]
+include::building-kibana.asciidoc[leveloffset=+1]
 
-include::development-plugin-resources.asciidoc[]
\ No newline at end of file
+include::development-plugin-resources.asciidoc[leveloffset=+1]
\ No newline at end of file
diff --git a/docs/developer/getting-started/running-kibana-advanced.asciidoc b/docs/developer/getting-started/running-kibana-advanced.asciidoc
index e36f38de1b366..c3b7847b0f8ba 100644
--- a/docs/developer/getting-started/running-kibana-advanced.asciidoc
+++ b/docs/developer/getting-started/running-kibana-advanced.asciidoc
@@ -1,5 +1,5 @@
 [[running-kibana-advanced]]
-=== Running {kib}
+== Running {kib}
 
 Change to your local {kib} directory. Start the development server.
 
@@ -23,8 +23,8 @@ By default, you can log in with username `elastic` and password
 `changeme`. See the `--help` options on `yarn es <command>` if
 you’d like to configure a different password.
 
-[float]
-==== Running {kib} in Open-Source mode
+[discrete]
+=== Running {kib} in Open-Source mode
 
 If you’re looking to only work with the open-source software, supply the
 license type to `yarn es`:
@@ -41,8 +41,8 @@ And start {kib} with only open-source code:
 yarn start --oss
 ----
 
-[float]
-==== Unsupported URL Type
+[discrete]
+=== Unsupported URL Type
 
 If you’re installing dependencies and seeing an error that looks
 something like
@@ -56,9 +56,9 @@ need to run `yarn kbn bootstrap`. For more info, see
 link:#setting-up-your-development-environment[Setting Up Your
 Development Environment] above.
 
-[float]
+[discrete]
 [[customize-kibana-yml]]
-==== Customizing `config/kibana.dev.yml`
+=== Customizing `config/kibana.dev.yml`
 
 The `config/kibana.yml` file stores user configuration directives.
 Since this file is checked into source control, however, developer
@@ -70,8 +70,8 @@ non-dev version and accepts any of the
 https://www.elastic.co/guide/en/kibana/current/settings.html[standard
 settings].
 
-[float]
-==== Potential Optimization Pitfalls
+[discrete]
+=== Potential Optimization Pitfalls
 
 * Webpack is trying to include a file in the bundle that I deleted and
 is now complaining about it is missing
@@ -79,9 +79,9 @@ is now complaining about it is missing
 directory, but webpack isn’t adapting
 * (if you discover other scenarios, please send a PR!)
 
-[float]
-==== Setting Up SSL
+[discrete]
+=== Setting Up SSL
 
 {kib} includes self-signed certificates that can be used for
 development purposes in the browser and for communicating with
-Elasticsearch: `yarn start --ssl` & `yarn es snapshot --ssl`.
\ No newline at end of file
+{es}: `yarn start --ssl` & `yarn es snapshot --ssl`.
\ No newline at end of file
diff --git a/docs/developer/getting-started/sample-data.asciidoc b/docs/developer/getting-started/sample-data.asciidoc
index 376211ceb2634..0d313cbabe64e 100644
--- a/docs/developer/getting-started/sample-data.asciidoc
+++ b/docs/developer/getting-started/sample-data.asciidoc
@@ -1,17 +1,17 @@
 [[sample-data]]
-=== Installing sample data
+== Installing sample data
 
-There are a couple ways to easily get data ingested into Elasticsearch.
+There are a couple ways to easily get data ingested into {es}.
 
-[float]
-==== Sample data packages available for one click installation
+[discrete]
+=== Sample data packages available for one click installation
 
 The easiest is to install one or more of our vailable sample data packages. If you have no data, you should be 
 prompted to install when running {kib} for the first time. You can also access and install the sample data packages
 by going to the home page and clicking "add sample data".
 
-[float]
-==== makelogs script
+[discrete]
+=== makelogs script
 
 The provided `makelogs` script will generate sample data.
 
@@ -22,10 +22,10 @@ node scripts/makelogs --auth <username>:<password>
 
 The default username and password combination are `elastic:changeme`
 
-Make sure to execute `node scripts/makelogs` *after* elasticsearch is up and running!
+Make sure to execute `node scripts/makelogs` *after* {es} is up and running!
 
-[float]
-==== CSV upload
+[discrete]
+=== CSV upload
 
 If running with a platinum or trial license, you can also use the CSV uploader provided inside the Machine learning app.
 Navigate to the Data visualizer to upload your data from a file.
\ No newline at end of file
diff --git a/docs/developer/plugin/external-plugin-functional-tests.asciidoc b/docs/developer/plugin/external-plugin-functional-tests.asciidoc
index 44f636d627011..706bf6af8ed9b 100644
--- a/docs/developer/plugin/external-plugin-functional-tests.asciidoc
+++ b/docs/developer/plugin/external-plugin-functional-tests.asciidoc
@@ -1,10 +1,10 @@
 [[external-plugin-functional-tests]]
-=== Functional Tests for Plugins outside the {kib} repo
+== Functional Tests for Plugins outside the {kib} repo
 
 Plugins use the `FunctionalTestRunner` by running it out of the {kib} repo. Ensure that your {kib} Development Environment is setup properly before continuing.
 
-[float]
-==== Writing your own configuration
+[discrete]
+=== Writing your own configuration
 
 Every project or plugin should have its own `FunctionalTestRunner` config file. Just like {kib}'s, this config file will define all of the test files to load, providers for Services and PageObjects, as well as configuration options for certain services.
 
@@ -82,8 +82,8 @@ From the root of your repo you should now be able to run the `FunctionalTestRunn
 node ../../kibana/scripts/functional_test_runner
 -----------
 
-[float]
-==== Using esArchiver
+[discrete]
+=== Using esArchiver
 
 We're working on documentation for this, but for now the best place to look is the original {kib-repo}/issues/10359[pull request].
 
diff --git a/docs/developer/plugin/external-plugin-localization.asciidoc b/docs/developer/plugin/external-plugin-localization.asciidoc
index c151832ab53fa..d30dec1a8f46b 100644
--- a/docs/developer/plugin/external-plugin-localization.asciidoc
+++ b/docs/developer/plugin/external-plugin-localization.asciidoc
@@ -1,10 +1,10 @@
 [[external-plugin-localization]]
-=== Localization for plugins outside the {kib} repo
+== Localization for plugins outside the {kib} repo
 
 To introduce localization for your plugin, use our i18n tool to create IDs and default messages. You can then extract these IDs with respective default messages into localization JSON files for {kib} to use when running your plugin.
 
-[float]
-==== Adding localization to your plugin
+[discrete]
+=== Adding localization to your plugin
 
 You must add a `translations` directory at the root of your plugin. This directory will contain the translation files that {kib} uses.
 
@@ -19,8 +19,8 @@ You must add a `translations` directory at the root of your plugin. This directo
 -----------
 
 
-[float]
-==== Using {kib} i18n tooling
+[discrete]
+=== Using {kib} i18n tooling
 To simplify the localization process, {kib} provides tools for the following functions:
 
 * Verify all translations have translatable strings and extract default messages from templates
@@ -51,8 +51,8 @@ An example {kib} `.i18nrc.json` is {blob}.i18nrc.json[here].
 
 Full documentation about i18n tooling is {blob}src/dev/i18n/README.md[here].
 
-[float]
-==== Extracting default messages
+[discrete]
+=== Extracting default messages
 To extract the default messages from your plugin, run the following command:
 
 ["source","shell"]
@@ -62,8 +62,8 @@ node scripts/i18n_extract --output-dir ./translations --include-config ../kibana
 
 This outputs a `en.json` file inside the `translations` directory. To localize other languages, clone the file and translate each string.
 
-[float]
-==== Checking i18n messages
+[discrete]
+=== Checking i18n messages
 
 Checking i18n does the following:
 
@@ -80,8 +80,8 @@ node scripts/i18n_check --fix --include-config ../kibana-extra/myPlugin/.i18nrc.
 -----------
 
 
-[float]
-==== Implementing i18n in the UI
+[discrete]
+=== Implementing i18n in the UI
 
 {kib} relies on several UI frameworks (ReactJS and AngularJS) and
 requires localization in different environments (browser and NodeJS).
@@ -97,8 +97,8 @@ so both React and AngularJS frameworks use the same engine and the same
 message syntax.
 
 
-[float]
-===== i18n for vanilla JavaScript
+[discrete]
+==== i18n for vanilla JavaScript
 
 ["source","js"]
 -----------
@@ -111,8 +111,8 @@ export const HELLO_WORLD = i18n.translate('hello.wonderful.world', {
 
 Full details are {kib-repo}tree/master/packages/kbn-i18n#vanilla-js[here].
 
-[float]
-===== i18n for React
+[discrete]
+==== i18n for React
 
 To localize strings in React, use either `FormattedMessage` or `i18n.translate`.
 
@@ -137,8 +137,8 @@ Full details are {kib-repo}tree/master/packages/kbn-i18n#react[here].
 
 
 
-[float]
-===== i18n for Angular
+[discrete]
+==== i18n for Angular
 
 You are encouraged to use `i18n.translate()` by statically importing `i18n` from `@kbn/i18n` wherever possible in your Angular code. Angular wrappers use the translation `service` with the i18n engine under the hood.
 
@@ -156,8 +156,8 @@ The translation directive has the following syntax:
 Full details are {kib-repo}tree/master/packages/kbn-i18n#angularjs[here].
 
 
-[float]
-==== Resources
+[discrete]
+=== Resources
 
 To learn more about i18n tooling, see {blob}src/dev/i18n/README.md[i18n dev tooling].
 
diff --git a/docs/developer/plugin/index.asciidoc b/docs/developer/plugin/index.asciidoc
index 73f1d2c908fa7..dd83cf234dea4 100644
--- a/docs/developer/plugin/index.asciidoc
+++ b/docs/developer/plugin/index.asciidoc
@@ -9,9 +9,9 @@ The {kib} plugin interfaces are in a state of constant development.  We cannot p
 Most developers who contribute code directly to the {kib} repo are writing code inside plugins, so our <<contributing>> docs are the best place to
 start. However, there are a few differences when developing plugins outside the {kib} repo. These differences are covered here.
 
-[float]
+[discrete]
 [[automatic-plugin-generator]]
-==== Automatic plugin generator
+=== Automatic plugin generator
 
 We recommend that you kick-start your plugin by generating it with the {kib-repo}tree/{branch}/packages/kbn-plugin-generator[Kibana Plugin Generator]. Run the following in the {kib} repo, and you will be asked a couple questions, see some progress bars, and have a freshly generated plugin ready for you to play with in {kib}'s `plugins` folder.
 
@@ -20,7 +20,7 @@ We recommend that you kick-start your plugin by generating it with the {kib-repo
 node scripts/generate_plugin my_plugin_name # replace "my_plugin_name" with your desired plugin name
 -----------
 
-[float]
+[discrete]
 === Plugin location
 
 The {kib} directory must be named `kibana`, and your plugin directory should be located in the root of `kibana` in a `plugins` directory, for example:
@@ -37,6 +37,6 @@ The {kib} directory must be named `kibana`, and your plugin directory should be
 * <<external-plugin-functional-tests>>
 * <<external-plugin-localization>>
 
-include::external-plugin-functional-tests.asciidoc[]
+include::external-plugin-functional-tests.asciidoc[leveloffset=+1]
 
-include::external-plugin-localization.asciidoc[]
+include::external-plugin-localization.asciidoc[leveloffset=+1]
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.embeddable.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.embeddable.md
new file mode 100644
index 0000000000000..027ae4209b77f
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.embeddable.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [ApplyGlobalFilterActionContext](./kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.md) &gt; [embeddable](./kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.embeddable.md)
+
+## ApplyGlobalFilterActionContext.embeddable property
+
+<b>Signature:</b>
+
+```typescript
+embeddable?: IEmbeddable;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.filters.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.filters.md
new file mode 100644
index 0000000000000..6d1d20580fb19
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.filters.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [ApplyGlobalFilterActionContext](./kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.md) &gt; [filters](./kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.filters.md)
+
+## ApplyGlobalFilterActionContext.filters property
+
+<b>Signature:</b>
+
+```typescript
+filters: Filter[];
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.md
new file mode 100644
index 0000000000000..62817cd0a1e33
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.md
@@ -0,0 +1,20 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [ApplyGlobalFilterActionContext](./kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.md)
+
+## ApplyGlobalFilterActionContext interface
+
+<b>Signature:</b>
+
+```typescript
+export interface ApplyGlobalFilterActionContext 
+```
+
+## Properties
+
+|  Property | Type | Description |
+|  --- | --- | --- |
+|  [embeddable](./kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.embeddable.md) | <code>IEmbeddable</code> |  |
+|  [filters](./kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.filters.md) | <code>Filter[]</code> |  |
+|  [timeFieldName](./kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.timefieldname.md) | <code>string</code> |  |
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.timefieldname.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.timefieldname.md
new file mode 100644
index 0000000000000..a5cf58018ec65
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.timefieldname.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [ApplyGlobalFilterActionContext](./kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.md) &gt; [timeFieldName](./kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.timefieldname.md)
+
+## ApplyGlobalFilterActionContext.timeFieldName property
+
+<b>Signature:</b>
+
+```typescript
+timeFieldName?: string;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.md
index 4852ad15781c7..db41936f35cca 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.md
@@ -48,6 +48,7 @@
 |  Interface | Description |
 |  --- | --- |
 |  [AggParamOption](./kibana-plugin-plugins-data-public.aggparamoption.md) |  |
+|  [ApplyGlobalFilterActionContext](./kibana-plugin-plugins-data-public.applyglobalfilteractioncontext.md) |  |
 |  [DataPublicPluginSetup](./kibana-plugin-plugins-data-public.datapublicpluginsetup.md) |  |
 |  [DataPublicPluginStart](./kibana-plugin-plugins-data-public.datapublicpluginstart.md) |  |
 |  [EsQueryConfig](./kibana-plugin-plugins-data-public.esqueryconfig.md) |  |
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.plugin.setup.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.plugin.setup.md
index 7bae595e75ad0..a0c9b38792825 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.plugin.setup.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.plugin.setup.md
@@ -7,14 +7,14 @@
 <b>Signature:</b>
 
 ```typescript
-setup(core: CoreSetup, { expressions, uiActions, usageCollection }: DataSetupDependencies): DataPublicPluginSetup;
+setup(core: CoreSetup<DataStartDependencies, DataPublicPluginStart>, { expressions, uiActions, usageCollection }: DataSetupDependencies): DataPublicPluginSetup;
 ```
 
 ## Parameters
 
 |  Parameter | Type | Description |
 |  --- | --- | --- |
-|  core | <code>CoreSetup</code> |  |
+|  core | <code>CoreSetup&lt;DataStartDependencies, DataPublicPluginStart&gt;</code> |  |
 |  { expressions, uiActions, usageCollection } | <code>DataSetupDependencies</code> |  |
 
 <b>Returns:</b>
diff --git a/docs/user/alerting/action-types.asciidoc b/docs/user/alerting/action-types.asciidoc
index e8dcf689df8e4..1743edb10f92b 100644
--- a/docs/user/alerting/action-types.asciidoc
+++ b/docs/user/alerting/action-types.asciidoc
@@ -23,6 +23,10 @@ a| <<server-log-action-type, ServerLog>>
 
 | Add a message to a Kibana log.
 
+a| <<servicenow-action-type, ServiceNow>>
+
+| Push or update data to a new incident in ServiceNow.
+
 a| <<slack-action-type, Slack>>
 
 | Send a message to a Slack channel or user.
@@ -55,3 +59,4 @@ include::action-types/server-log.asciidoc[]
 include::action-types/slack.asciidoc[]
 include::action-types/webhook.asciidoc[]
 include::action-types/pre-configured-connectors.asciidoc[]
+include::action-types/servicenow.asciidoc[]
diff --git a/docs/user/alerting/action-types/servicenow.asciidoc b/docs/user/alerting/action-types/servicenow.asciidoc
new file mode 100644
index 0000000000000..32f828aea2357
--- /dev/null
+++ b/docs/user/alerting/action-types/servicenow.asciidoc
@@ -0,0 +1,72 @@
+[role="xpack"]
+[[servicenow-action-type]]
+=== ServiceNow action
+
+The ServiceNow action type uses the https://developer.servicenow.com/app.do#!/rest_api_doc?v=orlando&id=c_TableAPI[V2 Table API] to create ServiceNow incidents.
+
+[float]
+[[servicenow-connector-configuration]]
+==== Connector configuration
+
+ServiceNow connectors have the following configuration properties:
+
+Name::      The name of the connector. The name is used to identify a  connector in the management UI connector listing, or in the connector list when configuring an action.
+URL::       ServiceNow instance URL.
+Username::  Username for HTTP Basic authentication.
+Password::  Password for HTTP Basic authentication.
+
+[float]
+[[Preconfigured-servicenow-configuration]]
+==== Preconfigured action type
+
+[source,text]
+--
+ my-servicenow:
+   name: preconfigured-servicenow-action-type
+   actionTypeId: .servicenow
+   config:
+     apiUrl: https://dev94428.service-now.com/
+   secrets:
+     username: testuser
+     password: passwordkeystorevalue
+--
+
+`config` defines the action type specific to the configuration and contains the following properties:
+
+[cols="2*<"]
+|===
+
+| `apiUrl`
+| An address that corresponds to *Sender*.
+
+|===
+
+`secrets` defines sensitive information for the action type:
+
+[cols="2*<"]
+|===
+
+| `username`
+| A string that corresponds to *User*.
+
+| `password`
+| A string that corresponds to *Password*. Should be stored in the <<creating-keystore, {kib} keystore>>.
+
+|===
+
+[[servicenow-action-configuration]]
+==== Action configuration
+
+ServiceNow actions have the following configuration properties:
+
+Urgency::              The extent to which the incident resolution can delay.
+Severity::             The severity of the incident.
+Impact::               The effect an incident has on business. Can be measured by the number of affected users or by how critical it is to the business in question.
+Short description::    A short description of the incident, used for searching the contents of the knowledge base. 
+Description::          The details about the incident.
+Additional comments::  Additional information for the client, such as how to troubleshoot the issue.
+
+[[configuring-servicenow]]
+==== Configuring and testing ServiceNow
+
+ServiceNow offers free https://developer.servicenow.com/dev.do#!/guides/madrid/now-platform/pdi-guide/obtaining-a-pdi[Personal Developer Instances], which you can use to test incidents.
diff --git a/docs/user/ml/images/ml-annotations-list.jpg b/docs/user/ml/images/ml-annotations-list.jpg
deleted file mode 100644
index 8b1194dd20c0f..0000000000000
Binary files a/docs/user/ml/images/ml-annotations-list.jpg and /dev/null differ
diff --git a/docs/user/ml/images/ml-annotations-list.png b/docs/user/ml/images/ml-annotations-list.png
new file mode 100644
index 0000000000000..f1a0b66241126
Binary files /dev/null and b/docs/user/ml/images/ml-annotations-list.png differ
diff --git a/docs/user/ml/images/ml-job-management.jpg b/docs/user/ml/images/ml-job-management.jpg
deleted file mode 100644
index efdf7923c0faa..0000000000000
Binary files a/docs/user/ml/images/ml-job-management.jpg and /dev/null differ
diff --git a/docs/user/ml/images/ml-job-management.png b/docs/user/ml/images/ml-job-management.png
new file mode 100644
index 0000000000000..4589c7093a7cf
Binary files /dev/null and b/docs/user/ml/images/ml-job-management.png differ
diff --git a/docs/user/ml/images/ml-settings.jpg b/docs/user/ml/images/ml-settings.jpg
deleted file mode 100644
index 3713be005924d..0000000000000
Binary files a/docs/user/ml/images/ml-settings.jpg and /dev/null differ
diff --git a/docs/user/ml/images/ml-settings.png b/docs/user/ml/images/ml-settings.png
new file mode 100644
index 0000000000000..f5c9fca647389
Binary files /dev/null and b/docs/user/ml/images/ml-settings.png differ
diff --git a/docs/user/ml/images/ml-single-metric-viewer.jpg b/docs/user/ml/images/ml-single-metric-viewer.jpg
deleted file mode 100644
index 2fbb9387d1e29..0000000000000
Binary files a/docs/user/ml/images/ml-single-metric-viewer.jpg and /dev/null differ
diff --git a/docs/user/ml/images/ml-single-metric-viewer.png b/docs/user/ml/images/ml-single-metric-viewer.png
new file mode 100644
index 0000000000000..04c21d9bc533a
Binary files /dev/null and b/docs/user/ml/images/ml-single-metric-viewer.png differ
diff --git a/docs/user/ml/images/outliers.png b/docs/user/ml/images/outliers.png
index 3f4c5f6c6bbf0..874ebbc79201c 100644
Binary files a/docs/user/ml/images/outliers.png and b/docs/user/ml/images/outliers.png differ
diff --git a/docs/user/ml/index.asciidoc b/docs/user/ml/index.asciidoc
index 1bc74ce87de08..214dae2b96e04 100644
--- a/docs/user/ml/index.asciidoc
+++ b/docs/user/ml/index.asciidoc
@@ -47,20 +47,20 @@ create {anomaly-jobs} and manage jobs and {dfeeds} from the *Job Management*
 pane: 
 
 [role="screenshot"]
-image::user/ml/images/ml-job-management.jpg[Job Management]
+image::user/ml/images/ml-job-management.png[Job Management]
 
 You can use the *Settings* pane to create and edit 
 {ml-docs}/ml-calendars.html[calendars] and the filters that are used in 
 {ml-docs}/ml-rules.html[custom rules]:
 
 [role="screenshot"]
-image::user/ml/images/ml-settings.jpg[Calendar Management]
+image::user/ml/images/ml-settings.png[Calendar Management]
 
 The *Anomaly Explorer* and *Single Metric Viewer* display the results of your
 {anomaly-jobs}. For example:
 
 [role="screenshot"]
-image::user/ml/images/ml-single-metric-viewer.jpg[Single Metric Viewer]
+image::user/ml/images/ml-single-metric-viewer.png[Single Metric Viewer]
 
 You can optionally add annotations by drag-selecting a period of time in
 the *Single Metric Viewer* and adding a description. For example, you can add an
@@ -68,7 +68,7 @@ explanation for anomalies in that time period or provide notes about what is
 occurring in your operational environment at that time:
 
 [role="screenshot"]
-image::user/ml/images/ml-annotations-list.jpg[Single Metric Viewer with annotations]
+image::user/ml/images/ml-annotations-list.png[Single Metric Viewer with annotations]
 
 In some circumstances, annotations are also added automatically. For example, if
 the {anomaly-job} detects that there is missing data, it annotates the affected 
@@ -94,8 +94,8 @@ The Elastic {ml} {dfanalytics} feature enables you to analyze your data using
 indices that contain the results alongside your source data. 
 
 If you have a license that includes the {ml-features}, you can create
-{dfanalytics-jobs} and view their results on the *Analytics* page
-in {kib}. For example:
+{dfanalytics-jobs} and view their results on the *Data Frame Analytics* page in
+{kib}. For example:
 
 [role="screenshot"]
 image::user/ml/images/outliers.png[{oldetection-cap} results in {kib}]
diff --git a/docs/visualize/images/vega_lite_tutorial_1.png b/docs/visualize/images/vega_lite_tutorial_1.png
new file mode 100644
index 0000000000000..4e8d0aba3635b
Binary files /dev/null and b/docs/visualize/images/vega_lite_tutorial_1.png differ
diff --git a/docs/visualize/images/vega_lite_tutorial_2.png b/docs/visualize/images/vega_lite_tutorial_2.png
new file mode 100644
index 0000000000000..523ae91514a11
Binary files /dev/null and b/docs/visualize/images/vega_lite_tutorial_2.png differ
diff --git a/docs/visualize/images/vega_tutorial_3.png b/docs/visualize/images/vega_tutorial_3.png
new file mode 100644
index 0000000000000..e025ecc585807
Binary files /dev/null and b/docs/visualize/images/vega_tutorial_3.png differ
diff --git a/docs/visualize/images/vega_tutorial_4.png b/docs/visualize/images/vega_tutorial_4.png
new file mode 100644
index 0000000000000..c8ee311e9bf5e
Binary files /dev/null and b/docs/visualize/images/vega_tutorial_4.png differ
diff --git a/docs/visualize/vega.asciidoc b/docs/visualize/vega.asciidoc
index 24bd3a44bebba..3a1c57da93f07 100644
--- a/docs/visualize/vega.asciidoc
+++ b/docs/visualize/vega.asciidoc
@@ -3,71 +3,1287 @@
 
 experimental[]
 
-Build custom visualizations from multiple data sources using Vega
-and Vega-Lite.
+Build custom visualizations using Vega and Vega-Lite, backed by one or more
+data sources including {es}, Elastic Map Service, URL,
+or static data. Use the {kib} extensions to Vega to embed Vega into
+your dashboard, and to add interactivity to the visualizations.
 
-* *Vega* &mdash; A declarative format to create visualizations using JSON.
-  Generate interactive displays using D3.
+Vega and Vega-Lite are both declarative formats to create visualizations
+using JSON. Both use a different syntax for declaring visualizations,
+and are not fully interchangeable.
 
-* *Vega-Lite* &mdash; An easier format to use than Vega that enables more rapid
-  data analysis. Compiles into Vega.
+[float]
+[[when-to-vega]]
+=== When to use Vega
 
-For more information about Vega and Vega-Lite, refer to
-<<vega-useful-links, Resources and examples>>.
+Vega and Vega-Lite are capable of building most of the visualizations
+that {kib} provides, but with higher complexity. The most common reason
+to use Vega in {kib} is that {kib} is missing support for the query or
+visualization, for example:
 
-[float]
-[[create-vega-viz]]
-=== Create Vega visualizations
+* Aggregations using the `nested` or `parent/child` mapping
+* Aggregations without a {kib} index pattern
+* Queries using custom time filters
+* Complex calculations
+* Extracting data from _source instead of aggregation
+* Scatter charts
+* Sankey charts
+* Custom maps
+* Using a visual theme that {kib} does not provide
+
+[[vega-lite-tutorial]]
+=== Tutorial: First visualization in Vega-Lite
 
-You create Vega visualizations by using the text editor, which is
-preconfigured with the options you need.
+In this tutorial, you will learn about how to edit Vega-Lite in {kib} to create
+a stacked area chart from an {es} search query. It will give you a starting point
+for a more comprehensive
+https://vega.github.io/vega-lite/tutorials/getting_started.html[introduction to Vega-Lite],
+while only covering the basics.
+
+In this tutorial, you will build a stacked area chart from one of the {kib} sample data
+sets.
 
 [role="screenshot"]
-image::images/vega_lite_default.png[]
+image::visualize/images/vega_lite_tutorial_1.png[]
 
-[float]
-[[vega-schema]]
-==== Change the Vega version
+Before beginning this tutorial, install the <<add-sample-data, eCommerce sample data>>
+set.
+
+When you first open the Vega editor in {kib}, you will see a pre-populated
+line chart which shows the total number of documents across all your indices
+within the time range.
 
-The default visualization uses Vega-Lite version 2. To use Vega version 4, edit
-the `schema`.
+[role="screenshot"]
+image::visualize/images/vega_lite_default.png[]
+
+The text editor contains a Vega-Lite spec written in https://hjson.github.io/[HJSON],
+which is similar to JSON but optimized for human editing. HJSON supports:
 
-Go to `$schema`, enter `https://vega.github.io/schema/vega/v5.json`, then click
-*Update*.
+* Comments using // or /* syntax
+* Object keys without quotes
+* String values without quotes
+* Optional commas
+* Double or single quotes
+* Multiline strings
 
 [float]
-[[vega-type]]
-==== Change the visualization type
+==== Small steps
 
-The default visualization is a line chart. To change the visualization type,
-change the `mark` value. The supported visualization types are listed in the
-text editor.
+Always work on Vega in the smallest steps possible, and save your work frequently.
+Small changes will cause unexpected results. Click the "Save" button now.
 
-Go to `mark`, change the value to a different visualization type, then click
-*Update*.
+The first step is to change the index to one of the <<add-sample-data, sample data>>
+sets. Change
+
+```yaml
+index: _all
+```
+
+to:
+
+```yaml
+index: kibana_sample_data_ecommerce
+```
+
+Click "Update". The result is probably not what you expect. You should see a flat
+line with 0 results.
+
+You've only changed the index, so the difference must be the query is returning
+no results. You can try the <<vega-browser-debugging-console, Vega debugging process>>,
+but intuition may be faster for this particular problem.
+
+In this case, the problem is that you are querying the field `@timestamp`,
+which does not exist in the `kibana_sample_data_ecommerce` data. Find and replace
+`@timestamp` with `order_date`. This fixes the problem, leaving you with this spec:
+
+.Expand Vega-Lite spec
+[%collapsible%closed]
+====
+[source,yaml]
+----
+{
+  $schema: https://vega.github.io/schema/vega-lite/v4.json
+  title: Event counts from ecommerce
+  data: {
+    url: {
+      %context%: true
+      %timefield%: order_date
+      index: kibana_sample_data_ecommerce
+      body: {
+        aggs: {
+          time_buckets: {
+            date_histogram: {
+              field: order_date
+              interval: {%autointerval%: true}
+              extended_bounds: {
+                min: {%timefilter%: "min"}
+                max: {%timefilter%: "max"}
+              }
+              min_doc_count: 0
+            }
+          }
+        }
+        size: 0
+      }
+    }
+    format: {property: "aggregations.time_buckets.buckets" }
+  }
+
+  mark: line
+
+  encoding: {
+    x: {
+      field: key
+      type: temporal
+      axis: { title: null }
+    }
+    y: {
+      field: doc_count
+      type: quantitative
+      axis: { title: "Document count" }
+    }
+  }
+}
+----
+
+====
+
+Now, let's make the visualization more interesting by adding another aggregation
+to create a stacked area chart. To verify that you have constructed the right
+query, it is easiest to use the {kib} Dev Tools in a separate tab from the
+Vega editor. Open the Dev Tools from the Management section of the navigation.
+
+This query is roughly equivalent to the one that is used in the default
+Vega-Lite spec. Copy it into the Dev Tools:
+
+```js
+POST kibana_sample_data_ecommerce/_search
+{
+  "query": {
+    "range": {
+      "order_date": {
+        "gte": "now-7d"
+      }
+    }
+  },
+  "aggs": {
+    "time_buckets": {
+      "date_histogram": {
+        "field": "order_date",
+        "fixed_interval": "1d",
+        "extended_bounds": {
+          "min": "now-7d"
+        },
+        "min_doc_count": 0
+      }
+    }
+  },
+  "size": 0
+}
+```
+
+There's not enough data to create a stacked bar in the original query, so we
+will add a new
+{ref}/search-aggregations-bucket-terms-aggregation.html[terms aggregation]:
+
+```js
+POST kibana_sample_data_ecommerce/_search
+{
+  "query": {
+    "range": {
+      "order_date": {
+        "gte": "now-7d"
+      }
+    }
+  },
+  "aggs": {
+    "categories": {
+      "terms": { "field": "category.keyword" },
+      "aggs": {
+        "time_buckets": {
+          "date_histogram": {
+            "field": "order_date",
+            "fixed_interval": "1d",
+            "extended_bounds": {
+              "min": "now-7d"
+            },
+            "min_doc_count": 0
+          }
+        }
+      }
+    }
+  },
+  "size": 0
+}
+```
+
+You'll see that the response format looks different from the previous query:
+
+```json
+{
+  "aggregations" : {
+    "categories" : {
+      "doc_count_error_upper_bound" : 0,
+      "sum_other_doc_count" : 0,
+      "buckets" : [{
+        "key" : "Men's Clothing",
+        "doc_count" : 1661,
+        "time_buckets" : {
+          "buckets" : [{
+            "key_as_string" : "2020-06-30T00:00:00.000Z",
+            "key" : 1593475200000,
+            "doc_count" : 19
+          }, {
+            "key_as_string" : "2020-07-01T00:00:00.000Z",
+            "key" : 1593561600000,
+            "doc_count" : 71
+          }]
+        }
+      }]
+    }
+  }
+}
+```
+
+Now that we have data that we're happy with, it's time to convert from an
+isolated {es} query into a query with {kib} integration. Looking at the
+<<vega-queries, reference for writing {es} queries in Vega>>, you will
+see the full list of special tokens that are used in this query, such
+as `%context: true`. This query has also replaced `"fixed_interval": "1d"`
+with `interval: {%autointerval%: true}`. Copy the final query into
+your spec:
+
+```yaml
+  data: {
+    url: {
+      %context%: true
+      %timefield%: order_date
+      index: kibana_sample_data_ecommerce
+      body: {
+        aggs: {
+          categories: {
+            terms: { field: "category.keyword" }
+            aggs: {
+              time_buckets: {
+                date_histogram: {
+                  field: order_date
+                  interval: {%autointerval%: true}
+                  extended_bounds: {
+                    min: {%timefilter%: "min"}
+                    max: {%timefilter%: "max"}
+                  }
+                  min_doc_count: 0
+                }
+              }
+            }
+          }
+        }
+        size: 0
+      }
+    }
+    format: {property: "aggregations.categories.buckets" }
+  }
+```
+
+If you copy and paste that into your Vega-Lite spec, and click "Update",
+you will see a warning saying `Infinite extent for field "key": [Infinity, -Infinity]`.
+Let's use our <<vega-browser-debugging-console, Vega debugging skills>> to understand why.
+
+Vega-Lite generates data using the names `source_0` and `data_0`. `source_0` contains
+the results from the {es} query, and `data_0` contains the visually encoded results
+which are shown in the chart. To debug this problem, you need to compare both.
+
+To look at the source, open the browser dev tools console and type
+`VEGA_DEBUG.view.data('source_0')`. You will see:
+
+```js
+[{
+  doc_count: 454
+  key: "Men's Clothing"
+  time_buckets: {buckets: Array(57)}
+  Symbol(vega_id): 12822
+}, ...]
+```
+
+To compare to the visually encoded data, open the browser dev tools console and type
+`VEGA_DEBUG.view.data('data_0')`. You will see:
+
+```js
+[{
+  doc_count: 454
+  key: NaN
+  time_buckets: {buckets: Array(57)}
+  Symbol(vega_id): 13879
+}]
+```
+
+The issue seems to be that the `key` property is not being converted the right way,
+which makes sense because the `key` is now `Men's Clothing` instead of a timestamp.
+
+To fix this, try updating the `encoding` of your Vega-Lite spec to:
+
+```yaml
+  encoding: {
+    x: {
+      field: time_buckets.buckets.key
+      type: temporal
+      axis: { title: null }
+    }
+    y: {
+      field: time_buckets.buckets.doc_count
+      type: quantitative
+      axis: { title: "Document count" }
+    }
+  }
+```
+
+This will show more errors, and you can inspect `VEGA_DEBUG.view.data('data_0')` to
+understand why. This now shows:
+
+```js
+[{
+  doc_count: 454
+  key: "Men's Clothing"
+  time_buckets: {buckets: Array(57)}
+  time_buckets.buckets.doc_count: undefined
+  time_buckets.buckets.key: null
+  Symbol(vega_id): 14094
+}]
+```
+
+It looks like the problem is that the `time_buckets` inner array is not being
+extracted by Vega. The solution is to use a Vega-lite
+https://vega.github.io/vega-lite/docs/flatten.html[flatten transformation], available in {kib} 7.9 and later.
+If using an older version of Kibana, the flatten transformation is available in Vega
+but not Vega-Lite.
+
+Add this section in between the `data` and `encoding` section:
+
+```yaml
+  transform: [{
+    flatten: ["time_buckets.buckets"]
+  }]
+```
+
+This does not yet produce the results you expect. Inspect the transformed data
+by typing `VEGA_DEBUG.view.data('data_0')` into the console again:
+
+```js
+[{
+  doc_count: 453
+  key: "Men's Clothing"
+  time_bucket.buckets.doc_count: undefined
+  time_buckets: {buckets: Array(57)}
+  time_buckets.buckets: {
+    key_as_string: "2020-06-30T15:00:00.000Z",
+    key: 1593529200000,
+    doc_count: 2
+  }
+  time_buckets.buckets.key: null
+  Symbol(vega_id): 21564
+}]
+```
+
+The debug view shows `undefined` values where you would expect to see numbers, and
+the cause is that there are duplicate names which are confusing Vega-Lite. This can
+be fixed by making this change to the `transform` and `encoding` blocks:
+
+```yaml
+  transform: [{
+    flatten: ["time_buckets.buckets"],
+    as: ["buckets"]
+  }]
+
+  mark: area
+
+  encoding: {
+    x: {
+      field: buckets.key
+      type: temporal
+      axis: { title: null }
+    }
+    y: {
+      field: buckets.doc_count
+      type: quantitative
+      axis: { title: "Document count" }
+    }
+    color: {
+      field: key
+      type: nominal
+    }
+  }
+```
+
+At this point, you have a stacked area chart that shows the top categories,
+but the chart is still missing some common features that we expect from a {kib}
+visualization. Let's add hover states and tooltips next.
+
+Hover states are handled differently in Vega-Lite and Vega. In Vega-Lite this is
+done using a concept called `selection`, which has many permutations that are not
+covered in this tutorial. We will be adding a simple tooltip and hover state.
+
+Because {kib} has enabled the https://vega.github.io/vega-lite/docs/tooltip.html[Vega tooltip plugin],
+tooltips can be defined in several ways:
+
+* Automatic tooltip based on the data, via `{ content: "data" }`
+* Array of fields, like `[{ field: "key", type: "nominal" }]`
+* Defining a custom Javascript object using the `calculate` transform
+
+For the simple tooltip, add this to your encoding:
+
+```yaml
+  encoding: {
+    tooltip: [{
+      field: buckets.key
+      type: temporal
+      title: "Date"
+    }, {
+      field: key
+      type: nominal
+      title: "Category"
+    }, {
+      field: buckets.doc_count
+      type: quantitative
+      title: "Count"
+    }]
+  }
+```
+
+As you hover over the area series in your chart, a multi-line tooltip will
+appear, but it won't indicate the nearest point that it's pointing to. To
+indicate the nearest point, we need to add a second layer.
+
+The first step is to remove the `mark: area` from your visualization.
+Once you've removed the previous mark, add a composite mark at the end of
+the Vega-Lite spec:
+
+```yaml
+  layer: [{
+    mark: area
+  }, {
+    mark: point
+  }]
+```
+
+You'll see that the points are not appearing to line up with the area chart,
+and the reason is that the points are not being stacked. Change your Y encoding
+to this:
+
+```yaml
+    y: {
+      field: buckets.doc_count
+      type: quantitative
+      axis: { title: "Document count" }
+      stack: true
+    }
+```
+
+Now, we will add a `selection` block inside the point mark:
+
+```yaml
+  layer: [{
+    mark: area
+  }, {
+    mark: point
+    
+    selection: {
+      pointhover: {
+        type: single
+        on: mouseover
+        clear: mouseout
+        empty: none
+        fields: ["buckets.key", "key"]
+        nearest: true
+      }
+    }
+
+    encoding: {
+      size: {
+        condition: {
+          selection: pointhover
+          value: 100
+        }
+        value: 5
+      }
+      fill: {
+        condition: {
+          selection: pointhover
+          value: white
+        }
+      }
+    }
+  }]
+```
+
+Now that you've enabled a selection, try moving the mouse around the visualization
+and seeing the points respond to the nearest position:
+
+[role="screenshot"]
+image::visualize/images/vega_lite_tutorial_2.png[]
+
+The final result of this tutorial is this spec:
+
+.Expand final Vega-Lite spec
+[%collapsible%closed]
+====
+[source,yaml]
+----
+{
+  $schema: https://vega.github.io/schema/vega-lite/v4.json
+  title: Event counts from ecommerce
+  data: {
+    url: {
+      %context%: true
+      %timefield%: order_date
+      index: kibana_sample_data_ecommerce
+      body: {
+        aggs: {
+          categories: {
+            terms: { field: "category.keyword" }
+            aggs: {
+              time_buckets: {
+                date_histogram: {
+                  field: order_date
+                  interval: {%autointerval%: true}
+                  extended_bounds: {
+                    min: {%timefilter%: "min"}
+                    max: {%timefilter%: "max"}
+                  }
+                  min_doc_count: 0
+                }
+              }
+            }
+          }
+        }
+        size: 0
+      }
+    }
+    format: {property: "aggregations.categories.buckets" }
+  }
+  
+  transform: [{
+    flatten: ["time_buckets.buckets"]
+    as: ["buckets"]
+  }]
+
+  encoding: {
+    x: {
+      field: buckets.key
+      type: temporal
+      axis: { title: null }
+    }
+    y: {
+      field: buckets.doc_count
+      type: quantitative
+      axis: { title: "Document count" }
+      stack: true
+    }
+    color: {
+      field: key
+      type: nominal
+      title: "Category"
+    }
+    tooltip: [{
+      field: buckets.key
+      type: temporal
+      title: "Date"
+    }, {
+      field: key
+      type: nominal
+      title: "Category"
+    }, {
+      field: buckets.doc_count
+      type: quantitative
+      title: "Count"
+    }]
+  }
+  
+  layer: [{
+    mark: area
+  }, {
+    mark: point
+    
+    selection: {
+      pointhover: {
+        type: single
+        on: mouseover
+        clear: mouseout
+        empty: none
+        fields: ["buckets.key", "key"]
+        nearest: true
+      }
+    }
+
+    encoding: {
+      size: {
+        condition: {
+          selection: pointhover
+          value: 100
+        }
+        value: 5
+      }
+      fill: {
+        condition: {
+          selection: pointhover
+          value: white
+        }
+      }
+    }
+  }]
+}
+----
+
+====
+
+[[vega-tutorial]]
+=== Tutorial: Updating {kib} filters from Vega
+
+In this tutorial you will build an area chart in Vega using an {es} search query,
+and add a click handler and drag handler to update {kib} filters.
+This tutorial is not a full https://vega.github.io/vega/tutorials/[Vega tutorial],
+but will cover the basics of creating Vega visualizations into {kib}.
+
+First, create an almost-blank Vega chart by pasting this into the editor:
+
+```yaml
+{
+  $schema: "https://vega.github.io/schema/vega/v5.json"
+  data: [{
+    name: source_0
+  }]
+  
+  scales: [{
+    name: x
+    type: time
+    range: width
+  }, {
+    name: y
+    type: linear
+    range: height
+  }]
+  
+  axes: [{
+    orient: bottom
+    scale: x
+  }, {
+    orient: left
+    scale: y
+  }]
+  
+  marks: [
+    {
+      type: area
+      from: {
+        data: source_0
+      }
+      encode: {
+        update: {
+        }
+      }
+    }
+  ]
+}
+```
+
+Despite being almost blank, this Vega spec still contains the minimum requirements:
+
+* Data
+* Scales
+* Marks
+* (optional) Axes
+
+Next, add a valid {es} search query in the `data` block:
+
+```yaml
+  data: [
+    {
+      name: source_0
+      url: {
+        %context%: true
+        %timefield%: order_date
+        index: kibana_sample_data_ecommerce
+        body: {
+          aggs: {
+            time_buckets: {
+              date_histogram: {
+                field: order_date
+                fixed_interval: "3h"
+                extended_bounds: {
+                  min: {%timefilter%: "min"}
+                  max: {%timefilter%: "max"}
+                }
+                min_doc_count: 0
+              }
+            }
+          }
+          size: 0
+        }
+      }
+      format: { property: "aggregations.time_buckets.buckets" }
+    }
+  ]
+```
+
+Click "Update", and nothing will change in the visualization. The first step
+is to change the X and Y scales based on the data:
+
+```yaml
+  scales: [{
+    name: x
+    type: time
+    range: width
+    domain: {
+      data: source_0
+      field: key
+    }
+  }, {
+    name: y
+    type: linear
+    range: height
+    domain: {
+      data: source_0
+      field: doc_count
+    }
+  }]
+```
+
+Click "Update", and you will see that the X and Y axes are now showing labels based
+on the real data.
+
+Next, encode the fields `key` and `doc_count` as the X and Y values:
+
+```yaml
+  marks: [
+    {
+      type: area
+      from: {
+        data: source_0
+      }
+      encode: {
+        update: {
+          x: {
+            scale: x
+            field: key
+          }
+          y: {
+            scale: y
+            value: 0
+          }
+          y2: {
+            scale: y
+            field: doc_count
+          }
+        }
+      }
+    }
+  ]
+```
+
+Click "Update" and you will get a basic area chart:
+
+[role="screenshot"]
+image::visualize/images/vega_tutorial_3.png[]
+
+Next, add a new block to the `marks` section. This will show clickable points to filter for a specific
+date:
+
+```yaml
+  {
+    name: point
+    type: symbol
+    style: ["point"]
+    from: {
+      data: source_0
+    }
+    encode: {
+      update: {
+        x: {
+          scale: x
+          field: key
+        }
+        y: {
+          scale: y
+          field: doc_count
+        }
+        size: {
+          value: 100
+        }
+        fill: {
+          value: black
+        }
+      }
+    }
+  }
+```
+
+Next, we will create a Vega signal to make the points clickable. You can access
+the clicked `datum` in the expression used to update. In this case, you want
+clicks on points to add a time filter with the 3-hour interval defined above.
+
+```yaml
+  signals: [
+    {
+      name: point_click
+      on: [{
+        events: {
+          source: scope
+          type: click
+          markname: point
+        }
+        update: '''kibanaSetTimeFilter(datum.key, datum.key + 3 * 60 * 60 * 1000)'''
+      }]
+    }
+  ]
+```
+
+This event is using the {kib} custom function `kibanaSetTimeFilter` to generate a filter that
+gets applied to the entire dashboard on click.
+
+The mouse cursor does not currently indicate that the chart is interactive. Find the `marks` section,
+and update the mark named `point` by adding `cursor: { value: "pointer" }` to
+the `encoding` section like this:
+
+```yaml
+  {
+    name: point
+    type: symbol
+    style: ["point"]
+    from: {
+      data: source_0
+    }
+    encode: {
+      update: {
+        ...
+        cursor: { value: "pointer" }
+      }
+    }
+  }
+```
+
+Next, we will add a drag interaction which will allow the user to narrow into
+a specific time range in the visualization. This will require adding more signals, and
+adding a rectangle overlay:
+
+[role="screenshot"]
+image::visualize/images/vega_tutorial_4.png[]
+
+The first step is to add a new `signal` to track the X position of the cursor:
+
+```yaml
+    {
+      name: currentX
+      value: -1
+      on: [{
+        events: {
+          type: mousemove
+          source: view
+        },
+        update: "clamp(x(), 0, width)"
+      }, {
+        events: {
+          type: mouseout
+          source: view
+        }
+        update: "-1"
+      }]
+    }
+```
+
+Now add a new `mark` to indicate the current cursor position:
+
+```yaml
+    {
+      type: rule
+      interactive: false
+      encode: {
+        update: {
+          y: {value: 0}
+          y2: {signal: "height"}
+          stroke: {value: "gray"}
+          strokeDash: {
+            value: [2, 1]
+          }
+          x: {signal: "max(currentX,0)"}
+          defined: {signal: "currentX > 0"}
+        }
+      }
+    }
+```
+
+Next, add a signal to track the current selected range, which will update
+until the user releases the mouse button or uses the escape key:
+
+
+```yaml
+    {
+      name: selected
+      value: [0, 0]
+      on: [{
+        events: {
+          type: mousedown
+          source: view
+        }
+        update: "[clamp(x(), 0, width), clamp(x(), 0, width)]"
+      }, {
+        events: {
+          type: mousemove
+          source: window
+          consume: true
+          between: [{
+            type: mousedown
+            source: view
+          }, {
+            merge: [{
+              type: mouseup
+              source: window
+            }, {
+              type: keydown
+              source: window
+              filter: "event.key === 'Escape'"
+            }]
+          }]
+        }
+        update: "[selected[0], clamp(x(), 0, width)]"
+      }, {
+        events: {
+          type: keydown
+          source: window
+          filter: "event.key === 'Escape'"
+        }
+        update: "[0, 0]"
+      }]
+    }
+```
+
+Now that there is a signal which tracks the time range from the user, we need to indicate
+the range visually by adding a new mark which only appears conditionally:
+
+```yaml
+    {
+      type: rect
+      name: selectedRect
+      encode: {
+        update: {
+          height: {signal: "height"}
+          fill: {value: "#333"}
+          fillOpacity: {value: 0.2}
+          x: {signal: "selected[0]"}
+          x2: {signal: "selected[1]"}
+          defined: {signal: "selected[0] !== selected[1]"}
+        }
+      }
+    }
+```
+
+Finally, add a new signal which will update the {kib} time filter when the mouse is released while
+dragging:
+
+```yaml
+    {
+      name: applyTimeFilter
+      value: null
+      on: [{
+        events: {
+          type: mouseup
+          source: view
+        }
+        update: '''selected[0] !== selected[1] ? kibanaSetTimeFilter(
+               invert('x',selected[0]),
+               invert('x',selected[1])) : null'''
+      }]
+    }
+```
+
+Putting this all together, your visualization now supports the main features of
+standard visualizations in {kib}, but with the potential to add even more control.
+The final Vega spec for this tutorial is here:
+
+.Expand final Vega spec
+[%collapsible%closed]
+====
+[source,yaml]
+----
+{
+  $schema: "https://vega.github.io/schema/vega/v5.json"
+  data: [
+    {
+      name: source_0
+      url: {
+        %context%: true
+        %timefield%: order_date
+        index: kibana_sample_data_ecommerce
+        body: {
+          aggs: {
+            time_buckets: {
+              date_histogram: {
+                field: order_date
+                fixed_interval: "3h"
+                extended_bounds: {
+                  min: {%timefilter%: "min"}
+                  max: {%timefilter%: "max"}
+                }
+                min_doc_count: 0
+              }
+            }
+          }
+          size: 0
+        }
+      }
+      format: { property: "aggregations.time_buckets.buckets" }
+    }
+  ]
+  
+  scales: [{
+    name: x
+    type: time
+    range: width
+    domain: {
+      data: source_0
+      field: key
+    }
+  }, {
+    name: y
+    type: linear
+    range: height
+    domain: {
+      data: source_0
+      field: doc_count
+    }
+  }]
+  
+  axes: [{
+    orient: bottom
+    scale: x
+  }, {
+    orient: left
+    scale: y
+  }]
+  
+  marks: [
+    {
+      type: area
+      from: {
+        data: source_0
+      }
+      encode: {
+        update: {
+          x: {
+            scale: x
+            field: key
+          }
+          y: {
+            scale: y
+            value: 0
+          }
+          y2: {
+            scale: y
+            field: doc_count
+          }
+        }
+      }
+    },
+    {
+      name: point
+      type: symbol
+      style: ["point"]
+      from: {
+        data: source_0
+      }
+      encode: {
+        update: {
+          x: {
+            scale: x
+            field: key
+          }
+          y: {
+            scale: y
+            field: doc_count
+          }
+          size: {
+            value: 100
+          }
+          fill: {
+            value: black
+          }
+          cursor: { value: "pointer" }
+        }
+      }
+    },
+    {
+      type: rule
+      interactive: false
+      encode: {
+        update: {
+          y: {value: 0}
+          y2: {signal: "height"}
+          stroke: {value: "gray"}
+          strokeDash: {
+            value: [2, 1]
+          }
+          x: {signal: "max(currentX,0)"}
+          defined: {signal: "currentX > 0"}
+        }
+      }
+    },
+    {
+      type: rect
+      name: selectedRect
+      encode: {
+        update: {
+          height: {signal: "height"}
+          fill: {value: "#333"}
+          fillOpacity: {value: 0.2}
+          x: {signal: "selected[0]"}
+          x2: {signal: "selected[1]"}
+          defined: {signal: "selected[0] !== selected[1]"}
+        }
+      }
+    }
+  ]
+  
+  signals: [
+    {
+      name: point_click
+      on: [{
+        events: {
+          source: scope
+          type: click
+          markname: point
+        }
+        update: '''kibanaSetTimeFilter(datum.key, datum.key + 3 * 60 * 60 * 1000)'''
+      }]
+    }
+    {
+      name: currentX
+      value: -1
+      on: [{
+        events: {
+          type: mousemove
+          source: view
+        },
+        update: "clamp(x(), 0, width)"
+      }, {
+        events: {
+          type: mouseout
+          source: view
+        }
+        update: "-1"
+      }]
+    }
+    {
+      name: selected
+      value: [0, 0]
+      on: [{
+        events: {
+          type: mousedown
+          source: view
+        }
+        update: "[clamp(x(), 0, width), clamp(x(), 0, width)]"
+      }, {
+        events: {
+          type: mousemove
+          source: window
+          consume: true
+          between: [{
+            type: mousedown
+            source: view
+          }, {
+            merge: [{
+              type: mouseup
+              source: window
+            }, {
+              type: keydown
+              source: window
+              filter: "event.key === 'Escape'"
+            }]
+          }]
+        }
+        update: "[selected[0], clamp(x(), 0, width)]"
+      }, {
+        events: {
+          type: keydown
+          source: window
+          filter: "event.key === 'Escape'"
+        }
+        update: "[0, 0]"
+      }]
+    }
+    {
+      name: applyTimeFilter
+      value: null
+      on: [{
+        events: {
+          type: mouseup
+          source: view
+        }
+        update: '''selected[0] !== selected[1] ? kibanaSetTimeFilter(
+               invert('x',selected[0]),
+               invert('x',selected[1])) : null'''
+      }]
+    }
+  ]
+}
+
+----
+====
+
+[[vega-reference]]
+=== Reference for {kib} extensions
+
+{kib} has extended Vega and Vega-Lite with extensions that support:
+
+* Default height and width
+* Default theme to match {kib}
+* Writing {es} queries using the time range and filters from dashboards
+* Using the Elastic Map Service in Vega maps
+* Additional tooltip styling
+* Advanced setting to enable URL loading from any domain
+* Limited debugging support using the browser dev tools
+* (Vega only) Expression functions which can update the time range and dashboard filters
 
-[float]
 [[vega-sizing-and-positioning]]
-==== Change the layout
+==== Default height and width
 
 By default, Vega visualizations use the `autosize = { type: 'fit', contains: 'padding' }` layout.
 `fit` uses all available space, ignores `width` and `height` values,
 and respects the padding values. To override this behavior, change the
 `autosize` value.
 
-[[vega-querying-elasticsearch]]
-=== Query {es}
+[[vega-theme]]
+==== Default theme to match {kib}
+
+{kib} registers a default https://vega.github.io/vega/docs/schemes/[Vega color scheme]
+with the id `elastic`, and sets a default color for each `mark` type.
+Override it by providing a different `stroke`, `fill`, or `color` (Vega-Lite) value.
+
+[[vega-queries]]
+==== Writing {es} queries in Vega
+
+experimental[] {kib} extends the Vega https://vega.github.io/vega/docs/data/[data] elements
+with support for direct {es} queries specified as a `url`.
 
-experimental[] Vega https://vega.github.io/vega/docs/data/[data] elements
-use embedded and external data with a `"url"` parameter. {kib} adds support for
-direct {es} queries by overloading
-the `"url"` value.
+Because of this, {kib} is **unable to support dynamically loaded data**,
+which would otherwise work in Vega. All data is fetched before it's passed to
+the Vega renderer.
 
-NOTE: With Vega, you dynamically load your data by setting signals as data URLs.
-Since {kib} is unable to support dynamically loaded data, all data is fetched
-before it's passed to the Vega renderer.
+To define an {es} query in Vega, set the `url` to an object. {kib} will parse
+the object looking for special tokens that allow your query to integrate with {kib}.
+These tokens are:
 
-For example, count the number of documents in all indices:
+* `%context%: true`: Set at the top level, and replaces the `query` section with filters from dashboard
+* `%timefield%: <name>`: Set at the top level, integrates the query with the dashboard time filter
+* `{%timefilter%: true}`: Replaced by an {es} range query with upper and lower bounds
+* `{%timefilter%: "min" | "max"}`: Replaced only by the upper or lower bounds
+* `{%timefilter: true, shift: -1, unit: 'hour'}`: Generates a time range query one hour in the past
+* `{%autointerval%: true}`: Replaced by the string which contains the automatic {kib} time interval, such as `1h`
+* `{%autointerval%: 10}`: Replaced by a string which is approximately dividing the time into 10 ranges, allowing
+  you to influence the automatic interval
+* `"%dashboard_context-must_clause%"`: String replaced by object containing filters
+* `"%dashboard_context-filter_clause%"`: String replaced by an object containing filters
+* `"%dashboard_context-must_not_clause%"`: String replaced by an object containing filters
+
+Putting this together, an example query that counts the number of documents in 
+a specific index:
 
 [source,yaml]
 ----
@@ -80,8 +1296,8 @@ url: {
   %context%: true
 
   // Which indexes to search
-  index: _all
-  // The body element may contain "aggs" and "query" subfields
+  index: kibana_sample_data_logs
+  // The body element may contain "aggs" and "query" keys
   body: {
     aggs: {
       time_buckets: {
@@ -183,7 +1399,7 @@ except that the time range is shifted back by 10 minutes:
 }
 ----
 
-NOTE: When using `"%context%": true` or defining a value for "%timefield%"` the body cannot contain a query. To customize the query within the VEGA specification (e.g. add an additional filter, or shift the timefilter), define your query and use the placeholders as in the example above. The placeholders will be replaced by the actual context of the dashboard or visualization once parsed.
+NOTE: When using `"%context%": true` or defining a value for `"%timefield%"` the body cannot contain a query. To customize the query within the VEGA specification (e.g. add an additional filter, or shift the timefilter), define your query and use the placeholders as in the example above. The placeholders will be replaced by the actual context of the dashboard or visualization once parsed.
 
 The `"%timefilter%"` can also be used to specify a single min or max
 value. The date_histogram's `extended_bounds` can be set
@@ -194,6 +1410,7 @@ also supported. The `"interval"` can also be set dynamically, depending
 on the currently picked range: `"interval": {"%autointerval%": 10}` will
 try to get about 10-15 data points (buckets).
 
+[float]
 [[vega-esmfiles]]
 === Access Elastic Map Service files
 
@@ -260,21 +1477,44 @@ Additionally, you can use `latitude`, `longitude`, and `zoom` signals.
 These signals can be used in the graph, or can be updated to modify the
 position of the map.
 
-Vega visualization ignore the `autosize`, `width`, `height`, and `padding`
-values, using `fit` model with zero padding.
+[float]
+[[vega-tooltip]]
+==== Additional tooltip styling
+
+{kib} has installed the https://vega.github.io/vega-lite/docs/tooltip.html[Vega tooltip plugin],
+so tooltips can be defined in the ways documented there. Beyond that, {kib} also supports
+a configuration option for changing the tooltip position and padding:
+
+```js
+{
+  config: {
+    kibana: {
+      tooltips: {
+        position: 'top',
+        padding: 15
+      }
+    }
+  }
+}
+```
+
+[[vega-url-loading]]
+==== Advanced setting to enable URL loading from any domain
 
-[[vega-debugging]]
-=== Debugging Vega
+Vega can load data from any URL, but this is disabled by default in {kib}. 
+To change this, set `vis_type_vega.enableExternalUrls: true` in `kibana.yml`,
+then restart {kib}.
 
 [[vega-browser-debugging-console]]
 ==== Browser debugging console
 
 experimental[] Use browser debugging tools (for example, F12 or Ctrl+Shift+J in Chrome) to
 inspect the `VEGA_DEBUG` variable:
-+
+
 * `view` &mdash; Access to the Vega View object. See https://vega.github.io/vega/docs/api/debugging/[Vega Debugging Guide]
-on how to inspect data and signals at runtime. For Vega-Lite, `VEGA_DEBUG.view.data('source_0')` gets the main data set.
-For Vega, it uses the data name as defined in your Vega spec.
+on how to inspect data and signals at runtime. For Vega-Lite,
+`VEGA_DEBUG.view.data('source_0')` gets the pre-transformed data, and `VEGA_DEBUG.view.data('data_0')`
+gets the encoded data. For Vega, it uses the data name as defined in your Vega spec.
 
 * `vega_spec` &mdash; Vega JSON graph specification after some modifications by {kib}. In case
 of Vega-Lite, this is the output of the Vega-Lite compiler.
@@ -283,7 +1523,7 @@ of Vega-Lite, this is the output of the Vega-Lite compiler.
 Vega-Lite compilation.
 
 [[vega-data]]
-==== Data
+==== Debugging data
 
 experimental[] If you are using an {es} query, make sure your resulting data is
 what you expected. The easiest way to view it is by using the "networking"
@@ -294,45 +1534,52 @@ https://www.elastic.co/guide/en/kibana/current/console-kibana.html[Dev Tools]. P
 `GET <INDEX_NAME>/_search`, then add your query as the following lines
 (just the value of the `"query"` field).
 
-If you need to share your graph with someone, copy the
-raw data response to https://gist.github.com/[gist.github.com], possibly
-with a `.json` extension, use the `[raw]` button, and use that url
-directly in your graph.
+[[vega-getting-help]]
+==== Asking for help with a Vega spec
 
-To restrict Vega from using non-ES data sources, add `vega.enableExternalUrls: false`
-to your kibana.yml file.
+Because of the dynamic nature of the data in {es}, it is hard to help you with
+Vega specs unless you can share a dataset. To do this, use the browser developer
+tools and type:
 
-[[vega-notes]]
-[[vega-useful-links]]
-=== Resources and examples
+`JSON.stringify(VEGA_DEBUG.vegalite_spec, null, 2)`
 
-experimental[] To learn more about Vega and Vega-List, refer to the resources and examples.
+Copy the response to https://gist.github.com/[gist.github.com], possibly
+with a `.json` extension, use the `[raw]` button, and share that when
+asking for help.
 
-==== Vega editor
-The https://vega.github.io/editor/[Vega Editor] includes examples for Vega & Vega-Lite, but does not support any
-{kib}-specific features like {es} requests and interactive base maps.
+[float]
+[[vega-expression-functions]]
+==== (Vega only) Expression functions which can update the time range and dashboard filters
 
-==== Vega-Lite resources
-* https://vega.github.io/vega-lite/tutorials/getting_started.html[Tutorials]
-* https://vega.github.io/vega-lite/docs/[Docs]
-* https://vega.github.io/vega-lite/examples/[Examples]
+{kib} has extended the Vega expression language with these functions:
 
-==== Vega resources
-* https://vega.github.io/vega/tutorials/[Tutorials]
-* https://vega.github.io/vega/docs/[Docs]
-* https://vega.github.io/vega/examples/[Examples]
+```js
+/**
+  * @param {object} query Elastic Query DSL snippet, as used in the query DSL editor
+  * @param {string} [index] as defined in Kibana, or default if missing
+  */
+kibanaAddFilter(query, index)
 
-TIP: When you use the examples, you may
-need to modify the "data" section to use absolute URL. For example,
-replace `"url": "data/world-110m.json"` with
-`"url": "https://vega.github.io/editor/data/world-110m.json"`.
+/**
+  * @param {object} query Elastic Query DSL snippet, as used in the query DSL editor
+  * @param {string} [index] as defined in Kibana, or default if missing
+  */
+kibanaRemoveFilter(query, index)
+
+kibanaRemoveAllFilters()
 
+/**
+  * Update dashboard time filter to the new values
+  * @param {number|string|Date} start
+  * @param {number|string|Date} end
+  */
+kibanaSetTimeFilter(start, end)
+```
+
+[float]
 [[vega-additional-configuration-options]]
 ==== Additional configuration options
 
-These options are specific to the {kib}. link:#vega-with-a-map[Map support] has
-additional configuration options.
-
 [source,yaml]
 ----
 {
@@ -343,12 +1590,37 @@ additional configuration options.
       controlsLocation: top
       // Can be `vertical` or `horizontal` (default).
       controlsDirection: vertical
-      // If true, hides most of Vega and VegaLite warnings
+      // If true, hides most of Vega and Vega-Lite warnings
       hideWarnings: true
       // Vega renderer to use: `svg` or `canvas` (default)
       renderer: canvas
     }
   }
-  /* the rest of Vega code */
 }
 ----
+
+
+[[vega-notes]]
+[[vega-useful-links]]
+=== Resources and examples
+
+experimental[] To learn more about Vega and Vega-Lite, refer to the resources and examples.
+
+==== Vega editor
+The https://vega.github.io/editor/[Vega Editor] includes examples for Vega & Vega-Lite, but does not support any
+{kib}-specific features like {es} requests and interactive base maps.
+
+==== Vega-Lite resources
+* https://vega.github.io/vega-lite/tutorials/getting_started.html[Tutorials]
+* https://vega.github.io/vega-lite/docs/[Docs]
+* https://vega.github.io/vega-lite/examples/[Examples]
+
+==== Vega resources
+* https://vega.github.io/vega/tutorials/[Tutorials]
+* https://vega.github.io/vega/docs/[Docs]
+* https://vega.github.io/vega/examples/[Examples]
+
+TIP: When you use the examples in {kib}, you may
+need to modify the "data" section to use absolute URL. For example,
+replace `"url": "data/world-110m.json"` with
+`"url": "https://vega.github.io/editor/data/world-110m.json"`.
diff --git a/examples/routing_example/README.md b/examples/routing_example/README.md
new file mode 100644
index 0000000000000..0a88707bf70bb
--- /dev/null
+++ b/examples/routing_example/README.md
@@ -0,0 +1,9 @@
+Team owner: Platform
+
+A working example of a plugin that registers and uses multiple custom routes.
+
+Read more:
+
+- [IRouter API Docs](../../docs/development/core/server/kibana-plugin-core-server.irouter.md)
+- [HttpHandler (core.http.fetch) API Docs](../../docs/development/core/public/kibana-plugin-core-public.httphandler.md)
+- [Routing Conventions](../../STYLEGUIDE.md#api-endpoints)
\ No newline at end of file
diff --git a/examples/routing_example/common/index.ts b/examples/routing_example/common/index.ts
new file mode 100644
index 0000000000000..5aa47b1f69cdf
--- /dev/null
+++ b/examples/routing_example/common/index.ts
@@ -0,0 +1,27 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+export const RANDOM_NUMBER_ROUTE_PATH = '/api/random_number';
+
+export const RANDOM_NUMBER_BETWEEN_ROUTE_PATH = '/api/random_number_between';
+
+export const POST_MESSAGE_ROUTE_PATH = '/api/post_message';
+
+// Internal APIs should use the `internal` prefix, instead of the `api` prefix.
+export const INTERNAL_GET_MESSAGE_BY_ID_ROUTE = '/internal/get_message';
diff --git a/examples/routing_example/kibana.json b/examples/routing_example/kibana.json
new file mode 100644
index 0000000000000..37851a0da5a85
--- /dev/null
+++ b/examples/routing_example/kibana.json
@@ -0,0 +1,9 @@
+{
+  "id": "routingExample",
+  "version": "0.0.1",
+  "kibanaVersion": "kibana",
+  "server": true,
+  "ui": true,
+  "requiredPlugins": ["developerExamples"],
+  "optionalPlugins": []
+}
diff --git a/examples/routing_example/public/app.tsx b/examples/routing_example/public/app.tsx
new file mode 100644
index 0000000000000..3b33cb33ccb01
--- /dev/null
+++ b/examples/routing_example/public/app.tsx
@@ -0,0 +1,105 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import React from 'react';
+import ReactDOM from 'react-dom';
+import { AppMountParameters } from 'kibana/public';
+import {
+  EuiPage,
+  EuiPageBody,
+  EuiPageContent,
+  EuiText,
+  EuiHorizontalRule,
+  EuiPageContentHeader,
+  EuiListGroup,
+} from '@elastic/eui';
+import { RandomNumberRouteExample } from './random_number_example';
+import { RandomNumberBetweenRouteExample } from './random_number_between_example';
+import { Services } from './services';
+import { PostMessageRouteExample } from './post_message_example';
+import { GetMessageRouteExample } from './get_message_example';
+
+type Props = Services;
+
+function RoutingExplorer({
+  fetchRandomNumber,
+  fetchRandomNumberBetween,
+  addSuccessToast,
+  postMessage,
+  getMessageById,
+}: Props) {
+  return (
+    <EuiPage>
+      <EuiPageBody>
+        <EuiPageContent>
+          <EuiPageContentHeader>
+            <EuiText>
+              <h1>Routing examples</h1>
+            </EuiText>
+          </EuiPageContentHeader>
+          <EuiText>
+            <EuiListGroup
+              listItems={[
+                {
+                  label: 'IRouter API docs',
+                  href:
+                    'https://github.com/elastic/kibana/blob/master/docs/development/core/server/kibana-plugin-core-server.irouter.md',
+                  iconType: 'logoGithub',
+                  target: '_blank',
+                  size: 's',
+                },
+                {
+                  label: 'HttpHandler (core.http.fetch) API docs',
+                  href:
+                    'https://github.com/elastic/kibana/blob/master/docs/development/core/public/kibana-plugin-core-public.httphandler.md',
+                  iconType: 'logoGithub',
+                  target: '_blank',
+                  size: 's',
+                },
+                {
+                  label: 'Conventions',
+                  href: 'https://github.com/elastic/kibana/tree/master/STYLEGUIDE.md#api-endpoints',
+                  iconType: 'logoGithub',
+                  target: '_blank',
+                  size: 's',
+                },
+              ]}
+            />
+          </EuiText>
+          <EuiHorizontalRule />
+          <RandomNumberRouteExample fetchRandomNumber={fetchRandomNumber} />
+          <EuiHorizontalRule />
+          <RandomNumberBetweenRouteExample fetchRandomNumberBetween={fetchRandomNumberBetween} />
+
+          <EuiHorizontalRule />
+          <PostMessageRouteExample addSuccessToast={addSuccessToast} postMessage={postMessage} />
+
+          <EuiHorizontalRule />
+          <GetMessageRouteExample getMessageById={getMessageById} />
+        </EuiPageContent>
+      </EuiPageBody>
+    </EuiPage>
+  );
+}
+
+export const renderApp = (props: Props, element: AppMountParameters['element']) => {
+  ReactDOM.render(<RoutingExplorer {...props} />, element);
+
+  return () => ReactDOM.unmountComponentAtNode(element);
+};
diff --git a/examples/routing_example/public/get_message_example.tsx b/examples/routing_example/public/get_message_example.tsx
new file mode 100644
index 0000000000000..3c34326564d2b
--- /dev/null
+++ b/examples/routing_example/public/get_message_example.tsx
@@ -0,0 +1,96 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import React, { useCallback } from 'react';
+import { useState } from 'react';
+import {
+  EuiText,
+  EuiButton,
+  EuiLoadingSpinner,
+  EuiFieldText,
+  EuiCallOut,
+  EuiFormRow,
+} from '@elastic/eui';
+import { HttpFetchError } from '../../../src/core/public';
+import { isError } from './is_error';
+import { Services } from './services';
+
+interface Props {
+  getMessageById: Services['getMessageById'];
+}
+
+export function GetMessageRouteExample({ getMessageById }: Props) {
+  const [error, setError] = useState<HttpFetchError | undefined>();
+  const [isFetching, setIsFetching] = useState<boolean>(false);
+  const [message, setMessage] = useState<string>('');
+  const [id, setId] = useState<string>('');
+
+  const doFetch = useCallback(async () => {
+    if (isFetching) return;
+    setIsFetching(true);
+    const response = await getMessageById(id);
+
+    if (isError(response)) {
+      setError(response);
+      setMessage('');
+    } else {
+      setError(undefined);
+      setMessage(response);
+    }
+
+    setIsFetching(false);
+  }, [isFetching, getMessageById, setMessage, id]);
+
+  return (
+    <React.Fragment>
+      <EuiText>
+        <h2>GET example with param</h2>
+
+        <p>This examples uses a simple GET route that takes an id as a param in the route path.</p>
+        <EuiFormRow label="Message Id">
+          <EuiFieldText
+            value={id}
+            onChange={(e) => setId(e.target.value)}
+            data-test-subj="routingExampleGetMessageId"
+          />
+        </EuiFormRow>
+
+        <EuiFormRow hasEmptyLabelSpace={true}>
+          <EuiButton
+            data-test-subj="routingExampleFetchMessage"
+            disabled={isFetching || id === ''}
+            onClick={() => doFetch()}
+          >
+            {isFetching ? <EuiLoadingSpinner /> : 'Get message'}
+          </EuiButton>
+        </EuiFormRow>
+
+        {error !== undefined ? (
+          <EuiCallOut color="danger" iconType="alert">
+            {error.message}
+          </EuiCallOut>
+        ) : null}
+        {message !== '' ? (
+          <p>
+            Message is: <pre data-test-subj="routingExampleGetMessage">{message}</pre>
+          </p>
+        ) : null}
+      </EuiText>
+    </React.Fragment>
+  );
+}
diff --git a/examples/routing_example/public/index.ts b/examples/routing_example/public/index.ts
new file mode 100644
index 0000000000000..2bb703e71cbef
--- /dev/null
+++ b/examples/routing_example/public/index.ts
@@ -0,0 +1,23 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { PluginInitializer } from 'kibana/public';
+import { RoutingExamplePlugin } from './plugin';
+
+export const plugin: PluginInitializer<{}, {}> = () => new RoutingExamplePlugin();
diff --git a/examples/routing_example/public/is_error.ts b/examples/routing_example/public/is_error.ts
new file mode 100644
index 0000000000000..528cca5b50d5d
--- /dev/null
+++ b/examples/routing_example/public/is_error.ts
@@ -0,0 +1,24 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { HttpFetchError } from '../../../src/core/public';
+
+export function isError<T>(error: T | HttpFetchError): error is HttpFetchError {
+  return error instanceof HttpFetchError;
+}
diff --git a/examples/routing_example/public/plugin.tsx b/examples/routing_example/public/plugin.tsx
new file mode 100644
index 0000000000000..eabdd2ade05b2
--- /dev/null
+++ b/examples/routing_example/public/plugin.tsx
@@ -0,0 +1,78 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import {
+  CoreStart,
+  Plugin,
+  CoreSetup,
+  AppMountParameters,
+  AppNavLinkStatus,
+} from '../../../src/core/public';
+import { DeveloperExamplesSetup } from '../../developer_examples/public';
+import { getServices } from './services';
+
+interface SetupDeps {
+  developerExamples: DeveloperExamplesSetup;
+}
+
+export class RoutingExamplePlugin implements Plugin<{}, {}, SetupDeps, {}> {
+  public setup(core: CoreSetup, { developerExamples }: SetupDeps) {
+    core.application.register({
+      id: 'routingExample',
+      title: 'Routing',
+      navLinkStatus: AppNavLinkStatus.hidden,
+      async mount(params: AppMountParameters) {
+        const [coreStart] = await core.getStartServices();
+        const startServices = getServices(coreStart);
+        const { renderApp } = await import('./app');
+        return renderApp(startServices, params.element);
+      },
+    });
+
+    developerExamples.register({
+      appId: 'routingExample',
+      title: 'Routing',
+      description: `Examples show how to use core routing and fetch services to register and query your own custom routes.`,
+      links: [
+        {
+          label: 'IRouter',
+          href:
+            'https://github.com/elastic/kibana/blob/master/docs/development/core/server/kibana-plugin-core-server.irouter.md',
+          iconType: 'logoGithub',
+          target: '_blank',
+          size: 's',
+        },
+        {
+          label: 'HttpHandler (core.http.fetch)',
+          href:
+            'https://github.com/elastic/kibana/blob/master/docs/development/core/public/kibana-plugin-core-public.httphandler.md',
+          iconType: 'logoGithub',
+          target: '_blank',
+          size: 's',
+        },
+      ],
+    });
+    return {};
+  }
+
+  public start(core: CoreStart) {
+    return {};
+  }
+
+  public stop() {}
+}
diff --git a/examples/routing_example/public/post_message_example.tsx b/examples/routing_example/public/post_message_example.tsx
new file mode 100644
index 0000000000000..3004d66c4aa97
--- /dev/null
+++ b/examples/routing_example/public/post_message_example.tsx
@@ -0,0 +1,103 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import React, { useCallback } from 'react';
+import { useState } from 'react';
+import {
+  EuiText,
+  EuiButton,
+  EuiLoadingSpinner,
+  EuiFieldText,
+  EuiCallOut,
+  EuiFormRow,
+  EuiTextArea,
+} from '@elastic/eui';
+import { HttpFetchError } from '../../../src/core/public';
+import { isError } from './is_error';
+import { Services } from './services';
+
+interface Props {
+  postMessage: Services['postMessage'];
+  addSuccessToast: Services['addSuccessToast'];
+}
+
+export function PostMessageRouteExample({ postMessage, addSuccessToast }: Props) {
+  const [error, setError] = useState<HttpFetchError | undefined>();
+  const [isPosting, setIsPosting] = useState<boolean>(false);
+  const [message, setMessage] = useState<string>('');
+  const [id, setId] = useState<string>('');
+
+  const doFetch = useCallback(async () => {
+    if (isPosting) return;
+    setIsPosting(true);
+    const response = await postMessage(message, id);
+
+    if (response && isError(response)) {
+      setError(response);
+    } else {
+      setError(undefined);
+      addSuccessToast('Message was added!');
+      setMessage('');
+      setId('');
+    }
+
+    setIsPosting(false);
+  }, [isPosting, postMessage, addSuccessToast, setMessage, message, id]);
+
+  return (
+    <React.Fragment>
+      <EuiText>
+        <h2>POST example with body</h2>
+        <p>
+          This examples uses a simple POST route that takes a body parameter and an id as a param in
+          the route path.
+        </p>
+        <EuiFormRow label="Message Id">
+          <EuiFieldText
+            value={id}
+            onChange={(e) => setId(e.target.value)}
+            data-test-subj="routingExampleSetMessageId"
+          />
+        </EuiFormRow>
+        <EuiFormRow label="Message">
+          <EuiTextArea
+            data-test-subj="routingExampleSetMessage"
+            value={message}
+            onChange={(e) => setMessage(e.target.value)}
+          />
+        </EuiFormRow>
+
+        <EuiFormRow hasEmptyLabelSpace={true}>
+          <EuiButton
+            data-test-subj="routingExamplePostMessage"
+            disabled={isPosting || id === '' || message === ''}
+            onClick={() => doFetch()}
+          >
+            {isPosting ? <EuiLoadingSpinner /> : 'Post message'}
+          </EuiButton>
+        </EuiFormRow>
+
+        {error !== undefined ? (
+          <EuiCallOut color="danger" iconType="alert">
+            {error.message}
+          </EuiCallOut>
+        ) : null}
+      </EuiText>
+    </React.Fragment>
+  );
+}
diff --git a/examples/routing_example/public/random_number_between_example.tsx b/examples/routing_example/public/random_number_between_example.tsx
new file mode 100644
index 0000000000000..9f75060193114
--- /dev/null
+++ b/examples/routing_example/public/random_number_between_example.tsx
@@ -0,0 +1,98 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import React, { useCallback } from 'react';
+import { useState } from 'react';
+import {
+  EuiText,
+  EuiButton,
+  EuiLoadingSpinner,
+  EuiFieldText,
+  EuiCallOut,
+  EuiFormRow,
+} from '@elastic/eui';
+import { HttpFetchError } from '../../../src/core/public';
+import { isError } from './is_error';
+import { Services } from './services';
+
+interface Props {
+  fetchRandomNumberBetween: Services['fetchRandomNumberBetween'];
+}
+
+export function RandomNumberBetweenRouteExample({ fetchRandomNumberBetween }: Props) {
+  const [error, setError] = useState<HttpFetchError | undefined>();
+  const [randomNumber, setRandomNumber] = useState<number>(0);
+  const [isFetching, setIsFetching] = useState<boolean>(false);
+  const [maxInput, setMaxInput] = useState<string>('10');
+
+  const doFetch = useCallback(async () => {
+    if (isFetching) return;
+    setIsFetching(true);
+    const response = await fetchRandomNumberBetween(Number.parseInt(maxInput, 10));
+
+    if (isError(response)) {
+      setError(response);
+    } else {
+      setRandomNumber(response);
+    }
+
+    setIsFetching(false);
+  }, [isFetching, maxInput, fetchRandomNumberBetween]);
+
+  return (
+    <React.Fragment>
+      <EuiText>
+        <h2>GET example with query</h2>
+        <p>
+          This examples uses a simple GET route that takes a query parameter in the request and
+          returns a single number.
+        </p>
+        <EuiFormRow label="Generate a random number between 0 and">
+          <EuiFieldText
+            data-test-subj="routingExampleMaxRandomNumberBetween"
+            value={maxInput}
+            onChange={(e) => setMaxInput(e.target.value)}
+            isInvalid={isNaN(Number(maxInput))}
+          />
+        </EuiFormRow>
+
+        <EuiFormRow hasEmptyLabelSpace={true}>
+          <EuiButton
+            data-test-subj="routingExampleFetchRandomNumberBetween"
+            disabled={isFetching || isNaN(Number(maxInput))}
+            onClick={() => doFetch()}
+          >
+            {isFetching ? <EuiLoadingSpinner /> : 'Generate random number'}
+          </EuiButton>
+        </EuiFormRow>
+
+        {error !== undefined ? (
+          <EuiCallOut color="danger" iconType="alert">
+            {error.message}
+          </EuiCallOut>
+        ) : null}
+        {randomNumber > -1 ? (
+          <h2>
+            Random number is
+            <div data-test-subj="routingExampleRandomNumberBetween">{randomNumber}</div>
+          </h2>
+        ) : null}
+      </EuiText>
+    </React.Fragment>
+  );
+}
diff --git a/examples/routing_example/public/random_number_example.tsx b/examples/routing_example/public/random_number_example.tsx
new file mode 100644
index 0000000000000..6b073826c854f
--- /dev/null
+++ b/examples/routing_example/public/random_number_example.tsx
@@ -0,0 +1,78 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import React, { useCallback } from 'react';
+import { useState } from 'react';
+import { EuiText, EuiButton, EuiLoadingSpinner, EuiCallOut } from '@elastic/eui';
+import { HttpFetchError } from '../../../src/core/public';
+import { Services } from './services';
+import { isError } from './is_error';
+
+interface Props {
+  fetchRandomNumber: Services['fetchRandomNumber'];
+}
+
+export function RandomNumberRouteExample({ fetchRandomNumber }: Props) {
+  const [error, setError] = useState<HttpFetchError | undefined>(undefined);
+  const [randomNumber, setRandomNumber] = useState<number>(0);
+  const [isFetching, setIsFetching] = useState<boolean>(false);
+
+  const doFetch = useCallback(async () => {
+    if (isFetching) return;
+    setIsFetching(true);
+    const response = await fetchRandomNumber();
+
+    if (isError(response)) {
+      setError(response);
+    } else {
+      setRandomNumber(response);
+    }
+
+    setIsFetching(false);
+  }, [isFetching, fetchRandomNumber]);
+
+  return (
+    <React.Fragment>
+      <EuiText>
+        <h2>GET example</h2>
+        <p>
+          This examples uses a simple GET route that takes no parameters or body in the request and
+          returns a single number.
+        </p>
+        <EuiButton
+          data-test-subj="routingExampleFetchRandomNumber"
+          disabled={isFetching}
+          onClick={() => doFetch()}
+        >
+          {isFetching ? <EuiLoadingSpinner /> : 'Generate a random number'}
+        </EuiButton>
+
+        {error !== undefined ? (
+          <EuiCallOut color="danger" iconType="alert">
+            {error}
+          </EuiCallOut>
+        ) : null}
+        {randomNumber > -1 ? (
+          <h2>
+            Random number is <div data-test-subj="routingExampleRandomNumber">{randomNumber}</div>
+          </h2>
+        ) : null}
+      </EuiText>
+    </React.Fragment>
+  );
+}
diff --git a/examples/routing_example/public/services.ts b/examples/routing_example/public/services.ts
new file mode 100644
index 0000000000000..08a79270372fd
--- /dev/null
+++ b/examples/routing_example/public/services.ts
@@ -0,0 +1,78 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { CoreStart, HttpFetchError } from 'kibana/public';
+import {
+  RANDOM_NUMBER_ROUTE_PATH,
+  RANDOM_NUMBER_BETWEEN_ROUTE_PATH,
+  POST_MESSAGE_ROUTE_PATH,
+  INTERNAL_GET_MESSAGE_BY_ID_ROUTE,
+} from '../common';
+
+export interface Services {
+  fetchRandomNumber: () => Promise<number | HttpFetchError>;
+  fetchRandomNumberBetween: (max: number) => Promise<number | HttpFetchError>;
+  postMessage: (message: string, id: string) => Promise<undefined | HttpFetchError>;
+  getMessageById: (id: string) => Promise<string | HttpFetchError>;
+  addSuccessToast: (message: string) => void;
+}
+
+export function getServices(core: CoreStart): Services {
+  return {
+    addSuccessToast: (message: string) => core.notifications.toasts.addSuccess(message),
+    fetchRandomNumber: async () => {
+      try {
+        const response = await core.http.fetch<{ randomNumber: number }>(RANDOM_NUMBER_ROUTE_PATH);
+        return response.randomNumber;
+      } catch (e) {
+        return e;
+      }
+    },
+    fetchRandomNumberBetween: async (max: number) => {
+      try {
+        const response = await core.http.fetch<{ randomNumber: number }>(
+          RANDOM_NUMBER_BETWEEN_ROUTE_PATH,
+          { query: { max } }
+        );
+        return response.randomNumber;
+      } catch (e) {
+        return e;
+      }
+    },
+    postMessage: async (message: string, id: string) => {
+      try {
+        await core.http.post(`${POST_MESSAGE_ROUTE_PATH}/${id}`, {
+          body: JSON.stringify({ message }),
+        });
+      } catch (e) {
+        return e;
+      }
+    },
+    getMessageById: async (id: string) => {
+      try {
+        const response = await core.http.get<{ message: string }>(
+          `${INTERNAL_GET_MESSAGE_BY_ID_ROUTE}/${id}`
+        );
+        return response.message;
+      } catch (e) {
+        return e;
+      }
+    },
+  };
+}
diff --git a/examples/routing_example/server/index.ts b/examples/routing_example/server/index.ts
new file mode 100644
index 0000000000000..77a0d9bb95549
--- /dev/null
+++ b/examples/routing_example/server/index.ts
@@ -0,0 +1,24 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { PluginInitializer } from 'kibana/server';
+
+import { RoutingExamplePlugin } from './plugin';
+
+export const plugin: PluginInitializer<{}, {}> = () => new RoutingExamplePlugin();
diff --git a/examples/routing_example/server/plugin.ts b/examples/routing_example/server/plugin.ts
new file mode 100644
index 0000000000000..8e92fafc7b30c
--- /dev/null
+++ b/examples/routing_example/server/plugin.ts
@@ -0,0 +1,37 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Plugin, CoreSetup, CoreStart } from 'kibana/server';
+import { registerRoutes } from './routes';
+
+export class RoutingExamplePlugin implements Plugin<{}, {}> {
+  public setup(core: CoreSetup) {
+    const router = core.http.createRouter();
+
+    registerRoutes(router);
+
+    return {};
+  }
+
+  public start(core: CoreStart) {
+    return {};
+  }
+
+  public stop() {}
+}
diff --git a/examples/routing_example/server/routes/index.ts b/examples/routing_example/server/routes/index.ts
new file mode 100644
index 0000000000000..ea575cf371bb7
--- /dev/null
+++ b/examples/routing_example/server/routes/index.ts
@@ -0,0 +1,19 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+export { registerRoutes } from './register_routes';
diff --git a/examples/routing_example/server/routes/message_routes.ts b/examples/routing_example/server/routes/message_routes.ts
new file mode 100644
index 0000000000000..2b4ec5e11fb4a
--- /dev/null
+++ b/examples/routing_example/server/routes/message_routes.ts
@@ -0,0 +1,90 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { schema } from '@kbn/config-schema';
+import { POST_MESSAGE_ROUTE_PATH, INTERNAL_GET_MESSAGE_BY_ID_ROUTE } from '../../common';
+
+import { IRouter } from '../../../../src/core/server';
+
+/**
+ *
+ * NOTE: DON'T USE IN MEMORY DATA STRUCTURES TO STORE DATA!
+ *
+ * That won't work in a system with multiple Kibanas, which is a setup we recommend for
+ * load balancing. I'm only doing so here to simplify the routing example. In real life,
+ * Elasticsearch should be used to persist data that can be shared across multiple Kibana
+ * instances.
+ */
+
+const messages: { [key: string]: string } = {};
+
+/**
+ * @param router Pushes a message with an id onto an in memory map.
+ */
+export function registerPostMessageRoute(router: IRouter) {
+  router.post(
+    {
+      path: `${POST_MESSAGE_ROUTE_PATH}/{id}`,
+      validate: {
+        params: schema.object({
+          // This parameter name matches the one in POST_MESSAGE_ROUTE_PATH: `api/post_message/{id}`.
+          // Params are often used for ids like this.
+          id: schema.string(),
+        }),
+        body: schema.object({
+          message: schema.string({ maxLength: 100 }),
+        }),
+      },
+    },
+    async (context, request, response) => {
+      if (messages[request.params.id]) {
+        return response.badRequest({
+          body: `Message with id ${request.params.id} already exists`,
+        });
+      }
+
+      // See note above. NEVER DO THIS IN REAL CODE! Data should only be persisted in Elasticsearch.
+      messages[request.params.id] = request.body.message;
+
+      return response.ok();
+    }
+  );
+}
+
+/**
+ * @param router Returns the message with the given id from an in memory array.
+ */
+export function registerGetMessageByIdRoute(router: IRouter) {
+  router.get(
+    {
+      path: `${INTERNAL_GET_MESSAGE_BY_ID_ROUTE}/{id}`,
+      validate: {
+        params: schema.object({
+          id: schema.string(),
+        }),
+      },
+    },
+    async (context, request, response) => {
+      if (!messages[request.params.id]) {
+        return response.notFound();
+      }
+      return response.ok({ body: { message: messages[request.params.id] } });
+    }
+  );
+}
diff --git a/examples/routing_example/server/routes/random_number_between_generator.ts b/examples/routing_example/server/routes/random_number_between_generator.ts
new file mode 100644
index 0000000000000..9481578e540fe
--- /dev/null
+++ b/examples/routing_example/server/routes/random_number_between_generator.ts
@@ -0,0 +1,47 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { schema } from '@kbn/config-schema';
+import { RANDOM_NUMBER_BETWEEN_ROUTE_PATH } from '../../common';
+
+import { IRouter } from '../../../../src/core/server';
+
+/**
+ *
+ * @param router Registers a get route that returns a random number between one and another number suplied by the user.
+ */
+export function registerGetRandomNumberBetweenRoute(router: IRouter) {
+  router.get(
+    {
+      path: RANDOM_NUMBER_BETWEEN_ROUTE_PATH,
+      validate: {
+        query: schema.object({
+          max: schema.number({ defaultValue: 10 }),
+        }),
+      },
+    },
+    async (context, request, response) => {
+      return response.ok({
+        body: {
+          randomNumber: Math.random() * request.query.max,
+        },
+      });
+    }
+  );
+}
diff --git a/examples/routing_example/server/routes/random_number_generator.ts b/examples/routing_example/server/routes/random_number_generator.ts
new file mode 100644
index 0000000000000..2cfce45b957ae
--- /dev/null
+++ b/examples/routing_example/server/routes/random_number_generator.ts
@@ -0,0 +1,43 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { RANDOM_NUMBER_ROUTE_PATH } from '../../common';
+
+import { IRouter } from '../../../../src/core/server';
+
+/**
+ *
+ * @param router Registers a get route that returns a random number between one and ten. It has no input
+ * parameters, and returns a random number in the body.
+ */
+export function registerGetRandomNumberRoute(router: IRouter) {
+  router.get(
+    {
+      path: RANDOM_NUMBER_ROUTE_PATH,
+      validate: {},
+    },
+    async (context, request, response) => {
+      return response.ok({
+        body: {
+          randomNumber: Math.random() * 10,
+        },
+      });
+    }
+  );
+}
diff --git a/examples/routing_example/server/routes/register_routes.ts b/examples/routing_example/server/routes/register_routes.ts
new file mode 100644
index 0000000000000..f556c0ed2c2fd
--- /dev/null
+++ b/examples/routing_example/server/routes/register_routes.ts
@@ -0,0 +1,30 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { IRouter } from 'kibana/server';
+import { registerGetRandomNumberRoute } from './random_number_generator';
+import { registerGetRandomNumberBetweenRoute } from './random_number_between_generator';
+import { registerGetMessageByIdRoute, registerPostMessageRoute } from './message_routes';
+
+export function registerRoutes(router: IRouter) {
+  registerGetRandomNumberRoute(router);
+  registerGetRandomNumberBetweenRoute(router);
+  registerGetMessageByIdRoute(router);
+  registerPostMessageRoute(router);
+}
diff --git a/examples/routing_example/tsconfig.json b/examples/routing_example/tsconfig.json
new file mode 100644
index 0000000000000..9bbd9021b2e0a
--- /dev/null
+++ b/examples/routing_example/tsconfig.json
@@ -0,0 +1,16 @@
+{
+  "extends": "../../tsconfig.json",
+  "compilerOptions": {
+    "outDir": "./target",
+    "skipLibCheck": true
+  },
+  "include": [
+    "index.ts",
+    "public/**/*.ts",
+    "public/**/*.tsx",
+    "server/**/*.ts",
+    "common/**/*.ts",
+    "../../typings/**/*",
+  ],
+  "exclude": []
+}
diff --git a/examples/ui_actions_explorer/public/actions/actions.tsx b/examples/ui_actions_explorer/public/actions/actions.tsx
index 4ef8d5bf4d9c6..6d83362e998bc 100644
--- a/examples/ui_actions_explorer/public/actions/actions.tsx
+++ b/examples/ui_actions_explorer/public/actions/actions.tsx
@@ -31,7 +31,7 @@ export const ACTION_VIEW_IN_MAPS = 'ACTION_VIEW_IN_MAPS';
 export const ACTION_TRAVEL_GUIDE = 'ACTION_TRAVEL_GUIDE';
 export const ACTION_CALL_PHONE_NUMBER = 'ACTION_CALL_PHONE_NUMBER';
 export const ACTION_EDIT_USER = 'ACTION_EDIT_USER';
-export const ACTION_PHONE_USER = 'ACTION_PHONE_USER';
+export const ACTION_TRIGGER_PHONE_USER = 'ACTION_TRIGGER_PHONE_USER';
 export const ACTION_SHOWCASE_PLUGGABILITY = 'ACTION_SHOWCASE_PLUGGABILITY';
 
 export const showcasePluggability = createAction<typeof ACTION_SHOWCASE_PLUGGABILITY>({
@@ -120,19 +120,13 @@ export interface UserContext {
   update: (user: User) => void;
 }
 
-export const createPhoneUserAction = (getUiActionsApi: () => Promise<UiActionsStart>) =>
-  createAction<typeof ACTION_PHONE_USER>({
-    type: ACTION_PHONE_USER,
+export const createTriggerPhoneTriggerAction = (getUiActionsApi: () => Promise<UiActionsStart>) =>
+  createAction<typeof ACTION_TRIGGER_PHONE_USER>({
+    type: ACTION_TRIGGER_PHONE_USER,
     getDisplayName: () => 'Call phone number',
+    shouldAutoExecute: async () => true,
     isCompatible: async ({ user }) => user.phone !== undefined,
     execute: async ({ user }) => {
-      // One option - execute the more specific action directly.
-      // makePhoneCallAction.execute({ phone: user.phone });
-
-      // Another option - emit the trigger and automatically get *all* the actions attached
-      // to the phone number trigger.
-      // TODO: we need to figure out the best way to handle these nested actions however, since
-      // we don't want multiple context menu's to pop up.
       if (user.phone !== undefined) {
         (await getUiActionsApi()).executeTriggerActions(PHONE_TRIGGER, { phone: user.phone });
       }
diff --git a/examples/ui_actions_explorer/public/plugin.tsx b/examples/ui_actions_explorer/public/plugin.tsx
index 670138b43b9c4..b28e5e7a9f692 100644
--- a/examples/ui_actions_explorer/public/plugin.tsx
+++ b/examples/ui_actions_explorer/public/plugin.tsx
@@ -23,7 +23,6 @@ import {
   PHONE_TRIGGER,
   USER_TRIGGER,
   COUNTRY_TRIGGER,
-  createPhoneUserAction,
   lookUpWeatherAction,
   viewInMapsAction,
   createEditUserAction,
@@ -37,7 +36,8 @@ import {
   ACTION_CALL_PHONE_NUMBER,
   ACTION_TRAVEL_GUIDE,
   ACTION_VIEW_IN_MAPS,
-  ACTION_PHONE_USER,
+  ACTION_TRIGGER_PHONE_USER,
+  createTriggerPhoneTriggerAction,
 } from './actions/actions';
 import { DeveloperExamplesSetup } from '../../developer_examples/public';
 import image from './ui_actions.png';
@@ -64,7 +64,7 @@ declare module '../../../src/plugins/ui_actions/public' {
     [ACTION_CALL_PHONE_NUMBER]: PhoneContext;
     [ACTION_TRAVEL_GUIDE]: CountryContext;
     [ACTION_VIEW_IN_MAPS]: CountryContext;
-    [ACTION_PHONE_USER]: UserContext;
+    [ACTION_TRIGGER_PHONE_USER]: UserContext;
   }
 }
 
@@ -84,7 +84,7 @@ export class UiActionsExplorerPlugin implements Plugin<void, void, {}, StartDeps
 
     deps.uiActions.addTriggerAction(
       USER_TRIGGER,
-      createPhoneUserAction(async () => (await startServices)[1].uiActions)
+      createTriggerPhoneTriggerAction(async () => (await startServices)[1].uiActions)
     );
     deps.uiActions.addTriggerAction(
       USER_TRIGGER,
diff --git a/package.json b/package.json
index 53aa6b25f190b..541fcc46a3d6e 100644
--- a/package.json
+++ b/package.json
@@ -237,7 +237,7 @@
     "pug": "^2.0.4",
     "query-string": "5.1.1",
     "raw-loader": "3.1.0",
-    "re2": "1.14.0",
+    "re2": "^1.15.4",
     "react": "^16.12.0",
     "react-color": "^2.13.8",
     "react-dom": "^16.12.0",
diff --git a/packages/kbn-optimizer/src/report_optimizer_stats.ts b/packages/kbn-optimizer/src/report_optimizer_stats.ts
index 2f92f3d648ab7..5057c717efcc3 100644
--- a/packages/kbn-optimizer/src/report_optimizer_stats.ts
+++ b/packages/kbn-optimizer/src/report_optimizer_stats.ts
@@ -35,6 +35,8 @@ interface Entry {
   stats: Fs.Stats;
 }
 
+const IGNORED_EXTNAME = ['.map', '.br', '.gz'];
+
 const getFiles = (dir: string, parent?: string) =>
   flatten(
     Fs.readdirSync(dir).map((name): Entry | Entry[] => {
@@ -51,7 +53,19 @@ const getFiles = (dir: string, parent?: string) =>
         stats,
       };
     })
-  );
+  ).filter((file) => {
+    const filename = Path.basename(file.relPath);
+    if (filename.startsWith('.')) {
+      return false;
+    }
+
+    const ext = Path.extname(filename);
+    if (IGNORED_EXTNAME.includes(ext)) {
+      return false;
+    }
+
+    return true;
+  });
 
 export function reportOptimizerStats(reporter: CiStatsReporter, config: OptimizerConfig) {
   return pipeClosure((update$: OptimizerUpdate$) => {
@@ -70,10 +84,7 @@ export function reportOptimizerStats(reporter: CiStatsReporter, config: Optimize
                 // make the cache read from the cache file since it was likely updated by the worker
                 bundle.cache.refresh();
 
-                const outputFiles = getFiles(bundle.outputDir).filter(
-                  (file) => !(file.relPath.startsWith('.') || file.relPath.endsWith('.map'))
-                );
-
+                const outputFiles = getFiles(bundle.outputDir);
                 const entryName = `${bundle.id}.${bundle.type}.js`;
                 const entry = outputFiles.find((f) => f.relPath === entryName);
                 if (!entry) {
diff --git a/renovate.json5 b/renovate.json5
index 1ba6dc0ff7e1b..6424894622c9f 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -25,7 +25,7 @@
     'Team:Operations',
     'renovate',
     'v8.0.0',
-    'v7.9.0',
+    'v7.10.0',
   ],
   major: {
     labels: [
@@ -33,7 +33,7 @@
       'Team:Operations',
       'renovate',
       'v8.0.0',
-      'v7.9.0',
+      'v7.10.0',
       'renovate:major',
     ],
   },
@@ -254,7 +254,7 @@
           'Team:Operations',
           'renovate',
           'v8.0.0',
-          'v7.9.0',
+          'v7.10.0',
           ':ml',
         ],
       },
diff --git a/src/core/public/doc_links/doc_links_service.ts b/src/core/public/doc_links/doc_links_service.ts
index 0662586797164..70b25cb78787a 100644
--- a/src/core/public/doc_links/doc_links_service.ts
+++ b/src/core/public/doc_links/doc_links_service.ts
@@ -111,8 +111,8 @@ export class DocLinksService {
         },
         kibana: `${ELASTIC_WEBSITE_URL}guide/en/kibana/${DOC_LINK_VERSION}/index.html`,
         siem: {
-          guide: `${ELASTIC_WEBSITE_URL}guide/en/siem/guide/${DOC_LINK_VERSION}/index.html`,
-          gettingStarted: `${ELASTIC_WEBSITE_URL}guide/en/siem/guide/${DOC_LINK_VERSION}/install-siem.html`,
+          guide: `${ELASTIC_WEBSITE_URL}guide/en/security/${DOC_LINK_VERSION}/index.html`,
+          gettingStarted: `${ELASTIC_WEBSITE_URL}guide/en/security/${DOC_LINK_VERSION}/install-siem.html`,
         },
         query: {
           luceneQuerySyntax: `${ELASTICSEARCH_DOCS}query-dsl-query-string-query.html#query-string-syntax`,
diff --git a/src/core/server/elasticsearch/elasticsearch_service.test.ts b/src/core/server/elasticsearch/elasticsearch_service.test.ts
index b36af2a7e4671..4375f09f1ce0b 100644
--- a/src/core/server/elasticsearch/elasticsearch_service.test.ts
+++ b/src/core/server/elasticsearch/elasticsearch_service.test.ts
@@ -17,11 +17,9 @@
  * under the License.
  */
 
-import { first } from 'rxjs/operators';
-
 import { MockLegacyClusterClient, MockClusterClient } from './elasticsearch_service.test.mocks';
-
 import { BehaviorSubject } from 'rxjs';
+import { first } from 'rxjs/operators';
 import { Env } from '../config';
 import { getEnvOptions } from '../config/__mocks__/env';
 import { CoreContext } from '../core_context';
@@ -227,28 +225,34 @@ describe('#setup', () => {
   });
 
   it('esNodeVersionCompatibility$ only starts polling when subscribed to', async (done) => {
-    mockLegacyClusterClientInstance.callAsInternalUser.mockRejectedValue(new Error());
+    const mockedClient = mockClusterClientInstance.asInternalUser;
+    mockedClient.nodes.info.mockImplementation(() =>
+      elasticsearchClientMock.createClientError(new Error())
+    );
 
     const setupContract = await elasticsearchService.setup(setupDeps);
     await delay(10);
 
-    expect(mockLegacyClusterClientInstance.callAsInternalUser).toHaveBeenCalledTimes(0);
+    expect(mockedClient.nodes.info).toHaveBeenCalledTimes(0);
     setupContract.esNodesCompatibility$.subscribe(() => {
-      expect(mockLegacyClusterClientInstance.callAsInternalUser).toHaveBeenCalledTimes(1);
+      expect(mockedClient.nodes.info).toHaveBeenCalledTimes(1);
       done();
     });
   });
 
   it('esNodeVersionCompatibility$ stops polling when unsubscribed from', async (done) => {
-    mockLegacyClusterClientInstance.callAsInternalUser.mockRejectedValue(new Error());
+    const mockedClient = mockClusterClientInstance.asInternalUser;
+    mockedClient.nodes.info.mockImplementation(() =>
+      elasticsearchClientMock.createClientError(new Error())
+    );
 
     const setupContract = await elasticsearchService.setup(setupDeps);
 
-    expect(mockLegacyClusterClientInstance.callAsInternalUser).toHaveBeenCalledTimes(0);
+    expect(mockedClient.nodes.info).toHaveBeenCalledTimes(0);
     const sub = setupContract.esNodesCompatibility$.subscribe(async () => {
       sub.unsubscribe();
       await delay(100);
-      expect(mockLegacyClusterClientInstance.callAsInternalUser).toHaveBeenCalledTimes(1);
+      expect(mockedClient.nodes.info).toHaveBeenCalledTimes(1);
       done();
     });
   });
@@ -353,16 +357,19 @@ describe('#stop', () => {
   it('stops pollEsNodeVersions even if there are active subscriptions', async (done) => {
     expect.assertions(2);
 
-    mockLegacyClusterClientInstance.callAsInternalUser.mockRejectedValue(new Error());
+    const mockedClient = mockClusterClientInstance.asInternalUser;
+    mockedClient.nodes.info.mockImplementation(() =>
+      elasticsearchClientMock.createClientError(new Error())
+    );
 
     const setupContract = await elasticsearchService.setup(setupDeps);
 
     setupContract.esNodesCompatibility$.subscribe(async () => {
-      expect(mockLegacyClusterClientInstance.callAsInternalUser).toHaveBeenCalledTimes(1);
+      expect(mockedClient.nodes.info).toHaveBeenCalledTimes(1);
 
       await elasticsearchService.stop();
       await delay(100);
-      expect(mockLegacyClusterClientInstance.callAsInternalUser).toHaveBeenCalledTimes(1);
+      expect(mockedClient.nodes.info).toHaveBeenCalledTimes(1);
       done();
     });
   });
diff --git a/src/core/server/elasticsearch/elasticsearch_service.ts b/src/core/server/elasticsearch/elasticsearch_service.ts
index 9b05fb9887a3b..69bf593dd5862 100644
--- a/src/core/server/elasticsearch/elasticsearch_service.ts
+++ b/src/core/server/elasticsearch/elasticsearch_service.ts
@@ -78,9 +78,10 @@ export class ElasticsearchService
 
     this.getAuthHeaders = deps.http.getAuthHeaders;
     this.legacyClient = this.createLegacyClusterClient('data', config);
+    this.client = this.createClusterClient('data', config);
 
     const esNodesCompatibility$ = pollEsNodesVersion({
-      callWithInternalUser: this.legacyClient.callAsInternalUser,
+      internalClient: this.client.asInternalUser,
       log: this.log,
       ignoreVersionMismatch: config.ignoreVersionMismatch,
       esVersionCheckInterval: config.healthCheckDelay.asMilliseconds(),
@@ -109,7 +110,6 @@ export class ElasticsearchService
     }
 
     const config = await this.config$.pipe(first()).toPromise();
-    this.client = this.createClusterClient('data', config);
 
     const createClient = (
       type: string,
@@ -120,7 +120,7 @@ export class ElasticsearchService
     };
 
     return {
-      client: this.client,
+      client: this.client!,
       createClient,
       legacy: {
         client: this.legacyClient,
@@ -133,7 +133,7 @@ export class ElasticsearchService
     this.log.debug('Stopping elasticsearch service');
     this.stop$.next();
     if (this.client) {
-      this.client.close();
+      await this.client.close();
     }
     if (this.legacyClient) {
       this.legacyClient.close();
diff --git a/src/core/server/elasticsearch/version_check/ensure_es_version.test.ts b/src/core/server/elasticsearch/version_check/ensure_es_version.test.ts
index 3d1218d4a8e8b..21adac081acf7 100644
--- a/src/core/server/elasticsearch/version_check/ensure_es_version.test.ts
+++ b/src/core/server/elasticsearch/version_check/ensure_es_version.test.ts
@@ -18,6 +18,7 @@
  */
 import { mapNodesVersionCompatibility, pollEsNodesVersion, NodesInfo } from './ensure_es_version';
 import { loggingSystemMock } from '../../logging/logging_system.mock';
+import { elasticsearchClientMock } from '../client/mocks';
 import { take, delay } from 'rxjs/operators';
 import { TestScheduler } from 'rxjs/testing';
 import { of } from 'rxjs';
@@ -27,6 +28,9 @@ const mockLogger = mockLoggerFactory.get('mock logger');
 
 const KIBANA_VERSION = '5.1.0';
 
+const createEsSuccess = elasticsearchClientMock.createClientResponse;
+const createEsError = elasticsearchClientMock.createClientError;
+
 function createNodes(...versions: string[]): NodesInfo {
   const nodes = {} as any;
   versions
@@ -111,25 +115,34 @@ describe('mapNodesVersionCompatibility', () => {
 });
 
 describe('pollEsNodesVersion', () => {
-  const callWithInternalUser = jest.fn();
+  let internalClient: ReturnType<typeof elasticsearchClientMock.createInternalClient>;
   const getTestScheduler = () =>
     new TestScheduler((actual, expected) => {
       expect(actual).toEqual(expected);
     });
 
   beforeEach(() => {
-    callWithInternalUser.mockReset();
+    internalClient = elasticsearchClientMock.createInternalClient();
   });
 
+  const nodeInfosSuccessOnce = (infos: NodesInfo) => {
+    internalClient.nodes.info.mockImplementationOnce(() => createEsSuccess(infos));
+  };
+  const nodeInfosErrorOnce = (error: any) => {
+    internalClient.nodes.info.mockImplementationOnce(() => createEsError(error));
+  };
+
   it('returns iscCompatible=false and keeps polling when a poll request throws', (done) => {
     expect.assertions(3);
     const expectedCompatibilityResults = [false, false, true];
     jest.clearAllMocks();
-    callWithInternalUser.mockResolvedValueOnce(createNodes('5.1.0', '5.2.0', '5.0.0'));
-    callWithInternalUser.mockRejectedValueOnce(new Error('mock request error'));
-    callWithInternalUser.mockResolvedValueOnce(createNodes('5.1.0', '5.2.0', '5.1.1-Beta1'));
+
+    nodeInfosSuccessOnce(createNodes('5.1.0', '5.2.0', '5.0.0'));
+    nodeInfosErrorOnce('mock request error');
+    nodeInfosSuccessOnce(createNodes('5.1.0', '5.2.0', '5.1.1-Beta1'));
+
     pollEsNodesVersion({
-      callWithInternalUser,
+      internalClient,
       esVersionCheckInterval: 1,
       ignoreVersionMismatch: false,
       kibanaVersion: KIBANA_VERSION,
@@ -148,9 +161,11 @@ describe('pollEsNodesVersion', () => {
   it('returns compatibility results', (done) => {
     expect.assertions(1);
     const nodes = createNodes('5.1.0', '5.2.0', '5.0.0');
-    callWithInternalUser.mockResolvedValueOnce(nodes);
+
+    nodeInfosSuccessOnce(nodes);
+
     pollEsNodesVersion({
-      callWithInternalUser,
+      internalClient,
       esVersionCheckInterval: 1,
       ignoreVersionMismatch: false,
       kibanaVersion: KIBANA_VERSION,
@@ -168,15 +183,15 @@ describe('pollEsNodesVersion', () => {
 
   it('only emits if the node versions changed since the previous poll', (done) => {
     expect.assertions(4);
-    callWithInternalUser.mockResolvedValueOnce(createNodes('5.1.0', '5.2.0', '5.0.0')); // emit
-    callWithInternalUser.mockResolvedValueOnce(createNodes('5.0.0', '5.1.0', '5.2.0')); // ignore, same versions, different ordering
-    callWithInternalUser.mockResolvedValueOnce(createNodes('5.1.1', '5.2.0', '5.0.0')); // emit
-    callWithInternalUser.mockResolvedValueOnce(createNodes('5.1.1', '5.1.2', '5.1.3')); // emit
-    callWithInternalUser.mockResolvedValueOnce(createNodes('5.1.1', '5.1.2', '5.1.3')); // ignore
-    callWithInternalUser.mockResolvedValueOnce(createNodes('5.0.0', '5.1.0', '5.2.0')); // emit, different from previous version
+    nodeInfosSuccessOnce(createNodes('5.1.0', '5.2.0', '5.0.0')); // emit
+    nodeInfosSuccessOnce(createNodes('5.0.0', '5.1.0', '5.2.0')); // ignore, same versions, different ordering
+    nodeInfosSuccessOnce(createNodes('5.1.1', '5.2.0', '5.0.0')); // emit
+    nodeInfosSuccessOnce(createNodes('5.1.1', '5.1.2', '5.1.3')); // emit
+    nodeInfosSuccessOnce(createNodes('5.1.1', '5.1.2', '5.1.3')); // ignore
+    nodeInfosSuccessOnce(createNodes('5.0.0', '5.1.0', '5.2.0')); // emit, different from previous version
 
     pollEsNodesVersion({
-      callWithInternalUser,
+      internalClient,
       esVersionCheckInterval: 1,
       ignoreVersionMismatch: false,
       kibanaVersion: KIBANA_VERSION,
@@ -192,14 +207,21 @@ describe('pollEsNodesVersion', () => {
 
   it('starts polling immediately and then every esVersionCheckInterval', () => {
     expect.assertions(1);
-    callWithInternalUser.mockReturnValueOnce([createNodes('5.1.0', '5.2.0', '5.0.0')]);
-    callWithInternalUser.mockReturnValueOnce([createNodes('5.1.1', '5.2.0', '5.0.0')]);
+
+    // @ts-expect-error we need to return an incompatible type to use the testScheduler here
+    internalClient.nodes.info.mockReturnValueOnce([
+      { body: createNodes('5.1.0', '5.2.0', '5.0.0') },
+    ]);
+    // @ts-expect-error we need to return an incompatible type to use the testScheduler here
+    internalClient.nodes.info.mockReturnValueOnce([
+      { body: createNodes('5.1.1', '5.2.0', '5.0.0') },
+    ]);
 
     getTestScheduler().run(({ expectObservable }) => {
       const expected = 'a 99ms (b|)';
 
       const esNodesCompatibility$ = pollEsNodesVersion({
-        callWithInternalUser,
+        internalClient,
         esVersionCheckInterval: 100,
         ignoreVersionMismatch: false,
         kibanaVersion: KIBANA_VERSION,
@@ -227,15 +249,17 @@ describe('pollEsNodesVersion', () => {
     getTestScheduler().run(({ expectObservable }) => {
       const expected = '100ms a 99ms (b|)';
 
-      callWithInternalUser.mockReturnValueOnce(
-        of(createNodes('5.1.0', '5.2.0', '5.0.0')).pipe(delay(100))
+      internalClient.nodes.info.mockReturnValueOnce(
+        // @ts-expect-error we need to return an incompatible type to use the testScheduler here
+        of({ body: createNodes('5.1.0', '5.2.0', '5.0.0') }).pipe(delay(100))
       );
-      callWithInternalUser.mockReturnValueOnce(
-        of(createNodes('5.1.1', '5.2.0', '5.0.0')).pipe(delay(100))
+      internalClient.nodes.info.mockReturnValueOnce(
+        // @ts-expect-error we need to return an incompatible type to use the testScheduler here
+        of({ body: createNodes('5.1.1', '5.2.0', '5.0.0') }).pipe(delay(100))
       );
 
       const esNodesCompatibility$ = pollEsNodesVersion({
-        callWithInternalUser,
+        internalClient,
         esVersionCheckInterval: 10,
         ignoreVersionMismatch: false,
         kibanaVersion: KIBANA_VERSION,
@@ -256,6 +280,6 @@ describe('pollEsNodesVersion', () => {
       });
     });
 
-    expect(callWithInternalUser).toHaveBeenCalledTimes(2);
+    expect(internalClient.nodes.info).toHaveBeenCalledTimes(2);
   });
 });
diff --git a/src/core/server/elasticsearch/version_check/ensure_es_version.ts b/src/core/server/elasticsearch/version_check/ensure_es_version.ts
index dc56d982d7b4a..5f926215d167f 100644
--- a/src/core/server/elasticsearch/version_check/ensure_es_version.ts
+++ b/src/core/server/elasticsearch/version_check/ensure_es_version.ts
@@ -29,10 +29,10 @@ import {
   esVersionEqualsKibana,
 } from './es_kibana_version_compatability';
 import { Logger } from '../../logging';
-import { LegacyAPICaller } from '../legacy';
+import type { ElasticsearchClient } from '../client';
 
 export interface PollEsNodesVersionOptions {
-  callWithInternalUser: LegacyAPICaller;
+  internalClient: ElasticsearchClient;
   log: Logger;
   kibanaVersion: string;
   ignoreVersionMismatch: boolean;
@@ -137,7 +137,7 @@ function compareNodes(prev: NodesVersionCompatibility, curr: NodesVersionCompati
 }
 
 export const pollEsNodesVersion = ({
-  callWithInternalUser,
+  internalClient,
   log,
   kibanaVersion,
   ignoreVersionMismatch,
@@ -147,10 +147,11 @@ export const pollEsNodesVersion = ({
   return timer(0, healthCheckInterval).pipe(
     exhaustMap(() => {
       return from(
-        callWithInternalUser('nodes.info', {
-          filterPath: ['nodes.*.version', 'nodes.*.http.publish_address', 'nodes.*.ip'],
+        internalClient.nodes.info<NodesInfo>({
+          filter_path: ['nodes.*.version', 'nodes.*.http.publish_address', 'nodes.*.ip'],
         })
       ).pipe(
+        map(({ body }) => body),
         catchError((_err) => {
           return of({ nodes: {} });
         })
diff --git a/src/dev/build/tasks/patch_native_modules_task.js b/src/dev/build/tasks/patch_native_modules_task.js
index a10010ed5255f..c30d1fd774b55 100644
--- a/src/dev/build/tasks/patch_native_modules_task.js
+++ b/src/dev/build/tasks/patch_native_modules_task.js
@@ -26,21 +26,21 @@ const DOWNLOAD_DIRECTORY = '.native_modules';
 const packages = [
   {
     name: 're2',
-    version: '1.14.0',
+    version: '1.15.4',
     destinationPath: 'node_modules/re2/build/Release/re2.node',
     extractMethod: 'gunzip',
     archives: {
       darwin: {
-        url: 'https://github.com/uhop/node-re2/releases/download/1.14.0/darwin-x64-64.gz',
-        sha256: '54c8386cb7cd53895cf379522114bfe82378e300e127e58d392ddd40a77e396f',
+        url: 'https://github.com/uhop/node-re2/releases/download/1.15.4/darwin-x64-64.gz',
+        sha256: '595c6653d796493ddb288fc0732a0d1df8560099796f55a1dd242357d96bb8d6',
       },
       linux: {
-        url: 'https://github.com/uhop/node-re2/releases/download/1.14.0/linux-x64-64.gz',
-        sha256: 'f54f059035e71a7ccb3fa201080e260c41d228d13a8247974b4bb157691b6757',
+        url: 'https://github.com/uhop/node-re2/releases/download/1.15.4/linux-x64-64.gz',
+        sha256: 'e743587bc96314edf10c3e659c03168bc374a5cd9a6623ee99d989251e331f28',
       },
       win32: {
-        url: 'https://github.com/uhop/node-re2/releases/download/1.14.0/win32-x64-64.gz',
-        sha256: 'de708446a8b802f4634c2cfef097c2625a2811fdcd8133dfd7b7c485f966caa9',
+        url: 'https://github.com/uhop/node-re2/releases/download/1.15.4/win32-x64-64.gz',
+        sha256: 'b33de62cda24fb02dc80a19fb79977d686468ac746e97cd211059d2d4c75d529',
       },
     },
   },
diff --git a/src/dev/ci_setup/setup_env.sh b/src/dev/ci_setup/setup_env.sh
index 343ff47199375..86927b694679a 100644
--- a/src/dev/ci_setup/setup_env.sh
+++ b/src/dev/ci_setup/setup_env.sh
@@ -126,6 +126,7 @@ export PATH="$PATH:$yarnGlobalDir"
 # use a proxy to fetch chromedriver/geckodriver asset
 export GECKODRIVER_CDNURL="https://us-central1-elastic-kibana-184716.cloudfunctions.net/kibana-ci-proxy-cache"
 export CHROMEDRIVER_CDNURL="https://us-central1-elastic-kibana-184716.cloudfunctions.net/kibana-ci-proxy-cache"
+export RE2_DOWNLOAD_MIRROR="https://us-central1-elastic-kibana-184716.cloudfunctions.net/kibana-ci-proxy-cache"
 export CYPRESS_DOWNLOAD_MIRROR="https://us-central1-elastic-kibana-184716.cloudfunctions.net/kibana-ci-proxy-cache/cypress"
 
 export CHECKS_REPORTER_ACTIVE=false
diff --git a/src/dev/renovate/config.ts b/src/dev/renovate/config.ts
index d868f0a89b98c..c9688fc0ae0bd 100644
--- a/src/dev/renovate/config.ts
+++ b/src/dev/renovate/config.ts
@@ -21,7 +21,7 @@ import { RENOVATE_PACKAGE_GROUPS } from './package_groups';
 import { PACKAGE_GLOBS } from './package_globs';
 import { wordRegExp, maybeFlatMap, maybeMap, getTypePackageName } from './utils';
 
-const DEFAULT_LABELS = ['release_note:skip', 'Team:Operations', 'renovate', 'v8.0.0', 'v7.9.0'];
+const DEFAULT_LABELS = ['release_note:skip', 'Team:Operations', 'renovate', 'v8.0.0', 'v7.10.0'];
 
 export const RENOVATE_CONFIG = {
   extends: ['config:base'],
diff --git a/src/es_archiver/lib/indices/create_index_stream.ts b/src/es_archiver/lib/indices/create_index_stream.ts
index df9d3bb623ad6..5629f95c7c9c6 100644
--- a/src/es_archiver/lib/indices/create_index_stream.ts
+++ b/src/es_archiver/lib/indices/create_index_stream.ts
@@ -18,6 +18,8 @@
  */
 
 import { Transform, Readable } from 'stream';
+import { inspect } from 'util';
+
 import { get, once } from 'lodash';
 import { Client } from 'elasticsearch';
 import { ToolingLog } from '@kbn/dev-utils';
@@ -84,6 +86,18 @@ export function createCreateIndexStream({
 
         stats.createdIndex(index, { settings });
       } catch (err) {
+        if (
+          err?.body?.error?.reason?.includes('index exists with the same name as the alias') &&
+          attemptNumber < 3
+        ) {
+          const aliasStr = inspect(aliases);
+          log.info(
+            `failed to create aliases [${aliasStr}] because ES indicated an index/alias already exists, trying again`
+          );
+          await attemptToCreate(attemptNumber + 1);
+          return;
+        }
+
         if (
           get(err, 'body.error.type') !== 'resource_already_exists_exception' ||
           attemptNumber >= 3
diff --git a/src/plugins/data/common/field_formats/converters/url.test.ts b/src/plugins/data/common/field_formats/converters/url.test.ts
index 5ee195f8c7752..771bde85626d0 100644
--- a/src/plugins/data/common/field_formats/converters/url.test.ts
+++ b/src/plugins/data/common/field_formats/converters/url.test.ts
@@ -167,8 +167,8 @@ describe('UrlFormat', () => {
     });
   });
 
-  describe('whitelist', () => {
-    test('should assume a relative url if the value is not in the whitelist without a base path', () => {
+  describe('allow-list', () => {
+    test('should assume a relative url if the value is not in the allow-list without a base path', () => {
       const parsedUrl = {
         origin: 'http://kibana',
         basePath: '',
@@ -193,7 +193,7 @@ describe('UrlFormat', () => {
       );
     });
 
-    test('should assume a relative url if the value is not in the whitelist with a basepath', () => {
+    test('should assume a relative url if the value is not in the allow-list with a basepath', () => {
       const parsedUrl = {
         origin: 'http://kibana',
         basePath: '/xyz',
diff --git a/src/plugins/data/common/field_formats/converters/url.ts b/src/plugins/data/common/field_formats/converters/url.ts
index b797159b53486..2630c97b0821b 100644
--- a/src/plugins/data/common/field_formats/converters/url.ts
+++ b/src/plugins/data/common/field_formats/converters/url.ts
@@ -161,8 +161,8 @@ export class UrlFormat extends FieldFormat {
 
         return this.generateImgHtml(url, imageLabel);
       default:
-        const inWhitelist = allowedUrlSchemes.some((scheme) => url.indexOf(scheme) === 0);
-        if (!inWhitelist && !parsedUrl) {
+        const allowed = allowedUrlSchemes.some((scheme) => url.indexOf(scheme) === 0);
+        if (!allowed && !parsedUrl) {
           return url;
         }
 
@@ -178,7 +178,7 @@ export class UrlFormat extends FieldFormat {
          * UNSUPPORTED
          *  - app/kibana
          */
-        if (!inWhitelist) {
+        if (!allowed) {
           // Handles urls like: `#/discover`
           if (url[0] === '#') {
             prefix = `${origin}${pathname}`;
diff --git a/src/plugins/data/public/actions/apply_filter_action.ts b/src/plugins/data/public/actions/apply_filter_action.ts
index 7e8ed5ec8fb22..a2621e6ce8802 100644
--- a/src/plugins/data/public/actions/apply_filter_action.ts
+++ b/src/plugins/data/public/actions/apply_filter_action.ts
@@ -22,6 +22,7 @@ import { toMountPoint } from '../../../kibana_react/public';
 import { ActionByType, createAction, IncompatibleActionError } from '../../../ui_actions/public';
 import { getOverlays, getIndexPatterns } from '../services';
 import { applyFiltersPopover } from '../ui/apply_filters';
+import type { IEmbeddable } from '../../../embeddable/public';
 import { Filter, FilterManager, TimefilterContract, esFilters } from '..';
 
 export const ACTION_GLOBAL_APPLY_FILTER = 'ACTION_GLOBAL_APPLY_FILTER';
@@ -29,6 +30,7 @@ export const ACTION_GLOBAL_APPLY_FILTER = 'ACTION_GLOBAL_APPLY_FILTER';
 export interface ApplyGlobalFilterActionContext {
   filters: Filter[];
   timeFieldName?: string;
+  embeddable?: IEmbeddable;
 }
 
 async function isCompatible(context: ApplyGlobalFilterActionContext) {
diff --git a/src/plugins/data/public/actions/filters/create_filters_from_range_select.ts b/src/plugins/data/public/actions/filters/create_filters_from_range_select.ts
index a0eb49d773f3d..d9aa1b8ec8048 100644
--- a/src/plugins/data/public/actions/filters/create_filters_from_range_select.ts
+++ b/src/plugins/data/public/actions/filters/create_filters_from_range_select.ts
@@ -22,7 +22,7 @@ import moment from 'moment';
 import { esFilters, IFieldType, RangeFilterParams } from '../../../public';
 import { getIndexPatterns } from '../../../public/services';
 import { deserializeAggConfig } from '../../search/expressions/utils';
-import { RangeSelectContext } from '../../../../embeddable/public';
+import type { RangeSelectContext } from '../../../../embeddable/public';
 
 export async function createFiltersFromRangeSelectAction(event: RangeSelectContext['data']) {
   const column: Record<string, any> = event.table.columns[event.column];
diff --git a/src/plugins/data/public/actions/filters/create_filters_from_value_click.ts b/src/plugins/data/public/actions/filters/create_filters_from_value_click.ts
index 1974b9f776748..9429df91f693c 100644
--- a/src/plugins/data/public/actions/filters/create_filters_from_value_click.ts
+++ b/src/plugins/data/public/actions/filters/create_filters_from_value_click.ts
@@ -21,7 +21,7 @@ import { KibanaDatatable } from '../../../../../plugins/expressions/public';
 import { deserializeAggConfig } from '../../search/expressions';
 import { esFilters, Filter } from '../../../public';
 import { getIndexPatterns } from '../../../public/services';
-import { ValueClickContext } from '../../../../embeddable/public';
+import type { ValueClickContext } from '../../../../embeddable/public';
 
 /**
  * For terms aggregations on `__other__` buckets, this assembles a list of applicable filter
diff --git a/src/plugins/data/public/actions/index.ts b/src/plugins/data/public/actions/index.ts
index ef9014aafe82d..692996cf6fd19 100644
--- a/src/plugins/data/public/actions/index.ts
+++ b/src/plugins/data/public/actions/index.ts
@@ -17,8 +17,12 @@
  * under the License.
  */
 
-export { ACTION_GLOBAL_APPLY_FILTER, createFilterAction } from './apply_filter_action';
+export {
+  ACTION_GLOBAL_APPLY_FILTER,
+  createFilterAction,
+  ApplyGlobalFilterActionContext,
+} from './apply_filter_action';
 export { createFiltersFromValueClickAction } from './filters/create_filters_from_value_click';
 export { createFiltersFromRangeSelectAction } from './filters/create_filters_from_range_select';
-export { selectRangeAction } from './select_range_action';
-export { valueClickAction } from './value_click_action';
+export * from './select_range_action';
+export * from './value_click_action';
diff --git a/src/plugins/data/public/actions/select_range_action.ts b/src/plugins/data/public/actions/select_range_action.ts
index 49766143b5588..1781da980dc30 100644
--- a/src/plugins/data/public/actions/select_range_action.ts
+++ b/src/plugins/data/public/actions/select_range_action.ts
@@ -17,60 +17,39 @@
  * under the License.
  */
 
-import { i18n } from '@kbn/i18n';
 import {
-  createAction,
-  IncompatibleActionError,
   ActionByType,
+  APPLY_FILTER_TRIGGER,
+  createAction,
+  UiActionsStart,
 } from '../../../../plugins/ui_actions/public';
 import { createFiltersFromRangeSelectAction } from './filters/create_filters_from_range_select';
-import { RangeSelectContext } from '../../../embeddable/public';
-import { FilterManager, TimefilterContract, esFilters } from '..';
-
-export const ACTION_SELECT_RANGE = 'ACTION_SELECT_RANGE';
+import type { RangeSelectContext } from '../../../embeddable/public';
 
 export type SelectRangeActionContext = RangeSelectContext;
 
-async function isCompatible(context: SelectRangeActionContext) {
-  try {
-    return Boolean(await createFiltersFromRangeSelectAction(context.data));
-  } catch {
-    return false;
-  }
-}
+export const ACTION_SELECT_RANGE = 'ACTION_SELECT_RANGE';
 
-export function selectRangeAction(
-  filterManager: FilterManager,
-  timeFilter: TimefilterContract
+export function createSelectRangeAction(
+  getStartServices: () => { uiActions: UiActionsStart }
 ): ActionByType<typeof ACTION_SELECT_RANGE> {
   return createAction<typeof ACTION_SELECT_RANGE>({
     type: ACTION_SELECT_RANGE,
     id: ACTION_SELECT_RANGE,
-    getIconType: () => 'filter',
-    getDisplayName: () => {
-      return i18n.translate('data.filter.applyFilterActionTitle', {
-        defaultMessage: 'Apply filter to current view',
-      });
-    },
-    isCompatible,
-    execute: async ({ data }: SelectRangeActionContext) => {
-      if (!(await isCompatible({ data }))) {
-        throw new IncompatibleActionError();
-      }
-
-      const selectedFilters = await createFiltersFromRangeSelectAction(data);
-
-      if (data.timeFieldName) {
-        const { timeRangeFilter, restOfFilters } = esFilters.extractTimeFilter(
-          data.timeFieldName,
-          selectedFilters
-        );
-        filterManager.addFilters(restOfFilters);
-        if (timeRangeFilter) {
-          esFilters.changeTimeFilter(timeFilter, timeRangeFilter);
+    shouldAutoExecute: async () => true,
+    execute: async (context: SelectRangeActionContext) => {
+      try {
+        const filters = await createFiltersFromRangeSelectAction(context.data);
+        if (filters.length > 0) {
+          await getStartServices().uiActions.getTrigger(APPLY_FILTER_TRIGGER).exec({
+            filters,
+            embeddable: context.embeddable,
+            timeFieldName: context.data.timeFieldName,
+          });
         }
-      } else {
-        filterManager.addFilters(selectedFilters);
+      } catch (e) {
+        // eslint-disable-next-line no-console
+        console.warn(`Error [ACTION_SELECT_RANGE]: can\'t extract filters from action context`);
       }
     },
   });
diff --git a/src/plugins/data/public/actions/value_click_action.ts b/src/plugins/data/public/actions/value_click_action.ts
index dd74a7ee507f3..81e62380eacfb 100644
--- a/src/plugins/data/public/actions/value_click_action.ts
+++ b/src/plugins/data/public/actions/value_click_action.ts
@@ -17,98 +17,41 @@
  * under the License.
  */
 
-import { i18n } from '@kbn/i18n';
-import { toMountPoint } from '../../../../plugins/kibana_react/public';
 import {
   ActionByType,
+  APPLY_FILTER_TRIGGER,
   createAction,
-  IncompatibleActionError,
+  UiActionsStart,
 } from '../../../../plugins/ui_actions/public';
-import { getOverlays, getIndexPatterns } from '../services';
-import { applyFiltersPopover } from '../ui/apply_filters';
 import { createFiltersFromValueClickAction } from './filters/create_filters_from_value_click';
-import { ValueClickContext } from '../../../embeddable/public';
-import { Filter, FilterManager, TimefilterContract, esFilters } from '..';
-
-export const ACTION_VALUE_CLICK = 'ACTION_VALUE_CLICK';
+import type { Filter } from '../../common/es_query/filters';
+import type { ValueClickContext } from '../../../embeddable/public';
 
 export type ValueClickActionContext = ValueClickContext;
+export const ACTION_VALUE_CLICK = 'ACTION_VALUE_CLICK';
 
-async function isCompatible(context: ValueClickActionContext) {
-  try {
-    const filters: Filter[] = await createFiltersFromValueClickAction(context.data);
-    return filters.length > 0;
-  } catch {
-    return false;
-  }
-}
-
-export function valueClickAction(
-  filterManager: FilterManager,
-  timeFilter: TimefilterContract
+export function createValueClickAction(
+  getStartServices: () => { uiActions: UiActionsStart }
 ): ActionByType<typeof ACTION_VALUE_CLICK> {
   return createAction<typeof ACTION_VALUE_CLICK>({
     type: ACTION_VALUE_CLICK,
     id: ACTION_VALUE_CLICK,
-    getIconType: () => 'filter',
-    getDisplayName: () => {
-      return i18n.translate('data.filter.applyFilterActionTitle', {
-        defaultMessage: 'Apply filter to current view',
-      });
-    },
-    isCompatible,
-    execute: async ({ data }: ValueClickActionContext) => {
-      if (!(await isCompatible({ data }))) {
-        throw new IncompatibleActionError();
-      }
-
-      const filters: Filter[] = await createFiltersFromValueClickAction(data);
-
-      let selectedFilters = filters;
-
-      if (filters.length > 1) {
-        const indexPatterns = await Promise.all(
-          filters.map((filter) => {
-            return getIndexPatterns().get(filter.meta.index!);
-          })
-        );
-
-        const filterSelectionPromise: Promise<Filter[]> = new Promise((resolve) => {
-          const overlay = getOverlays().openModal(
-            toMountPoint(
-              applyFiltersPopover(
-                filters,
-                indexPatterns,
-                () => {
-                  overlay.close();
-                  resolve([]);
-                },
-                (filterSelection: Filter[]) => {
-                  overlay.close();
-                  resolve(filterSelection);
-                }
-              )
-            ),
-            {
-              'data-test-subj': 'selectFilterOverlay',
-            }
-          );
-        });
-
-        selectedFilters = await filterSelectionPromise;
-      }
-
-      if (data.timeFieldName) {
-        const { timeRangeFilter, restOfFilters } = esFilters.extractTimeFilter(
-          data.timeFieldName,
-          selectedFilters
-        );
-        filterManager.addFilters(restOfFilters);
-        if (timeRangeFilter) {
-          esFilters.changeTimeFilter(timeFilter, timeRangeFilter);
+    shouldAutoExecute: async () => true,
+    execute: async (context: ValueClickActionContext) => {
+      try {
+        const filters: Filter[] = await createFiltersFromValueClickAction(context.data);
+        if (filters.length > 0) {
+          await getStartServices().uiActions.getTrigger(APPLY_FILTER_TRIGGER).exec({
+            filters,
+            embeddable: context.embeddable,
+            timeFieldName: context.data.timeFieldName,
+          });
         }
-      } else {
-        filterManager.addFilters(selectedFilters);
+      } catch (e) {
+        // eslint-disable-next-line no-console
+        console.warn(
+          `Error [ACTION_EMIT_APPLY_FILTER_TRIGGER]: can\'t extract filters from action context`
+        );
       }
     },
   });
diff --git a/src/plugins/data/public/index.ts b/src/plugins/data/public/index.ts
index 6328e694193c9..846471420327f 100644
--- a/src/plugins/data/public/index.ts
+++ b/src/plugins/data/public/index.ts
@@ -438,6 +438,8 @@ export {
 
 export { isTimeRange, isQuery, isFilter, isFilters } from '../common';
 
+export { ApplyGlobalFilterActionContext } from './actions';
+
 export * from '../common/field_mapping';
 
 /*
diff --git a/src/plugins/data/public/plugin.ts b/src/plugins/data/public/plugin.ts
index 323a32ea362ac..68c0f506f121d 100644
--- a/src/plugins/data/public/plugin.ts
+++ b/src/plugins/data/public/plugin.ts
@@ -69,18 +69,15 @@ import {
   createFilterAction,
   createFiltersFromValueClickAction,
   createFiltersFromRangeSelectAction,
-} from './actions';
-import { ApplyGlobalFilterActionContext } from './actions/apply_filter_action';
-import {
-  selectRangeAction,
-  SelectRangeActionContext,
+  ApplyGlobalFilterActionContext,
   ACTION_SELECT_RANGE,
-} from './actions/select_range_action';
-import {
-  valueClickAction,
   ACTION_VALUE_CLICK,
+  SelectRangeActionContext,
   ValueClickActionContext,
-} from './actions/value_click_action';
+  createValueClickAction,
+  createSelectRangeAction,
+} from './actions';
+
 import { SavedObjectsClientPublicToCommon } from './index_patterns';
 import { indexPatternLoad } from './index_patterns/expressions/load_index_pattern';
 
@@ -92,7 +89,14 @@ declare module '../../ui_actions/public' {
   }
 }
 
-export class DataPublicPlugin implements Plugin<DataPublicPluginSetup, DataPublicPluginStart> {
+export class DataPublicPlugin
+  implements
+    Plugin<
+      DataPublicPluginSetup,
+      DataPublicPluginStart,
+      DataSetupDependencies,
+      DataStartDependencies
+    > {
   private readonly autocomplete: AutocompleteService;
   private readonly searchService: SearchService;
   private readonly fieldFormatsService: FieldFormatsService;
@@ -110,13 +114,13 @@ export class DataPublicPlugin implements Plugin<DataPublicPluginSetup, DataPubli
   }
 
   public setup(
-    core: CoreSetup,
+    core: CoreSetup<DataStartDependencies, DataPublicPluginStart>,
     { expressions, uiActions, usageCollection }: DataSetupDependencies
   ): DataPublicPluginSetup {
     const startServices = createStartServicesGetter(core.getStartServices);
 
     const getInternalStartServices = (): InternalStartServices => {
-      const { core: coreStart, self }: any = startServices();
+      const { core: coreStart, self } = startServices();
       return {
         fieldFormats: self.fieldFormats,
         notifications: coreStart.notifications,
@@ -140,12 +144,16 @@ export class DataPublicPlugin implements Plugin<DataPublicPluginSetup, DataPubli
 
     uiActions.addTriggerAction(
       SELECT_RANGE_TRIGGER,
-      selectRangeAction(queryService.filterManager, queryService.timefilter.timefilter)
+      createSelectRangeAction(() => ({
+        uiActions: startServices().plugins.uiActions,
+      }))
     );
 
     uiActions.addTriggerAction(
       VALUE_CLICK_TRIGGER,
-      valueClickAction(queryService.filterManager, queryService.timefilter.timefilter)
+      createValueClickAction(() => ({
+        uiActions: startServices().plugins.uiActions,
+      }))
     );
 
     return {
diff --git a/src/plugins/data/public/public.api.md b/src/plugins/data/public/public.api.md
index f8b8cb43b2297..38e0416233e25 100644
--- a/src/plugins/data/public/public.api.md
+++ b/src/plugins/data/public/public.api.md
@@ -250,6 +250,20 @@ export class AggParamType<TAggConfig extends IAggConfig = IAggConfig> extends Ba
     makeAgg: (agg: TAggConfig, state?: AggConfigSerialized) => TAggConfig;
 }
 
+// Warning: (ae-missing-release-tag) "ApplyGlobalFilterActionContext" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
+//
+// @public (undocumented)
+export interface ApplyGlobalFilterActionContext {
+    // Warning: (ae-forgotten-export) The symbol "IEmbeddable" needs to be exported by the entry point index.d.ts
+    //
+    // (undocumented)
+    embeddable?: IEmbeddable;
+    // (undocumented)
+    filters: Filter[];
+    // (undocumented)
+    timeFieldName?: string;
+}
+
 // Warning: (ae-forgotten-export) The symbol "DateNanosFormat" needs to be exported by the entry point index.d.ts
 // Warning: (ae-forgotten-export) The symbol "DateFormat" needs to be exported by the entry point index.d.ts
 // Warning: (ae-missing-release-tag) "baseFormattersPublic" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
@@ -1443,18 +1457,16 @@ export type PhrasesFilter = Filter & {
     meta: PhrasesFilterMeta;
 };
 
+// Warning: (ae-forgotten-export) The symbol "DataSetupDependencies" needs to be exported by the entry point index.d.ts
+// Warning: (ae-forgotten-export) The symbol "DataStartDependencies" needs to be exported by the entry point index.d.ts
 // Warning: (ae-missing-release-tag) "DataPublicPlugin" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
-export class Plugin implements Plugin_2<DataPublicPluginSetup, DataPublicPluginStart> {
+export class Plugin implements Plugin_2<DataPublicPluginSetup, DataPublicPluginStart, DataSetupDependencies, DataStartDependencies> {
     // Warning: (ae-forgotten-export) The symbol "ConfigSchema" needs to be exported by the entry point index.d.ts
     constructor(initializerContext: PluginInitializerContext_2<ConfigSchema>);
-    // Warning: (ae-forgotten-export) The symbol "DataSetupDependencies" needs to be exported by the entry point index.d.ts
-    //
     // (undocumented)
-    setup(core: CoreSetup, { expressions, uiActions, usageCollection }: DataSetupDependencies): DataPublicPluginSetup;
-    // Warning: (ae-forgotten-export) The symbol "DataStartDependencies" needs to be exported by the entry point index.d.ts
-    //
+    setup(core: CoreSetup<DataStartDependencies, DataPublicPluginStart>, { expressions, uiActions, usageCollection }: DataSetupDependencies): DataPublicPluginSetup;
     // (undocumented)
     start(core: CoreStart_2, { uiActions }: DataStartDependencies): DataPublicPluginStart;
     // (undocumented)
diff --git a/src/plugins/dev_tools/public/plugin.ts b/src/plugins/dev_tools/public/plugin.ts
index 3ee44aaa0816e..45fa3634bc87e 100644
--- a/src/plugins/dev_tools/public/plugin.ts
+++ b/src/plugins/dev_tools/public/plugin.ts
@@ -61,7 +61,7 @@ export class DevToolsPlugin implements Plugin<DevToolsSetup, void> {
       }),
       updater$: this.appStateUpdater,
       euiIconType: 'devToolsApp',
-      order: 9001,
+      order: 9010,
       category: DEFAULT_APP_CATEGORIES.management,
       mount: async (params: AppMountParameters) => {
         const { element, history } = params;
diff --git a/src/plugins/discover/public/application/components/sidebar/discover_field.tsx b/src/plugins/discover/public/application/components/sidebar/discover_field.tsx
index 5f40c55e30e7e..724908281146d 100644
--- a/src/plugins/discover/public/application/components/sidebar/discover_field.tsx
+++ b/src/plugins/discover/public/application/components/sidebar/discover_field.tsx
@@ -17,7 +17,7 @@
  * under the License.
  */
 import React from 'react';
-import { EuiButton, EuiText } from '@elastic/eui';
+import { EuiButton } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { DiscoverFieldDetails } from './discover_field_details';
 import { FieldIcon } from '../../../../../kibana_react/public';
@@ -108,6 +108,13 @@ export function DiscoverField({
     }
   };
 
+  function wrapOnDot(str?: string) {
+    // u200B is a non-width white-space character, which allows
+    // the browser to efficiently word-wrap right after the dot
+    // without us having to draw a lot of extra DOM elements, etc
+    return str ? str.replace(/\./g, '.\u200B') : '';
+  }
+
   return (
     <>
       <div
@@ -124,15 +131,12 @@ export function DiscoverField({
             scripted={field.scripted}
           />
         </span>
-        <span className="dscSidebarField__name eui-textTruncate">
-          <EuiText
-            size="xs"
-            data-test-subj={`field-${field.name}`}
-            className="eui-textTruncate"
-            title={field.name}
-          >
-            {useShortDots ? shortenDottedString(field.name) : field.displayName}
-          </EuiText>
+        <span
+          data-test-subj={`field-${field.name}`}
+          title={field.name}
+          className="dscSidebarField__name"
+        >
+          {useShortDots ? wrapOnDot(shortenDottedString(field.name)) : wrapOnDot(field.displayName)}
         </span>
         <span>
           {field.name !== '_source' && !selected && (
diff --git a/src/plugins/discover/public/application/components/sidebar/discover_sidebar.scss b/src/plugins/discover/public/application/components/sidebar/discover_sidebar.scss
index ae7e915f09773..07efd64752c84 100644
--- a/src/plugins/discover/public/application/components/sidebar/discover_sidebar.scss
+++ b/src/plugins/discover/public/application/components/sidebar/discover_sidebar.scss
@@ -23,13 +23,6 @@
   margin-bottom: 0;
 }
 
-.dscFieldList--selected,
-.dscFieldList--unpopular,
-.dscFieldList--popular {
-  padding-left: $euiSizeS;
-  padding-right: $euiSizeS;
-}
-
 .dscFieldListHeader {
   padding: $euiSizeS $euiSizeS 0 $euiSizeS;
   background-color: lightOrDarkTheme(tint($euiColorPrimary, 90%), $euiColorLightShade);
@@ -40,8 +33,7 @@
 }
 
 .dscFieldChooser {
-  padding-left: $euiSizeS !important;
-  padding-right: $euiSizeS !important;
+  padding-left: $euiSize;
 }
 
 .dscFieldChooser__toggle {
@@ -55,12 +47,12 @@
   display: flex;
   align-items: center;
   justify-content: space-between;
-  padding: 0 2px;
   cursor: pointer;
   font-size: $euiFontSizeXS;
   border-top: solid 1px transparent;
   border-bottom: solid 1px transparent;
   line-height: normal;
+  margin-bottom: $euiSizeXS * 0.5;
 
   &:hover,
   &:focus {
@@ -72,28 +64,25 @@
 
 .dscSidebarItem--active {
   border-top: 1px solid $euiColorLightShade;
-  background: shade($euiColorLightestShade, 5%);
   color: $euiColorFullShade;
-  .euiText {
-    font-weight: bold;
-  }
 }
 
 .dscSidebarField {
-  padding: $euiSizeXS 0;
+  padding: $euiSizeXS;
   display: flex;
-  align-items: flex-start;
+  align-items: center;
   max-width: 100%;
-  margin: 0;
   width: 100%;
   border: none;
-  border-radius: 0;
+  border-radius: $euiBorderRadius - 1px;
   text-align: left;
 }
 
 .dscSidebarField__name {
   margin-left: $euiSizeS;
   flex-grow: 1;
+  word-break: break-word;
+  padding-right: 1px;
 }
 
 .dscSidebarField__fieldIcon {
diff --git a/src/plugins/discover/public/application/components/sidebar/discover_sidebar.tsx b/src/plugins/discover/public/application/components/sidebar/discover_sidebar.tsx
index 96e04c13d70e9..e8ed8b80da3bb 100644
--- a/src/plugins/discover/public/application/components/sidebar/discover_sidebar.tsx
+++ b/src/plugins/discover/public/application/components/sidebar/discover_sidebar.tsx
@@ -19,7 +19,7 @@
 import './discover_sidebar.scss';
 import React, { useCallback, useEffect, useState, useMemo } from 'react';
 import { i18n } from '@kbn/i18n';
-import { EuiButtonIcon, EuiTitle } from '@elastic/eui';
+import { EuiButtonIcon, EuiTitle, EuiSpacer } from '@elastic/eui';
 import { sortBy } from 'lodash';
 import { FormattedMessage, I18nProvider } from '@kbn/i18n/react';
 import { DiscoverField } from './discover_field';
@@ -199,6 +199,7 @@ export function DiscoverSidebar({
                   />
                 </h3>
               </EuiTitle>
+              <EuiSpacer size="xs" />
               <ul
                 className="dscSidebarList dscFieldList--selected"
                 aria-labelledby="selected_fields"
diff --git a/src/plugins/embeddable/public/lib/panel/embeddable_panel.tsx b/src/plugins/embeddable/public/lib/panel/embeddable_panel.tsx
index 8cf2e015f88cf..cb02ffc470e95 100644
--- a/src/plugins/embeddable/public/lib/panel/embeddable_panel.tsx
+++ b/src/plugins/embeddable/public/lib/panel/embeddable_panel.tsx
@@ -311,8 +311,7 @@ export class EmbeddablePanel extends React.Component<Props, State> {
     const sortedActions = [...regularActions, ...extraActions].sort(sortByOrderField);
 
     return await buildContextMenuForActions({
-      actions: sortedActions,
-      actionContext: { embeddable: this.props.embeddable },
+      actions: sortedActions.map((action) => [action, { embeddable: this.props.embeddable }]),
       closeMenu: this.closeMyContextMenuPanel,
     });
   };
diff --git a/src/plugins/es_ui_shared/public/forms/multi_content/multi_content_context.tsx b/src/plugins/es_ui_shared/public/forms/multi_content/multi_content_context.tsx
index 210b0cedccd06..c5659745f229a 100644
--- a/src/plugins/es_ui_shared/public/forms/multi_content/multi_content_context.tsx
+++ b/src/plugins/es_ui_shared/public/forms/multi_content/multi_content_context.tsx
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import React, { useEffect, useCallback, createContext, useContext } from 'react';
+import React, { useEffect, useCallback, createContext, useContext, useRef } from 'react';
 
 import { useMultiContent, HookProps, Content, MultiContent } from './use_multi_content';
 
@@ -55,7 +55,14 @@ export function useMultiContentContext<T extends object = { [key: string]: any }
  * @param contentId The content id to be added to the "contents" map
  */
 export function useContent<T extends object, K extends keyof T>(contentId: K) {
-  const { updateContentAt, saveSnapshotAndRemoveContent, getData } = useMultiContentContext<T>();
+  const isMounted = useRef(false);
+  const defaultValue = useRef<T[K] | undefined>(undefined);
+  const {
+    updateContentAt,
+    saveSnapshotAndRemoveContent,
+    getData,
+    getSingleContentData,
+  } = useMultiContentContext<T>();
 
   const updateContent = useCallback(
     (content: Content) => {
@@ -71,12 +78,22 @@ export function useContent<T extends object, K extends keyof T>(contentId: K) {
     };
   }, [contentId, saveSnapshotAndRemoveContent]);
 
-  const data = getData();
-  const defaultValue = data[contentId];
+  useEffect(() => {
+    if (isMounted.current === false) {
+      isMounted.current = true;
+    }
+  }, []);
+
+  if (isMounted.current === false) {
+    // Only read the default value once, on component mount to avoid re-rendering the
+    // consumer each time the multi-content validity ("isValid") changes.
+    defaultValue.current = getSingleContentData(contentId);
+  }
 
   return {
-    defaultValue,
+    defaultValue: defaultValue.current!,
     updateContent,
     getData,
+    getSingleContentData,
   };
 }
diff --git a/src/plugins/es_ui_shared/public/forms/multi_content/use_multi_content.ts b/src/plugins/es_ui_shared/public/forms/multi_content/use_multi_content.ts
index adc68a39a4a5b..8d470f6454b0e 100644
--- a/src/plugins/es_ui_shared/public/forms/multi_content/use_multi_content.ts
+++ b/src/plugins/es_ui_shared/public/forms/multi_content/use_multi_content.ts
@@ -45,6 +45,7 @@ export interface MultiContent<T extends object> {
   updateContentAt: (id: keyof T, content: Content) => void;
   saveSnapshotAndRemoveContent: (id: keyof T) => void;
   getData: () => T;
+  getSingleContentData: <K extends keyof T>(contentId: K) => T[K];
   validate: () => Promise<boolean>;
   validation: Validation<T>;
 }
@@ -109,9 +110,22 @@ export function useMultiContent<T extends object>({
     };
   }, [stateData, validation]);
 
+  /**
+   * Read a single content data.
+   */
+  const getSingleContentData = useCallback(
+    <K extends keyof T>(contentId: K): T[K] => {
+      if (contents.current[contentId]) {
+        return contents.current[contentId].getData();
+      }
+      return stateData[contentId];
+    },
+    [stateData]
+  );
+
   const updateContentValidity = useCallback(
     (updatedData: { [key in keyof T]?: boolean | undefined }): boolean | undefined => {
-      let allContentValidity: boolean | undefined;
+      let isAllContentValid: boolean | undefined = validation.isValid;
 
       setValidation((prev) => {
         if (
@@ -120,7 +134,7 @@ export function useMultiContent<T extends object>({
           )
         ) {
           // No change in validation, nothing to update
-          allContentValidity = prev.isValid;
+          isAllContentValid = prev.isValid;
           return prev;
         }
 
@@ -129,21 +143,21 @@ export function useMultiContent<T extends object>({
           ...updatedData,
         };
 
-        allContentValidity = Object.values(nextContentsValidityState).some(
+        isAllContentValid = Object.values(nextContentsValidityState).some(
           (_isValid) => _isValid === undefined
         )
           ? undefined
           : Object.values(nextContentsValidityState).every(Boolean);
 
         return {
-          isValid: allContentValidity,
+          isValid: isAllContentValid,
           contents: nextContentsValidityState,
         };
       });
 
-      return allContentValidity;
+      return isAllContentValid;
     },
-    []
+    [validation.isValid]
   );
 
   /**
@@ -163,7 +177,7 @@ export function useMultiContent<T extends object>({
     }
 
     return Boolean(updateContentValidity(updatedValidation));
-  }, [updateContentValidity]);
+  }, [validation.isValid, updateContentValidity]);
 
   /**
    * Update a content. It replaces the content in our "contents" map and update
@@ -186,7 +200,7 @@ export function useMultiContent<T extends object>({
         });
       }
     },
-    [updateContentValidity, onChange]
+    [updateContentValidity, onChange, getData, validate]
   );
 
   /**
@@ -211,6 +225,7 @@ export function useMultiContent<T extends object>({
 
   return {
     getData,
+    getSingleContentData,
     validate,
     validation,
     updateContentAt,
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/form_data_provider.ts b/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/form_data_provider.ts
index 4c4a7f0642022..4c8e91b13b1b7 100644
--- a/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/form_data_provider.ts
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/form_data_provider.ts
@@ -29,6 +29,7 @@ interface Props {
 
 export const FormDataProvider = React.memo(({ children, pathsToWatch }: Props) => {
   const form = useFormContext();
+  const { subscribe } = form;
   const previousRawData = useRef<FormData>(form.__getFormData$().value);
   const [formData, setFormData] = useState<FormData>(previousRawData.current);
 
@@ -54,9 +55,9 @@ export const FormDataProvider = React.memo(({ children, pathsToWatch }: Props) =
   );
 
   useEffect(() => {
-    const subscription = form.subscribe(onFormData);
+    const subscription = subscribe(onFormData);
     return subscription.unsubscribe;
-  }, [form.subscribe, onFormData]);
+  }, [subscribe, onFormData]);
 
   return children(formData);
 });
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_array.ts b/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_array.ts
index 1605c09f575f6..3688421964d2e 100644
--- a/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_array.ts
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_array.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import { useState, useEffect, useRef } from 'react';
+import { useState, useEffect, useRef, useCallback } from 'react';
 
 import { useFormContext } from '../form_context';
 
@@ -83,14 +83,18 @@ export const UseArray = ({
 
   const [items, setItems] = useState<ArrayItem[]>(initialState);
 
-  const updatePaths = (_rows: ArrayItem[]) =>
-    _rows.map(
-      (row, index) =>
-        ({
-          ...row,
-          path: `${path}[${index}]`,
-        } as ArrayItem)
-    );
+  const updatePaths = useCallback(
+    (_rows: ArrayItem[]) => {
+      return _rows.map(
+        (row, index) =>
+          ({
+            ...row,
+            path: `${path}[${index}]`,
+          } as ArrayItem)
+      );
+    },
+    [path]
+  );
 
   const addItem = () => {
     setItems((previousItems) => {
@@ -108,11 +112,13 @@ export const UseArray = ({
 
   useEffect(() => {
     if (didMountRef.current) {
-      setItems(updatePaths(items));
+      setItems((prev) => {
+        return updatePaths(prev);
+      });
     } else {
       didMountRef.current = true;
     }
-  }, [path]);
+  }, [path, updatePaths]);
 
   return children({ items, addItem, removeItem });
 };
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_field.test.tsx b/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_field.test.tsx
index 7ad32cb0bc3f0..f00beb470a9fc 100644
--- a/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_field.test.tsx
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/components/use_field.test.tsx
@@ -30,8 +30,9 @@ describe('<UseField />', () => {
 
     const TestComp = ({ onData }: { onData: OnUpdateHandler }) => {
       const { form } = useForm();
+      const { subscribe } = form;
 
-      useEffect(() => form.subscribe(onData).unsubscribe, [form]);
+      useEffect(() => subscribe(onData).unsubscribe, [subscribe, onData]);
 
       return (
         <Form form={form}>
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_field.ts b/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_field.ts
index b83006c6cec52..b2f00610a3d33 100644
--- a/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_field.ts
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_field.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import { useState, useEffect, useRef, useMemo } from 'react';
+import { useMemo, useState, useEffect, useRef, useCallback } from 'react';
 
 import { FormHook, FieldHook, FieldConfig, FieldValidateResponse, ValidationError } from '../types';
 import { FIELD_TYPES, VALIDATION_TYPES } from '../constants';
@@ -34,21 +34,21 @@ export const useField = <T>(
     label = '',
     labelAppend = '',
     helpText = '',
-    validations = [],
-    formatters = [],
-    fieldsToValidateOnChange = [path],
+    validations,
+    formatters,
+    fieldsToValidateOnChange,
     errorDisplayDelay = form.__options.errorDisplayDelay,
-    serializer = (value: unknown) => value,
-    deserializer = (value: unknown) => value,
+    serializer,
+    deserializer,
   } = config;
+  const { getFormData, __removeField, __updateFormDataAt, __validateFields } = form;
 
-  const initialValue = useMemo(
-    () =>
-      typeof defaultValue === 'function'
-        ? deserializer(defaultValue())
-        : deserializer(defaultValue),
-    [defaultValue]
-  ) as T;
+  const initialValue = useMemo(() => {
+    if (typeof defaultValue === 'function') {
+      return deserializer ? deserializer(defaultValue()) : defaultValue();
+    }
+    return deserializer ? deserializer(defaultValue) : defaultValue;
+  }, [defaultValue, deserializer]) as T;
 
   const [value, setStateValue] = useState<T>(initialValue);
   const [errors, setErrors] = useState<ValidationError[]>([]);
@@ -64,6 +64,12 @@ export const useField = <T>(
 
   // -- HELPERS
   // ----------------------------------
+  const serializeOutput: FieldHook<T>['__serializeOutput'] = useCallback(
+    (rawValue = value) => {
+      return serializer ? serializer(rawValue) : rawValue;
+    },
+    [serializer, value]
+  );
 
   /**
    * Filter an array of errors with specific validation type on them
@@ -84,19 +90,22 @@ export const useField = <T>(
     );
   };
 
-  const formatInputValue = <T>(inputValue: unknown): T => {
-    const isEmptyString = typeof inputValue === 'string' && inputValue.trim() === '';
+  const formatInputValue = useCallback(
+    <T>(inputValue: unknown): T => {
+      const isEmptyString = typeof inputValue === 'string' && inputValue.trim() === '';
 
-    if (isEmptyString) {
-      return inputValue as T;
-    }
+      if (isEmptyString || !formatters) {
+        return inputValue as T;
+      }
 
-    const formData = form.getFormData({ unflatten: false });
+      const formData = getFormData({ unflatten: false });
 
-    return formatters.reduce((output, formatter) => formatter(output, formData), inputValue) as T;
-  };
+      return formatters.reduce((output, formatter) => formatter(output, formData), inputValue) as T;
+    },
+    [formatters, getFormData]
+  );
 
-  const onValueChange = async () => {
+  const onValueChange = useCallback(async () => {
     const changeIteration = ++changeCounter.current;
     const startTime = Date.now();
 
@@ -116,10 +125,10 @@ export const useField = <T>(
     }
 
     // Update the form data observable
-    form.__updateFormDataAt(path, newValue);
+    __updateFormDataAt(path, newValue);
 
-    // Validate field(s) and set form.isValid flag
-    await form.__validateFields(fieldsToValidateOnChange);
+    // Validate field(s) and update form.isValid state
+    await __validateFields(fieldsToValidateOnChange ?? [path]);
 
     if (isUnmounted.current) {
       return;
@@ -142,9 +151,18 @@ export const useField = <T>(
         setIsChangingValue(false);
       }
     }
-  };
+  }, [
+    serializeOutput,
+    valueChangeListener,
+    errorDisplayDelay,
+    path,
+    value,
+    fieldsToValidateOnChange,
+    __updateFormDataAt,
+    __validateFields,
+  ]);
 
-  const cancelInflightValidation = () => {
+  const cancelInflightValidation = useCallback(() => {
     // Cancel any inflight validation (like an HTTP Request)
     if (
       inflightValidation.current &&
@@ -153,209 +171,232 @@ export const useField = <T>(
       (inflightValidation.current as any).cancel();
       inflightValidation.current = null;
     }
-  };
+  }, []);
 
-  const runValidations = ({
-    formData,
-    value: valueToValidate,
-    validationTypeToValidate,
-  }: {
-    formData: any;
-    value: unknown;
-    validationTypeToValidate?: string;
-  }): ValidationError[] | Promise<ValidationError[]> => {
-    // By default, for fields that have an asynchronous validation
-    // we will clear the errors as soon as the field value changes.
-    clearErrors([VALIDATION_TYPES.FIELD, VALIDATION_TYPES.ASYNC]);
-
-    cancelInflightValidation();
-
-    const runAsync = async () => {
-      const validationErrors: ValidationError[] = [];
-
-      for (const validation of validations) {
-        inflightValidation.current = null;
-
-        const {
-          validator,
-          exitOnFail = true,
-          type: validationType = VALIDATION_TYPES.FIELD,
-        } = validation;
-
-        if (
-          typeof validationTypeToValidate !== 'undefined' &&
-          validationType !== validationTypeToValidate
-        ) {
-          continue;
-        }
-
-        inflightValidation.current = validator({
-          value: (valueToValidate as unknown) as string,
-          errors: validationErrors,
-          form,
-          formData,
-          path,
-        }) as Promise<ValidationError>;
-
-        const validationResult = await inflightValidation.current;
-
-        if (!validationResult) {
-          continue;
-        }
-
-        validationErrors.push({
-          ...validationResult,
-          validationType: validationType || VALIDATION_TYPES.FIELD,
-        });
+  const clearErrors: FieldHook['clearErrors'] = useCallback(
+    (validationType = VALIDATION_TYPES.FIELD) => {
+      setErrors((previousErrors) => filterErrors(previousErrors, validationType));
+    },
+    []
+  );
 
-        if (exitOnFail) {
-          break;
-        }
+  const runValidations = useCallback(
+    ({
+      formData,
+      value: valueToValidate,
+      validationTypeToValidate,
+    }: {
+      formData: any;
+      value: unknown;
+      validationTypeToValidate?: string;
+    }): ValidationError[] | Promise<ValidationError[]> => {
+      if (!validations) {
+        return [];
       }
 
-      return validationErrors;
-    };
-
-    const runSync = () => {
-      const validationErrors: ValidationError[] = [];
-      // Sequentially execute all the validations for the field
-      for (const validation of validations) {
-        const {
-          validator,
-          exitOnFail = true,
-          type: validationType = VALIDATION_TYPES.FIELD,
-        } = validation;
-
-        if (
-          typeof validationTypeToValidate !== 'undefined' &&
-          validationType !== validationTypeToValidate
-        ) {
-          continue;
-        }
-
-        const validationResult = validator({
-          value: (valueToValidate as unknown) as string,
-          errors: validationErrors,
-          form,
-          formData,
-          path,
-        });
-
-        if (!validationResult) {
-          continue;
+      // By default, for fields that have an asynchronous validation
+      // we will clear the errors as soon as the field value changes.
+      clearErrors([VALIDATION_TYPES.FIELD, VALIDATION_TYPES.ASYNC]);
+
+      cancelInflightValidation();
+
+      const runAsync = async () => {
+        const validationErrors: ValidationError[] = [];
+
+        for (const validation of validations) {
+          inflightValidation.current = null;
+
+          const {
+            validator,
+            exitOnFail = true,
+            type: validationType = VALIDATION_TYPES.FIELD,
+          } = validation;
+
+          if (
+            typeof validationTypeToValidate !== 'undefined' &&
+            validationType !== validationTypeToValidate
+          ) {
+            continue;
+          }
+
+          inflightValidation.current = validator({
+            value: (valueToValidate as unknown) as string,
+            errors: validationErrors,
+            form,
+            formData,
+            path,
+          }) as Promise<ValidationError>;
+
+          const validationResult = await inflightValidation.current;
+
+          if (!validationResult) {
+            continue;
+          }
+
+          validationErrors.push({
+            ...validationResult,
+            validationType: validationType || VALIDATION_TYPES.FIELD,
+          });
+
+          if (exitOnFail) {
+            break;
+          }
         }
 
-        if (!!validationResult.then) {
-          // The validator returned a Promise: abort and run the validations asynchronously
-          // We keep a reference to the onflith promise so we can cancel it.
-
-          inflightValidation.current = validationResult as Promise<ValidationError>;
-          cancelInflightValidation();
-
-          return runAsync();
-        }
-
-        validationErrors.push({
-          ...(validationResult as ValidationError),
-          validationType: validationType || VALIDATION_TYPES.FIELD,
-        });
+        return validationErrors;
+      };
 
-        if (exitOnFail) {
-          break;
+      const runSync = () => {
+        const validationErrors: ValidationError[] = [];
+        // Sequentially execute all the validations for the field
+        for (const validation of validations) {
+          const {
+            validator,
+            exitOnFail = true,
+            type: validationType = VALIDATION_TYPES.FIELD,
+          } = validation;
+
+          if (
+            typeof validationTypeToValidate !== 'undefined' &&
+            validationType !== validationTypeToValidate
+          ) {
+            continue;
+          }
+
+          const validationResult = validator({
+            value: (valueToValidate as unknown) as string,
+            errors: validationErrors,
+            form,
+            formData,
+            path,
+          });
+
+          if (!validationResult) {
+            continue;
+          }
+
+          if (!!validationResult.then) {
+            // The validator returned a Promise: abort and run the validations asynchronously
+            // We keep a reference to the onflith promise so we can cancel it.
+
+            inflightValidation.current = validationResult as Promise<ValidationError>;
+            cancelInflightValidation();
+
+            return runAsync();
+          }
+
+          validationErrors.push({
+            ...(validationResult as ValidationError),
+            validationType: validationType || VALIDATION_TYPES.FIELD,
+          });
+
+          if (exitOnFail) {
+            break;
+          }
         }
-      }
 
-      return validationErrors;
-    };
+        return validationErrors;
+      };
 
-    // We first try to run the validations synchronously
-    return runSync();
-  };
+      // We first try to run the validations synchronously
+      return runSync();
+    },
+    [clearErrors, cancelInflightValidation, validations, form, path]
+  );
 
   // -- API
   // ----------------------------------
-  const clearErrors: FieldHook['clearErrors'] = (validationType = VALIDATION_TYPES.FIELD) => {
-    setErrors((previousErrors) => filterErrors(previousErrors, validationType));
-  };
 
   /**
    * Validate a form field, running all its validations.
    * If a validationType is provided then only that validation will be executed,
    * skipping the other type of validation that might exist.
    */
-  const validate: FieldHook<T>['validate'] = (validationData = {}) => {
-    const {
-      formData = form.getFormData({ unflatten: false }),
-      value: valueToValidate = value,
-      validationType,
-    } = validationData;
-
-    setIsValidated(true);
-    setValidating(true);
-
-    // By the time our validate function has reached completion, it’s possible
-    // that validate() will have been called again. If this is the case, we need
-    // to ignore the results of this invocation and only use the results of
-    // the most recent invocation to update the error state for a field
-    const validateIteration = ++validateCounter.current;
-
-    const onValidationErrors = (_validationErrors: ValidationError[]): FieldValidateResponse => {
-      if (validateIteration === validateCounter.current) {
-        // This is the most recent invocation
-        setValidating(false);
-        // Update the errors array
-        const filteredErrors = filterErrors(errors, validationType);
-        setErrors([...filteredErrors, ..._validationErrors]);
-      }
+  const validate: FieldHook<T>['validate'] = useCallback(
+    (validationData = {}) => {
+      const {
+        formData = getFormData({ unflatten: false }),
+        value: valueToValidate = value,
+        validationType,
+      } = validationData;
+
+      setIsValidated(true);
+      setValidating(true);
+
+      // By the time our validate function has reached completion, it’s possible
+      // that validate() will have been called again. If this is the case, we need
+      // to ignore the results of this invocation and only use the results of
+      // the most recent invocation to update the error state for a field
+      const validateIteration = ++validateCounter.current;
+
+      const onValidationErrors = (_validationErrors: ValidationError[]): FieldValidateResponse => {
+        if (validateIteration === validateCounter.current) {
+          // This is the most recent invocation
+          setValidating(false);
+          // Update the errors array
+          setErrors((prev) => {
+            const filteredErrors = filterErrors(prev, validationType);
+            return [...filteredErrors, ..._validationErrors];
+          });
+        }
 
-      return {
-        isValid: _validationErrors.length === 0,
-        errors: _validationErrors,
+        return {
+          isValid: _validationErrors.length === 0,
+          errors: _validationErrors,
+        };
       };
-    };
 
-    const validationErrors = runValidations({
-      formData,
-      value: valueToValidate,
-      validationTypeToValidate: validationType,
-    });
+      const validationErrors = runValidations({
+        formData,
+        value: valueToValidate,
+        validationTypeToValidate: validationType,
+      });
 
-    if (Reflect.has(validationErrors, 'then')) {
-      return (validationErrors as Promise<ValidationError[]>).then(onValidationErrors);
-    }
-    return onValidationErrors(validationErrors as ValidationError[]);
-  };
+      if (Reflect.has(validationErrors, 'then')) {
+        return (validationErrors as Promise<ValidationError[]>).then(onValidationErrors);
+      }
+      return onValidationErrors(validationErrors as ValidationError[]);
+    },
+    [getFormData, value, runValidations]
+  );
 
   /**
    * Handler to change the field value
    *
    * @param newValue The new value to assign to the field
    */
-  const setValue: FieldHook<T>['setValue'] = (newValue) => {
-    if (isPristine) {
-      setPristine(false);
-    }
+  const setValue: FieldHook<T>['setValue'] = useCallback(
+    (newValue) => {
+      if (isPristine) {
+        setPristine(false);
+      }
 
-    const formattedValue = formatInputValue<T>(newValue);
-    setStateValue(formattedValue);
-  };
+      const formattedValue = formatInputValue<T>(newValue);
+      setStateValue(formattedValue);
+      return formattedValue;
+    },
+    [formatInputValue, isPristine]
+  );
 
-  const _setErrors: FieldHook<T>['setErrors'] = (_errors) => {
+  const _setErrors: FieldHook<T>['setErrors'] = useCallback((_errors) => {
     setErrors(_errors.map((error) => ({ validationType: VALIDATION_TYPES.FIELD, ...error })));
-  };
+  }, []);
 
   /**
    * Form <input /> "onChange" event handler
    *
    * @param event Form input change event
    */
-  const onChange: FieldHook<T>['onChange'] = (event) => {
-    const newValue = {}.hasOwnProperty.call(event!.target, 'checked')
-      ? event.target.checked
-      : event.target.value;
+  const onChange: FieldHook<T>['onChange'] = useCallback(
+    (event) => {
+      const newValue = {}.hasOwnProperty.call(event!.target, 'checked')
+        ? event.target.checked
+        : event.target.value;
 
-    setValue((newValue as unknown) as T);
-  };
+      setValue((newValue as unknown) as T);
+    },
+    [setValue]
+  );
 
   /**
    * As we can have multiple validation types (FIELD, ASYNC, ARRAY_ITEM), this
@@ -367,48 +408,50 @@ export const useField = <T>(
    *
    * @param validationType The validation type to return error messages from
    */
-  const getErrorsMessages: FieldHook<T>['getErrorsMessages'] = (args = {}) => {
-    const { errorCode, validationType = VALIDATION_TYPES.FIELD } = args;
-    const errorMessages = errors.reduce((messages, error) => {
-      const isSameErrorCode = errorCode && error.code === errorCode;
-      const isSamevalidationType =
-        error.validationType === validationType ||
-        (validationType === VALIDATION_TYPES.FIELD &&
-          !{}.hasOwnProperty.call(error, 'validationType'));
-
-      if (isSameErrorCode || (typeof errorCode === 'undefined' && isSamevalidationType)) {
-        return messages ? `${messages}, ${error.message}` : (error.message as string);
+  const getErrorsMessages: FieldHook<T>['getErrorsMessages'] = useCallback(
+    (args = {}) => {
+      const { errorCode, validationType = VALIDATION_TYPES.FIELD } = args;
+      const errorMessages = errors.reduce((messages, error) => {
+        const isSameErrorCode = errorCode && error.code === errorCode;
+        const isSamevalidationType =
+          error.validationType === validationType ||
+          (validationType === VALIDATION_TYPES.FIELD &&
+            !{}.hasOwnProperty.call(error, 'validationType'));
+
+        if (isSameErrorCode || (typeof errorCode === 'undefined' && isSamevalidationType)) {
+          return messages ? `${messages}, ${error.message}` : (error.message as string);
+        }
+        return messages;
+      }, '');
+
+      return errorMessages ? errorMessages : null;
+    },
+    [errors]
+  );
+
+  const reset: FieldHook<T>['reset'] = useCallback(
+    (resetOptions = { resetValue: true }) => {
+      const { resetValue = true } = resetOptions;
+
+      setPristine(true);
+      setValidating(false);
+      setIsChangingValue(false);
+      setIsValidated(false);
+      setErrors([]);
+
+      if (resetValue) {
+        setValue(initialValue);
+        /**
+         * Having to call serializeOutput() is a current bug of the lib and will be fixed
+         * in a future PR. The serializer function should only be called when outputting
+         * the form data. If we need to continuously format the data while it changes,
+         * we need to use the field `formatter` config.
+         */
+        return serializeOutput(initialValue);
       }
-      return messages;
-    }, '');
-
-    return errorMessages ? errorMessages : null;
-  };
-
-  const reset: FieldHook<T>['reset'] = (resetOptions = { resetValue: true }) => {
-    const { resetValue = true } = resetOptions;
-
-    setPristine(true);
-    setValidating(false);
-    setIsChangingValue(false);
-    setIsValidated(false);
-    setErrors([]);
-
-    if (resetValue) {
-      setValue(initialValue);
-      /**
-       * Having to call serializeOutput() is a current bug of the lib and will be fixed
-       * in a future PR. The serializer function should only be called when outputting
-       * the form data. If we need to continuously format the data while it changes,
-       * we need to use the field `formatter` config.
-       */
-      return serializeOutput(initialValue);
-    }
-    return value;
-  };
-
-  const serializeOutput: FieldHook<T>['__serializeOutput'] = (rawValue = value) =>
-    serializer(rawValue);
+    },
+    [setValue, serializeOutput, initialValue]
+  );
 
   // -- EFFECTS
   // ----------------------------------
@@ -425,54 +468,64 @@ export const useField = <T>(
         clearTimeout(debounceTimeout.current);
       }
     };
-  }, [value]);
-
-  const field: FieldHook<T> = {
+  }, [isPristine, onValueChange]);
+
+  const field: FieldHook<T> = useMemo(() => {
+    return {
+      path,
+      type,
+      label,
+      labelAppend,
+      helpText,
+      value,
+      errors,
+      form,
+      isPristine,
+      isValid: errors.length === 0,
+      isValidating,
+      isValidated,
+      isChangingValue,
+      onChange,
+      getErrorsMessages,
+      setValue,
+      setErrors: _setErrors,
+      clearErrors,
+      validate,
+      reset,
+      __serializeOutput: serializeOutput,
+    };
+  }, [
     path,
     type,
     label,
     labelAppend,
     helpText,
     value,
-    errors,
     form,
     isPristine,
-    isValid: errors.length === 0,
+    errors,
     isValidating,
     isValidated,
     isChangingValue,
     onChange,
     getErrorsMessages,
     setValue,
-    setErrors: _setErrors,
+    _setErrors,
     clearErrors,
     validate,
     reset,
-    __serializeOutput: serializeOutput,
-  };
+    serializeOutput,
+  ]);
 
-  form.__addField(field as FieldHook<any>); // Executed first (1)
+  form.__addField(field as FieldHook<any>);
 
   useEffect(() => {
-    /**
-     * NOTE: effect cleanup actually happens *after* the new component has been mounted,
-     * but before the next effect callback is run.
-     * Ref: https://kentcdodds.com/blog/understanding-reacts-key-prop
-     *
-     * This means that, the "form.__addField(field)" outside the effect will be called *before*
-     * the cleanup `form.__removeField(path);` creating a race condition.
-     *
-     * TODO: See how we could refactor "use_field" & "use_form" to avoid having the
-     * `form.__addField(field)` call outside the effect.
-     */
-    form.__addField(field as FieldHook<any>); // Executed third (3)
-
     return () => {
       // Remove field from the form when it is unmounted or if its path changes.
       isUnmounted.current = true;
-      form.__removeField(path); // Executed second (2)
+      __removeField(path);
     };
-  }, [path]);
+  }, [path, __removeField]);
 
   return field;
 };
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form.test.tsx b/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form.test.tsx
index f332d2e6ea604..216c7974a9679 100644
--- a/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form.test.tsx
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form.test.tsx
@@ -135,12 +135,13 @@ describe('use_form() hook', () => {
     test('should allow subscribing to the form data changes and provide a handler to build the form data', async () => {
       const TestComp = ({ onData }: { onData: OnUpdateHandler }) => {
         const { form } = useForm();
+        const { subscribe } = form;
 
         useEffect(() => {
           // Any time the form value changes, forward the data to the consumer
-          const subscription = form.subscribe(onData);
+          const subscription = subscribe(onData);
           return subscription.unsubscribe;
-        }, [form]);
+        }, [subscribe, onData]);
 
         return (
           <Form form={form}>
@@ -200,8 +201,9 @@ describe('use_form() hook', () => {
 
       const TestComp = ({ onData }: { onData: OnUpdateHandler }) => {
         const { form } = useForm({ defaultValue });
+        const { subscribe } = form;
 
-        useEffect(() => form.subscribe(onData).unsubscribe, [form]);
+        useEffect(() => subscribe(onData).unsubscribe, [subscribe, onData]);
 
         return (
           <Form form={form}>
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form.ts b/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form.ts
index f9286d99cbf80..46b8958491e56 100644
--- a/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form.ts
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/hooks/use_form.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import { useState, useRef, useEffect, useMemo } from 'react';
+import { useState, useRef, useEffect, useMemo, useCallback } from 'react';
 import { get } from 'lodash';
 
 import { FormHook, FieldHook, FormData, FieldConfig, FieldsMap, FormConfig } from '../types';
@@ -34,28 +34,34 @@ interface UseFormReturn<T extends FormData> {
 }
 
 export function useForm<T extends FormData = FormData>(
-  formConfig: FormConfig<T> | undefined = {}
+  formConfig?: FormConfig<T>
 ): UseFormReturn<T> {
-  const {
-    onSubmit,
-    schema,
-    serializer = <T>(data: T): T => data,
-    deserializer = <T>(data: T): T => data,
-    options = {},
-    id = 'default',
-  } = formConfig;
-
-  const formDefaultValue =
-    formConfig.defaultValue === undefined || Object.keys(formConfig.defaultValue).length === 0
-      ? {}
-      : Object.entries(formConfig.defaultValue as object)
-          .filter(({ 1: value }) => value !== undefined)
-          .reduce((acc, [key, value]) => ({ ...acc, [key]: value }), {});
-
-  const formOptions = { ...DEFAULT_OPTIONS, ...options };
-  const defaultValueDeserialized = useMemo(() => deserializer(formDefaultValue), [
-    formConfig.defaultValue,
-  ]);
+  const { onSubmit, schema, serializer, deserializer, options, id = 'default', defaultValue } =
+    formConfig ?? {};
+
+  const formDefaultValue = useMemo(() => {
+    if (defaultValue === undefined || Object.keys(defaultValue).length === 0) {
+      return {};
+    }
+
+    return Object.entries(defaultValue as object)
+      .filter(({ 1: value }) => value !== undefined)
+      .reduce((acc, [key, value]) => ({ ...acc, [key]: value }), {});
+  }, [defaultValue]);
+
+  const { errorDisplayDelay, stripEmptyFields: doStripEmptyFields } = options ?? {};
+  const formOptions = useMemo(
+    () => ({
+      stripEmptyFields: doStripEmptyFields ?? DEFAULT_OPTIONS.stripEmptyFields,
+      errorDisplayDelay: errorDisplayDelay ?? DEFAULT_OPTIONS.errorDisplayDelay,
+    }),
+    [errorDisplayDelay, doStripEmptyFields]
+  );
+
+  const defaultValueDeserialized = useMemo(
+    () => (deserializer ? deserializer(formDefaultValue) : formDefaultValue),
+    [formDefaultValue, deserializer]
+  );
 
   const [isSubmitted, setIsSubmitted] = useState(false);
   const [isSubmitting, setSubmitting] = useState(false);
@@ -81,55 +87,68 @@ export function useForm<T extends FormData = FormData>(
 
   // -- HELPERS
   // ----------------------------------
-  const getFormData$ = (): Subject<T> => {
+  const getFormData$ = useCallback((): Subject<T> => {
     if (formData$.current === null) {
       formData$.current = new Subject<T>({} as T);
     }
     return formData$.current;
-  };
-  const fieldsToArray = () => Object.values(fieldsRefs.current);
+  }, []);
 
-  const stripEmptyFields = (fields: FieldsMap): FieldsMap => {
-    if (formOptions.stripEmptyFields) {
-      return Object.entries(fields).reduce((acc, [key, field]) => {
-        if (typeof field.value !== 'string' || field.value.trim() !== '') {
-          acc[key] = field;
-        }
-        return acc;
-      }, {} as FieldsMap);
-    }
-    return fields;
-  };
+  const fieldsToArray = useCallback(() => Object.values(fieldsRefs.current), []);
+
+  const stripEmptyFields = useCallback(
+    (fields: FieldsMap): FieldsMap => {
+      if (formOptions.stripEmptyFields) {
+        return Object.entries(fields).reduce((acc, [key, field]) => {
+          if (typeof field.value !== 'string' || field.value.trim() !== '') {
+            acc[key] = field;
+          }
+          return acc;
+        }, {} as FieldsMap);
+      }
+      return fields;
+    },
+    [formOptions]
+  );
+
+  const updateFormDataAt: FormHook<T>['__updateFormDataAt'] = useCallback(
+    (path, value) => {
+      const _formData$ = getFormData$();
+      const currentFormData = _formData$.value;
+
+      if (currentFormData[path] !== value) {
+        _formData$.next({ ...currentFormData, [path]: value });
+      }
 
-  const updateFormDataAt: FormHook<T>['__updateFormDataAt'] = (path, value) => {
-    const _formData$ = getFormData$();
-    const currentFormData = _formData$.value;
-    const nextValue = { ...currentFormData, [path]: value };
-    _formData$.next(nextValue);
-    return _formData$.value;
-  };
+      return _formData$.value;
+    },
+    [getFormData$]
+  );
 
   // -- API
   // ----------------------------------
-  const getFormData: FormHook<T>['getFormData'] = (
-    getDataOptions: Parameters<FormHook<T>['getFormData']>[0] = { unflatten: true }
-  ) => {
-    if (getDataOptions.unflatten) {
-      const nonEmptyFields = stripEmptyFields(fieldsRefs.current);
-      const fieldsValue = mapFormFields(nonEmptyFields, (field) => field.__serializeOutput());
-      return serializer(unflattenObject(fieldsValue)) as T;
-    }
-
-    return Object.entries(fieldsRefs.current).reduce(
-      (acc, [key, field]) => ({
-        ...acc,
-        [key]: field.__serializeOutput(),
-      }),
-      {} as T
-    );
-  };
+  const getFormData: FormHook<T>['getFormData'] = useCallback(
+    (getDataOptions: Parameters<FormHook<T>['getFormData']>[0] = { unflatten: true }) => {
+      if (getDataOptions.unflatten) {
+        const nonEmptyFields = stripEmptyFields(fieldsRefs.current);
+        const fieldsValue = mapFormFields(nonEmptyFields, (field) => field.__serializeOutput());
+        return serializer
+          ? (serializer(unflattenObject(fieldsValue)) as T)
+          : (unflattenObject(fieldsValue) as T);
+      }
 
-  const getErrors: FormHook['getErrors'] = () => {
+      return Object.entries(fieldsRefs.current).reduce(
+        (acc, [key, field]) => ({
+          ...acc,
+          [key]: field.__serializeOutput(),
+        }),
+        {} as T
+      );
+    },
+    [stripEmptyFields, serializer]
+  );
+
+  const getErrors: FormHook['getErrors'] = useCallback(() => {
     if (isValid === true) {
       return [];
     }
@@ -141,11 +160,15 @@ export function useForm<T extends FormData = FormData>(
       }
       return [...acc, fieldError];
     }, [] as string[]);
-  };
+  }, [isValid, fieldsToArray]);
 
   const isFieldValid = (field: FieldHook) => field.isValid && !field.isValidating;
 
-  const updateFormValidity = () => {
+  const updateFormValidity = useCallback(() => {
+    if (isUnmounted.current) {
+      return;
+    }
+
     const fieldsArray = fieldsToArray();
     const areAllFieldsValidated = fieldsArray.every((field) => field.isValidated);
 
@@ -158,176 +181,220 @@ export function useForm<T extends FormData = FormData>(
 
     setIsValid(isFormValid);
     return isFormValid;
-  };
+  }, [fieldsToArray]);
 
-  const validateFields: FormHook<T>['__validateFields'] = async (fieldNames) => {
-    const fieldsToValidate = fieldNames
-      .map((name) => fieldsRefs.current[name])
-      .filter((field) => field !== undefined);
+  const validateFields: FormHook<T>['__validateFields'] = useCallback(
+    async (fieldNames) => {
+      const fieldsToValidate = fieldNames
+        .map((name) => fieldsRefs.current[name])
+        .filter((field) => field !== undefined);
 
-    if (fieldsToValidate.length === 0) {
-      // Nothing to validate
-      return { areFieldsValid: true, isFormValid: true };
-    }
+      if (fieldsToValidate.length === 0) {
+        // Nothing to validate
+        return { areFieldsValid: true, isFormValid: true };
+      }
 
-    const formData = getFormData({ unflatten: false });
-    await Promise.all(fieldsToValidate.map((field) => field.validate({ formData })));
+      const formData = getFormData({ unflatten: false });
+      await Promise.all(fieldsToValidate.map((field) => field.validate({ formData })));
 
-    const isFormValid = updateFormValidity();
-    const areFieldsValid = fieldsToValidate.every(isFieldValid);
+      const isFormValid = updateFormValidity();
+      const areFieldsValid = fieldsToValidate.every(isFieldValid);
 
-    return { areFieldsValid, isFormValid };
-  };
+      return { areFieldsValid, isFormValid };
+    },
+    [getFormData, updateFormValidity]
+  );
 
-  const validateAllFields = async (): Promise<boolean> => {
+  const validateAllFields = useCallback(async (): Promise<boolean> => {
     const fieldsArray = fieldsToArray();
     const fieldsToValidate = fieldsArray.filter((field) => !field.isValidated);
 
-    let isFormValid: boolean | undefined = isValid;
+    let isFormValid: boolean | undefined;
 
     if (fieldsToValidate.length === 0) {
-      if (isFormValid === undefined) {
-        // We should never enter this condition as the form validity is updated each time
-        // a field is validated. But sometimes, during tests it does not happen and we need
-        // to wait the next tick (hooks lifecycle being tricky) to make sure the "isValid" state is updated.
-        // In order to avoid this unintentional behaviour, we add this if condition here.
-        isFormValid = fieldsArray.every(isFieldValid);
-        setIsValid(isFormValid);
-      }
+      // We should never enter this condition as the form validity is updated each time
+      // a field is validated. But sometimes, during tests or race conditions it does not happen and we need
+      // to wait the next tick (hooks lifecycle being tricky) to make sure the "isValid" state is updated.
+      // In order to avoid this unintentional behaviour, we add this if condition here.
+
+      // TODO: Fix this when adding tests to the form lib.
+      isFormValid = fieldsArray.every(isFieldValid);
+      setIsValid(isFormValid);
       return isFormValid;
     }
 
     ({ isFormValid } = await validateFields(fieldsToValidate.map((field) => field.path)));
 
     return isFormValid!;
-  };
+  }, [fieldsToArray, validateFields]);
 
-  const addField: FormHook<T>['__addField'] = (field) => {
-    fieldsRefs.current[field.path] = field;
+  const addField: FormHook<T>['__addField'] = useCallback(
+    (field) => {
+      fieldsRefs.current[field.path] = field;
 
-    if (!{}.hasOwnProperty.call(getFormData$().value, field.path)) {
-      const fieldValue = field.__serializeOutput();
-      updateFormDataAt(field.path, fieldValue);
-    }
-  };
+      if (!{}.hasOwnProperty.call(getFormData$().value, field.path)) {
+        const fieldValue = field.__serializeOutput();
+        updateFormDataAt(field.path, fieldValue);
+      }
+    },
+    [getFormData$, updateFormDataAt]
+  );
 
-  const removeField: FormHook<T>['__removeField'] = (_fieldNames) => {
-    const fieldNames = Array.isArray(_fieldNames) ? _fieldNames : [_fieldNames];
-    const currentFormData = { ...getFormData$().value } as FormData;
+  const removeField: FormHook<T>['__removeField'] = useCallback(
+    (_fieldNames) => {
+      const fieldNames = Array.isArray(_fieldNames) ? _fieldNames : [_fieldNames];
+      const currentFormData = { ...getFormData$().value } as FormData;
 
-    fieldNames.forEach((name) => {
-      delete fieldsRefs.current[name];
-      delete currentFormData[name];
-    });
+      fieldNames.forEach((name) => {
+        delete fieldsRefs.current[name];
+        delete currentFormData[name];
+      });
 
-    getFormData$().next(currentFormData as T);
+      getFormData$().next(currentFormData as T);
 
-    /**
-     * After removing a field, the form validity might have changed
-     * (an invalid field might have been removed and now the form is valid)
-     */
-    updateFormValidity();
-  };
+      /**
+       * After removing a field, the form validity might have changed
+       * (an invalid field might have been removed and now the form is valid)
+       */
+      updateFormValidity();
+    },
+    [getFormData$, updateFormValidity]
+  );
 
-  const setFieldValue: FormHook<T>['setFieldValue'] = (fieldName, value) => {
+  const setFieldValue: FormHook<T>['setFieldValue'] = useCallback((fieldName, value) => {
     if (fieldsRefs.current[fieldName] === undefined) {
       return;
     }
     fieldsRefs.current[fieldName].setValue(value);
-  };
+  }, []);
 
-  const setFieldErrors: FormHook<T>['setFieldErrors'] = (fieldName, errors) => {
+  const setFieldErrors: FormHook<T>['setFieldErrors'] = useCallback((fieldName, errors) => {
     if (fieldsRefs.current[fieldName] === undefined) {
       return;
     }
     fieldsRefs.current[fieldName].setErrors(errors);
-  };
+  }, []);
 
-  const getFields: FormHook<T>['getFields'] = () => fieldsRefs.current;
+  const getFields: FormHook<T>['getFields'] = useCallback(() => fieldsRefs.current, []);
 
-  const getFieldDefaultValue: FormHook['getFieldDefaultValue'] = (fieldName) =>
-    get(defaultValueDeserialized, fieldName);
+  const getFieldDefaultValue: FormHook['getFieldDefaultValue'] = useCallback(
+    (fieldName) => get(defaultValueDeserialized, fieldName),
+    [defaultValueDeserialized]
+  );
 
-  const readFieldConfigFromSchema: FormHook<T>['__readFieldConfigFromSchema'] = (fieldName) => {
-    const config = (get(schema ? schema : {}, fieldName) as FieldConfig) || {};
+  const readFieldConfigFromSchema: FormHook<T>['__readFieldConfigFromSchema'] = useCallback(
+    (fieldName) => {
+      const config = (get(schema ?? {}, fieldName) as FieldConfig) || {};
 
-    return config;
-  };
+      return config;
+    },
+    [schema]
+  );
 
-  const submitForm: FormHook<T>['submit'] = async (e) => {
-    if (e) {
-      e.preventDefault();
-    }
+  const submitForm: FormHook<T>['submit'] = useCallback(
+    async (e) => {
+      if (e) {
+        e.preventDefault();
+      }
 
-    if (!isSubmitted) {
       setIsSubmitted(true); // User has attempted to submit the form at least once
-    }
-    setSubmitting(true);
+      setSubmitting(true);
 
-    const isFormValid = await validateAllFields();
-    const formData = getFormData();
-
-    if (onSubmit) {
-      await onSubmit(formData, isFormValid!);
-    }
-
-    if (isUnmounted.current === false) {
-      setSubmitting(false);
-    }
+      const isFormValid = await validateAllFields();
+      const formData = getFormData();
 
-    return { data: formData, isValid: isFormValid! };
-  };
+      if (onSubmit) {
+        await onSubmit(formData, isFormValid!);
+      }
 
-  const subscribe: FormHook<T>['subscribe'] = (handler) => {
-    const subscription = getFormData$().subscribe((raw) => {
-      if (!isUnmounted.current) {
-        handler({ isValid, data: { raw, format: getFormData }, validate: validateAllFields });
+      if (isUnmounted.current === false) {
+        setSubmitting(false);
       }
-    });
 
-    formUpdateSubscribers.current.push(subscription);
+      return { data: formData, isValid: isFormValid! };
+    },
+    [validateAllFields, getFormData, onSubmit]
+  );
 
-    return {
-      unsubscribe() {
-        formUpdateSubscribers.current = formUpdateSubscribers.current.filter(
-          (sub) => sub !== subscription
-        );
-        return subscription.unsubscribe();
-      },
-    };
-  };
+  const subscribe: FormHook<T>['subscribe'] = useCallback(
+    (handler) => {
+      const subscription = getFormData$().subscribe((raw) => {
+        if (!isUnmounted.current) {
+          handler({ isValid, data: { raw, format: getFormData }, validate: validateAllFields });
+        }
+      });
+
+      formUpdateSubscribers.current.push(subscription);
+
+      return {
+        unsubscribe() {
+          formUpdateSubscribers.current = formUpdateSubscribers.current.filter(
+            (sub) => sub !== subscription
+          );
+          return subscription.unsubscribe();
+        },
+      };
+    },
+    [getFormData$, isValid, getFormData, validateAllFields]
+  );
 
   /**
    * Reset all the fields of the form to their default values
    * and reset all the states to their original value.
    */
-  const reset: FormHook<T>['reset'] = (resetOptions = { resetValues: true }) => {
-    const { resetValues = true } = resetOptions;
-    const currentFormData = { ...getFormData$().value } as FormData;
-    Object.entries(fieldsRefs.current).forEach(([path, field]) => {
-      // By resetting the form, some field might be unmounted. In order
-      // to avoid a race condition, we check that the field still exists.
-      const isFieldMounted = fieldsRefs.current[path] !== undefined;
-      if (isFieldMounted) {
-        const fieldValue = field.reset({ resetValue: resetValues });
-        currentFormData[path] = fieldValue;
+  const reset: FormHook<T>['reset'] = useCallback(
+    (resetOptions = { resetValues: true }) => {
+      const { resetValues = true } = resetOptions;
+      const currentFormData = { ...getFormData$().value } as FormData;
+      Object.entries(fieldsRefs.current).forEach(([path, field]) => {
+        // By resetting the form, some field might be unmounted. In order
+        // to avoid a race condition, we check that the field still exists.
+        const isFieldMounted = fieldsRefs.current[path] !== undefined;
+        if (isFieldMounted) {
+          const fieldValue = field.reset({ resetValue: resetValues }) ?? currentFormData[path];
+          currentFormData[path] = fieldValue;
+        }
+      });
+      if (resetValues) {
+        getFormData$().next(currentFormData as T);
       }
-    });
-    if (resetValues) {
-      getFormData$().next(currentFormData as T);
-    }
 
-    setIsSubmitted(false);
-    setSubmitting(false);
-    setIsValid(undefined);
-  };
+      setIsSubmitted(false);
+      setSubmitting(false);
+      setIsValid(undefined);
+    },
+    [getFormData$]
+  );
 
-  const form: FormHook<T> = {
+  const form = useMemo<FormHook<T>>(() => {
+    return {
+      isSubmitted,
+      isSubmitting,
+      isValid,
+      id,
+      submit: submitForm,
+      subscribe,
+      setFieldValue,
+      setFieldErrors,
+      getFields,
+      getFormData,
+      getErrors,
+      getFieldDefaultValue,
+      reset,
+      __options: formOptions,
+      __getFormData$: getFormData$,
+      __updateFormDataAt: updateFormDataAt,
+      __readFieldConfigFromSchema: readFieldConfigFromSchema,
+      __addField: addField,
+      __removeField: removeField,
+      __validateFields: validateFields,
+    };
+  }, [
     isSubmitted,
     isSubmitting,
     isValid,
     id,
-    submit: submitForm,
+    submitForm,
     subscribe,
     setFieldValue,
     setFieldErrors,
@@ -336,14 +403,14 @@ export function useForm<T extends FormData = FormData>(
     getErrors,
     getFieldDefaultValue,
     reset,
-    __options: formOptions,
-    __getFormData$: getFormData$,
-    __updateFormDataAt: updateFormDataAt,
-    __readFieldConfigFromSchema: readFieldConfigFromSchema,
-    __addField: addField,
-    __removeField: removeField,
-    __validateFields: validateFields,
-  };
+    formOptions,
+    getFormData$,
+    updateFormDataAt,
+    readFieldConfigFromSchema,
+    addField,
+    removeField,
+    validateFields,
+  ]);
 
   return {
     form,
diff --git a/src/plugins/es_ui_shared/static/forms/hook_form_lib/types.ts b/src/plugins/es_ui_shared/static/forms/hook_form_lib/types.ts
index f11b61edaddf4..7e38a33f0c684 100644
--- a/src/plugins/es_ui_shared/static/forms/hook_form_lib/types.ts
+++ b/src/plugins/es_ui_shared/static/forms/hook_form_lib/types.ts
@@ -107,7 +107,7 @@ export interface FieldHook<T = unknown> {
     errorCode?: string;
   }) => string | null;
   onChange: (event: ChangeEvent<{ name?: string; value: string; checked?: boolean }>) => void;
-  setValue: (value: T) => void;
+  setValue: (value: T) => T;
   setErrors: (errors: ValidationError[]) => void;
   clearErrors: (type?: string | string[]) => void;
   validate: (validateData?: {
@@ -115,7 +115,7 @@ export interface FieldHook<T = unknown> {
     value?: unknown;
     validationType?: string;
   }) => FieldValidateResponse | Promise<FieldValidateResponse>;
-  reset: (options?: { resetValue: boolean }) => unknown;
+  reset: (options?: { resetValue: boolean }) => unknown | undefined;
   __serializeOutput: (rawValue?: unknown) => unknown;
 }
 
diff --git a/src/plugins/management/public/plugin.ts b/src/plugins/management/public/plugin.ts
index 17d8cb4adc701..8be130b4028c6 100644
--- a/src/plugins/management/public/plugin.ts
+++ b/src/plugins/management/public/plugin.ts
@@ -65,7 +65,7 @@ export class ManagementPlugin implements Plugin<ManagementSetup, ManagementStart
       title: i18n.translate('management.stackManagement.title', {
         defaultMessage: 'Stack Management',
       }),
-      order: 9003,
+      order: 9040,
       euiIconType: 'managementApp',
       category: DEFAULT_APP_CATEGORIES.management,
       async mount(params: AppMountParameters) {
diff --git a/src/plugins/ui_actions/kibana.json b/src/plugins/ui_actions/kibana.json
index 7b24b3cc5c48b..337c5ddf0fd5c 100644
--- a/src/plugins/ui_actions/kibana.json
+++ b/src/plugins/ui_actions/kibana.json
@@ -7,6 +7,7 @@
     "public/tests/test_samples"
   ],
   "requiredBundles": [
+    "kibanaUtils",
     "kibanaReact"
   ]
 }
diff --git a/src/plugins/ui_actions/public/actions/action.ts b/src/plugins/ui_actions/public/actions/action.ts
index f5dbbc9f923ac..bc5f36acb8f0c 100644
--- a/src/plugins/ui_actions/public/actions/action.ts
+++ b/src/plugins/ui_actions/public/actions/action.ts
@@ -68,6 +68,13 @@ export interface Action<Context extends {} = {}, T = ActionType>
    * Executes the action.
    */
   execute(context: Context): Promise<void>;
+
+  /**
+   * Determines if action should be executed automatically,
+   * without first showing up in context menu.
+   * false by default.
+   */
+  shouldAutoExecute?(context: Context): Promise<boolean>;
 }
 
 /**
@@ -89,6 +96,13 @@ export interface ActionDefinition<Context extends object = object>
    * Executes the action.
    */
   execute(context: Context): Promise<void>;
+
+  /**
+   * Determines if action should be executed automatically,
+   * without first showing up in context menu.
+   * false by default.
+   */
+  shouldAutoExecute?(context: Context): Promise<boolean>;
 }
 
 export type ActionContext<A> = A extends ActionDefinition<infer Context> ? Context : never;
diff --git a/src/plugins/ui_actions/public/actions/action_internal.ts b/src/plugins/ui_actions/public/actions/action_internal.ts
index 10eb760b13089..a22b3fa5b0367 100644
--- a/src/plugins/ui_actions/public/actions/action_internal.ts
+++ b/src/plugins/ui_actions/public/actions/action_internal.ts
@@ -65,4 +65,9 @@ export class ActionInternal<A extends ActionDefinition = ActionDefinition>
     if (!this.definition.getHref) return undefined;
     return await this.definition.getHref(context);
   }
+
+  public async shouldAutoExecute(context: Context<A>): Promise<boolean> {
+    if (!this.definition.shouldAutoExecute) return false;
+    return this.definition.shouldAutoExecute(context);
+  }
 }
diff --git a/src/plugins/ui_actions/public/context_menu/build_eui_context_menu_panels.tsx b/src/plugins/ui_actions/public/context_menu/build_eui_context_menu_panels.tsx
index 74e9ef96b575b..7b87a5992a7f5 100644
--- a/src/plugins/ui_actions/public/context_menu/build_eui_context_menu_panels.tsx
+++ b/src/plugins/ui_actions/public/context_menu/build_eui_context_menu_panels.tsx
@@ -23,28 +23,28 @@ import _ from 'lodash';
 import { i18n } from '@kbn/i18n';
 import { uiToReactComponent } from '../../../kibana_react/public';
 import { Action } from '../actions';
+import { BaseContext } from '../types';
 
 export const defaultTitle = i18n.translate('uiActions.actionPanel.title', {
   defaultMessage: 'Options',
 });
 
+type ActionWithContext<Context extends BaseContext = BaseContext> = [Action<Context>, Context];
+
 /**
  * Transforms an array of Actions to the shape EuiContextMenuPanel expects.
  */
-export async function buildContextMenuForActions<Context extends object>({
+export async function buildContextMenuForActions({
   actions,
-  actionContext,
   title = defaultTitle,
   closeMenu,
 }: {
-  actions: Array<Action<Context>>;
-  actionContext: Context;
+  actions: ActionWithContext[];
   title?: string;
   closeMenu: () => void;
 }): Promise<EuiContextMenuPanelDescriptor> {
-  const menuItems = await buildEuiContextMenuPanelItems<Context>({
+  const menuItems = await buildEuiContextMenuPanelItems({
     actions,
-    actionContext,
     closeMenu,
   });
 
@@ -58,17 +58,15 @@ export async function buildContextMenuForActions<Context extends object>({
 /**
  * Transform an array of Actions into the shape needed to build an EUIContextMenu
  */
-async function buildEuiContextMenuPanelItems<Context extends object>({
+async function buildEuiContextMenuPanelItems({
   actions,
-  actionContext,
   closeMenu,
 }: {
-  actions: Array<Action<Context>>;
-  actionContext: Context;
+  actions: ActionWithContext[];
   closeMenu: () => void;
 }) {
   const items: EuiContextMenuPanelItemDescriptor[] = new Array(actions.length);
-  const promises = actions.map(async (action, index) => {
+  const promises = actions.map(async ([action, actionContext], index) => {
     const isCompatible = await action.isCompatible(actionContext);
     if (!isCompatible) {
       return;
diff --git a/src/plugins/ui_actions/public/service/ui_actions_execution_service.ts b/src/plugins/ui_actions/public/service/ui_actions_execution_service.ts
new file mode 100644
index 0000000000000..7393989672e9d
--- /dev/null
+++ b/src/plugins/ui_actions/public/service/ui_actions_execution_service.ts
@@ -0,0 +1,121 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { uniqBy } from 'lodash';
+import { Action } from '../actions';
+import { BaseContext } from '../types';
+import { defer as createDefer, Defer } from '../../../kibana_utils/public';
+import { buildContextMenuForActions, openContextMenu } from '../context_menu';
+import { Trigger } from '../triggers';
+
+interface ExecuteActionTask {
+  action: Action;
+  context: BaseContext;
+  trigger: Trigger;
+  defer: Defer<void>;
+}
+
+export class UiActionsExecutionService {
+  private readonly batchingQueue: ExecuteActionTask[] = [];
+  private readonly pendingTasks = new Set<ExecuteActionTask>();
+
+  constructor() {}
+
+  async execute({
+    action,
+    context,
+    trigger,
+  }: {
+    action: Action<BaseContext>;
+    context: BaseContext;
+    trigger: Trigger;
+  }): Promise<void> {
+    const shouldBatch = !(await action.shouldAutoExecute?.(context)) ?? false;
+    const task: ExecuteActionTask = {
+      action,
+      context,
+      trigger,
+      defer: createDefer(),
+    };
+
+    if (shouldBatch) {
+      this.batchingQueue.push(task);
+    } else {
+      this.pendingTasks.add(task);
+      try {
+        await action.execute(context);
+        this.pendingTasks.delete(task);
+      } catch (e) {
+        this.pendingTasks.delete(task);
+        throw new Error(e);
+      }
+    }
+
+    this.scheduleFlush();
+
+    return task.defer.promise;
+  }
+
+  private scheduleFlush() {
+    /**
+     * Have to delay at least until next macro task
+     * Otherwise chain:
+     * Trigger -> await action.execute() -> trigger -> action
+     * isn't batched
+     *
+     * This basically needed to support a chain of scheduled micro tasks (async/awaits) within uiActions code
+     */
+    setTimeout(() => {
+      if (this.pendingTasks.size === 0) {
+        const tasks = uniqBy(this.batchingQueue, (t) => t.action.id);
+        if (tasks.length === 1) {
+          this.executeSingleTask(tasks[0]);
+        }
+        if (tasks.length > 1) {
+          this.executeMultipleActions(tasks);
+        }
+
+        this.batchingQueue.splice(0, this.batchingQueue.length);
+      }
+    }, 0);
+  }
+
+  private async executeSingleTask({ context, action, defer }: ExecuteActionTask) {
+    try {
+      await action.execute(context);
+      defer.resolve();
+    } catch (e) {
+      defer.reject(e);
+    }
+  }
+
+  private async executeMultipleActions(tasks: ExecuteActionTask[]) {
+    const panel = await buildContextMenuForActions({
+      actions: tasks.map(({ action, context }) => [action, context]),
+      title: tasks[0].trigger.title, // title of context menu is title of trigger which originated the chain
+      closeMenu: () => {
+        tasks.forEach((t) => t.defer.resolve());
+        session.close();
+      },
+    });
+    const session = openContextMenu([panel], {
+      'data-test-subj': 'multipleActionsContextMenu',
+    });
+  }
+}
diff --git a/src/plugins/ui_actions/public/service/ui_actions_service.ts b/src/plugins/ui_actions/public/service/ui_actions_service.ts
index 11f5769a94648..08efffbb6b5a8 100644
--- a/src/plugins/ui_actions/public/service/ui_actions_service.ts
+++ b/src/plugins/ui_actions/public/service/ui_actions_service.ts
@@ -28,6 +28,7 @@ import { ActionInternal, Action, ActionDefinition, ActionContext } from '../acti
 import { Trigger, TriggerContext } from '../triggers/trigger';
 import { TriggerInternal } from '../triggers/trigger_internal';
 import { TriggerContract } from '../triggers/trigger_contract';
+import { UiActionsExecutionService } from './ui_actions_execution_service';
 
 export interface UiActionsServiceParams {
   readonly triggers?: TriggerRegistry;
@@ -40,6 +41,7 @@ export interface UiActionsServiceParams {
 }
 
 export class UiActionsService {
+  public readonly executionService = new UiActionsExecutionService();
   protected readonly triggers: TriggerRegistry;
   protected readonly actions: ActionRegistry;
   protected readonly triggerToActions: TriggerToActionsRegistry;
diff --git a/src/plugins/ui_actions/public/tests/execute_trigger_actions.test.ts b/src/plugins/ui_actions/public/tests/execute_trigger_actions.test.ts
index 983c6796eeb09..9af46f25b4fec 100644
--- a/src/plugins/ui_actions/public/tests/execute_trigger_actions.test.ts
+++ b/src/plugins/ui_actions/public/tests/execute_trigger_actions.test.ts
@@ -22,6 +22,7 @@ import { openContextMenu } from '../context_menu';
 import { uiActionsPluginMock } from '../mocks';
 import { Trigger } from '../triggers';
 import { TriggerId, ActionType } from '../types';
+import { wait } from '@testing-library/dom';
 
 jest.mock('../context_menu');
 
@@ -36,13 +37,15 @@ const TEST_ACTION_TYPE = 'TEST_ACTION_TYPE' as ActionType;
 
 function createTestAction<C extends object>(
   type: string,
-  checkCompatibility: (context: C) => boolean
+  checkCompatibility: (context: C) => boolean,
+  autoExecutable = false
 ): Action<object> {
   return createAction<typeof TEST_ACTION_TYPE>({
     type: type as ActionType,
     id: type,
     isCompatible: (context: C) => Promise.resolve(checkCompatibility(context)),
     execute: (context) => executeFn(context),
+    shouldAutoExecute: () => Promise.resolve(autoExecutable),
   });
 }
 
@@ -57,6 +60,7 @@ const reset = () => {
 
   executeFn.mockReset();
   openContextMenuSpy.mockReset();
+  jest.useFakeTimers();
 };
 beforeEach(reset);
 
@@ -75,6 +79,8 @@ test('executes a single action mapped to a trigger', async () => {
   const start = doStart();
   await start.executeTriggerActions('MY-TRIGGER' as TriggerId, context);
 
+  jest.runAllTimers();
+
   expect(executeFn).toBeCalledTimes(1);
   expect(executeFn).toBeCalledWith(context);
 });
@@ -117,6 +123,8 @@ test('does not execute an incompatible action', async () => {
   };
   await start.executeTriggerActions('MY-TRIGGER' as TriggerId, context);
 
+  jest.runAllTimers();
+
   expect(executeFn).toBeCalledTimes(1);
 });
 
@@ -139,8 +147,12 @@ test('shows a context menu when more than one action is mapped to a trigger', as
   const context = {};
   await start.executeTriggerActions('MY-TRIGGER' as TriggerId, context);
 
-  expect(executeFn).toBeCalledTimes(0);
-  expect(openContextMenu).toHaveBeenCalledTimes(1);
+  jest.runAllTimers();
+
+  await wait(() => {
+    expect(executeFn).toBeCalledTimes(0);
+    expect(openContextMenu).toHaveBeenCalledTimes(1);
+  });
 });
 
 test('passes whole action context to isCompatible()', async () => {
@@ -161,4 +173,32 @@ test('passes whole action context to isCompatible()', async () => {
 
   const context = { foo: 'bar' };
   await start.executeTriggerActions('MY-TRIGGER' as TriggerId, context);
+  jest.runAllTimers();
+});
+
+test("doesn't show a context menu for auto executable actions", async () => {
+  const { setup, doStart } = uiActions;
+  const trigger: Trigger = {
+    id: 'MY-TRIGGER' as TriggerId,
+    title: 'My trigger',
+  };
+  const action1 = createTestAction('test1', () => true, true);
+  const action2 = createTestAction('test2', () => true, false);
+
+  setup.registerTrigger(trigger);
+  setup.addTriggerAction(trigger.id, action1);
+  setup.addTriggerAction(trigger.id, action2);
+
+  expect(openContextMenu).toHaveBeenCalledTimes(0);
+
+  const start = doStart();
+  const context = {};
+  await start.executeTriggerActions('MY-TRIGGER' as TriggerId, context);
+
+  jest.runAllTimers();
+
+  await wait(() => {
+    expect(executeFn).toBeCalledTimes(2);
+    expect(openContextMenu).toHaveBeenCalledTimes(0);
+  });
 });
diff --git a/src/plugins/ui_actions/public/triggers/trigger_internal.ts b/src/plugins/ui_actions/public/triggers/trigger_internal.ts
index e499c404ae745..c91468d31add5 100644
--- a/src/plugins/ui_actions/public/triggers/trigger_internal.ts
+++ b/src/plugins/ui_actions/public/triggers/trigger_internal.ts
@@ -20,8 +20,6 @@
 import { Trigger } from './trigger';
 import { TriggerContract } from './trigger_contract';
 import { UiActionsService } from '../service';
-import { Action } from '../actions';
-import { buildContextMenuForActions, openContextMenu } from '../context_menu';
 import { TriggerId, TriggerContextMapping } from '../types';
 
 /**
@@ -43,33 +41,14 @@ export class TriggerInternal<T extends TriggerId> {
       );
     }
 
-    if (actions.length === 1) {
-      await this.executeSingleAction(actions[0], context);
-      return;
-    }
-
-    await this.executeMultipleActions(actions, context);
-  }
-
-  private async executeSingleAction(
-    action: Action<TriggerContextMapping[T]>,
-    context: TriggerContextMapping[T]
-  ) {
-    await action.execute(context);
-  }
-
-  private async executeMultipleActions(
-    actions: Array<Action<TriggerContextMapping[T]>>,
-    context: TriggerContextMapping[T]
-  ) {
-    const panel = await buildContextMenuForActions({
-      actions,
-      actionContext: context,
-      title: this.trigger.title,
-      closeMenu: () => session.close(),
-    });
-    const session = openContextMenu([panel], {
-      'data-test-subj': 'multipleActionsContextMenu',
-    });
+    await Promise.all([
+      actions.map((action) =>
+        this.service.executionService.execute({
+          action,
+          context,
+          trigger: this.trigger,
+        })
+      ),
+    ]);
   }
 }
diff --git a/src/plugins/ui_actions/public/types.ts b/src/plugins/ui_actions/public/types.ts
index 9fcd8a32881df..5631441cf9a1b 100644
--- a/src/plugins/ui_actions/public/types.ts
+++ b/src/plugins/ui_actions/public/types.ts
@@ -19,10 +19,9 @@
 
 import { ActionInternal } from './actions/action_internal';
 import { TriggerInternal } from './triggers/trigger_internal';
-import { Filter } from '../../data/public';
 import { SELECT_RANGE_TRIGGER, VALUE_CLICK_TRIGGER, APPLY_FILTER_TRIGGER } from './triggers';
-import { IEmbeddable } from '../../embeddable/public';
-import { RangeSelectContext, ValueClickContext } from '../../embeddable/public';
+import type { RangeSelectContext, ValueClickContext } from '../../embeddable/public';
+import type { ApplyGlobalFilterActionContext } from '../../data/public';
 
 export type TriggerRegistry = Map<TriggerId, TriggerInternal<any>>;
 export type ActionRegistry = Map<string, ActionInternal>;
@@ -39,10 +38,7 @@ export interface TriggerContextMapping {
   [DEFAULT_TRIGGER]: TriggerContext;
   [SELECT_RANGE_TRIGGER]: RangeSelectContext;
   [VALUE_CLICK_TRIGGER]: ValueClickContext;
-  [APPLY_FILTER_TRIGGER]: {
-    embeddable: IEmbeddable;
-    filters: Filter[];
-  };
+  [APPLY_FILTER_TRIGGER]: ApplyGlobalFilterActionContext;
 }
 
 const DEFAULT_ACTION = '';
diff --git a/src/plugins/vis_type_vega/public/vega_view/vega_base_view.js b/src/plugins/vis_type_vega/public/vega_view/vega_base_view.js
index 069664a9c91c1..55c3606bf5e45 100644
--- a/src/plugins/vis_type_vega/public/vega_view/vega_base_view.js
+++ b/src/plugins/vis_type_vega/public/vega_view/vega_base_view.js
@@ -147,7 +147,7 @@ export class VegaBaseView {
             defaultMessage:
               'External URLs are not enabled. Add   {enableExternalUrls}   to {kibanaConfigFileName}',
             values: {
-              enableExternalUrls: 'vega.enableExternalUrls: true',
+              enableExternalUrls: 'vis_type_vega.enableExternalUrls: true',
               kibanaConfigFileName: 'kibana.yml',
             },
           })
diff --git a/test/examples/config.js b/test/examples/config.js
index 3c55be216fbc6..43d92ea21f077 100644
--- a/test/examples/config.js
+++ b/test/examples/config.js
@@ -29,6 +29,7 @@ export default async function ({ readConfigFile }) {
       require.resolve('./bfetch_explorer'),
       require.resolve('./ui_actions'),
       require.resolve('./state_sync'),
+      require.resolve('./routing'),
     ],
     services: {
       ...functionalConfig.get('services'),
diff --git a/test/examples/routing/index.ts b/test/examples/routing/index.ts
new file mode 100644
index 0000000000000..f96a7b96b46f6
--- /dev/null
+++ b/test/examples/routing/index.ts
@@ -0,0 +1,72 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import expect from '@kbn/expect';
+import { FtrProviderContext } from 'test/functional/ftr_provider_context';
+
+// eslint-disable-next-line import/no-default-export
+export default function ({ getService, getPageObjects, loadTestFile }: FtrProviderContext) {
+  const retry = getService('retry');
+  const testSubjects = getService('testSubjects');
+  const PageObjects = getPageObjects(['common']);
+
+  describe('routing examples', function () {
+    before(async () => {
+      await PageObjects.common.navigateToApp('routingExample');
+    });
+
+    it('basic get example', async () => {
+      await retry.try(async () => {
+        await testSubjects.click('routingExampleFetchRandomNumber');
+        const numberAsString = await testSubjects.getVisibleText('routingExampleRandomNumber');
+        expect(numberAsString).to.not.be(undefined);
+        const number = parseFloat(numberAsString);
+        expect(number).to.be.lessThan(10);
+        expect(number).to.be.greaterThan(0);
+      });
+    });
+
+    it('basic get example with query param', async () => {
+      await retry.try(async () => {
+        await testSubjects.setValue('routingExampleMaxRandomNumberBetween', '3');
+        await testSubjects.click('routingExampleFetchRandomNumberBetween');
+        const numberAsString = await testSubjects.getVisibleText(
+          'routingExampleRandomNumberBetween'
+        );
+        expect(numberAsString).to.not.be(undefined);
+        const number = parseFloat(numberAsString);
+        expect(number).to.be.lessThan(3);
+        expect(number).to.be.greaterThan(0);
+      });
+    });
+
+    it('post and get message example', async () => {
+      await testSubjects.setValue('routingExampleSetMessageId', '234');
+      await testSubjects.setValue('routingExampleSetMessage', 'hello!');
+      await testSubjects.click('routingExamplePostMessage');
+      await testSubjects.setValue('routingExampleGetMessageId', '234');
+      await testSubjects.click('routingExampleFetchMessage');
+
+      await retry.try(async () => {
+        const message = await testSubjects.getVisibleText('routingExampleGetMessage');
+        expect(message).to.be('hello!');
+      });
+    });
+  });
+}
diff --git a/test/functional/apps/dashboard/dashboard_filter_bar.js b/test/functional/apps/dashboard/dashboard_filter_bar.js
index f9b0d0a370c06..f3241568bbb3e 100644
--- a/test/functional/apps/dashboard/dashboard_filter_bar.js
+++ b/test/functional/apps/dashboard/dashboard_filter_bar.js
@@ -30,7 +30,8 @@ export default function ({ getService, getPageObjects }) {
   const browser = getService('browser');
   const PageObjects = getPageObjects(['common', 'dashboard', 'header', 'visualize', 'timePicker']);
 
-  describe('dashboard filter bar', () => {
+  // FLAKY: https://github.com/elastic/kibana/issues/71987
+  describe.skip('dashboard filter bar', () => {
     before(async () => {
       await esArchiver.load('dashboard/current/kibana');
       await kibanaServer.uiSettings.replace({
diff --git a/test/functional/apps/management/_create_index_pattern_wizard.js b/test/functional/apps/management/_create_index_pattern_wizard.js
index 97f2641b51d13..160b052e70d30 100644
--- a/test/functional/apps/management/_create_index_pattern_wizard.js
+++ b/test/functional/apps/management/_create_index_pattern_wizard.js
@@ -51,42 +51,6 @@ export default function ({ getService, getPageObjects }) {
       });
     });
 
-    describe('data streams', () => {
-      it('can be an index pattern', async () => {
-        await es.transport.request({
-          path: '/_index_template/generic-logs',
-          method: 'PUT',
-          body: {
-            index_patterns: ['logs-*', 'test_data_stream'],
-            template: {
-              mappings: {
-                properties: {
-                  '@timestamp': {
-                    type: 'date',
-                  },
-                },
-              },
-            },
-            data_stream: {
-              timestamp_field: '@timestamp',
-            },
-          },
-        });
-
-        await es.transport.request({
-          path: '/_data_stream/test_data_stream',
-          method: 'PUT',
-        });
-
-        await PageObjects.settings.createIndexPattern('test_data_stream', false);
-
-        await es.transport.request({
-          path: '/_data_stream/test_data_stream',
-          method: 'DELETE',
-        });
-      });
-    });
-
     describe('index alias', () => {
       it('can be an index pattern', async () => {
         await es.transport.request({
diff --git a/test/functional/apps/visualize/_tsvb_chart.ts b/test/functional/apps/visualize/_tsvb_chart.ts
index 191572e3e1354..5e8d2ef5653f2 100644
--- a/test/functional/apps/visualize/_tsvb_chart.ts
+++ b/test/functional/apps/visualize/_tsvb_chart.ts
@@ -28,7 +28,8 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const security = getService('security');
   const PageObjects = getPageObjects(['visualize', 'visualBuilder', 'timePicker', 'visChart']);
 
-  describe('visual builder', function describeIndexTests() {
+  // FLAKY: https://github.com/elastic/kibana/issues/71979
+  describe.skip('visual builder', function describeIndexTests() {
     this.tags('includeFirefox');
     beforeEach(async () => {
       await security.testUser.setRoles([
diff --git a/test/functional/page_objects/home_page.ts b/test/functional/page_objects/home_page.ts
index 6a503f4f73b66..2d78de49a4f94 100644
--- a/test/functional/page_objects/home_page.ts
+++ b/test/functional/page_objects/home_page.ts
@@ -54,6 +54,10 @@ export function HomePageProvider({ getService, getPageObjects }: FtrProviderCont
     async removeSampleDataSet(id: string) {
       // looks like overkill but we're hitting flaky cases where we click but it doesn't remove
       await testSubjects.waitForEnabled(`removeSampleDataSet${id}`);
+      // https://github.com/elastic/kibana/issues/65949
+      // Even after waiting for the "Remove" button to be enabled we still have failures
+      // where it appears the click just didn't work.
+      await PageObjects.common.sleep(1010);
       await testSubjects.click(`removeSampleDataSet${id}`);
       await this._waitForSampleDataLoadingAction(id);
     }
diff --git a/x-pack/plugins/actions/server/builtin_action_types/servicenow/api.test.ts b/x-pack/plugins/actions/server/builtin_action_types/servicenow/api.test.ts
index 7daf14e99f254..0bb096ecd0f62 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/servicenow/api.test.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/servicenow/api.test.ts
@@ -71,7 +71,7 @@ describe('api', () => {
       });
 
       test('it calls createIncident correctly', async () => {
-        const params = { ...apiParams, externalId: null, comments: undefined };
+        const params = { ...apiParams, externalId: null, comments: [] };
         await api.pushToService({
           externalService,
           mapping,
diff --git a/x-pack/plugins/actions/server/builtin_action_types/servicenow/api.ts b/x-pack/plugins/actions/server/builtin_action_types/servicenow/api.ts
index bd6f88f5efaa9..3281832941558 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/servicenow/api.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/servicenow/api.ts
@@ -53,7 +53,7 @@ const pushToServiceHandler = async ({
 
   let incident = {};
   // TODO: should be removed later but currently keep it for the Case implementation support
-  if (mapping) {
+  if (mapping && Array.isArray(params.comments)) {
     const fields = prepareFieldsForTransformation({
       externalCase: params.externalObject,
       mapping,
diff --git a/x-pack/plugins/apm/common/__snapshots__/apm_telemetry.test.ts.snap b/x-pack/plugins/apm/common/__snapshots__/apm_telemetry.test.ts.snap
index 1d8cfa28aea75..708758f2c6e58 100644
--- a/x-pack/plugins/apm/common/__snapshots__/apm_telemetry.test.ts.snap
+++ b/x-pack/plugins/apm/common/__snapshots__/apm_telemetry.test.ts.snap
@@ -527,6 +527,70 @@ exports[`APM telemetry helpers getApmTelemetry generates a JSON object with the
                         }
                       }
                     },
+                    "aggregated_transactions": {
+                      "properties": {
+                        "current_implementation": {
+                          "properties": {
+                            "expected_metric_document_count": {
+                              "type": "long"
+                            },
+                            "transaction_count": {
+                              "type": "long"
+                            }
+                          }
+                        },
+                        "no_observer_name": {
+                          "properties": {
+                            "expected_metric_document_count": {
+                              "type": "long"
+                            },
+                            "transaction_count": {
+                              "type": "long"
+                            }
+                          }
+                        },
+                        "no_rum": {
+                          "properties": {
+                            "expected_metric_document_count": {
+                              "type": "long"
+                            },
+                            "transaction_count": {
+                              "type": "long"
+                            }
+                          }
+                        },
+                        "no_rum_no_observer_name": {
+                          "properties": {
+                            "expected_metric_document_count": {
+                              "type": "long"
+                            },
+                            "transaction_count": {
+                              "type": "long"
+                            }
+                          }
+                        },
+                        "only_rum": {
+                          "properties": {
+                            "expected_metric_document_count": {
+                              "type": "long"
+                            },
+                            "transaction_count": {
+                              "type": "long"
+                            }
+                          }
+                        },
+                        "only_rum_no_observer_name": {
+                          "properties": {
+                            "expected_metric_document_count": {
+                              "type": "long"
+                            },
+                            "transaction_count": {
+                              "type": "long"
+                            }
+                          }
+                        }
+                      }
+                    },
                     "cloud": {
                       "properties": {
                         "availability_zone": {
@@ -647,12 +711,14 @@ exports[`APM telemetry helpers getApmTelemetry generates a JSON object with the
                         "client": {
                           "properties": {
                             "geo": {
-                              "properites": {
+                              "properties": {
                                 "country_iso_code": {
-                                  "rum": {
-                                    "properties": {
-                                      "1d": {
-                                        "type": "long"
+                                  "properties": {
+                                    "rum": {
+                                      "properties": {
+                                        "1d": {
+                                          "type": "long"
+                                        }
                                       }
                                     }
                                   }
@@ -831,6 +897,17 @@ exports[`APM telemetry helpers getApmTelemetry generates a JSON object with the
                     },
                     "tasks": {
                       "properties": {
+                        "aggregated_transactions": {
+                          "properties": {
+                            "took": {
+                              "properties": {
+                                "ms": {
+                                  "type": "long"
+                                }
+                              }
+                            }
+                          }
+                        },
                         "agent_configuration": {
                           "properties": {
                             "took": {
diff --git a/x-pack/plugins/apm/common/__snapshots__/elasticsearch_fieldnames.test.ts.snap b/x-pack/plugins/apm/common/__snapshots__/elasticsearch_fieldnames.test.ts.snap
index f7f2836745384..7c42fb6f12a54 100644
--- a/x-pack/plugins/apm/common/__snapshots__/elasticsearch_fieldnames.test.ts.snap
+++ b/x-pack/plugins/apm/common/__snapshots__/elasticsearch_fieldnames.test.ts.snap
@@ -70,6 +70,8 @@ exports[`Error METRIC_SYSTEM_TOTAL_MEMORY 1`] = `undefined`;
 
 exports[`Error OBSERVER_LISTENING 1`] = `undefined`;
 
+exports[`Error OBSERVER_NAME 1`] = `"an observer"`;
+
 exports[`Error OBSERVER_VERSION_MAJOR 1`] = `8`;
 
 exports[`Error PARENT_ID 1`] = `"parentId"`;
@@ -216,6 +218,8 @@ exports[`Span METRIC_SYSTEM_TOTAL_MEMORY 1`] = `undefined`;
 
 exports[`Span OBSERVER_LISTENING 1`] = `undefined`;
 
+exports[`Span OBSERVER_NAME 1`] = `"an observer"`;
+
 exports[`Span OBSERVER_VERSION_MAJOR 1`] = `8`;
 
 exports[`Span PARENT_ID 1`] = `"parentId"`;
@@ -362,6 +366,8 @@ exports[`Transaction METRIC_SYSTEM_TOTAL_MEMORY 1`] = `undefined`;
 
 exports[`Transaction OBSERVER_LISTENING 1`] = `undefined`;
 
+exports[`Transaction OBSERVER_NAME 1`] = `"an observer"`;
+
 exports[`Transaction OBSERVER_VERSION_MAJOR 1`] = `8`;
 
 exports[`Transaction PARENT_ID 1`] = `"parentId"`;
diff --git a/x-pack/plugins/apm/common/apm_telemetry.test.ts b/x-pack/plugins/apm/common/apm_telemetry.test.ts
index 035c546a5b49a..38f8e17d07485 100644
--- a/x-pack/plugins/apm/common/apm_telemetry.test.ts
+++ b/x-pack/plugins/apm/common/apm_telemetry.test.ts
@@ -4,7 +4,10 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { getApmTelemetryMapping } from './apm_telemetry';
+import {
+  getApmTelemetryMapping,
+  mergeApmTelemetryMapping,
+} from './apm_telemetry';
 
 // Add this snapshot serializer for this test. The default snapshot serializer
 // prints "Object" next to objects in the JSON output, but we want to be able to
@@ -43,4 +46,43 @@ describe('APM telemetry helpers', () => {
       }).toMatchSnapshot();
     });
   });
+
+  describe('mergeApmTelemetryMapping', () => {
+    describe('with an invalid mapping', () => {
+      it('throws an error', () => {
+        expect(() => mergeApmTelemetryMapping({})).toThrowError();
+      });
+    });
+
+    describe('with a valid mapping', () => {
+      it('merges the mapping', () => {
+        // This is "valid" in the sense that it has all of the deep fields
+        // needed to merge. It's not a valid mapping opbject.
+        const validTelemetryMapping = {
+          mappings: {
+            properties: {
+              stack_stats: {
+                properties: {
+                  kibana: {
+                    properties: {
+                      plugins: {
+                        properties: {
+                          apm: getApmTelemetryMapping(),
+                        },
+                      },
+                    },
+                  },
+                },
+              },
+            },
+          },
+        };
+
+        expect(
+          mergeApmTelemetryMapping(validTelemetryMapping)?.mappings.properties
+            .stack_stats.properties.kibana.properties.plugins.properties.apm
+        ).toEqual(getApmTelemetryMapping());
+      });
+    });
+  });
 });
diff --git a/x-pack/plugins/apm/common/apm_telemetry.ts b/x-pack/plugins/apm/common/apm_telemetry.ts
index 5fb6414674d1c..318b956cd3b3e 100644
--- a/x-pack/plugins/apm/common/apm_telemetry.ts
+++ b/x-pack/plugins/apm/common/apm_telemetry.ts
@@ -3,6 +3,7 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
+import { produce } from 'immer';
 import { AGENT_NAMES } from './agent_name';
 
 /**
@@ -73,6 +74,13 @@ export function getApmTelemetryMapping() {
     },
   };
 
+  const aggregatedTransactionsProperties = {
+    properties: {
+      expected_metric_document_count: long,
+      transaction_count: long,
+    },
+  };
+
   return {
     properties: {
       agents: {
@@ -90,6 +98,16 @@ export function getApmTelemetryMapping() {
           {}
         ),
       },
+      aggregated_transactions: {
+        properties: {
+          current_implementation: aggregatedTransactionsProperties,
+          no_observer_name: aggregatedTransactionsProperties,
+          no_rum: aggregatedTransactionsProperties,
+          no_rum_no_observer_name: aggregatedTransactionsProperties,
+          only_rum: aggregatedTransactionsProperties,
+          only_rum_no_observer_name: aggregatedTransactionsProperties,
+        },
+      },
       cloud: {
         properties: {
           availability_zone: keyword,
@@ -117,8 +135,8 @@ export function getApmTelemetryMapping() {
           client: {
             properties: {
               geo: {
-                properites: {
-                  country_iso_code: { rum: oneDayProperties },
+                properties: {
+                  country_iso_code: { properties: { rum: oneDayProperties } },
                 },
               },
             },
@@ -204,6 +222,7 @@ export function getApmTelemetryMapping() {
       },
       tasks: {
         properties: {
+          aggregated_transactions: tookProperties,
           agent_configuration: tookProperties,
           agents: tookProperties,
           cardinality: tookProperties,
@@ -230,3 +249,16 @@ export function getApmTelemetryMapping() {
     },
   };
 }
+
+/**
+ * Merge a telemetry mapping object (from https://github.com/elastic/telemetry/blob/master/config/templates/xpack-phone-home.json)
+ * with the output from `getApmTelemetryMapping`.
+ */
+export function mergeApmTelemetryMapping(
+  xpackPhoneHomeMapping: Record<string, any>
+) {
+  return produce(xpackPhoneHomeMapping, (draft: Record<string, any>) => {
+    draft.mappings.properties.stack_stats.properties.kibana.properties.plugins.properties.apm = getApmTelemetryMapping();
+    return draft;
+  });
+}
diff --git a/x-pack/plugins/apm/common/elasticsearch_fieldnames.test.ts b/x-pack/plugins/apm/common/elasticsearch_fieldnames.test.ts
index a9eb95cf37d4d..2b9b2c85e0bb5 100644
--- a/x-pack/plugins/apm/common/elasticsearch_fieldnames.test.ts
+++ b/x-pack/plugins/apm/common/elasticsearch_fieldnames.test.ts
@@ -16,6 +16,7 @@ describe('Transaction', () => {
     '@timestamp': new Date().toString(),
     '@metadata': 'whatever',
     observer: {
+      name: 'an observer',
       version: 'whatever',
       version_major: 8,
     },
@@ -72,6 +73,7 @@ describe('Span', () => {
     '@timestamp': new Date().toString(),
     '@metadata': 'whatever',
     observer: {
+      name: 'an observer',
       version: 'whatever',
       version_major: 8,
     },
@@ -124,6 +126,7 @@ describe('Error', () => {
   const errorDoc: AllowUnknownProperties<APMError> = {
     '@metadata': 'whatever',
     observer: {
+      name: 'an observer',
       version: 'whatever',
       version_major: 8,
     },
diff --git a/x-pack/plugins/apm/common/elasticsearch_fieldnames.ts b/x-pack/plugins/apm/common/elasticsearch_fieldnames.ts
index d8d3827909b07..610a32e8e9b99 100644
--- a/x-pack/plugins/apm/common/elasticsearch_fieldnames.ts
+++ b/x-pack/plugins/apm/common/elasticsearch_fieldnames.ts
@@ -31,6 +31,7 @@ export const USER_AGENT_NAME = 'user_agent.name';
 
 export const DESTINATION_ADDRESS = 'destination.address';
 
+export const OBSERVER_NAME = 'observer.name';
 export const OBSERVER_VERSION_MAJOR = 'observer.version_major';
 export const OBSERVER_LISTENING = 'observer.listening';
 export const PROCESSOR_EVENT = 'processor.event';
diff --git a/x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum/rum_dashboard.ts b/x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum/rum_dashboard.ts
index ac7aaf33b7849..8e010d5180f88 100644
--- a/x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum/rum_dashboard.ts
+++ b/x-pack/plugins/apm/e2e/cypress/support/step_definitions/rum/rum_dashboard.ts
@@ -61,7 +61,10 @@ Then(`should display chart legend`, () => {
   cy.get('kbnLoadingIndicator').should('not.be.visible');
   cy.get('.euiLoadingChart').should('not.be.visible');
 
-  cy.get(chartLegend).eq(0).invoke('text').snapshot();
+  cy.get(chartLegend, { timeout: DEFAULT_TIMEOUT })
+    .eq(0)
+    .invoke('text')
+    .snapshot();
 });
 
 Then(`should display tooltip on hover`, () => {
@@ -73,7 +76,7 @@ Then(`should display tooltip on hover`, () => {
   cy.get('kbnLoadingIndicator').should('not.be.visible');
   cy.get('.euiLoadingChart').should('not.be.visible');
 
-  const marker = cy.get(pMarkers).eq(0);
+  const marker = cy.get(pMarkers, { timeout: DEFAULT_TIMEOUT }).eq(0);
   marker.invoke('show');
   marker.trigger('mouseover', { force: true });
   cy.get('span[data-cy=percentileTooltipTitle]').should('be.visible');
diff --git a/x-pack/plugins/apm/public/application/index.tsx b/x-pack/plugins/apm/public/application/index.tsx
index 0a6cca8434a85..c39afe6da215e 100644
--- a/x-pack/plugins/apm/public/application/index.tsx
+++ b/x-pack/plugins/apm/public/application/index.tsx
@@ -26,7 +26,6 @@ import {
 } from '../../../../../src/plugins/kibana_react/public';
 import { px, units } from '../style/variables';
 import { UpdateBreadcrumbs } from '../components/app/Main/UpdateBreadcrumbs';
-import { APMIndicesPermission } from '../components/app/APMIndicesPermission';
 import { ScrollToTopOnPathChange } from '../components/app/Main/ScrollToTopOnPathChange';
 import { routes } from '../components/app/Main/route_config';
 import { history, resetHistory } from '../utils/history';
@@ -52,13 +51,11 @@ const App = () => {
       <MainContainer data-test-subj="apmMainContainer" role="main">
         <UpdateBreadcrumbs routes={routes} />
         <Route component={ScrollToTopOnPathChange} />
-        <APMIndicesPermission>
-          <Switch>
-            {routes.map((route, i) => (
-              <ApmRoute key={i} {...route} />
-            ))}
-          </Switch>
-        </APMIndicesPermission>
+        <Switch>
+          {routes.map((route, i) => (
+            <ApmRoute key={i} {...route} />
+          ))}
+        </Switch>
       </MainContainer>
     </ThemeProvider>
   );
diff --git a/x-pack/plugins/apm/public/components/app/APMIndicesPermission/index.test.tsx b/x-pack/plugins/apm/public/components/app/APMIndicesPermission/index.test.tsx
deleted file mode 100644
index f5d3edf98662e..0000000000000
--- a/x-pack/plugins/apm/public/components/app/APMIndicesPermission/index.test.tsx
+++ /dev/null
@@ -1,151 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-import React from 'react';
-import { render, fireEvent, act } from '@testing-library/react';
-import { shallow } from 'enzyme';
-import { APMIndicesPermission } from './';
-
-import * as hooks from '../../../hooks/useFetcher';
-import {
-  expectTextsInDocument,
-  expectTextsNotInDocument,
-} from '../../../utils/testHelpers';
-import { MockApmPluginContextWrapper } from '../../../context/ApmPluginContext/MockApmPluginContext';
-
-describe('APMIndicesPermission', () => {
-  it('returns empty component when api status is loading', () => {
-    jest.spyOn(hooks, 'useFetcher').mockReturnValue({
-      status: hooks.FETCH_STATUS.LOADING,
-      refetch: jest.fn(),
-    });
-    const component = shallow(<APMIndicesPermission />);
-    expect(component.isEmptyRender()).toBeTruthy();
-  });
-  it('returns empty component when api status is pending', () => {
-    jest.spyOn(hooks, 'useFetcher').mockReturnValue({
-      status: hooks.FETCH_STATUS.PENDING,
-      refetch: jest.fn(),
-    });
-    const component = shallow(<APMIndicesPermission />);
-    expect(component.isEmptyRender()).toBeTruthy();
-  });
-  it('renders missing permission page', () => {
-    jest.spyOn(hooks, 'useFetcher').mockReturnValue({
-      status: hooks.FETCH_STATUS.SUCCESS,
-      data: {
-        has_all_requested: false,
-        index: {
-          'apm-*': { read: false },
-        },
-      },
-      refetch: jest.fn(),
-    });
-    const component = render(
-      <MockApmPluginContextWrapper>
-        <APMIndicesPermission />
-      </MockApmPluginContextWrapper>
-    );
-    expectTextsInDocument(component, [
-      'Missing permissions to access APM',
-      'Dismiss',
-      'apm-*',
-    ]);
-  });
-
-  it('shows children component when no index is returned', () => {
-    jest.spyOn(hooks, 'useFetcher').mockReturnValue({
-      status: hooks.FETCH_STATUS.SUCCESS,
-      data: {
-        has_all_requested: false,
-        index: {},
-      },
-      refetch: jest.fn(),
-    });
-    const component = render(
-      <MockApmPluginContextWrapper>
-        <APMIndicesPermission>
-          <p>My amazing component</p>
-        </APMIndicesPermission>
-      </MockApmPluginContextWrapper>
-    );
-    expectTextsNotInDocument(component, ['Missing permissions to access APM']);
-    expectTextsInDocument(component, ['My amazing component']);
-  });
-
-  it('shows children component when indices have read privileges', () => {
-    jest.spyOn(hooks, 'useFetcher').mockReturnValue({
-      status: hooks.FETCH_STATUS.SUCCESS,
-      data: {
-        has_all_requested: true,
-        index: {},
-      },
-      refetch: jest.fn(),
-    });
-    const component = render(
-      <MockApmPluginContextWrapper>
-        <APMIndicesPermission>
-          <p>My amazing component</p>
-        </APMIndicesPermission>
-      </MockApmPluginContextWrapper>
-    );
-    expectTextsNotInDocument(component, ['Missing permissions to access APM']);
-    expectTextsInDocument(component, ['My amazing component']);
-  });
-
-  it('dismesses the warning by clicking on the escape hatch', () => {
-    jest.spyOn(hooks, 'useFetcher').mockReturnValue({
-      status: hooks.FETCH_STATUS.SUCCESS,
-      data: {
-        has_all_requested: false,
-        index: {
-          'apm-error-*': { read: false },
-          'apm-trasanction-*': { read: false },
-          'apm-metrics-*': { read: true },
-          'apm-span-*': { read: true },
-        },
-      },
-      refetch: jest.fn(),
-    });
-    const component = render(
-      <MockApmPluginContextWrapper>
-        <APMIndicesPermission>
-          <p>My amazing component</p>
-        </APMIndicesPermission>
-      </MockApmPluginContextWrapper>
-    );
-    expectTextsInDocument(component, [
-      'Dismiss',
-      'apm-error-*',
-      'apm-trasanction-*',
-    ]);
-    act(() => {
-      fireEvent.click(component.getByText('Dismiss'));
-    });
-    expectTextsInDocument(component, ['My amazing component']);
-  });
-
-  it("shows children component when api doesn't return value", () => {
-    jest.spyOn(hooks, 'useFetcher').mockReturnValue({
-      status: hooks.FETCH_STATUS.SUCCESS,
-      refetch: jest.fn(),
-    });
-    const component = render(
-      <MockApmPluginContextWrapper>
-        <APMIndicesPermission>
-          <p>My amazing component</p>
-        </APMIndicesPermission>
-      </MockApmPluginContextWrapper>
-    );
-    expectTextsNotInDocument(component, [
-      'Missing permissions to access APM',
-      'apm-7.5.1-error-*',
-      'apm-7.5.1-metric-*',
-      'apm-7.5.1-transaction-*',
-      'apm-7.5.1-span-*',
-    ]);
-    expectTextsInDocument(component, ['My amazing component']);
-  });
-});
diff --git a/x-pack/plugins/apm/public/components/app/APMIndicesPermission/index.tsx b/x-pack/plugins/apm/public/components/app/APMIndicesPermission/index.tsx
deleted file mode 100644
index f55f26fe7fc3c..0000000000000
--- a/x-pack/plugins/apm/public/components/app/APMIndicesPermission/index.tsx
+++ /dev/null
@@ -1,167 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import {
-  EuiButton,
-  EuiEmptyPrompt,
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiLink,
-  EuiPanel,
-  EuiText,
-  EuiTitle,
-} from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
-import React, { useState } from 'react';
-import styled from 'styled-components';
-import { isEmpty } from 'lodash';
-import { FETCH_STATUS, useFetcher } from '../../../hooks/useFetcher';
-import { fontSize, pct, px, units } from '../../../style/variables';
-import { ElasticDocsLink } from '../../shared/Links/ElasticDocsLink';
-import { SetupInstructionsLink } from '../../shared/Links/SetupInstructionsLink';
-
-export const APMIndicesPermission: React.FC = ({ children }) => {
-  const [
-    isPermissionWarningDismissed,
-    setIsPermissionWarningDismissed,
-  ] = useState(false);
-
-  const { data: indicesPrivileges, status } = useFetcher((callApmApi) => {
-    return callApmApi({
-      pathname: '/api/apm/security/indices_privileges',
-    });
-  }, []);
-
-  // Return null until receive the reponse of the api.
-  if (status === FETCH_STATUS.LOADING || status === FETCH_STATUS.PENDING) {
-    return null;
-  }
-
-  // Show permission warning when a user has at least one index without Read privilege,
-  // and they have not manually dismissed the warning
-  if (
-    indicesPrivileges &&
-    !indicesPrivileges.has_all_requested &&
-    !isEmpty(indicesPrivileges.index) &&
-    !isPermissionWarningDismissed
-  ) {
-    const indicesWithoutPermission = Object.keys(
-      indicesPrivileges.index
-    ).filter((index) => !indicesPrivileges.index[index].read);
-    return (
-      <PermissionWarning
-        indicesWithoutPermission={indicesWithoutPermission}
-        onEscapeHatchClick={() => setIsPermissionWarningDismissed(true)}
-      />
-    );
-  }
-
-  return <>{children}</>;
-};
-
-const CentralizedContainer = styled.div`
-  height: ${pct(100)};
-  display: flex;
-  justify-content: center;
-  align-items: center;
-`;
-
-const EscapeHatch = styled.div`
-  width: ${pct(100)};
-  margin-top: ${px(units.plus)};
-  justify-content: center;
-  display: flex;
-`;
-
-interface Props {
-  indicesWithoutPermission: string[];
-  onEscapeHatchClick: () => void;
-}
-
-const PermissionWarning = ({
-  indicesWithoutPermission,
-  onEscapeHatchClick,
-}: Props) => {
-  return (
-    <div style={{ height: pct(95) }}>
-      <EuiFlexGroup alignItems="center">
-        <EuiFlexItem grow={false}>
-          <EuiTitle size="l">
-            <h1>
-              {i18n.translate('xpack.apm.permission.apm', {
-                defaultMessage: 'APM',
-              })}
-            </h1>
-          </EuiTitle>
-        </EuiFlexItem>
-        <EuiFlexItem grow={false}>
-          <SetupInstructionsLink />
-        </EuiFlexItem>
-      </EuiFlexGroup>
-      <CentralizedContainer>
-        <div>
-          <EuiPanel paddingSize="none">
-            <EuiEmptyPrompt
-              iconType="apmApp"
-              iconColor={''}
-              title={
-                <h2>
-                  {i18n.translate('xpack.apm.permission.title', {
-                    defaultMessage: 'Missing permissions to access APM',
-                  })}
-                </h2>
-              }
-              body={
-                <>
-                  <p>
-                    {i18n.translate('xpack.apm.permission.description', {
-                      defaultMessage:
-                        "Your user doesn't have access to all APM indices. You can still use the APM app but some data may be missing. You must be granted access to the following indices:",
-                    })}
-                  </p>
-                  <ul style={{ listStyleType: 'none' }}>
-                    {indicesWithoutPermission.map((index) => (
-                      <li key={index} style={{ marginTop: units.half }}>
-                        <EuiText size="s">{index}</EuiText>
-                      </li>
-                    ))}
-                  </ul>
-                </>
-              }
-              actions={
-                <>
-                  <ElasticDocsLink
-                    section="/apm/server"
-                    path="/feature-roles.html"
-                  >
-                    {(href: string) => (
-                      <EuiButton color="primary" fill href={href}>
-                        {i18n.translate('xpack.apm.permission.learnMore', {
-                          defaultMessage: 'Learn more about APM permissions',
-                        })}
-                      </EuiButton>
-                    )}
-                  </ElasticDocsLink>
-                  <EscapeHatch>
-                    <EuiLink
-                      color="subdued"
-                      onClick={onEscapeHatchClick}
-                      style={{ fontSize }}
-                    >
-                      {i18n.translate('xpack.apm.permission.dismissWarning', {
-                        defaultMessage: 'Dismiss',
-                      })}
-                    </EuiLink>
-                  </EscapeHatch>
-                </>
-              }
-            />
-          </EuiPanel>
-        </div>
-      </CentralizedContainer>
-    </div>
-  );
-};
diff --git a/x-pack/plugins/apm/server/lib/apm_telemetry/collect_data_telemetry/tasks.test.ts b/x-pack/plugins/apm/server/lib/apm_telemetry/collect_data_telemetry/tasks.test.ts
index ea2b57c01acff..eafd0f04b9d10 100644
--- a/x-pack/plugins/apm/server/lib/apm_telemetry/collect_data_telemetry/tasks.test.ts
+++ b/x-pack/plugins/apm/server/lib/apm_telemetry/collect_data_telemetry/tasks.test.ts
@@ -4,8 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { tasks } from './tasks';
+import { AGENT_NAME } from '../../../../common/elasticsearch_fieldnames';
 import { ApmIndicesConfig } from '../../settings/apm_indices/get_apm_indices';
+import { tasks } from './tasks';
 
 describe('data telemetry collection tasks', () => {
   const indices = {
@@ -15,6 +16,109 @@ describe('data telemetry collection tasks', () => {
     'apm_oss.transactionIndices': 'apm-8.0.0-transaction',
   } as ApmIndicesConfig;
 
+  describe('aggregated_transactions', () => {
+    const task = tasks.find((t) => t.name === 'aggregated_transactions');
+
+    it('returns aggregated transaction counts', async () => {
+      // This mock implementation returns different values based on the parameters,
+      // which should simulate all the queries that are done. For most of them we'll
+      // simulate the number of buckets by using the length of the key, but for a
+      // couple we'll simulate being paginated by returning an after_key.
+      const search = jest.fn().mockImplementation((params) => {
+        const isRumResult =
+          params.body.query.bool.filter &&
+          params.body.query.bool.filter.some(
+            (filter: any) =>
+              filter.terms && filter.terms[AGENT_NAME]?.includes('rum-js')
+          );
+        const isNonRumResult =
+          params.body.query.bool.filter &&
+          params.body.query.bool.filter.some(
+            (filter: any) =>
+              filter.terms && !filter.terms[AGENT_NAME]?.includes('rum-js')
+          );
+        const isPagedResult =
+          !!params.body.aggs?.current_implementation?.composite.after ||
+          !!params.body.aggs?.no_observer_name?.composite.after;
+        const isTotalResult = 'track_total_hits' in params.body;
+        const key = Object.keys(params.body.aggs ?? [])[0];
+
+        if (isRumResult) {
+          if (isTotalResult) {
+            return Promise.resolve({ hits: { total: { value: 3000 } } });
+          }
+        }
+
+        if (isNonRumResult) {
+          if (isTotalResult) {
+            return Promise.resolve({ hits: { total: { value: 2000 } } });
+          }
+        }
+
+        if (isPagedResult && key) {
+          return Promise.resolve({
+            hits: { total: { value: key.length } },
+            aggregations: { [key]: { buckets: [{}] } },
+          });
+        }
+
+        if (isTotalResult) {
+          return Promise.resolve({ hits: { total: { value: 1000 } } });
+        }
+
+        if (
+          key === 'current_implementation' ||
+          (key === 'no_observer_name' && !isPagedResult)
+        ) {
+          return Promise.resolve({
+            hits: { total: { value: key.length } },
+            aggregations: {
+              [key]: { after_key: {}, buckets: key.split('').map((_) => ({})) },
+            },
+          });
+        }
+
+        if (key) {
+          return Promise.resolve({
+            hits: { total: { value: key.length } },
+            aggregations: {
+              [key]: { buckets: key.split('').map((_) => ({})) },
+            },
+          });
+        }
+      });
+
+      expect(await task?.executor({ indices, search } as any)).toEqual({
+        aggregated_transactions: {
+          current_implementation: {
+            expected_metric_document_count: 23,
+            transaction_count: 1000,
+          },
+          no_observer_name: {
+            expected_metric_document_count: 17,
+            transaction_count: 1000,
+          },
+          no_rum: {
+            expected_metric_document_count: 6,
+            transaction_count: 2000,
+          },
+          no_rum_no_observer_name: {
+            expected_metric_document_count: 23,
+            transaction_count: 2000,
+          },
+          only_rum: {
+            expected_metric_document_count: 8,
+            transaction_count: 3000,
+          },
+          only_rum_no_observer_name: {
+            expected_metric_document_count: 25,
+            transaction_count: 3000,
+          },
+        },
+      });
+    });
+  });
+
   describe('cloud', () => {
     const task = tasks.find((t) => t.name === 'cloud');
 
diff --git a/x-pack/plugins/apm/server/lib/apm_telemetry/collect_data_telemetry/tasks.ts b/x-pack/plugins/apm/server/lib/apm_telemetry/collect_data_telemetry/tasks.ts
index 2ecb5a935893f..840f47b043418 100644
--- a/x-pack/plugins/apm/server/lib/apm_telemetry/collect_data_telemetry/tasks.ts
+++ b/x-pack/plugins/apm/server/lib/apm_telemetry/collect_data_telemetry/tasks.ts
@@ -5,7 +5,7 @@
  */
 import { flatten, merge, sortBy, sum } from 'lodash';
 import { TelemetryTask } from '.';
-import { AGENT_NAMES } from '../../../../common/agent_name';
+import { AGENT_NAMES, RUM_AGENTS } from '../../../../common/agent_name';
 import {
   AGENT_NAME,
   AGENT_VERSION,
@@ -13,9 +13,14 @@ import {
   CLOUD_AVAILABILITY_ZONE,
   CLOUD_PROVIDER,
   CLOUD_REGION,
+  CONTAINER_ID,
   ERROR_GROUP_ID,
+  HOST_NAME,
+  OBSERVER_NAME,
   PARENT_ID,
+  POD_NAME,
   PROCESSOR_EVENT,
+  SERVICE_ENVIRONMENT,
   SERVICE_FRAMEWORK_NAME,
   SERVICE_FRAMEWORK_VERSION,
   SERVICE_LANGUAGE_NAME,
@@ -23,9 +28,14 @@ import {
   SERVICE_NAME,
   SERVICE_RUNTIME_NAME,
   SERVICE_RUNTIME_VERSION,
+  SERVICE_VERSION,
   TRANSACTION_NAME,
+  TRANSACTION_RESULT,
+  TRANSACTION_TYPE,
+  USER_AGENT_NAME,
   USER_AGENT_ORIGINAL,
 } from '../../../../common/elasticsearch_fieldnames';
+import { ESFilter } from '../../../../typings/elasticsearch';
 import { APMError } from '../../../../typings/es_schemas/ui/apm_error';
 import { AgentName } from '../../../../typings/es_schemas/ui/fields/agent';
 import { Span } from '../../../../typings/es_schemas/ui/span';
@@ -39,6 +49,166 @@ const range1d = { range: { '@timestamp': { gte: 'now-1d' } } };
 const timeout = '5m';
 
 export const tasks: TelemetryTask[] = [
+  {
+    name: 'aggregated_transactions',
+    // Record the number of metric documents we can expect in different scenarios. We simulate this by requesting data for 1m,
+    // adding a composite aggregation on a number of fields and counting the number of buckets. The resulting count is an
+    // approximation of the amount of metric documents that will be created. We record both the expected metric document count plus
+    // the transaction count for that time range.
+    executor: async ({ indices, search }) => {
+      async function getBucketCountFromPaginatedQuery(
+        key: string,
+        filter: ESFilter[],
+        count: number = 0,
+        after?: any
+      ) {
+        const params = {
+          index: [indices['apm_oss.transactionIndices']],
+          body: {
+            size: 0,
+            timeout,
+            query: { bool: { filter } },
+            aggs: {
+              [key]: {
+                composite: {
+                  ...(after ? { after } : {}),
+                  size: 10000,
+                  sources: fieldMap[key].map((field) => ({
+                    [field]: { terms: { field, missing_bucket: true } },
+                  })),
+                },
+              },
+            },
+          },
+        };
+        const result = await search(params);
+        let nextAfter: any;
+
+        if (result.aggregations) {
+          nextAfter = result.aggregations[key].after_key;
+          count += result.aggregations[key].buckets.length;
+        }
+
+        if (nextAfter) {
+          count = await getBucketCountFromPaginatedQuery(
+            key,
+            filter,
+            count,
+            nextAfter
+          );
+        }
+
+        return count;
+      }
+
+      async function totalSearch(filter: ESFilter[]) {
+        const result = await search({
+          index: [indices['apm_oss.transactionIndices']],
+          body: {
+            size: 0,
+            timeout,
+            query: { bool: { filter } },
+            track_total_hits: true,
+          },
+        });
+
+        return result.hits.total.value;
+      }
+
+      const nonRumAgentNames = AGENT_NAMES.filter(
+        (name) => !RUM_AGENTS.includes(name)
+      );
+
+      const filter: ESFilter[] = [
+        { term: { [PROCESSOR_EVENT]: 'transaction' } },
+        { range: { '@timestamp': { gte: 'now-1m' } } },
+      ];
+      const noRumFilter = [
+        ...filter,
+        { terms: { [AGENT_NAME]: nonRumAgentNames } },
+      ];
+      const rumFilter = [...filter, { terms: { [AGENT_NAME]: RUM_AGENTS } }];
+
+      const baseFields = [
+        TRANSACTION_NAME,
+        TRANSACTION_RESULT,
+        TRANSACTION_TYPE,
+        AGENT_NAME,
+        SERVICE_ENVIRONMENT,
+        SERVICE_VERSION,
+        HOST_NAME,
+        CONTAINER_ID,
+        POD_NAME,
+      ];
+
+      const fieldMap: Record<string, string[]> = {
+        current_implementation: [OBSERVER_NAME, ...baseFields, USER_AGENT_NAME],
+        no_observer_name: [...baseFields, USER_AGENT_NAME],
+        no_rum: [OBSERVER_NAME, ...baseFields],
+        no_rum_no_observer_name: baseFields,
+        only_rum: [OBSERVER_NAME, ...baseFields, USER_AGENT_NAME],
+        only_rum_no_observer_name: [...baseFields, USER_AGENT_NAME],
+      };
+
+      // It would be more performant to do these in parallel, but we have different filters and keys and it's easier to
+      // understand if we make the code slower and longer
+      const countMap: Record<string, number> = {
+        current_implementation: await getBucketCountFromPaginatedQuery(
+          'current_implementation',
+          filter
+        ),
+        no_observer_name: await getBucketCountFromPaginatedQuery(
+          'no_observer_name',
+          filter
+        ),
+        no_rum: await getBucketCountFromPaginatedQuery('no_rum', noRumFilter),
+        no_rum_no_observer_name: await getBucketCountFromPaginatedQuery(
+          'no_rum_no_observer_name',
+          noRumFilter
+        ),
+        only_rum: await getBucketCountFromPaginatedQuery('only_rum', rumFilter),
+        only_rum_no_observer_name: await getBucketCountFromPaginatedQuery(
+          'only_rum_no_observer_name',
+          rumFilter
+        ),
+      };
+
+      const [allCount, noRumCount, rumCount] = await Promise.all([
+        totalSearch(filter),
+        totalSearch(noRumFilter),
+        totalSearch(rumFilter),
+      ]);
+
+      return {
+        aggregated_transactions: {
+          current_implementation: {
+            transaction_count: allCount,
+            expected_metric_document_count: countMap.current_implementation,
+          },
+          no_observer_name: {
+            transaction_count: allCount,
+            expected_metric_document_count: countMap.no_observer_name,
+          },
+          no_rum: {
+            transaction_count: noRumCount,
+            expected_metric_document_count: countMap.no_rum,
+          },
+          no_rum_no_observer_name: {
+            transaction_count: noRumCount,
+            expected_metric_document_count: countMap.no_rum_no_observer_name,
+          },
+          only_rum: {
+            transaction_count: rumCount,
+            expected_metric_document_count: countMap.only_rum,
+          },
+          only_rum_no_observer_name: {
+            transaction_count: rumCount,
+            expected_metric_document_count: countMap.only_rum_no_observer_name,
+          },
+        },
+      };
+    },
+  },
   {
     name: 'cloud',
     executor: async ({ indices, search }) => {
@@ -742,10 +912,7 @@ export const tasks: TelemetryTask[] = [
           timeout,
           query: {
             bool: {
-              filter: [
-                range1d,
-                { terms: { [AGENT_NAME]: ['rum-js', 'js-base'] } },
-              ],
+              filter: [range1d, { terms: { [AGENT_NAME]: RUM_AGENTS } }],
             },
           },
           aggs: {
diff --git a/x-pack/plugins/apm/server/lib/apm_telemetry/types.ts b/x-pack/plugins/apm/server/lib/apm_telemetry/types.ts
index 4c376aac52f5b..82e4d1e395ed3 100644
--- a/x-pack/plugins/apm/server/lib/apm_telemetry/types.ts
+++ b/x-pack/plugins/apm/server/lib/apm_telemetry/types.ts
@@ -15,6 +15,11 @@ export interface TimeframeMap {
 export type TimeframeMap1d = Pick<TimeframeMap, '1d'>;
 export type TimeframeMapAll = Pick<TimeframeMap, 'all'>;
 
+export interface AggregatedTransactionsCounts {
+  expected_metric_document_count: number;
+  transaction_count: number;
+}
+
 export type APMDataTelemetry = DeepPartial<{
   has_any_services: boolean;
   services_per_agent: Record<AgentName, number>;
@@ -25,6 +30,14 @@ export type APMDataTelemetry = DeepPartial<{
       patch: number;
     };
   };
+  aggregated_transactions: {
+    current_implementation: AggregatedTransactionsCounts;
+    no_observer_name: AggregatedTransactionsCounts;
+    no_rum: AggregatedTransactionsCounts;
+    no_rum_no_observer_name: AggregatedTransactionsCounts;
+    only_rum: AggregatedTransactionsCounts;
+    only_rum_no_observer_name: AggregatedTransactionsCounts;
+  };
   cloud: {
     availability_zone: string[];
     provider: string[];
@@ -108,6 +121,7 @@ export type APMDataTelemetry = DeepPartial<{
     };
   };
   tasks: Record<
+    | 'aggregated_transactions'
     | 'cloud'
     | 'processor_events'
     | 'agent_configuration'
diff --git a/x-pack/plugins/apm/server/lib/security/get_indices_privileges.test.ts b/x-pack/plugins/apm/server/lib/security/get_indices_privileges.test.ts
deleted file mode 100644
index 9665d231d20a9..0000000000000
--- a/x-pack/plugins/apm/server/lib/security/get_indices_privileges.test.ts
+++ /dev/null
@@ -1,148 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-import { Setup } from '../helpers/setup_request';
-import { getIndicesPrivileges } from './get_indices_privileges';
-
-describe('getIndicesPrivileges', () => {
-  const indices = {
-    apm_oss: {
-      errorIndices: 'apm-*',
-      metricsIndices: 'apm-*',
-      transactionIndices: 'apm-*',
-      spanIndices: 'apm-*',
-    },
-  };
-  it('return that the user has privileges when security plugin is disabled', async () => {
-    const setup = ({
-      indices,
-      client: {
-        hasPrivileges: () => {
-          const error = {
-            message:
-              'no handler found for uri [/_security/user/_has_privileges]',
-            statusCode: 400,
-          };
-          throw error;
-        },
-      },
-    } as unknown) as Setup;
-    const privileges = await getIndicesPrivileges({
-      setup,
-      isSecurityPluginEnabled: false,
-    });
-    expect(privileges).toEqual({
-      has_all_requested: true,
-      index: {},
-    });
-  });
-  it('throws when an error happens while fetching indices privileges', async () => {
-    const setup = ({
-      indices,
-      client: {
-        hasPrivileges: () => {
-          throw new Error('unknow error');
-        },
-      },
-    } as unknown) as Setup;
-    await expect(
-      getIndicesPrivileges({ setup, isSecurityPluginEnabled: true })
-    ).rejects.toThrowError('unknow error');
-  });
-  it("has privileges to read from 'apm-*'", async () => {
-    const setup = ({
-      indices,
-      client: {
-        hasPrivileges: () => {
-          return Promise.resolve({
-            has_all_requested: true,
-            index: { 'apm-*': { read: true } },
-          });
-        },
-      },
-    } as unknown) as Setup;
-    const privileges = await getIndicesPrivileges({
-      setup,
-      isSecurityPluginEnabled: true,
-    });
-
-    expect(privileges).toEqual({
-      has_all_requested: true,
-      index: {
-        'apm-*': {
-          read: true,
-        },
-      },
-    });
-  });
-
-  it("doesn't have privileges to read from 'apm-*'", async () => {
-    const setup = ({
-      indices,
-      client: {
-        hasPrivileges: () => {
-          return Promise.resolve({
-            has_all_requested: false,
-            index: { 'apm-*': { read: false } },
-          });
-        },
-      },
-    } as unknown) as Setup;
-
-    const privileges = await getIndicesPrivileges({
-      setup,
-      isSecurityPluginEnabled: true,
-    });
-
-    expect(privileges).toEqual({
-      has_all_requested: false,
-      index: {
-        'apm-*': {
-          read: false,
-        },
-      },
-    });
-  });
-  it("doesn't have privileges on multiple indices", async () => {
-    const setup = ({
-      indices: {
-        apm_oss: {
-          errorIndices: 'apm-error-*',
-          metricsIndices: 'apm-metrics-*',
-          transactionIndices: 'apm-trasanction-*',
-          spanIndices: 'apm-span-*',
-        },
-      },
-      client: {
-        hasPrivileges: () => {
-          return Promise.resolve({
-            has_all_requested: false,
-            index: {
-              'apm-error-*': { read: false },
-              'apm-trasanction-*': { read: false },
-              'apm-metrics-*': { read: true },
-              'apm-span-*': { read: true },
-            },
-          });
-        },
-      },
-    } as unknown) as Setup;
-
-    const privileges = await getIndicesPrivileges({
-      setup,
-      isSecurityPluginEnabled: true,
-    });
-
-    expect(privileges).toEqual({
-      has_all_requested: false,
-      index: {
-        'apm-error-*': { read: false },
-        'apm-trasanction-*': { read: false },
-        'apm-metrics-*': { read: true },
-        'apm-span-*': { read: true },
-      },
-    });
-  });
-});
diff --git a/x-pack/plugins/apm/server/lib/security/get_indices_privileges.ts b/x-pack/plugins/apm/server/lib/security/get_indices_privileges.ts
deleted file mode 100644
index 729a81a13b8cf..0000000000000
--- a/x-pack/plugins/apm/server/lib/security/get_indices_privileges.ts
+++ /dev/null
@@ -1,36 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-import { Setup } from '../helpers/setup_request';
-import { IndexPrivileges } from '../helpers/es_client';
-
-export async function getIndicesPrivileges({
-  setup,
-  isSecurityPluginEnabled,
-}: {
-  setup: Setup;
-  isSecurityPluginEnabled: boolean;
-}): Promise<IndexPrivileges> {
-  // When security plugin is not enabled, returns that the user has all requested privileges.
-  if (!isSecurityPluginEnabled) {
-    return { has_all_requested: true, index: {} };
-  }
-
-  const { client, indices } = setup;
-  const response = await client.hasPrivileges({
-    index: [
-      {
-        names: [
-          indices['apm_oss.errorIndices'],
-          indices['apm_oss.metricsIndices'],
-          indices['apm_oss.transactionIndices'],
-          indices['apm_oss.spanIndices'],
-        ],
-        privileges: ['read'],
-      },
-    ],
-  });
-  return response;
-}
diff --git a/x-pack/plugins/apm/server/routes/create_apm_api.ts b/x-pack/plugins/apm/server/routes/create_apm_api.ts
index 11911cda79c17..5dff13e5b37e0 100644
--- a/x-pack/plugins/apm/server/routes/create_apm_api.ts
+++ b/x-pack/plugins/apm/server/routes/create_apm_api.ts
@@ -63,7 +63,6 @@ import {
 } from './ui_filters';
 import { createApi } from './create_api';
 import { serviceMapRoute, serviceMapServiceNodeRoute } from './service_map';
-import { indicesPrivilegesRoute } from './security';
 import {
   createCustomLinkRoute,
   updateCustomLinkRoute,
@@ -158,9 +157,6 @@ const createApmApi = () => {
     .add(serviceMapRoute)
     .add(serviceMapServiceNodeRoute)
 
-    // security
-    .add(indicesPrivilegesRoute)
-
     // Custom links
     .add(createCustomLinkRoute)
     .add(updateCustomLinkRoute)
diff --git a/x-pack/plugins/apm/server/routes/security.ts b/x-pack/plugins/apm/server/routes/security.ts
deleted file mode 100644
index ce5a7313012f2..0000000000000
--- a/x-pack/plugins/apm/server/routes/security.ts
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { createRoute } from './create_route';
-import { setupRequest } from '../lib/helpers/setup_request';
-import { getIndicesPrivileges } from '../lib/security/get_indices_privileges';
-
-export const indicesPrivilegesRoute = createRoute(() => ({
-  path: '/api/apm/security/indices_privileges',
-  handler: async ({ context, request }) => {
-    const setup = await setupRequest(context, request);
-    return getIndicesPrivileges({
-      setup,
-      isSecurityPluginEnabled:
-        context.plugins.security?.license.isEnabled() ?? false,
-    });
-  },
-}));
diff --git a/x-pack/plugins/event_log/kibana.json b/x-pack/plugins/event_log/kibana.json
index 7231d967b4c8d..0231bb6234471 100644
--- a/x-pack/plugins/event_log/kibana.json
+++ b/x-pack/plugins/event_log/kibana.json
@@ -3,6 +3,7 @@
   "version": "0.0.1",
   "kibanaVersion": "kibana",
   "configPath": ["xpack", "eventLog"],
+  "optionalPlugins": ["spaces"],
   "server": true,
   "ui": false
 }
diff --git a/x-pack/plugins/event_log/server/es/cluster_client_adapter.test.ts b/x-pack/plugins/event_log/server/es/cluster_client_adapter.test.ts
index ee6f0a301e9f8..6e787c905d400 100644
--- a/x-pack/plugins/event_log/server/es/cluster_client_adapter.test.ts
+++ b/x-pack/plugins/event_log/server/es/cluster_client_adapter.test.ts
@@ -4,10 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { LegacyClusterClient, Logger } from '../../../../../src/core/server';
-import { elasticsearchServiceMock, loggingSystemMock } from '../../../../../src/core/server/mocks';
+import { LegacyClusterClient, Logger } from 'src/core/server';
+import { elasticsearchServiceMock, loggingSystemMock } from 'src/core/server/mocks';
 import { ClusterClientAdapter, IClusterClientAdapter } from './cluster_client_adapter';
-import moment from 'moment';
 import { findOptionsSchema } from '../event_log_client';
 
 type EsClusterClient = Pick<jest.Mocked<LegacyClusterClient>, 'callAsInternalUser' | 'asScoped'>;
@@ -205,7 +204,7 @@ describe('createIndex', () => {
 describe('queryEventsBySavedObject', () => {
   const DEFAULT_OPTIONS = findOptionsSchema.validate({});
 
-  test('should call cluster with proper arguments', async () => {
+  test('should call cluster with proper arguments with non-default namespace', async () => {
     clusterClient.callAsInternalUser.mockResolvedValue({
       hits: {
         hits: [],
@@ -214,6 +213,7 @@ describe('queryEventsBySavedObject', () => {
     });
     await clusterClientAdapter.queryEventsBySavedObject(
       'index-name',
+      'namespace',
       'saved-object-type',
       'saved-object-id',
       DEFAULT_OPTIONS
@@ -221,52 +221,147 @@ describe('queryEventsBySavedObject', () => {
 
     const [method, query] = clusterClient.callAsInternalUser.mock.calls[0];
     expect(method).toEqual('search');
-    expect(query).toMatchObject({
-      index: 'index-name',
-      body: {
-        from: 0,
-        size: 10,
-        sort: { '@timestamp': { order: 'asc' } },
-        query: {
-          bool: {
-            must: [
-              {
-                nested: {
-                  path: 'kibana.saved_objects',
-                  query: {
-                    bool: {
-                      must: [
-                        {
-                          term: {
-                            'kibana.saved_objects.rel': {
-                              value: 'primary',
+    expect(query).toMatchInlineSnapshot(`
+      Object {
+        "body": Object {
+          "from": 0,
+          "query": Object {
+            "bool": Object {
+              "must": Array [
+                Object {
+                  "nested": Object {
+                    "path": "kibana.saved_objects",
+                    "query": Object {
+                      "bool": Object {
+                        "must": Array [
+                          Object {
+                            "term": Object {
+                              "kibana.saved_objects.rel": Object {
+                                "value": "primary",
+                              },
                             },
                           },
-                        },
-                        {
-                          term: {
-                            'kibana.saved_objects.type': {
-                              value: 'saved-object-type',
+                          Object {
+                            "term": Object {
+                              "kibana.saved_objects.type": Object {
+                                "value": "saved-object-type",
+                              },
                             },
                           },
-                        },
-                        {
-                          term: {
-                            'kibana.saved_objects.id': {
-                              value: 'saved-object-id',
+                          Object {
+                            "term": Object {
+                              "kibana.saved_objects.id": Object {
+                                "value": "saved-object-id",
+                              },
                             },
                           },
-                        },
-                      ],
+                          Object {
+                            "term": Object {
+                              "kibana.saved_objects.namespace": Object {
+                                "value": "namespace",
+                              },
+                            },
+                          },
+                        ],
+                      },
                     },
                   },
                 },
-              },
-            ],
+              ],
+            },
+          },
+          "size": 10,
+          "sort": Object {
+            "@timestamp": Object {
+              "order": "asc",
+            },
           },
         },
+        "index": "index-name",
+        "rest_total_hits_as_int": true,
+      }
+    `);
+  });
+
+  test('should call cluster with proper arguments with default namespace', async () => {
+    clusterClient.callAsInternalUser.mockResolvedValue({
+      hits: {
+        hits: [],
+        total: { value: 0 },
       },
     });
+    await clusterClientAdapter.queryEventsBySavedObject(
+      'index-name',
+      undefined,
+      'saved-object-type',
+      'saved-object-id',
+      DEFAULT_OPTIONS
+    );
+
+    const [method, query] = clusterClient.callAsInternalUser.mock.calls[0];
+    expect(method).toEqual('search');
+    expect(query).toMatchInlineSnapshot(`
+      Object {
+        "body": Object {
+          "from": 0,
+          "query": Object {
+            "bool": Object {
+              "must": Array [
+                Object {
+                  "nested": Object {
+                    "path": "kibana.saved_objects",
+                    "query": Object {
+                      "bool": Object {
+                        "must": Array [
+                          Object {
+                            "term": Object {
+                              "kibana.saved_objects.rel": Object {
+                                "value": "primary",
+                              },
+                            },
+                          },
+                          Object {
+                            "term": Object {
+                              "kibana.saved_objects.type": Object {
+                                "value": "saved-object-type",
+                              },
+                            },
+                          },
+                          Object {
+                            "term": Object {
+                              "kibana.saved_objects.id": Object {
+                                "value": "saved-object-id",
+                              },
+                            },
+                          },
+                          Object {
+                            "bool": Object {
+                              "must_not": Object {
+                                "exists": Object {
+                                  "field": "kibana.saved_objects.namespace",
+                                },
+                              },
+                            },
+                          },
+                        ],
+                      },
+                    },
+                  },
+                },
+              ],
+            },
+          },
+          "size": 10,
+          "sort": Object {
+            "@timestamp": Object {
+              "order": "asc",
+            },
+          },
+        },
+        "index": "index-name",
+        "rest_total_hits_as_int": true,
+      }
+    `);
   });
 
   test('should call cluster with sort', async () => {
@@ -278,6 +373,7 @@ describe('queryEventsBySavedObject', () => {
     });
     await clusterClientAdapter.queryEventsBySavedObject(
       'index-name',
+      'namespace',
       'saved-object-type',
       'saved-object-id',
       { ...DEFAULT_OPTIONS, sort_field: 'event.end', sort_order: 'desc' }
@@ -301,10 +397,11 @@ describe('queryEventsBySavedObject', () => {
       },
     });
 
-    const start = moment().subtract(1, 'days').toISOString();
+    const start = '2020-07-08T00:52:28.350Z';
 
     await clusterClientAdapter.queryEventsBySavedObject(
       'index-name',
+      'namespace',
       'saved-object-type',
       'saved-object-id',
       { ...DEFAULT_OPTIONS, start }
@@ -312,56 +409,73 @@ describe('queryEventsBySavedObject', () => {
 
     const [method, query] = clusterClient.callAsInternalUser.mock.calls[0];
     expect(method).toEqual('search');
-    expect(query).toMatchObject({
-      index: 'index-name',
-      body: {
-        query: {
-          bool: {
-            must: [
-              {
-                nested: {
-                  path: 'kibana.saved_objects',
-                  query: {
-                    bool: {
-                      must: [
-                        {
-                          term: {
-                            'kibana.saved_objects.rel': {
-                              value: 'primary',
+    expect(query).toMatchInlineSnapshot(`
+      Object {
+        "body": Object {
+          "from": 0,
+          "query": Object {
+            "bool": Object {
+              "must": Array [
+                Object {
+                  "nested": Object {
+                    "path": "kibana.saved_objects",
+                    "query": Object {
+                      "bool": Object {
+                        "must": Array [
+                          Object {
+                            "term": Object {
+                              "kibana.saved_objects.rel": Object {
+                                "value": "primary",
+                              },
                             },
                           },
-                        },
-                        {
-                          term: {
-                            'kibana.saved_objects.type': {
-                              value: 'saved-object-type',
+                          Object {
+                            "term": Object {
+                              "kibana.saved_objects.type": Object {
+                                "value": "saved-object-type",
+                              },
                             },
                           },
-                        },
-                        {
-                          term: {
-                            'kibana.saved_objects.id': {
-                              value: 'saved-object-id',
+                          Object {
+                            "term": Object {
+                              "kibana.saved_objects.id": Object {
+                                "value": "saved-object-id",
+                              },
                             },
                           },
-                        },
-                      ],
+                          Object {
+                            "term": Object {
+                              "kibana.saved_objects.namespace": Object {
+                                "value": "namespace",
+                              },
+                            },
+                          },
+                        ],
+                      },
                     },
                   },
                 },
-              },
-              {
-                range: {
-                  '@timestamp': {
-                    gte: start,
+                Object {
+                  "range": Object {
+                    "@timestamp": Object {
+                      "gte": "2020-07-08T00:52:28.350Z",
+                    },
                   },
                 },
-              },
-            ],
+              ],
+            },
+          },
+          "size": 10,
+          "sort": Object {
+            "@timestamp": Object {
+              "order": "asc",
+            },
           },
         },
-      },
-    });
+        "index": "index-name",
+        "rest_total_hits_as_int": true,
+      }
+    `);
   });
 
   test('supports optional date range', async () => {
@@ -372,11 +486,12 @@ describe('queryEventsBySavedObject', () => {
       },
     });
 
-    const start = moment().subtract(1, 'days').toISOString();
-    const end = moment().add(1, 'days').toISOString();
+    const start = '2020-07-08T00:52:28.350Z';
+    const end = '2020-07-08T00:00:00.000Z';
 
     await clusterClientAdapter.queryEventsBySavedObject(
       'index-name',
+      'namespace',
       'saved-object-type',
       'saved-object-id',
       { ...DEFAULT_OPTIONS, start, end }
@@ -384,62 +499,79 @@ describe('queryEventsBySavedObject', () => {
 
     const [method, query] = clusterClient.callAsInternalUser.mock.calls[0];
     expect(method).toEqual('search');
-    expect(query).toMatchObject({
-      index: 'index-name',
-      body: {
-        query: {
-          bool: {
-            must: [
-              {
-                nested: {
-                  path: 'kibana.saved_objects',
-                  query: {
-                    bool: {
-                      must: [
-                        {
-                          term: {
-                            'kibana.saved_objects.rel': {
-                              value: 'primary',
+    expect(query).toMatchInlineSnapshot(`
+      Object {
+        "body": Object {
+          "from": 0,
+          "query": Object {
+            "bool": Object {
+              "must": Array [
+                Object {
+                  "nested": Object {
+                    "path": "kibana.saved_objects",
+                    "query": Object {
+                      "bool": Object {
+                        "must": Array [
+                          Object {
+                            "term": Object {
+                              "kibana.saved_objects.rel": Object {
+                                "value": "primary",
+                              },
                             },
                           },
-                        },
-                        {
-                          term: {
-                            'kibana.saved_objects.type': {
-                              value: 'saved-object-type',
+                          Object {
+                            "term": Object {
+                              "kibana.saved_objects.type": Object {
+                                "value": "saved-object-type",
+                              },
                             },
                           },
-                        },
-                        {
-                          term: {
-                            'kibana.saved_objects.id': {
-                              value: 'saved-object-id',
+                          Object {
+                            "term": Object {
+                              "kibana.saved_objects.id": Object {
+                                "value": "saved-object-id",
+                              },
                             },
                           },
-                        },
-                      ],
+                          Object {
+                            "term": Object {
+                              "kibana.saved_objects.namespace": Object {
+                                "value": "namespace",
+                              },
+                            },
+                          },
+                        ],
+                      },
                     },
                   },
                 },
-              },
-              {
-                range: {
-                  '@timestamp': {
-                    gte: start,
+                Object {
+                  "range": Object {
+                    "@timestamp": Object {
+                      "gte": "2020-07-08T00:52:28.350Z",
+                    },
                   },
                 },
-              },
-              {
-                range: {
-                  '@timestamp': {
-                    lte: end,
+                Object {
+                  "range": Object {
+                    "@timestamp": Object {
+                      "lte": "2020-07-08T00:00:00.000Z",
+                    },
                   },
                 },
-              },
-            ],
+              ],
+            },
+          },
+          "size": 10,
+          "sort": Object {
+            "@timestamp": Object {
+              "order": "asc",
+            },
           },
         },
-      },
-    });
+        "index": "index-name",
+        "rest_total_hits_as_int": true,
+      }
+    `);
   });
 });
diff --git a/x-pack/plugins/event_log/server/es/cluster_client_adapter.ts b/x-pack/plugins/event_log/server/es/cluster_client_adapter.ts
index 3478358f88a54..f86e5d9ca0e32 100644
--- a/x-pack/plugins/event_log/server/es/cluster_client_adapter.ts
+++ b/x-pack/plugins/event_log/server/es/cluster_client_adapter.ts
@@ -6,8 +6,9 @@
 
 import { reject, isUndefined } from 'lodash';
 import { SearchResponse, Client } from 'elasticsearch';
-import { Logger, LegacyClusterClient } from '../../../../../src/core/server';
-import { IEvent, SAVED_OBJECT_REL_PRIMARY } from '../types';
+import { Logger, LegacyClusterClient } from 'src/core/server';
+
+import { IValidatedEvent, SAVED_OBJECT_REL_PRIMARY } from '../types';
 import { FindOptionsType } from '../event_log_client';
 
 export type EsClusterClient = Pick<LegacyClusterClient, 'callAsInternalUser' | 'asScoped'>;
@@ -22,7 +23,7 @@ export interface QueryEventsBySavedObjectResult {
   page: number;
   per_page: number;
   total: number;
-  data: IEvent[];
+  data: IValidatedEvent[];
 }
 
 export class ClusterClientAdapter {
@@ -129,84 +130,106 @@ export class ClusterClientAdapter {
 
   public async queryEventsBySavedObject(
     index: string,
+    namespace: string | undefined,
     type: string,
     id: string,
     { page, per_page: perPage, start, end, sort_field, sort_order }: FindOptionsType
   ): Promise<QueryEventsBySavedObjectResult> {
-    try {
-      const {
-        hits: { hits, total },
-      }: SearchResponse<unknown> = await this.callEs('search', {
-        index,
-        // The SearchResponse type only supports total as an int,
-        // so we're forced to explicitly request that it return as an int
-        rest_total_hits_as_int: true,
-        body: {
-          size: perPage,
-          from: (page - 1) * perPage,
-          sort: { [sort_field]: { order: sort_order } },
-          query: {
-            bool: {
-              must: reject(
-                [
-                  {
-                    nested: {
-                      path: 'kibana.saved_objects',
-                      query: {
-                        bool: {
-                          must: [
-                            {
-                              term: {
-                                'kibana.saved_objects.rel': {
-                                  value: SAVED_OBJECT_REL_PRIMARY,
-                                },
-                              },
+    const defaultNamespaceQuery = {
+      bool: {
+        must_not: {
+          exists: {
+            field: 'kibana.saved_objects.namespace',
+          },
+        },
+      },
+    };
+    const namedNamespaceQuery = {
+      term: {
+        'kibana.saved_objects.namespace': {
+          value: namespace,
+        },
+      },
+    };
+    const namespaceQuery = namespace === undefined ? defaultNamespaceQuery : namedNamespaceQuery;
+
+    const body = {
+      size: perPage,
+      from: (page - 1) * perPage,
+      sort: { [sort_field]: { order: sort_order } },
+      query: {
+        bool: {
+          must: reject(
+            [
+              {
+                nested: {
+                  path: 'kibana.saved_objects',
+                  query: {
+                    bool: {
+                      must: [
+                        {
+                          term: {
+                            'kibana.saved_objects.rel': {
+                              value: SAVED_OBJECT_REL_PRIMARY,
                             },
-                            {
-                              term: {
-                                'kibana.saved_objects.type': {
-                                  value: type,
-                                },
-                              },
+                          },
+                        },
+                        {
+                          term: {
+                            'kibana.saved_objects.type': {
+                              value: type,
                             },
-                            {
-                              term: {
-                                'kibana.saved_objects.id': {
-                                  value: id,
-                                },
-                              },
+                          },
+                        },
+                        {
+                          term: {
+                            'kibana.saved_objects.id': {
+                              value: id,
                             },
-                          ],
+                          },
                         },
-                      },
+                        namespaceQuery,
+                      ],
                     },
                   },
-                  start && {
-                    range: {
-                      '@timestamp': {
-                        gte: start,
-                      },
-                    },
+                },
+              },
+              start && {
+                range: {
+                  '@timestamp': {
+                    gte: start,
                   },
-                  end && {
-                    range: {
-                      '@timestamp': {
-                        lte: end,
-                      },
-                    },
+                },
+              },
+              end && {
+                range: {
+                  '@timestamp': {
+                    lte: end,
                   },
-                ],
-                isUndefined
-              ),
-            },
-          },
+                },
+              },
+            ],
+            isUndefined
+          ),
         },
+      },
+    };
+
+    try {
+      const {
+        hits: { hits, total },
+      }: SearchResponse<unknown> = await this.callEs('search', {
+        index,
+        // The SearchResponse type only supports total as an int,
+        // so we're forced to explicitly request that it return as an int
+        rest_total_hits_as_int: true,
+        body,
       });
       return {
         page,
         per_page: perPage,
         total,
-        data: hits.map((hit) => hit._source) as IEvent[],
+        data: hits.map((hit) => hit._source) as IValidatedEvent[],
       };
     } catch (err) {
       throw new Error(
diff --git a/x-pack/plugins/event_log/server/es/context.mock.ts b/x-pack/plugins/event_log/server/es/context.mock.ts
index 8d5483b88c4fa..aac7c684218aa 100644
--- a/x-pack/plugins/event_log/server/es/context.mock.ts
+++ b/x-pack/plugins/event_log/server/es/context.mock.ts
@@ -4,10 +4,11 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { loggingSystemMock } from 'src/core/server/mocks';
+
 import { EsContext } from './context';
 import { namesMock } from './names.mock';
 import { IClusterClientAdapter } from './cluster_client_adapter';
-import { loggingSystemMock } from '../../../../../src/core/server/mocks';
 import { clusterClientAdapterMock } from './cluster_client_adapter.mock';
 
 const createContextMock = () => {
diff --git a/x-pack/plugins/event_log/server/event_log_client.test.ts b/x-pack/plugins/event_log/server/event_log_client.test.ts
index 16e5fa69d36f6..917d517a6e27d 100644
--- a/x-pack/plugins/event_log/server/event_log_client.test.ts
+++ b/x-pack/plugins/event_log/server/event_log_client.test.ts
@@ -4,6 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { KibanaRequest } from 'src/core/server';
 import { EventLogClient } from './event_log_client';
 import { contextMock } from './es/context.mock';
 import { savedObjectsClientMock } from 'src/core/server/mocks';
@@ -18,6 +19,7 @@ describe('EventLogStart', () => {
       const eventLogClient = new EventLogClient({
         esContext,
         savedObjectsClient,
+        request: FakeRequest(),
       });
 
       savedObjectsClient.get.mockResolvedValueOnce({
@@ -38,6 +40,7 @@ describe('EventLogStart', () => {
       const eventLogClient = new EventLogClient({
         esContext,
         savedObjectsClient,
+        request: FakeRequest(),
       });
 
       savedObjectsClient.get.mockRejectedValue(new Error('Fail'));
@@ -53,6 +56,7 @@ describe('EventLogStart', () => {
       const eventLogClient = new EventLogClient({
         esContext,
         savedObjectsClient,
+        request: FakeRequest(),
       });
 
       savedObjectsClient.get.mockResolvedValueOnce({
@@ -107,6 +111,7 @@ describe('EventLogStart', () => {
 
       expect(esContext.esAdapter.queryEventsBySavedObject).toHaveBeenCalledWith(
         esContext.esNames.alias,
+        undefined,
         'saved-object-type',
         'saved-object-id',
         {
@@ -124,6 +129,7 @@ describe('EventLogStart', () => {
       const eventLogClient = new EventLogClient({
         esContext,
         savedObjectsClient,
+        request: FakeRequest(),
       });
 
       savedObjectsClient.get.mockResolvedValueOnce({
@@ -184,6 +190,7 @@ describe('EventLogStart', () => {
 
       expect(esContext.esAdapter.queryEventsBySavedObject).toHaveBeenCalledWith(
         esContext.esNames.alias,
+        undefined,
         'saved-object-type',
         'saved-object-id',
         {
@@ -203,6 +210,7 @@ describe('EventLogStart', () => {
       const eventLogClient = new EventLogClient({
         esContext,
         savedObjectsClient,
+        request: FakeRequest(),
       });
 
       savedObjectsClient.get.mockResolvedValueOnce({
@@ -232,6 +240,7 @@ describe('EventLogStart', () => {
       const eventLogClient = new EventLogClient({
         esContext,
         savedObjectsClient,
+        request: FakeRequest(),
       });
 
       savedObjectsClient.get.mockResolvedValueOnce({
@@ -286,3 +295,22 @@ function fakeEvent(overrides = {}) {
     overrides
   );
 }
+
+function FakeRequest(): KibanaRequest {
+  const savedObjectsClient = savedObjectsClientMock.create();
+  return ({
+    headers: {},
+    getBasePath: () => '',
+    path: '/',
+    route: { settings: {} },
+    url: {
+      href: '/',
+    },
+    raw: {
+      req: {
+        url: '/',
+      },
+    },
+    getSavedObjectsClient: () => savedObjectsClient,
+  } as unknown) as KibanaRequest;
+}
diff --git a/x-pack/plugins/event_log/server/event_log_client.ts b/x-pack/plugins/event_log/server/event_log_client.ts
index e7ba598de2ac6..f4115e06160d7 100644
--- a/x-pack/plugins/event_log/server/event_log_client.ts
+++ b/x-pack/plugins/event_log/server/event_log_client.ts
@@ -5,20 +5,16 @@
  */
 
 import { Observable } from 'rxjs';
-import { LegacyClusterClient, SavedObjectsClientContract } from 'src/core/server';
-
 import { schema, TypeOf } from '@kbn/config-schema';
+import { LegacyClusterClient, SavedObjectsClientContract, KibanaRequest } from 'src/core/server';
+import { SpacesServiceSetup } from '../../spaces/server';
+
 import { EsContext } from './es';
 import { IEventLogClient } from './types';
 import { QueryEventsBySavedObjectResult } from './es/cluster_client_adapter';
 export type PluginClusterClient = Pick<LegacyClusterClient, 'callAsInternalUser' | 'asScoped'>;
 export type AdminClusterClient$ = Observable<PluginClusterClient>;
 
-interface EventLogServiceCtorParams {
-  esContext: EsContext;
-  savedObjectsClient: SavedObjectsClientContract;
-}
-
 const optionalDateFieldSchema = schema.maybe(
   schema.string({
     validate(value) {
@@ -60,14 +56,30 @@ export type FindOptionsType = Pick<
 > &
   Partial<TypeOf<typeof findOptionsSchema>>;
 
+interface EventLogServiceCtorParams {
+  esContext: EsContext;
+  savedObjectsClient: SavedObjectsClientContract;
+  spacesService?: SpacesServiceSetup;
+  request: KibanaRequest;
+}
+
 // note that clusterClient may be null, indicating we can't write to ES
 export class EventLogClient implements IEventLogClient {
   private esContext: EsContext;
   private savedObjectsClient: SavedObjectsClientContract;
+  private spacesService?: SpacesServiceSetup;
+  private request: KibanaRequest;
 
-  constructor({ esContext, savedObjectsClient }: EventLogServiceCtorParams) {
+  constructor({
+    esContext,
+    savedObjectsClient,
+    spacesService,
+    request,
+  }: EventLogServiceCtorParams) {
     this.esContext = esContext;
     this.savedObjectsClient = savedObjectsClient;
+    this.spacesService = spacesService;
+    this.request = request;
   }
 
   async findEventsBySavedObject(
@@ -75,13 +87,20 @@ export class EventLogClient implements IEventLogClient {
     id: string,
     options?: Partial<FindOptionsType>
   ): Promise<QueryEventsBySavedObjectResult> {
+    const findOptions = findOptionsSchema.validate(options ?? {});
+
+    const space = await this.spacesService?.getActiveSpace(this.request);
+    const namespace = space && this.spacesService?.spaceIdToNamespace(space.id);
+
     // verify the user has the required permissions to view this saved object
     await this.savedObjectsClient.get(type, id);
+
     return await this.esContext.esAdapter.queryEventsBySavedObject(
       this.esContext.esNames.alias,
+      namespace,
       type,
       id,
-      findOptionsSchema.validate(options ?? {})
+      findOptions
     );
   }
 }
diff --git a/x-pack/plugins/event_log/server/event_log_start_service.test.ts b/x-pack/plugins/event_log/server/event_log_start_service.test.ts
index 58dd3ae6eb514..3bd5ef7c0b3ba 100644
--- a/x-pack/plugins/event_log/server/event_log_start_service.test.ts
+++ b/x-pack/plugins/event_log/server/event_log_start_service.test.ts
@@ -4,10 +4,11 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { KibanaRequest } from 'src/core/server';
+import { savedObjectsClientMock, savedObjectsServiceMock } from 'src/core/server/mocks';
+
 import { EventLogClientService } from './event_log_start_service';
 import { contextMock } from './es/context.mock';
-import { KibanaRequest } from 'kibana/server';
-import { savedObjectsClientMock, savedObjectsServiceMock } from 'src/core/server/mocks';
 
 jest.mock('./event_log_client');
 
@@ -26,13 +27,8 @@ describe('EventLogClientService', () => {
 
       eventLogStartService.getClient(request);
 
-      expect(savedObjectsService.getScopedClient).toHaveBeenCalledWith(request);
-
-      const [{ value: savedObjectsClient }] = savedObjectsService.getScopedClient.mock.results;
-
-      expect(jest.requireMock('./event_log_client').EventLogClient).toHaveBeenCalledWith({
-        esContext,
-        savedObjectsClient,
+      expect(savedObjectsService.getScopedClient).toHaveBeenCalledWith(request, {
+        includedHiddenTypes: ['action', 'alert'],
       });
     });
   });
diff --git a/x-pack/plugins/event_log/server/event_log_start_service.ts b/x-pack/plugins/event_log/server/event_log_start_service.ts
index 0339d0883dc46..8b752684c1cc3 100644
--- a/x-pack/plugins/event_log/server/event_log_start_service.ts
+++ b/x-pack/plugins/event_log/server/event_log_start_service.ts
@@ -11,6 +11,7 @@ import {
   SavedObjectsServiceStart,
   SavedObjectsClientContract,
 } from 'src/core/server';
+import { SpacesServiceSetup } from '../../spaces/server';
 
 import { EsContext } from './es';
 import { IEventLogClientService } from './types';
@@ -18,30 +19,37 @@ import { EventLogClient } from './event_log_client';
 export type PluginClusterClient = Pick<LegacyClusterClient, 'callAsInternalUser' | 'asScoped'>;
 export type AdminClusterClient$ = Observable<PluginClusterClient>;
 
+const includedHiddenTypes = ['action', 'alert'];
+
 interface EventLogServiceCtorParams {
   esContext: EsContext;
   savedObjectsService: SavedObjectsServiceStart;
+  spacesService?: SpacesServiceSetup;
 }
 
 // note that clusterClient may be null, indicating we can't write to ES
 export class EventLogClientService implements IEventLogClientService {
   private esContext: EsContext;
   private savedObjectsService: SavedObjectsServiceStart;
+  private spacesService?: SpacesServiceSetup;
 
-  constructor({ esContext, savedObjectsService }: EventLogServiceCtorParams) {
+  constructor({ esContext, savedObjectsService, spacesService }: EventLogServiceCtorParams) {
     this.esContext = esContext;
     this.savedObjectsService = savedObjectsService;
+    this.spacesService = spacesService;
   }
 
-  getClient(
-    request: KibanaRequest,
-    savedObjectsClient: SavedObjectsClientContract = this.savedObjectsService.getScopedClient(
-      request
-    )
-  ) {
+  getClient(request: KibanaRequest) {
+    const savedObjectsClient: SavedObjectsClientContract = this.savedObjectsService.getScopedClient(
+      request,
+      { includedHiddenTypes }
+    );
+
     return new EventLogClient({
       esContext: this.esContext,
       savedObjectsClient,
+      spacesService: this.spacesService,
+      request,
     });
   }
 }
diff --git a/x-pack/plugins/event_log/server/index.ts b/x-pack/plugins/event_log/server/index.ts
index 0612b5319c15b..25b1b95831b8a 100644
--- a/x-pack/plugins/event_log/server/index.ts
+++ b/x-pack/plugins/event_log/server/index.ts
@@ -13,6 +13,7 @@ export {
   IEventLogger,
   IEventLogClientService,
   IEvent,
+  IValidatedEvent,
   SAVED_OBJECT_REL_PRIMARY,
 } from './types';
 export const config = { schema: ConfigSchema };
diff --git a/x-pack/plugins/event_log/server/plugin.ts b/x-pack/plugins/event_log/server/plugin.ts
index ed530607aabba..9e36ca10b71f2 100644
--- a/x-pack/plugins/event_log/server/plugin.ts
+++ b/x-pack/plugins/event_log/server/plugin.ts
@@ -17,6 +17,7 @@ import {
   IContextProvider,
   RequestHandler,
 } from 'src/core/server';
+import { SpacesPluginSetup, SpacesServiceSetup } from '../../spaces/server';
 
 import {
   IEventLogConfig,
@@ -39,14 +40,19 @@ const ACTIONS = {
   stopping: 'stopping',
 };
 
+interface PluginSetupDeps {
+  spaces?: SpacesPluginSetup;
+}
+
 export class Plugin implements CorePlugin<IEventLogService, IEventLogClientService> {
   private readonly config$: IEventLogConfig$;
   private systemLogger: Logger;
-  private eventLogService?: IEventLogService;
+  private eventLogService?: EventLogService;
   private esContext?: EsContext;
   private eventLogger?: IEventLogger;
   private globalConfig$: Observable<SharedGlobalConfig>;
   private eventLogClientService?: EventLogClientService;
+  private spacesService?: SpacesServiceSetup;
 
   constructor(private readonly context: PluginInitializerContext) {
     this.systemLogger = this.context.logger.get();
@@ -54,13 +60,14 @@ export class Plugin implements CorePlugin<IEventLogService, IEventLogClientServi
     this.globalConfig$ = this.context.config.legacy.globalConfig$;
   }
 
-  async setup(core: CoreSetup): Promise<IEventLogService> {
+  async setup(core: CoreSetup, { spaces }: PluginSetupDeps): Promise<IEventLogService> {
     const globalConfig = await this.globalConfig$.pipe(first()).toPromise();
     const kibanaIndex = globalConfig.kibana.index;
 
     this.systemLogger.debug('setting up plugin');
 
     const config = await this.config$.pipe(first()).toPromise();
+    this.spacesService = spaces?.spacesService;
 
     this.esContext = createEsContext({
       logger: this.systemLogger,
@@ -89,7 +96,7 @@ export class Plugin implements CorePlugin<IEventLogService, IEventLogClientServi
     // Routes
     const router = core.http.createRouter();
     // Register routes
-    findRoute(router);
+    findRoute(router, this.systemLogger);
 
     return this.eventLogService;
   }
@@ -115,6 +122,7 @@ export class Plugin implements CorePlugin<IEventLogService, IEventLogClientServi
     this.eventLogClientService = new EventLogClientService({
       esContext: this.esContext,
       savedObjectsService: core.savedObjects,
+      spacesService: this.spacesService,
     });
     return this.eventLogClientService;
   }
@@ -125,8 +133,7 @@ export class Plugin implements CorePlugin<IEventLogService, IEventLogClientServi
   > => {
     return async (context, request) => {
       return {
-        getEventLogClient: () =>
-          this.eventLogClientService!.getClient(request, context.core.savedObjects.client),
+        getEventLogClient: () => this.eventLogClientService!.getClient(request),
       };
     };
   };
diff --git a/x-pack/plugins/event_log/server/routes/_mock_handler_arguments.ts b/x-pack/plugins/event_log/server/routes/_mock_handler_arguments.ts
index 2d5e37e870b28..b0ce5605d0e51 100644
--- a/x-pack/plugins/event_log/server/routes/_mock_handler_arguments.ts
+++ b/x-pack/plugins/event_log/server/routes/_mock_handler_arguments.ts
@@ -4,9 +4,10 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { RequestHandlerContext, KibanaRequest, KibanaResponseFactory } from 'kibana/server';
 import { identity, merge } from 'lodash';
-import { httpServerMock } from '../../../../../src/core/server/mocks';
+import { RequestHandlerContext, KibanaRequest, KibanaResponseFactory } from 'src/core/server';
+
+import { httpServerMock } from 'src/core/server/mocks';
 import { IEventLogClient } from '../types';
 
 export function mockHandlerArguments(
diff --git a/x-pack/plugins/event_log/server/routes/find.test.ts b/x-pack/plugins/event_log/server/routes/find.test.ts
index f47df499d742f..07bb8329f78ec 100644
--- a/x-pack/plugins/event_log/server/routes/find.test.ts
+++ b/x-pack/plugins/event_log/server/routes/find.test.ts
@@ -8,8 +8,10 @@ import { findRoute } from './find';
 import { httpServiceMock } from 'src/core/server/mocks';
 import { mockHandlerArguments, fakeEvent } from './_mock_handler_arguments';
 import { eventLogClientMock } from '../event_log_client.mock';
+import { loggingSystemMock } from 'src/core/server/mocks';
 
 const eventLogClient = eventLogClientMock.create();
+const systemLogger = loggingSystemMock.createLogger();
 
 beforeEach(() => {
   jest.resetAllMocks();
@@ -19,7 +21,7 @@ describe('find', () => {
   it('finds events with proper parameters', async () => {
     const router = httpServiceMock.createRouter();
 
-    findRoute(router);
+    findRoute(router, systemLogger);
 
     const [config, handler] = router.get.mock.calls[0];
 
@@ -58,7 +60,7 @@ describe('find', () => {
   it('supports optional pagination parameters', async () => {
     const router = httpServiceMock.createRouter();
 
-    findRoute(router);
+    findRoute(router, systemLogger);
 
     const [, handler] = router.get.mock.calls[0];
     eventLogClient.findEventsBySavedObject.mockResolvedValueOnce({
@@ -95,4 +97,29 @@ describe('find', () => {
       },
     });
   });
+
+  it('logs a warning when the query throws an error', async () => {
+    const router = httpServiceMock.createRouter();
+
+    findRoute(router, systemLogger);
+
+    const [, handler] = router.get.mock.calls[0];
+    eventLogClient.findEventsBySavedObject.mockRejectedValueOnce(new Error('oof!'));
+
+    const [context, req, res] = mockHandlerArguments(
+      eventLogClient,
+      {
+        params: { id: '1', type: 'action' },
+        query: { page: 3, per_page: 10 },
+      },
+      ['ok']
+    );
+
+    await handler(context, req, res);
+
+    expect(systemLogger.debug).toHaveBeenCalledTimes(1);
+    expect(systemLogger.debug).toHaveBeenCalledWith(
+      'error calling eventLog findEventsBySavedObject(action, 1, {"page":3,"per_page":10}): oof!'
+    );
+  });
 });
diff --git a/x-pack/plugins/event_log/server/routes/find.ts b/x-pack/plugins/event_log/server/routes/find.ts
index e03aef7c757f6..3880ac2c10129 100644
--- a/x-pack/plugins/event_log/server/routes/find.ts
+++ b/x-pack/plugins/event_log/server/routes/find.ts
@@ -11,7 +11,9 @@ import {
   KibanaRequest,
   IKibanaResponse,
   KibanaResponseFactory,
-} from 'kibana/server';
+  Logger,
+} from 'src/core/server';
+
 import { BASE_EVENT_LOG_API_PATH } from '../../common';
 import { findOptionsSchema, FindOptionsType } from '../event_log_client';
 
@@ -20,7 +22,7 @@ const paramSchema = schema.object({
   id: schema.string(),
 });
 
-export const findRoute = (router: IRouter) => {
+export const findRoute = (router: IRouter, systemLogger: Logger) => {
   router.get(
     {
       path: `${BASE_EVENT_LOG_API_PATH}/{type}/{id}/_find`,
@@ -42,9 +44,16 @@ export const findRoute = (router: IRouter) => {
         params: { id, type },
         query,
       } = req;
-      return res.ok({
-        body: await eventLogClient.findEventsBySavedObject(type, id, query),
-      });
+
+      try {
+        return res.ok({
+          body: await eventLogClient.findEventsBySavedObject(type, id, query),
+        });
+      } catch (err) {
+        const call = `findEventsBySavedObject(${type}, ${id}, ${JSON.stringify(query)})`;
+        systemLogger.debug(`error calling eventLog ${call}: ${err.message}`);
+        return res.notFound();
+      }
     })
   );
 };
diff --git a/x-pack/plugins/event_log/server/types.ts b/x-pack/plugins/event_log/server/types.ts
index 58be6707b0373..1a37c4e58d079 100644
--- a/x-pack/plugins/event_log/server/types.ts
+++ b/x-pack/plugins/event_log/server/types.ts
@@ -6,9 +6,9 @@
 
 import { Observable } from 'rxjs';
 import { schema, TypeOf } from '@kbn/config-schema';
+import { KibanaRequest } from 'src/core/server';
 
 export { IEvent, IValidatedEvent, EventSchema, ECS_VERSION } from '../generated/schemas';
-import { KibanaRequest } from 'kibana/server';
 import { IEvent } from '../generated/schemas';
 import { FindOptionsType } from './event_log_client';
 import { QueryEventsBySavedObjectResult } from './es/cluster_client_adapter';
diff --git a/x-pack/plugins/index_management/public/application/components/component_templates/component_template_wizard/component_template_form/steps/step_logistics.tsx b/x-pack/plugins/index_management/public/application/components/component_templates/component_template_wizard/component_template_form/steps/step_logistics.tsx
index c48a23226a371..032eb93f7f9f9 100644
--- a/x-pack/plugins/index_management/public/application/components/component_templates/component_template_wizard/component_template_form/steps/step_logistics.tsx
+++ b/x-pack/plugins/index_management/public/application/components/component_templates/component_template_wizard/component_template_form/steps/step_logistics.tsx
@@ -3,7 +3,7 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import React, { useEffect, useState } from 'react';
+import React, { useEffect, useState, useCallback } from 'react';
 import {
   EuiFlexGroup,
   EuiFlexItem,
@@ -44,26 +44,28 @@ export const StepLogistics: React.FunctionComponent<Props> = React.memo(
       options: { stripEmptyFields: false },
     });
 
+    const { isValid: isFormValid, submit, getFormData, subscribe } = form;
+
     const { documentation } = useComponentTemplatesContext();
 
     const [isMetaVisible, setIsMetaVisible] = useState<boolean>(
       Boolean(defaultValue._meta && Object.keys(defaultValue._meta).length)
     );
 
-    const validate = async () => {
-      return (await form.submit()).isValid;
-    };
+    const validate = useCallback(async () => {
+      return (await submit()).isValid;
+    }, [submit]);
 
     useEffect(() => {
       onChange({
-        isValid: form.isValid,
+        isValid: isFormValid,
         validate,
-        getData: form.getFormData,
+        getData: getFormData,
       });
-    }, [form.isValid, onChange]); // eslint-disable-line react-hooks/exhaustive-deps
+    }, [isFormValid, getFormData, validate, onChange]);
 
     useEffect(() => {
-      const subscription = form.subscribe(({ data, isValid }) => {
+      const subscription = subscribe(({ data, isValid }) => {
         onChange({
           isValid,
           validate,
@@ -71,7 +73,7 @@ export const StepLogistics: React.FunctionComponent<Props> = React.memo(
         });
       });
       return subscription.unsubscribe;
-    }, [onChange]); // eslint-disable-line react-hooks/exhaustive-deps
+    }, [subscribe, validate, onChange]);
 
     return (
       <Form form={form} data-test-subj="stepLogistics">
diff --git a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/configuration_form/configuration_form.tsx b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/configuration_form/configuration_form.tsx
index 098e530bddb3c..86bcc796a88eb 100644
--- a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/configuration_form/configuration_form.tsx
+++ b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/configuration_form/configuration_form.tsx
@@ -94,22 +94,23 @@ export const ConfigurationForm = React.memo(({ value }: Props) => {
     id: 'configurationForm',
   });
   const dispatch = useDispatch();
+  const { subscribe, submit, reset, getFormData } = form;
 
   useEffect(() => {
-    const subscription = form.subscribe(({ data, isValid, validate }) => {
+    const subscription = subscribe(({ data, isValid, validate }) => {
       dispatch({
         type: 'configuration.update',
         value: {
           data,
           isValid,
           validate,
-          submitForm: form.submit,
+          submitForm: submit,
         },
       });
     });
 
     return subscription.unsubscribe;
-  }, [dispatch]); // eslint-disable-line react-hooks/exhaustive-deps
+  }, [dispatch, subscribe, submit]);
 
   useEffect(() => {
     if (isMounted.current === undefined) {
@@ -125,18 +126,18 @@ export const ConfigurationForm = React.memo(({ value }: Props) => {
 
     // If the value has changed (it probably means that we have loaded a new JSON)
     // we need to reset the form to update the fields values.
-    form.reset({ resetValues: true });
-  }, [value]); // eslint-disable-line react-hooks/exhaustive-deps
+    reset({ resetValues: true });
+  }, [value, reset]);
 
   useEffect(() => {
     return () => {
       isMounted.current = false;
 
       // Save a snapshot of the form state so we can get back to it when navigating back to the tab
-      const configurationData = form.getFormData();
+      const configurationData = getFormData();
       dispatch({ type: 'configuration.save', value: configurationData });
     };
-  }, [dispatch]); // eslint-disable-line react-hooks/exhaustive-deps
+  }, [getFormData, dispatch]);
 
   return (
     <Form
diff --git a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/create_field/create_field.tsx b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/create_field/create_field.tsx
index 62eb920f8865d..57a765c38dd26 100644
--- a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/create_field/create_field.tsx
+++ b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/create_field/create_field.tsx
@@ -50,13 +50,15 @@ export const CreateField = React.memo(function CreateFieldComponent({
     options: { stripEmptyFields: false },
   });
 
+  const { subscribe } = form;
+
   useEffect(() => {
-    const subscription = form.subscribe((updatedFieldForm) => {
+    const subscription = subscribe((updatedFieldForm) => {
       dispatch({ type: 'fieldForm.update', value: updatedFieldForm });
     });
 
     return subscription.unsubscribe;
-  }, [dispatch]); // eslint-disable-line react-hooks/exhaustive-deps
+  }, [dispatch, subscribe]);
 
   const cancel = () => {
     dispatch({ type: 'documentField.changeStatus', value: 'idle' });
diff --git a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/edit_field/edit_field_container.tsx b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/edit_field/edit_field_container.tsx
index d543e49d23be9..5105a2a157a6d 100644
--- a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/edit_field/edit_field_container.tsx
+++ b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/document_fields/fields/edit_field/edit_field_container.tsx
@@ -26,13 +26,15 @@ export const EditFieldContainer = React.memo(({ field, allFields }: Props) => {
     options: { stripEmptyFields: false },
   });
 
+  const { subscribe } = form;
+
   useEffect(() => {
-    const subscription = form.subscribe((updatedFieldForm) => {
+    const subscription = subscribe((updatedFieldForm) => {
       dispatch({ type: 'fieldForm.update', value: updatedFieldForm });
     });
 
     return subscription.unsubscribe;
-  }, [dispatch]); // eslint-disable-line react-hooks/exhaustive-deps
+  }, [subscribe, dispatch]);
 
   const exitEdit = useCallback(() => {
     dispatch({ type: 'documentField.changeStatus', value: 'idle' });
diff --git a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/templates_form/templates_form.tsx b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/templates_form/templates_form.tsx
index 79685d46b6bdd..a95579a8a141e 100644
--- a/x-pack/plugins/index_management/public/application/components/mappings_editor/components/templates_form/templates_form.tsx
+++ b/x-pack/plugins/index_management/public/application/components/mappings_editor/components/templates_form/templates_form.tsx
@@ -61,17 +61,18 @@ export const TemplatesForm = React.memo(({ value }: Props) => {
     deserializer: formDeserializer,
     defaultValue: value,
   });
+  const { subscribe, getFormData, submit: submitForm, reset } = form;
   const dispatch = useDispatch();
 
   useEffect(() => {
-    const subscription = form.subscribe(({ data, isValid, validate }) => {
+    const subscription = subscribe(({ data, isValid, validate }) => {
       dispatch({
         type: 'templates.update',
-        value: { data, isValid, validate, submitForm: form.submit },
+        value: { data, isValid, validate, submitForm },
       });
     });
     return subscription.unsubscribe;
-  }, [dispatch]); // eslint-disable-line react-hooks/exhaustive-deps
+  }, [subscribe, dispatch, submitForm]);
 
   useEffect(() => {
     if (isMounted.current === undefined) {
@@ -87,18 +88,18 @@ export const TemplatesForm = React.memo(({ value }: Props) => {
 
     // If the value has changed (it probably means that we have loaded a new JSON)
     // we need to reset the form to update the fields values.
-    form.reset({ resetValues: true });
-  }, [value]); // eslint-disable-line react-hooks/exhaustive-deps
+    reset({ resetValues: true });
+  }, [value, reset]);
 
   useEffect(() => {
     return () => {
       isMounted.current = false;
 
       // On unmount => save in the state a snapshot of the current form data.
-      const dynamicTemplatesData = form.getFormData();
+      const dynamicTemplatesData = getFormData();
       dispatch({ type: 'templates.save', value: dynamicTemplatesData });
     };
-  }, [dispatch]); // eslint-disable-line react-hooks/exhaustive-deps
+  }, [getFormData, dispatch]);
 
   return (
     <div data-test-subj="dynamicTemplates">
diff --git a/x-pack/plugins/index_management/public/application/components/shared/components/wizard_steps/step_mappings_container.tsx b/x-pack/plugins/index_management/public/application/components/shared/components/wizard_steps/step_mappings_container.tsx
index 38c4a85bbe0ff..b0675c1412259 100644
--- a/x-pack/plugins/index_management/public/application/components/shared/components/wizard_steps/step_mappings_container.tsx
+++ b/x-pack/plugins/index_management/public/application/components/shared/components/wizard_steps/step_mappings_container.tsx
@@ -14,15 +14,16 @@ interface Props {
 }
 
 export const StepMappingsContainer: React.FunctionComponent<Props> = ({ esDocsBase }) => {
-  const { defaultValue, updateContent, getData } = Forms.useContent<CommonWizardSteps, 'mappings'>(
+  const { defaultValue, updateContent, getSingleContentData } = Forms.useContent<
+    CommonWizardSteps,
     'mappings'
-  );
+  >('mappings');
 
   return (
     <StepMappings
       defaultValue={defaultValue}
       onChange={updateContent}
-      indexSettings={getData().settings}
+      indexSettings={getSingleContentData('settings')}
       esDocsBase={esDocsBase}
     />
   );
diff --git a/x-pack/plugins/ingest_manager/common/types/models/epm.ts b/x-pack/plugins/ingest_manager/common/types/models/epm.ts
index ab6a6c73843c5..6ec5b73eaa43e 100644
--- a/x-pack/plugins/ingest_manager/common/types/models/epm.ts
+++ b/x-pack/plugins/ingest_manager/common/types/models/epm.ts
@@ -276,9 +276,7 @@ export interface IndexTemplate {
     mappings: any;
     aliases: object;
   };
-  data_stream: {
-    timestamp_field: string;
-  };
+  data_stream: object;
   composed_of: string[];
   _meta: object;
 }
diff --git a/x-pack/plugins/ingest_manager/public/plugin.ts b/x-pack/plugins/ingest_manager/public/plugin.ts
index 670e75f7a241b..fde4e93f8e39f 100644
--- a/x-pack/plugins/ingest_manager/public/plugin.ts
+++ b/x-pack/plugins/ingest_manager/public/plugin.ts
@@ -72,6 +72,7 @@ export class IngestManagerPlugin
       id: PLUGIN_ID,
       category: DEFAULT_APP_CATEGORIES.management,
       title: i18n.translate('xpack.ingestManager.appTitle', { defaultMessage: 'Ingest Manager' }),
+      order: 9020,
       euiIconType: 'savedObjectsApp',
       async mount(params: AppMountParameters) {
         const [coreStart, startDeps] = (await core.getStartServices()) as [
diff --git a/x-pack/plugins/ingest_manager/server/services/epm/elasticsearch/template/__snapshots__/template.test.ts.snap b/x-pack/plugins/ingest_manager/server/services/epm/elasticsearch/template/__snapshots__/template.test.ts.snap
index 7437321163749..219c2de675359 100644
--- a/x-pack/plugins/ingest_manager/server/services/epm/elasticsearch/template/__snapshots__/template.test.ts.snap
+++ b/x-pack/plugins/ingest_manager/server/services/epm/elasticsearch/template/__snapshots__/template.test.ts.snap
@@ -10,7 +10,7 @@ exports[`tests loading base.yml: base.yml 1`] = `
     "settings": {
       "index": {
         "lifecycle": {
-          "name": "logs-default"
+          "name": "logs"
         },
         "codec": "best_compression",
         "mapping": {
@@ -91,9 +91,7 @@ exports[`tests loading base.yml: base.yml 1`] = `
     },
     "aliases": {}
   },
-  "data_stream": {
-    "timestamp_field": "@timestamp"
-  },
+  "data_stream": {},
   "composed_of": [],
   "_meta": {
     "package": {
@@ -115,7 +113,7 @@ exports[`tests loading coredns.logs.yml: coredns.logs.yml 1`] = `
     "settings": {
       "index": {
         "lifecycle": {
-          "name": "logs-default"
+          "name": "logs"
         },
         "codec": "best_compression",
         "mapping": {
@@ -196,9 +194,7 @@ exports[`tests loading coredns.logs.yml: coredns.logs.yml 1`] = `
     },
     "aliases": {}
   },
-  "data_stream": {
-    "timestamp_field": "@timestamp"
-  },
+  "data_stream": {},
   "composed_of": [],
   "_meta": {
     "package": {
@@ -220,7 +216,7 @@ exports[`tests loading system.yml: system.yml 1`] = `
     "settings": {
       "index": {
         "lifecycle": {
-          "name": "metrics-default"
+          "name": "metrics"
         },
         "codec": "best_compression",
         "mapping": {
@@ -1685,9 +1681,7 @@ exports[`tests loading system.yml: system.yml 1`] = `
     },
     "aliases": {}
   },
-  "data_stream": {
-    "timestamp_field": "@timestamp"
-  },
+  "data_stream": {},
   "composed_of": [],
   "_meta": {
     "package": {
diff --git a/x-pack/plugins/ingest_manager/server/services/epm/elasticsearch/template/template.ts b/x-pack/plugins/ingest_manager/server/services/epm/elasticsearch/template/template.ts
index b907c735d2630..876573f2270ea 100644
--- a/x-pack/plugins/ingest_manager/server/services/epm/elasticsearch/template/template.ts
+++ b/x-pack/plugins/ingest_manager/server/services/epm/elasticsearch/template/template.ts
@@ -262,7 +262,7 @@ function getBaseTemplate(
         index: {
           // ILM Policy must be added here, for now point to the default global ILM policy name
           lifecycle: {
-            name: `${type}-default`,
+            name: type,
           },
           // What should be our default for the compression?
           codec: 'best_compression',
@@ -308,9 +308,7 @@ function getBaseTemplate(
       // To be filled with the aliases that we need
       aliases: {},
     },
-    data_stream: {
-      timestamp_field: '@timestamp',
-    },
+    data_stream: {},
     composed_of: composedOfTemplates,
     _meta: {
       package: {
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/datapanel.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/datapanel.tsx
index 6854452fd02a4..bb564214e4fab 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/datapanel.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/datapanel.tsx
@@ -125,6 +125,7 @@ export function IndexPatternDataPanel({
       id,
       title: indexPatterns[id].title,
       timeFieldName: indexPatterns[id].timeFieldName,
+      fields: indexPatterns[id].fields,
     }));
 
   const dslQuery = buildSafeEsQuery(
@@ -197,6 +198,7 @@ export function IndexPatternDataPanel({
           charts={charts}
           onChangeIndexPattern={onChangeIndexPattern}
           existingFields={state.existingFields}
+          existenceFetchFailed={state.existenceFetchFailed}
         />
       )}
     </>
@@ -231,6 +233,7 @@ export const InnerIndexPatternDataPanel = function InnerIndexPatternDataPanel({
   currentIndexPatternId,
   indexPatternRefs,
   indexPatterns,
+  existenceFetchFailed,
   query,
   dateRange,
   filters,
@@ -249,6 +252,7 @@ export const InnerIndexPatternDataPanel = function InnerIndexPatternDataPanel({
   onChangeIndexPattern: (newId: string) => void;
   existingFields: IndexPatternPrivateState['existingFields'];
   charts: ChartsPluginSetup;
+  existenceFetchFailed?: boolean;
 }) {
   const [localState, setLocalState] = useState<DataPanelState>({
     nameFilter: '',
@@ -553,9 +557,15 @@ export const InnerIndexPatternDataPanel = function InnerIndexPatternDataPanel({
               <FieldsAccordion
                 initialIsOpen={localState.isAvailableAccordionOpen}
                 id="lnsIndexPatternAvailableFields"
-                label={i18n.translate('xpack.lens.indexPattern.availableFieldsLabel', {
-                  defaultMessage: 'Available fields',
-                })}
+                label={
+                  existenceFetchFailed
+                    ? i18n.translate('xpack.lens.indexPattern.allFieldsLabel', {
+                        defaultMessage: 'All fields',
+                      })
+                    : i18n.translate('xpack.lens.indexPattern.availableFieldsLabel', {
+                        defaultMessage: 'Available fields',
+                      })
+                }
                 exists={true}
                 hasLoaded={!!hasSyncedExistingFields}
                 fieldsCount={filteredFieldGroups.availableFields.length}
@@ -576,6 +586,7 @@ export const InnerIndexPatternDataPanel = function InnerIndexPatternDataPanel({
                     Math.max(PAGINATION_SIZE, Math.min(pageSize * 1.5, displayedFieldLength))
                   );
                 }}
+                showExistenceFetchError={existenceFetchFailed}
                 renderCallout={
                   <NoFieldsCallout
                     isAffectedByGlobalFilter={!!filters.length}
@@ -588,42 +599,44 @@ export const InnerIndexPatternDataPanel = function InnerIndexPatternDataPanel({
                 }
               />
               <EuiSpacer size="m" />
-              <FieldsAccordion
-                initialIsOpen={localState.isEmptyAccordionOpen}
-                isFiltered={
-                  filteredFieldGroups.emptyFields.length !== fieldGroups.emptyFields.length
-                }
-                fieldsCount={filteredFieldGroups.emptyFields.length}
-                paginatedFields={paginatedEmptyFields}
-                hasLoaded={!!hasSyncedExistingFields}
-                exists={false}
-                fieldProps={fieldProps}
-                id="lnsIndexPatternEmptyFields"
-                label={i18n.translate('xpack.lens.indexPattern.emptyFieldsLabel', {
-                  defaultMessage: 'Empty fields',
-                })}
-                onToggle={(open) => {
-                  setLocalState((s) => ({
-                    ...s,
-                    isEmptyAccordionOpen: open,
-                  }));
-                  const displayedFieldLength =
-                    (localState.isAvailableAccordionOpen
-                      ? filteredFieldGroups.availableFields.length
-                      : 0) + (open ? filteredFieldGroups.emptyFields.length : 0);
-                  setPageSize(
-                    Math.max(PAGINATION_SIZE, Math.min(pageSize * 1.5, displayedFieldLength))
-                  );
-                }}
-                renderCallout={
-                  <NoFieldsCallout
-                    isAffectedByFieldFilter={
-                      !!(localState.typeFilter.length || localState.nameFilter.length)
-                    }
-                    existFieldsInIndex={!!fieldGroups.emptyFields.length}
-                  />
-                }
-              />
+              {!existenceFetchFailed && (
+                <FieldsAccordion
+                  initialIsOpen={localState.isEmptyAccordionOpen}
+                  isFiltered={
+                    filteredFieldGroups.emptyFields.length !== fieldGroups.emptyFields.length
+                  }
+                  fieldsCount={filteredFieldGroups.emptyFields.length}
+                  paginatedFields={paginatedEmptyFields}
+                  hasLoaded={!!hasSyncedExistingFields}
+                  exists={false}
+                  fieldProps={fieldProps}
+                  id="lnsIndexPatternEmptyFields"
+                  label={i18n.translate('xpack.lens.indexPattern.emptyFieldsLabel', {
+                    defaultMessage: 'Empty fields',
+                  })}
+                  onToggle={(open) => {
+                    setLocalState((s) => ({
+                      ...s,
+                      isEmptyAccordionOpen: open,
+                    }));
+                    const displayedFieldLength =
+                      (localState.isAvailableAccordionOpen
+                        ? filteredFieldGroups.availableFields.length
+                        : 0) + (open ? filteredFieldGroups.emptyFields.length : 0);
+                    setPageSize(
+                      Math.max(PAGINATION_SIZE, Math.min(pageSize * 1.5, displayedFieldLength))
+                    );
+                  }}
+                  renderCallout={
+                    <NoFieldsCallout
+                      isAffectedByFieldFilter={
+                        !!(localState.typeFilter.length || localState.nameFilter.length)
+                      }
+                      existFieldsInIndex={!!fieldGroups.emptyFields.length}
+                    />
+                  }
+                />
+              )}
               <EuiSpacer size="m" />
             </div>
           </div>
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/dimension_panel.test.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/dimension_panel.test.tsx
index e4dbc64184528..1f48f95ee45e0 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/dimension_panel.test.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/dimension_panel.test.tsx
@@ -314,11 +314,11 @@ describe('IndexPatternDimensionEditorPanel', () => {
       const items: EuiListGroupItemProps[] = wrapper.find(EuiListGroup).prop('listItems') || [];
 
       expect(items.find(({ label }) => label === 'Minimum')!['data-test-subj']).not.toContain(
-        'Incompatible'
+        'incompatible'
       );
 
       expect(items.find(({ label }) => label === 'Date histogram')!['data-test-subj']).toContain(
-        'Incompatible'
+        'incompatible'
       );
     });
 
@@ -601,7 +601,7 @@ describe('IndexPatternDimensionEditorPanel', () => {
 
         act(() => {
           wrapper
-            .find('button[data-test-subj="lns-indexPatternDimensionIncompatible-terms"]')
+            .find('button[data-test-subj="lns-indexPatternDimension-terms incompatible"]')
             .simulate('click');
         });
 
@@ -612,7 +612,7 @@ describe('IndexPatternDimensionEditorPanel', () => {
         wrapper = mount(<IndexPatternDimensionEditorComponent {...defaultProps} />);
 
         wrapper
-          .find('button[data-test-subj="lns-indexPatternDimensionIncompatible-terms"]')
+          .find('button[data-test-subj="lns-indexPatternDimension-terms incompatible"]')
           .simulate('click');
 
         expect(wrapper.find('[data-test-subj="indexPattern-invalid-operation"]')).not.toHaveLength(
@@ -626,7 +626,7 @@ describe('IndexPatternDimensionEditorPanel', () => {
         wrapper = mount(<IndexPatternDimensionEditorComponent {...defaultProps} />);
 
         wrapper
-          .find('button[data-test-subj="lns-indexPatternDimensionIncompatible-terms"]')
+          .find('button[data-test-subj="lns-indexPatternDimension-terms incompatible"]')
           .simulate('click');
 
         wrapper
@@ -640,7 +640,7 @@ describe('IndexPatternDimensionEditorPanel', () => {
         wrapper = mount(<IndexPatternDimensionEditorComponent {...defaultProps} />);
 
         wrapper
-          .find('button[data-test-subj="lns-indexPatternDimensionIncompatible-terms"]')
+          .find('button[data-test-subj="lns-indexPatternDimension-terms incompatible"]')
           .simulate('click');
 
         const options = wrapper
@@ -722,7 +722,7 @@ describe('IndexPatternDimensionEditorPanel', () => {
         );
 
         wrapper
-          .find('button[data-test-subj="lns-indexPatternDimensionIncompatible-count"]')
+          .find('button[data-test-subj="lns-indexPatternDimension-count incompatible"]')
           .simulate('click');
 
         const newColumnState = setState.mock.calls[0][0].layers.first.columns.col2;
@@ -758,7 +758,7 @@ describe('IndexPatternDimensionEditorPanel', () => {
         );
 
         wrapper
-          .find('button[data-test-subj="lns-indexPatternDimensionIncompatible-terms"]')
+          .find('button[data-test-subj="lns-indexPatternDimension-terms incompatible"]')
           .simulate('click');
 
         const options = wrapper
@@ -781,7 +781,7 @@ describe('IndexPatternDimensionEditorPanel', () => {
 
         act(() => {
           wrapper
-            .find('button[data-test-subj="lns-indexPatternDimensionIncompatible-terms"]')
+            .find('button[data-test-subj="lns-indexPatternDimension-terms incompatible"]')
             .simulate('click');
         });
 
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/popover_editor.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/popover_editor.tsx
index 2fb7382f992e7..a5108b30cea1d 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/popover_editor.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/dimension_panel/popover_editor.tsx
@@ -156,9 +156,9 @@ export function PopoverEditor(props: PopoverEditorProps) {
         isActive,
         size: 's',
         className: 'lnsIndexPatternDimensionEditor__operation',
-        'data-test-subj': `lns-indexPatternDimension${
-          compatibleWithCurrentField ? '' : 'Incompatible'
-        }-${operationType}`,
+        'data-test-subj': `lns-indexPatternDimension-${operationType}${
+          compatibleWithCurrentField ? '' : ' incompatible'
+        }`,
         onClick() {
           if (!selectedColumn || !compatibleWithCurrentField) {
             const possibleFields = fieldByOperation[operationType] || [];
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/fields_accordion.tsx b/x-pack/plugins/lens/public/indexpattern_datasource/fields_accordion.tsx
index 7cc049c107b87..1d60b0b5cbbee 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/fields_accordion.tsx
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/fields_accordion.tsx
@@ -6,12 +6,14 @@
 
 import './datapanel.scss';
 import React, { memo, useCallback } from 'react';
+import { i18n } from '@kbn/i18n';
 import {
   EuiText,
   EuiNotificationBadge,
   EuiSpacer,
   EuiAccordion,
   EuiLoadingSpinner,
+  EuiIconTip,
 } from '@elastic/eui';
 import { DataPublicPluginStart } from 'src/plugins/data/public';
 import { IndexPatternField } from './types';
@@ -44,6 +46,7 @@ export interface FieldsAccordionProps {
   fieldProps: FieldItemSharedProps;
   renderCallout: JSX.Element;
   exists: boolean;
+  showExistenceFetchError?: boolean;
 }
 
 export const InnerFieldsAccordion = function InnerFieldsAccordion({
@@ -58,6 +61,7 @@ export const InnerFieldsAccordion = function InnerFieldsAccordion({
   fieldProps,
   renderCallout,
   exists,
+  showExistenceFetchError,
 }: FieldsAccordionProps) {
   const renderField = useCallback(
     (field: IndexPatternField) => {
@@ -78,7 +82,18 @@ export const InnerFieldsAccordion = function InnerFieldsAccordion({
         </EuiText>
       }
       extraAction={
-        hasLoaded ? (
+        showExistenceFetchError ? (
+          <EuiIconTip
+            aria-label={i18n.translate('xpack.lens.indexPattern.existenceErrorAriaLabel', {
+              defaultMessage: 'Existence fetch failed',
+            })}
+            type="alert"
+            color="warning"
+            content={i18n.translate('xpack.lens.indexPattern.existenceErrorLabel', {
+              defaultMessage: "Field information can't be loaded",
+            })}
+          />
+        ) : hasLoaded ? (
           <EuiNotificationBadge size="m" color={isFiltered ? 'accent' : 'subdued'}>
             {fieldsCount}
           </EuiNotificationBadge>
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/loader.test.ts b/x-pack/plugins/lens/public/indexpattern_datasource/loader.test.ts
index 5776691fbcc7f..27904a0f23f16 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/loader.test.ts
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/loader.test.ts
@@ -13,7 +13,7 @@ import {
   changeLayerIndexPattern,
   syncExistingFields,
 } from './loader';
-import { IndexPatternPersistedState, IndexPatternPrivateState } from './types';
+import { IndexPatternPersistedState, IndexPatternPrivateState, IndexPatternField } from './types';
 import { documentField } from './document_field';
 
 jest.mock('./operations');
@@ -642,7 +642,11 @@ describe('loader', () => {
       await syncExistingFields({
         dateRange: { fromDate: '1900-01-01', toDate: '2000-01-01' },
         fetchJson,
-        indexPatterns: [{ id: 'a' }, { id: 'b' }, { id: 'c' }],
+        indexPatterns: [
+          { id: 'a', title: 'a', fields: [] },
+          { id: 'b', title: 'a', fields: [] },
+          { id: 'c', title: 'a', fields: [] },
+        ],
         setState,
         dslQuery,
         showNoDataPopover: jest.fn(),
@@ -662,6 +666,7 @@ describe('loader', () => {
       expect(newState).toEqual({
         foo: 'bar',
         isFirstExistenceFetch: false,
+        existenceFetchFailed: false,
         existingFields: {
           a: { a_field_1: true, a_field_2: true },
           b: { b_field_1: true, b_field_2: true },
@@ -687,7 +692,11 @@ describe('loader', () => {
       const args = {
         dateRange: { fromDate: '1900-01-01', toDate: '2000-01-01' },
         fetchJson,
-        indexPatterns: [{ id: 'a' }, { id: 'b' }, { id: 'c' }],
+        indexPatterns: [
+          { id: 'a', title: 'a', fields: [] },
+          { id: 'b', title: 'a', fields: [] },
+          { id: 'c', title: 'a', fields: [] },
+        ],
         setState,
         dslQuery,
         showNoDataPopover: jest.fn(),
@@ -702,5 +711,45 @@ describe('loader', () => {
       await syncExistingFields({ ...args, isFirstExistenceFetch: true });
       expect(showNoDataPopover).not.toHaveBeenCalled();
     });
+
+    it('should set all fields to available and existence error flag if the request fails', async () => {
+      const setState = jest.fn();
+      const fetchJson = (jest.fn((path: string) => {
+        return new Promise((resolve, reject) => {
+          reject(new Error());
+        });
+      }) as unknown) as HttpHandler;
+
+      const args = {
+        dateRange: { fromDate: '1900-01-01', toDate: '2000-01-01' },
+        fetchJson,
+        indexPatterns: [
+          {
+            id: 'a',
+            title: 'a',
+            fields: [{ name: 'field1' }, { name: 'field2' }] as IndexPatternField[],
+          },
+        ],
+        setState,
+        dslQuery,
+        showNoDataPopover: jest.fn(),
+        currentIndexPatternTitle: 'abc',
+        isFirstExistenceFetch: false,
+      };
+
+      await syncExistingFields(args);
+
+      const [fn] = setState.mock.calls[0];
+      const newState = fn({
+        foo: 'bar',
+        existingFields: {},
+      }) as IndexPatternPrivateState;
+
+      expect(newState.existenceFetchFailed).toEqual(true);
+      expect(newState.existingFields.a).toEqual({
+        field1: true,
+        field2: true,
+      });
+    });
   });
 });
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/loader.ts b/x-pack/plugins/lens/public/indexpattern_datasource/loader.ts
index e995c7317b5d8..20e7bec6db131 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/loader.ts
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/loader.ts
@@ -246,7 +246,12 @@ export async function syncExistingFields({
   showNoDataPopover,
 }: {
   dateRange: DateRange;
-  indexPatterns: Array<{ id: string; timeFieldName?: string | null }>;
+  indexPatterns: Array<{
+    id: string;
+    title: string;
+    fields: IndexPatternField[];
+    timeFieldName?: string | null;
+  }>;
   fetchJson: HttpSetup['post'];
   setState: SetState;
   isFirstExistenceFetch: boolean;
@@ -254,41 +259,53 @@ export async function syncExistingFields({
   dslQuery: object;
   showNoDataPopover: () => void;
 }) {
-  const emptinessInfo = await Promise.all(
-    indexPatterns.map((pattern) => {
-      const body: Record<string, string | object> = {
-        dslQuery,
-        fromDate: dateRange.fromDate,
-        toDate: dateRange.toDate,
-      };
-
-      if (pattern.timeFieldName) {
-        body.timeFieldName = pattern.timeFieldName;
-      }
+  const existenceRequests = indexPatterns.map((pattern) => {
+    const body: Record<string, string | object> = {
+      dslQuery,
+      fromDate: dateRange.fromDate,
+      toDate: dateRange.toDate,
+    };
 
-      return fetchJson(`${BASE_API_URL}/existing_fields/${pattern.id}`, {
-        body: JSON.stringify(body),
-      }) as Promise<ExistingFields>;
-    })
-  );
+    if (pattern.timeFieldName) {
+      body.timeFieldName = pattern.timeFieldName;
+    }
 
-  if (isFirstExistenceFetch) {
-    const fieldsCurrentIndexPattern = emptinessInfo.find(
-      (info) => info.indexPatternTitle === currentIndexPatternTitle
-    );
-    if (fieldsCurrentIndexPattern && fieldsCurrentIndexPattern.existingFieldNames.length === 0) {
-      showNoDataPopover();
+    return fetchJson(`${BASE_API_URL}/existing_fields/${pattern.id}`, {
+      body: JSON.stringify(body),
+    }) as Promise<ExistingFields>;
+  });
+
+  try {
+    const emptinessInfo = await Promise.all(existenceRequests);
+    if (isFirstExistenceFetch) {
+      const fieldsCurrentIndexPattern = emptinessInfo.find(
+        (info) => info.indexPatternTitle === currentIndexPatternTitle
+      );
+      if (fieldsCurrentIndexPattern && fieldsCurrentIndexPattern.existingFieldNames.length === 0) {
+        showNoDataPopover();
+      }
     }
-  }
 
-  setState((state) => ({
-    ...state,
-    isFirstExistenceFetch: false,
-    existingFields: emptinessInfo.reduce((acc, info) => {
-      acc[info.indexPatternTitle] = booleanMap(info.existingFieldNames);
-      return acc;
-    }, state.existingFields),
-  }));
+    setState((state) => ({
+      ...state,
+      isFirstExistenceFetch: false,
+      existenceFetchFailed: false,
+      existingFields: emptinessInfo.reduce((acc, info) => {
+        acc[info.indexPatternTitle] = booleanMap(info.existingFieldNames);
+        return acc;
+      }, state.existingFields),
+    }));
+  } catch (e) {
+    // show all fields as available if fetch failed
+    setState((state) => ({
+      ...state,
+      existenceFetchFailed: true,
+      existingFields: indexPatterns.reduce((acc, pattern) => {
+        acc[pattern.title] = booleanMap(pattern.fields.map((field) => field.name));
+        return acc;
+      }, state.existingFields),
+    }));
+  }
 }
 
 function booleanMap(keys: string[]) {
diff --git a/x-pack/plugins/lens/public/indexpattern_datasource/types.ts b/x-pack/plugins/lens/public/indexpattern_datasource/types.ts
index b7beb67196add..2a9b3f452d991 100644
--- a/x-pack/plugins/lens/public/indexpattern_datasource/types.ts
+++ b/x-pack/plugins/lens/public/indexpattern_datasource/types.ts
@@ -52,6 +52,7 @@ export type IndexPatternPrivateState = IndexPatternPersistedState & {
    */
   existingFields: Record<string, Record<string, boolean>>;
   isFirstExistenceFetch: boolean;
+  existenceFetchFailed?: boolean;
 };
 
 export interface IndexPatternRef {
diff --git a/x-pack/plugins/maps/README.md b/x-pack/plugins/maps/README.md
new file mode 100644
index 0000000000000..aae5a708b680b
--- /dev/null
+++ b/x-pack/plugins/maps/README.md
@@ -0,0 +1,13 @@
+# Maps
+
+Visualize geo data from Elasticsearch or 3rd party geo-services.
+
+
+## Testing
+
+Run all tests from the `x-pack` root directory
+
+- Unit tests: `node scripts/jest --watch maps`
+- Functional tests:
+  - Run `node scripts/functional_tests_server`
+  - Run `node ../scripts/functional_test_runner.js --config ./test/functional/config.js --grep="maps app"`
\ No newline at end of file
diff --git a/x-pack/plugins/maps/common/descriptor_types/data_request_descriptor_types.ts b/x-pack/plugins/maps/common/descriptor_types/data_request_descriptor_types.ts
index 35b33da12d384..e73126ef10d3d 100644
--- a/x-pack/plugins/maps/common/descriptor_types/data_request_descriptor_types.ts
+++ b/x-pack/plugins/maps/common/descriptor_types/data_request_descriptor_types.ts
@@ -18,6 +18,7 @@ export type MapFilters = {
   refreshTimerLastTriggeredAt?: string;
   timeFilters: TimeRange;
   zoom: number;
+  geogridPrecision?: number;
 };
 
 type ESSearchSourceSyncMeta = {
diff --git a/x-pack/plugins/maps/common/descriptor_types/map_descriptor.ts b/x-pack/plugins/maps/common/descriptor_types/map_descriptor.ts
index 027cc886cd7f7..ed0656a2fc265 100644
--- a/x-pack/plugins/maps/common/descriptor_types/map_descriptor.ts
+++ b/x-pack/plugins/maps/common/descriptor_types/map_descriptor.ts
@@ -10,10 +10,10 @@ import { Query } from '../../../../../src/plugins/data/common';
 import { DRAW_TYPE, ES_GEO_FIELD_TYPE, ES_SPATIAL_RELATIONS } from '../constants';
 
 export type MapExtent = {
-  maxLat: number;
-  maxLon: number;
-  minLat: number;
   minLon: number;
+  minLat: number;
+  maxLon: number;
+  maxLat: number;
 };
 
 export type MapQuery = Query & {
diff --git a/x-pack/plugins/maps/public/classes/sources/es_geo_grid_source/es_geo_grid_source.test.ts b/x-pack/plugins/maps/public/classes/sources/es_geo_grid_source/es_geo_grid_source.test.ts
index e35bb998ce7db..2707b2ac23e58 100644
--- a/x-pack/plugins/maps/public/classes/sources/es_geo_grid_source/es_geo_grid_source.test.ts
+++ b/x-pack/plugins/maps/public/classes/sources/es_geo_grid_source/es_geo_grid_source.test.ts
@@ -3,18 +3,50 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-jest.mock('../../../kibana_services', () => {});
+import { MapExtent, MapFilters } from '../../../../common/descriptor_types';
+
+jest.mock('../../../kibana_services');
 jest.mock('ui/new_platform');
 
+import {
+  getIndexPatternService,
+  getSearchService,
+  fetchSearchSourceAndRecordWithInspector,
+} from '../../../kibana_services';
 import { ESGeoGridSource } from './es_geo_grid_source';
-import { GRID_RESOLUTION, RENDER_AS, SOURCE_TYPES } from '../../../../common/constants';
+import {
+  ES_GEO_FIELD_TYPE,
+  GRID_RESOLUTION,
+  RENDER_AS,
+  SOURCE_TYPES,
+} from '../../../../common/constants';
+import { SearchSource } from '../../../../../../../src/plugins/data/public/search/search_source';
+
+export class MockSearchSource {
+  setField = jest.fn();
+}
 
 describe('ESGeoGridSource', () => {
+  const geoFieldName = 'bar';
+  const mockIndexPatternService = {
+    get() {
+      return {
+        fields: {
+          getByName() {
+            return {
+              name: geoFieldName,
+              type: ES_GEO_FIELD_TYPE.GEO_POINT,
+            };
+          },
+        },
+      };
+    },
+  };
   const geogridSource = new ESGeoGridSource(
     {
       id: 'foobar',
       indexPatternId: 'fooIp',
-      geoField: 'bar',
+      geoField: geoFieldName,
       metrics: [],
       resolution: GRID_RESOLUTION.COARSE,
       type: SOURCE_TYPES.ES_GEO_GRID,
@@ -23,6 +55,144 @@ describe('ESGeoGridSource', () => {
     {}
   );
 
+  describe('getGeoJsonWithMeta', () => {
+    let mockSearchSource: unknown;
+    beforeEach(async () => {
+      mockSearchSource = new MockSearchSource();
+      const mockSearchService = {
+        searchSource: {
+          async create() {
+            return mockSearchSource as SearchSource;
+          },
+        },
+      };
+
+      // @ts-expect-error
+      getIndexPatternService.mockReturnValue(mockIndexPatternService);
+      // @ts-expect-error
+      getSearchService.mockReturnValue(mockSearchService);
+      // @ts-expect-error
+      fetchSearchSourceAndRecordWithInspector.mockReturnValue({
+        took: 71,
+        timed_out: false,
+        _shards: {
+          total: 1,
+          successful: 1,
+          skipped: 0,
+          failed: 0,
+        },
+        hits: {
+          total: 748 + 683,
+          max_score: null,
+          hits: [],
+        },
+        aggregations: {
+          gridSplit: {
+            buckets: [
+              {
+                key: '4/4/6',
+                doc_count: 748,
+                gridCentroid: {
+                  location: {
+                    lat: 35.64189018148127,
+                    lon: -82.84314106196105,
+                  },
+                  count: 748,
+                },
+              },
+              {
+                key: '4/3/6',
+                doc_count: 683,
+                gridCentroid: {
+                  location: {
+                    lat: 35.24134021274211,
+                    lon: -98.45945192042787,
+                  },
+                  count: 683,
+                },
+              },
+            ],
+          },
+        },
+      });
+    });
+
+    const extent: MapExtent = {
+      minLon: -160,
+      minLat: -80,
+      maxLon: 160,
+      maxLat: 80,
+    };
+
+    const mapFilters: MapFilters = {
+      geogridPrecision: 4,
+      filters: [],
+      timeFilters: {
+        from: 'now',
+        to: '15m',
+        mode: 'relative',
+      },
+      // extent,
+      buffer: extent,
+      zoom: 0,
+    };
+
+    it('Should configure the SearchSource correctly', async () => {
+      const { data, meta } = await geogridSource.getGeoJsonWithMeta(
+        'foobarLayer',
+        mapFilters,
+        () => {}
+      );
+
+      expect(meta && meta.areResultsTrimmed).toEqual(false);
+      expect(data).toEqual({
+        type: 'FeatureCollection',
+        features: [
+          {
+            type: 'Feature',
+            geometry: { type: 'Point', coordinates: [-82.84314106196105, 35.64189018148127] },
+            id: '4/4/6',
+            properties: { doc_count: 748 },
+          },
+          {
+            type: 'Feature',
+            geometry: { type: 'Point', coordinates: [-98.45945192042787, 35.24134021274211] },
+            id: '4/3/6',
+            properties: { doc_count: 683 },
+          },
+        ],
+      });
+
+      function getProperty(property: string) {
+        // @ts-expect-error
+        const call = mockSearchSource.setField.mock.calls.find((c) => {
+          return c[0] === property;
+        });
+        return call[1];
+      }
+
+      expect(getProperty('size')).toEqual(0);
+      expect(getProperty('query')).toEqual(undefined);
+      expect(getProperty('filter')).toEqual([
+        {
+          geo_bounding_box: { bar: { bottom_right: [180, -82.67628], top_left: [-180, 82.67628] } },
+        },
+      ]);
+      expect(getProperty('aggs')).toEqual({
+        gridSplit: {
+          aggs: { gridCentroid: { geo_centroid: { field: geoFieldName } } },
+          geotile_grid: {
+            bounds: { bottom_right: [160, -80], top_left: [-160, 80] },
+            field: 'bar',
+            precision: 4,
+            shard_size: 65535,
+            size: 65535,
+          },
+        },
+      });
+    });
+  });
+
   describe('getGridResolution', () => {
     it('should echo gridResoltuion', () => {
       expect(geogridSource.getGridResolution()).toBe(GRID_RESOLUTION.COARSE);
diff --git a/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/__snapshots__/mvt_single_layer_source_settings.test.tsx.snap b/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/__snapshots__/mvt_single_layer_source_settings.test.tsx.snap
index 699173bd362fa..c82618a500a33 100644
--- a/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/__snapshots__/mvt_single_layer_source_settings.test.tsx.snap
+++ b/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/__snapshots__/mvt_single_layer_source_settings.test.tsx.snap
@@ -8,7 +8,7 @@ exports[`should not render fields-editor when there is no layername 1`] = `
     fullWidth={false}
     hasChildLabel={true}
     hasEmptyLabelSpace={false}
-    label="Tile layer"
+    label="Source layer"
     labelType="label"
   >
     <EuiFieldText
@@ -64,7 +64,7 @@ exports[`should render with fields 1`] = `
     fullWidth={false}
     hasChildLabel={true}
     hasEmptyLabelSpace={false}
-    label="Tile layer"
+    label="Source layer"
     labelType="label"
   >
     <EuiFieldText
@@ -162,7 +162,7 @@ exports[`should render without fields 1`] = `
     fullWidth={false}
     hasChildLabel={true}
     hasEmptyLabelSpace={false}
-    label="Tile layer"
+    label="Source layer"
     labelType="label"
   >
     <EuiFieldText
diff --git a/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/mvt_single_layer_source_settings.tsx b/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/mvt_single_layer_source_settings.tsx
index cd3fd97cf66a6..566d7bb09e86b 100644
--- a/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/mvt_single_layer_source_settings.tsx
+++ b/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/mvt_single_layer_source_settings.tsx
@@ -133,7 +133,7 @@ export class MVTSingleLayerSourceSettings extends Component<Props, State> {
           label={i18n.translate(
             'xpack.maps.source.MVTSingleLayerVectorSourceEditor.layerNameMessage',
             {
-              defaultMessage: 'Tile layer',
+              defaultMessage: 'Source layer',
             }
           )}
         >
diff --git a/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/mvt_single_layer_vector_source.test.tsx b/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/mvt_single_layer_vector_source.test.tsx
index bc08baad7a842..4e9e1e9cd7680 100644
--- a/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/mvt_single_layer_vector_source.test.tsx
+++ b/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/mvt_single_layer_vector_source.test.tsx
@@ -84,7 +84,7 @@ describe('getImmutableSourceProperties', () => {
     const source = new MVTSingleLayerVectorSource(descriptor);
     const properties = await source.getImmutableProperties();
     expect(properties).toEqual([
-      { label: 'Data source', value: '.pbf vector tiles' },
+      { label: 'Data source', value: 'Vector tiles' },
       { label: 'Url', value: 'https://example.com/{x}/{y}/{z}.pbf' },
     ]);
   });
diff --git a/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/mvt_single_layer_vector_source.tsx b/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/mvt_single_layer_vector_source.tsx
index ae28828dec5a8..e64d20138cfb8 100644
--- a/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/mvt_single_layer_vector_source.tsx
+++ b/x-pack/plugins/maps/public/classes/sources/mvt_single_layer_vector_source/mvt_single_layer_vector_source.tsx
@@ -32,7 +32,7 @@ import { ITooltipProperty, TooltipProperty } from '../../tooltips/tooltip_proper
 export const sourceTitle = i18n.translate(
   'xpack.maps.source.MVTSingleLayerVectorSource.sourceTitle',
   {
-    defaultMessage: '.pbf vector tiles',
+    defaultMessage: 'Vector tiles',
   }
 );
 
@@ -127,11 +127,7 @@ export class MVTSingleLayerVectorSource extends AbstractSource
     });
   }
 
-  getGeoJsonWithMeta(
-    layerName: 'string',
-    searchFilters: unknown[],
-    registerCancelCallback: (callback: () => void) => void
-  ): Promise<GeoJsonWithMeta> {
+  getGeoJsonWithMeta(): Promise<GeoJsonWithMeta> {
     // Having this method here is a consequence of ITiledSingleLayerVectorSource extending IVectorSource.
     throw new Error('Does not implement getGeoJsonWithMeta');
   }
diff --git a/x-pack/plugins/maps/public/classes/sources/vector_source/vector_source.d.ts b/x-pack/plugins/maps/public/classes/sources/vector_source/vector_source.d.ts
index 42993bf36f618..62fc5a283e5f3 100644
--- a/x-pack/plugins/maps/public/classes/sources/vector_source/vector_source.d.ts
+++ b/x-pack/plugins/maps/public/classes/sources/vector_source/vector_source.d.ts
@@ -12,8 +12,8 @@ import { IField } from '../../fields/field';
 import {
   ESSearchSourceResponseMeta,
   MapExtent,
+  MapFilters,
   MapQuery,
-  VectorSourceRequestMeta,
   VectorSourceSyncMeta,
 } from '../../../../common/descriptor_types';
 import { VECTOR_SHAPE_TYPE } from '../../../../common/constants';
@@ -42,7 +42,7 @@ export interface IVectorSource extends ISource {
   ): MapExtent | null;
   getGeoJsonWithMeta(
     layerName: 'string',
-    searchFilters: unknown[],
+    searchFilters: MapFilters,
     registerCancelCallback: (callback: () => void) => void
   ): Promise<GeoJsonWithMeta>;
 
@@ -62,8 +62,8 @@ export class AbstractVectorSource extends AbstractSource implements IVectorSourc
     registerCancelCallback: (requestToken: symbol, callback: () => void) => void
   ): MapExtent | null;
   getGeoJsonWithMeta(
-    layerName: 'string',
-    searchFilters: unknown[],
+    layerName: string,
+    searchFilters: MapFilters,
     registerCancelCallback: (callback: () => void) => void
   ): Promise<GeoJsonWithMeta>;
 
diff --git a/x-pack/plugins/maps/public/kibana_services.d.ts b/x-pack/plugins/maps/public/kibana_services.d.ts
index 974bccf4942f3..2e6911e89fa0a 100644
--- a/x-pack/plugins/maps/public/kibana_services.d.ts
+++ b/x-pack/plugins/maps/public/kibana_services.d.ts
@@ -49,6 +49,7 @@ export function getShowMapsInspectorAdapter(): boolean;
 export function getPreserveDrawingBuffer(): boolean;
 export function getProxyElasticMapsServiceInMaps(): boolean;
 export function getIsGoldPlus(): boolean;
+export function fetchSearchSourceAndRecordWithInspector(args: unknown): any;
 
 export function setLicenseId(args: unknown): void;
 export function setInspector(args: unknown): void;
diff --git a/x-pack/plugins/maps/server/maps_telemetry/maps_telemetry.test.js b/x-pack/plugins/maps/server/maps_telemetry/maps_telemetry.test.js
index 6131ff45c4a0f..a447c4ae7ce84 100644
--- a/x-pack/plugins/maps/server/maps_telemetry/maps_telemetry.test.js
+++ b/x-pack/plugins/maps/server/maps_telemetry/maps_telemetry.test.js
@@ -22,6 +22,7 @@ describe('buildMapsTelemetry', () => {
       indexPatternsWithGeoFieldCount: 0,
       indexPatternsWithGeoPointFieldCount: 0,
       indexPatternsWithGeoShapeFieldCount: 0,
+      geoShapeAggLayersCount: 0,
       attributesPerMap: {
         dataSourcesCount: {
           avg: 0,
@@ -50,48 +51,49 @@ describe('buildMapsTelemetry', () => {
       indexPatternsWithGeoFieldCount: 3,
       indexPatternsWithGeoPointFieldCount: 2,
       indexPatternsWithGeoShapeFieldCount: 1,
+      geoShapeAggLayersCount: 2,
       attributesPerMap: {
         dataSourcesCount: {
-          avg: 2.6666666666666665,
+          avg: 2,
           max: 3,
-          min: 2,
+          min: 1,
         },
         emsVectorLayersCount: {
           canada_provinces: {
-            avg: 0.3333333333333333,
+            avg: 0.2,
             max: 1,
             min: 1,
           },
           france_departments: {
-            avg: 0.3333333333333333,
+            avg: 0.2,
             max: 1,
             min: 1,
           },
           italy_provinces: {
-            avg: 0.3333333333333333,
+            avg: 0.2,
             max: 1,
             min: 1,
           },
         },
         layerTypesCount: {
           TILE: {
-            avg: 1,
+            avg: 0.6,
             max: 1,
             min: 1,
           },
           VECTOR: {
-            avg: 1.6666666666666667,
+            avg: 1.2,
             max: 2,
             min: 1,
           },
         },
         layersCount: {
-          avg: 2.6666666666666665,
+          avg: 2,
           max: 3,
-          min: 2,
+          min: 1,
         },
       },
-      mapsTotalCount: 3,
+      mapsTotalCount: 5,
       settings: {
         showMapVisualizationTypes: false,
       },
diff --git a/x-pack/plugins/maps/server/maps_telemetry/maps_telemetry.ts b/x-pack/plugins/maps/server/maps_telemetry/maps_telemetry.ts
index 5f57d666b9f74..f0286d7e5811f 100644
--- a/x-pack/plugins/maps/server/maps_telemetry/maps_telemetry.ts
+++ b/x-pack/plugins/maps/server/maps_telemetry/maps_telemetry.ts
@@ -6,13 +6,25 @@
 
 import _ from 'lodash';
 import {
-  SavedObjectsClientContract,
-  SavedObjectAttributes,
   SavedObjectAttribute,
+  SavedObjectAttributes,
+  SavedObjectsClientContract,
 } from 'kibana/server';
 import { IFieldType, IIndexPattern } from 'src/plugins/data/public';
-import { SOURCE_TYPES, ES_GEO_FIELD_TYPE, MAP_SAVED_OBJECT_TYPE } from '../../common/constants';
-import { LayerDescriptor } from '../../common/descriptor_types';
+import {
+  ES_GEO_FIELD_TYPE,
+  LAYER_TYPE,
+  MAP_SAVED_OBJECT_TYPE,
+  SCALING_TYPES,
+  SOURCE_TYPES,
+} from '../../common/constants';
+import {
+  AbstractSourceDescriptor,
+  ESGeoGridSourceDescriptor,
+  ESSearchSourceDescriptor,
+  LayerDescriptor,
+  SourceDescriptor,
+} from '../../common/descriptor_types';
 import { MapSavedObject } from '../../common/map_saved_object_type';
 // @ts-ignore
 import { getInternalRepository } from '../kibana_server_services';
@@ -82,6 +94,111 @@ function getIndexPatternsWithGeoFieldCount(indexPatterns: IIndexPattern[]) {
   };
 }
 
+function getEMSLayerCount(layerLists: LayerDescriptor[][]): ILayerTypeCount[] {
+  return layerLists.map((layerList: LayerDescriptor[]) => {
+    const emsLayers = layerList.filter((layer: LayerDescriptor) => {
+      return (
+        layer.sourceDescriptor !== null &&
+        layer.sourceDescriptor.type === SOURCE_TYPES.EMS_FILE &&
+        (layer.sourceDescriptor as AbstractSourceDescriptor).id
+      );
+    });
+    const emsCountsById = _(emsLayers).countBy((layer: LayerDescriptor) => {
+      return (layer.sourceDescriptor as AbstractSourceDescriptor).id;
+    });
+
+    const layerTypeCount = emsCountsById.value();
+    return layerTypeCount as ILayerTypeCount;
+  }) as ILayerTypeCount[];
+}
+
+function isFieldGeoShape(
+  indexPatterns: IIndexPattern[],
+  indexPatternId: string,
+  geoField: string | undefined
+): boolean {
+  if (!geoField) {
+    return false;
+  }
+
+  const matchIndexPattern = indexPatterns.find((indexPattern: IIndexPattern) => {
+    return indexPattern.id === indexPatternId;
+  });
+
+  if (!matchIndexPattern) {
+    return false;
+  }
+
+  const fieldList: IFieldType[] =
+    matchIndexPattern.attributes && matchIndexPattern.attributes.fields
+      ? JSON.parse(matchIndexPattern.attributes.fields)
+      : [];
+
+  const matchField = fieldList.find((field: IFieldType) => {
+    return field.name === geoField;
+  });
+
+  return !!matchField && matchField.type === ES_GEO_FIELD_TYPE.GEO_SHAPE;
+}
+
+function isGeoShapeAggLayer(indexPatterns: IIndexPattern[], layer: LayerDescriptor): boolean {
+  if (layer.sourceDescriptor === null) {
+    return false;
+  }
+
+  if (
+    layer.type !== LAYER_TYPE.VECTOR &&
+    layer.type !== LAYER_TYPE.BLENDED_VECTOR &&
+    layer.type !== LAYER_TYPE.HEATMAP
+  ) {
+    return false;
+  }
+
+  const sourceDescriptor: SourceDescriptor = layer.sourceDescriptor;
+  if (sourceDescriptor.type === SOURCE_TYPES.ES_GEO_GRID) {
+    return isFieldGeoShape(
+      indexPatterns,
+      (sourceDescriptor as ESGeoGridSourceDescriptor).indexPatternId,
+      (sourceDescriptor as ESGeoGridSourceDescriptor).geoField
+    );
+  } else if (
+    sourceDescriptor.type === SOURCE_TYPES.ES_SEARCH &&
+    (sourceDescriptor as ESSearchSourceDescriptor).scalingType === SCALING_TYPES.CLUSTERS
+  ) {
+    return isFieldGeoShape(
+      indexPatterns,
+      (sourceDescriptor as ESSearchSourceDescriptor).indexPatternId,
+      (sourceDescriptor as ESSearchSourceDescriptor).geoField
+    );
+  } else {
+    return false;
+  }
+}
+
+function getGeoShapeAggCount(
+  layerLists: LayerDescriptor[][],
+  indexPatterns: IIndexPattern[]
+): number {
+  const countsPerMap: number[] = layerLists.map((layerList: LayerDescriptor[]) => {
+    const geoShapeAggLayers = layerList.filter((layerDescriptor) => {
+      return isGeoShapeAggLayer(indexPatterns, layerDescriptor);
+    });
+    return geoShapeAggLayers.length;
+  });
+
+  return _.sum(countsPerMap);
+}
+
+export function getLayerLists(mapSavedObjects: MapSavedObject[]): LayerDescriptor[][] {
+  return mapSavedObjects.map((savedMapObject) => {
+    const layerList =
+      savedMapObject.attributes && savedMapObject.attributes.layerListJSON
+        ? JSON.parse(savedMapObject.attributes.layerListJSON)
+        : [];
+    return layerList as LayerDescriptor[];
+  });
+}
+
 export function buildMapsTelemetry({
   mapSavedObjects,
   indexPatternSavedObjects,
@@ -91,17 +208,13 @@ export function buildMapsTelemetry({
   indexPatternSavedObjects: IIndexPattern[];
   settings: SavedObjectAttribute;
 }): SavedObjectAttributes {
-  const layerLists = mapSavedObjects.map((savedMapObject) =>
-    savedMapObject.attributes && savedMapObject.attributes.layerListJSON
-      ? JSON.parse(savedMapObject.attributes.layerListJSON)
-      : []
-  );
+  const layerLists: LayerDescriptor[][] = getLayerLists(mapSavedObjects);
   const mapsCount = layerLists.length;
 
-  const dataSourcesCount = layerLists.map((lList) => {
+  const dataSourcesCount = layerLists.map((layerList: LayerDescriptor[]) => {
     // todo: not every source-descriptor has an id
     // @ts-ignore
-    const sourceIdList = lList.map((layer: LayerDescriptor) => layer.sourceDescriptor.id);
+    const sourceIdList = layerList.map((layer: LayerDescriptor) => layer.sourceDescriptor.id);
     return _.uniq(sourceIdList).length;
   });
 
@@ -109,15 +222,7 @@ export function buildMapsTelemetry({
   const layerTypesCount = layerLists.map((lList) => _.countBy(lList, 'type'));
 
   // Count of EMS Vector layers used
-  const emsLayersCount = layerLists.map((lList) =>
-    _(lList)
-      .countBy((layer: LayerDescriptor) => {
-        const isEmsFile = _.get(layer, 'sourceDescriptor.type') === SOURCE_TYPES.EMS_FILE;
-        return isEmsFile && _.get(layer, 'sourceDescriptor.id');
-      })
-      .pickBy((val, key) => key !== 'false')
-      .value()
-  ) as ILayerTypeCount[];
+  const emsLayersCount = getEMSLayerCount(layerLists);
 
   const dataSourcesCountSum = _.sum(dataSourcesCount);
   const layersCountSum = _.sum(layersCount);
@@ -127,11 +232,16 @@ export function buildMapsTelemetry({
     indexPatternsWithGeoPointFieldCount,
     indexPatternsWithGeoShapeFieldCount,
   } = getIndexPatternsWithGeoFieldCount(indexPatternSavedObjects);
+
+  // Tracks whether user users Gold+ only functionality
+  const geoShapeAggLayersCount = getGeoShapeAggCount(layerLists, indexPatternSavedObjects);
+
   return {
     settings,
     indexPatternsWithGeoFieldCount,
     indexPatternsWithGeoPointFieldCount,
     indexPatternsWithGeoShapeFieldCount,
+    geoShapeAggLayersCount,
     // Total count of maps
     mapsTotalCount: mapsCount,
     // Time of capture
diff --git a/x-pack/plugins/maps/server/maps_telemetry/test_resources/sample_map_saved_objects.json b/x-pack/plugins/maps/server/maps_telemetry/test_resources/sample_map_saved_objects.json
index 017f9e69ffe46..82a8035c77dc7 100644
--- a/x-pack/plugins/maps/server/maps_telemetry/test_resources/sample_map_saved_objects.json
+++ b/x-pack/plugins/maps/server/maps_telemetry/test_resources/sample_map_saved_objects.json
@@ -43,5 +43,38 @@
     ],
     "updated_at": "2019-01-31T23:19:55.855Z",
     "version": 1
+  },
+  {
+    "type": "gis-map",
+    "id": "643da1e6-c628-11ea-87d0-0242ac130003",
+    "attributes": {
+      "title": "Single cluster layer with geo_shape field",
+      "description": "",
+      "mapStateJSON": "{\"zoom\":2.12,\"center\":{\"lon\":-88.67592,\"lat\":34.23257},\"timeFilters\":{\"from\":\"now-15m\",\"to\":\"now\",\"mode\":\"quick\"},\"refreshConfig\":{\"isPaused\":false,\"interval\":0},\"query\":{\"query\":\"\",\"language\":\"lucene\"}}",
+      "layerListJSON": "[{\"sourceDescriptor\":{\"type\":\"ES_GEO_GRID\",\"id\":\"51afb7d0-c628-11ea-87d0-0242ac130003\",\"geoField\":\"geometry\",\"metrics\":[{\"type\":\"count\"}],\"requestType\":\"point\",\"resolution\":\"COARSE\",\"indexPatternId\":\"4a7f6010-0aed-11ea-9dd2-95afd7ad44d4\"},\"style\":{\"type\":\"VECTOR\",\"properties\":{\"icon\":{\"type\":\"STATIC\",\"options\":{\"value\":\"marker\"}},\"fillColor\":{\"type\":\"DYNAMIC\",\"options\":{\"color\":\"Blues\",\"colorCategory\":\"palette_0\",\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":true,\"sigma\":3},\"type\":\"ORDINAL\"}},\"lineColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#FFF\"}},\"lineWidth\":{\"type\":\"STATIC\",\"options\":{\"size\":0}},\"iconSize\":{\"type\":\"DYNAMIC\",\"options\":{\"minSize\":7,\"maxSize\":32,\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":true,\"sigma\":3}}},\"iconOrientation\":{\"type\":\"STATIC\",\"options\":{\"orientation\":0}},\"labelText\":{\"type\":\"DYNAMIC\",\"options\":{\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"}}},\"labelColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#000000\"}},\"labelSize\":{\"type\":\"STATIC\",\"options\":{\"size\":14}},\"labelBorderColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#FFFFFF\"}},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}}},\"isTimeAware\":true},\"id\":\"8d384d5d-6353-468f-b8f8-8eaa487358c4\",\"label\":null,\"minZoom\":0,\"maxZoom\":24,\"alpha\":1,\"visible\":true,\"type\":\"VECTOR\",\"joins\":[]}]",
+      "uiStateJSON": "{}"
+    },
+    "references": [
+    ],
+    "updated_at": "2019-01-31T23:19:55.855Z",
+    "version": 1
+  },
+  {
+    "type": "gis-map",
+    "id": "5efd136a-c628-11ea-87d0-0242ac130003",
+    "attributes": {
+      "title": "Single heatmap layer with geo_shape field",
+      "description": "",
+      "mapStateJSON": "{\"zoom\":2.12,\"center\":{\"lon\":-88.67592,\"lat\":34.23257},\"timeFilters\":{\"from\":\"now-15m\",\"to\":\"now\",\"mode\":\"quick\"},\"refreshConfig\":{\"isPaused\":false,\"interval\":0},\"query\":{\"query\":\"\",\"language\":\"lucene\"}}",
+      "layerListJSON": "[{\"sourceDescriptor\":{\"type\":\"ES_GEO_GRID\",\"id\":\"51afb7d0-c628-11ea-87d0-0242ac130003\",\"geoField\":\"geometry\",\"metrics\":[{\"type\":\"count\"}],\"requestType\":\"heatmap\",\"resolution\":\"COARSE\",\"indexPatternId\":\"4a7f6010-0aed-11ea-9dd2-95afd7ad44d4\"},\"id\":\"52eade74-1c78-4e18-8670-2061f38b613b\",\"label\":null,\"minZoom\":0,\"maxZoom\":24,\"alpha\":0.75,\"visible\":true,\"style\":{\"type\":\"HEATMAP\",\"colorRampName\":\"theclassic\"},\"type\":\"HEATMAP\",\"joins\":[]}]",
+      "uiStateJSON": "{}"
+    },
+    "references": [
+    ],
+    "updated_at": "2019-01-31T23:19:55.855Z",
+    "version": 1
   }
+
 ]
+
+
diff --git a/x-pack/plugins/ml/public/application/capabilities/check_capabilities.ts b/x-pack/plugins/ml/public/application/capabilities/check_capabilities.ts
index 56b372ff39919..653eca126006d 100644
--- a/x-pack/plugins/ml/public/application/capabilities/check_capabilities.ts
+++ b/x-pack/plugins/ml/public/application/capabilities/check_capabilities.ts
@@ -10,7 +10,6 @@ import { hasLicenseExpired } from '../license';
 
 import { MlCapabilities, getDefaultCapabilities } from '../../../common/types/capabilities';
 import { getCapabilities, getManageMlCapabilities } from './get_capabilities';
-import { ACCESS_DENIED_PATH } from '../management/management_urls';
 
 let _capabilities: MlCapabilities = getDefaultCapabilities();
 
@@ -25,12 +24,10 @@ export function checkGetManagementMlJobsResolver() {
         if (isManageML === true && isPlatinumOrTrialLicense === true) {
           return resolve({ mlFeatureEnabledInSpace });
         } else {
-          window.location.href = ACCESS_DENIED_PATH;
           return reject();
         }
       })
       .catch((e) => {
-        window.location.href = ACCESS_DENIED_PATH;
         return reject();
       });
   });
diff --git a/x-pack/plugins/ml/public/application/components/ml_in_memory_table/ml_in_memory_table.tsx b/x-pack/plugins/ml/public/application/components/ml_in_memory_table/ml_in_memory_table.tsx
deleted file mode 100644
index 7caaadf65d6da..0000000000000
--- a/x-pack/plugins/ml/public/application/components/ml_in_memory_table/ml_in_memory_table.tsx
+++ /dev/null
@@ -1,108 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-// This component extends EuiInMemoryTable with some
-// fixes and TS specs until the changes become available upstream.
-
-import React, { Fragment } from 'react';
-
-import { EuiProgress } from '@elastic/eui';
-
-// The built in loading progress bar of EuiInMemoryTable causes a full DOM replacement
-// of the table and doesn't play well with auto-refreshing. That's why we're displaying
-// our own progress bar on top of the table. `EuiProgress` after `isLoading` displays
-// the loading indicator. The variation after `!isLoading` displays an empty progress
-// bar fixed to 0%. Without it, the display would vertically jump when showing/hiding
-// the progress bar.
-export const ProgressBar = ({ isLoading = false }) => {
-  return (
-    <Fragment>
-      {isLoading && <EuiProgress className="mlAnalyticsProgressBar" size="xs" color="primary" />}
-      {!isLoading && (
-        <EuiProgress className="mlAnalyticsProgressBar" value={0} max={100} size="xs" />
-      )}
-    </Fragment>
-  );
-};
-
-// copied from EUI to be available to the extended getDerivedStateFromProps()
-function findColumnByProp(columns: any, prop: any, value: any) {
-  for (let i = 0; i < columns.length; i++) {
-    const column = columns[i];
-    if (column[prop] === value) {
-      return column;
-    }
-  }
-}
-
-// copied from EUI to be available to the extended getDerivedStateFromProps()
-const getInitialSorting = (columns: any, sorting: any) => {
-  if (!sorting || !sorting.sort) {
-    return {
-      sortName: undefined,
-      sortDirection: undefined,
-    };
-  }
-
-  const { field: sortable, direction: sortDirection } = sorting.sort;
-
-  // sortable could be a column's `field` or its `name`
-  // for backwards compatibility `field` must be checked first
-  let sortColumn = findColumnByProp(columns, 'field', sortable);
-  if (sortColumn == null) {
-    sortColumn = findColumnByProp(columns, 'name', sortable);
-  }
-
-  if (sortColumn == null) {
-    return {
-      sortName: undefined,
-      sortDirection: undefined,
-    };
-  }
-
-  const sortName = sortColumn.name;
-
-  return {
-    sortName,
-    sortDirection,
-  };
-};
-
-import { mlInMemoryTableBasicFactory } from './types';
-
-export function mlInMemoryTableFactory<T>() {
-  const MlInMemoryTableBasic = mlInMemoryTableBasicFactory<T>();
-
-  return class MlInMemoryTable extends MlInMemoryTableBasic {
-    static getDerivedStateFromProps(nextProps: any, prevState: any) {
-      const derivedState = {
-        ...prevState.prevProps,
-        pageIndex: nextProps.pagination.initialPageIndex,
-        pageSize: nextProps.pagination.initialPageSize,
-      };
-
-      if (nextProps.items !== prevState.prevProps.items) {
-        Object.assign(derivedState, {
-          prevProps: {
-            items: nextProps.items,
-          },
-        });
-      }
-
-      const { sortName, sortDirection } = getInitialSorting(nextProps.columns, nextProps.sorting);
-      if (
-        sortName !== prevState.prevProps.sortName ||
-        sortDirection !== prevState.prevProps.sortDirection
-      ) {
-        Object.assign(derivedState, {
-          sortName,
-          sortDirection,
-        });
-      }
-      return derivedState;
-    }
-  };
-}
diff --git a/x-pack/plugins/ml/public/application/components/ml_in_memory_table/types.ts b/x-pack/plugins/ml/public/application/components/ml_in_memory_table/types.ts
deleted file mode 100644
index 05b941f2544b4..0000000000000
--- a/x-pack/plugins/ml/public/application/components/ml_in_memory_table/types.ts
+++ /dev/null
@@ -1,202 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { Component, HTMLAttributes, ReactElement, ReactNode } from 'react';
-
-import { Direction, CommonProps, EuiInMemoryTable } from '@elastic/eui';
-
-// Not using an enum here because the original HorizontalAlignment is also a union type of string.
-type HorizontalAlignment = 'left' | 'center' | 'right';
-
-type SortableFunc<T> = <T>(item: T) => any;
-type Sortable<T> = boolean | SortableFunc<T>;
-type DATA_TYPES = any;
-type FooterFunc = <T>(payload: { items: T[]; pagination: any }) => ReactNode;
-type RenderFunc = (value: any, record?: any) => ReactNode;
-export interface FieldDataColumnType<T> {
-  field: string;
-  name: ReactNode;
-  description?: string;
-  dataType?: DATA_TYPES;
-  width?: string;
-  sortable?: Sortable<T>;
-  align?: HorizontalAlignment;
-  truncateText?: boolean;
-  render?: RenderFunc;
-  footer?: string | ReactElement | FooterFunc;
-  textOnly?: boolean;
-  scope?: 'col' | 'row' | 'colgroup' | 'rowgroup';
-  'data-test-subj'?: string;
-}
-
-export interface ComputedColumnType<T> {
-  render: RenderFunc;
-  name?: ReactNode;
-  description?: string;
-  sortable?: (item: T) => any;
-  width?: string;
-  truncateText?: boolean;
-  'data-test-subj'?: string;
-}
-
-type ICON_TYPES = any;
-type IconTypesFunc<T> = (item: T) => ICON_TYPES; // (item) => oneOf(ICON_TYPES)
-type BUTTON_ICON_COLORS = any;
-type ButtonIconColorsFunc<T> = (item: T) => BUTTON_ICON_COLORS; // (item) => oneOf(ICON_BUTTON_COLORS)
-interface DefaultItemActionType<T> {
-  type?: 'icon' | 'button';
-  name: ReactNode;
-  description: string;
-  onClick?(item: T): void;
-  href?: string;
-  target?: string;
-  available?(item: T): boolean;
-  enabled?(item: T): boolean;
-  isPrimary?: boolean;
-  icon?: ICON_TYPES | IconTypesFunc<T>; // required when type is 'icon'
-  color?: BUTTON_ICON_COLORS | ButtonIconColorsFunc<T>;
-}
-
-interface CustomItemActionType<T> {
-  render(item: T, enabled: boolean): ReactNode;
-  available?(item: T): boolean;
-  enabled?(item: T): boolean;
-  isPrimary?: boolean;
-}
-
-export interface ExpanderColumnType<T> extends ComputedColumnType<T> {
-  align?: HorizontalAlignment;
-  isExpander: true;
-}
-
-type SupportedItemActionType<T> = DefaultItemActionType<T> | CustomItemActionType<T>;
-
-export interface ActionsColumnType<T> {
-  actions: Array<SupportedItemActionType<T>>;
-  name?: ReactNode;
-  description?: string;
-  width?: string;
-}
-
-export type ColumnType<T> =
-  | ActionsColumnType<T>
-  | ComputedColumnType<T>
-  | ExpanderColumnType<T>
-  | FieldDataColumnType<T>;
-
-type QueryType = any;
-
-interface Schema {
-  strict?: boolean;
-  fields?: Record<string, any>;
-  flags?: string[];
-}
-
-interface SearchBoxConfigPropTypes {
-  placeholder?: string;
-  incremental?: boolean;
-  schema?: Schema;
-}
-
-interface Box {
-  placeholder?: string;
-  incremental?: boolean;
-  // here we enable the user to just assign 'true' to the schema, in which case
-  // we will auto-generate it out of the columns configuration
-  schema?: boolean | SearchBoxConfigPropTypes['schema'];
-}
-
-type SearchFiltersFiltersType = any;
-
-interface ExecuteQueryOptions {
-  defaultFields: string[];
-  isClauseMatcher: () => void;
-  explain: boolean;
-}
-
-type SearchType =
-  | boolean
-  | {
-      toolsLeft?: ReactNode;
-      toolsRight?: ReactNode;
-      defaultQuery?: QueryType;
-      box?: Box;
-      filters?: SearchFiltersFiltersType;
-      onChange?: (arg: any) => void;
-      executeQueryOptions?: ExecuteQueryOptions;
-    };
-
-interface PageSizeOptions {
-  pageSizeOptions: number[];
-}
-interface InitialPageOptions extends PageSizeOptions {
-  initialPageIndex: number;
-  initialPageSize: number;
-}
-type PaginationProp = boolean | PageSizeOptions | InitialPageOptions;
-
-export enum SORT_DIRECTION {
-  ASC = 'asc',
-  DESC = 'desc',
-}
-export type SortDirection = SORT_DIRECTION.ASC | SORT_DIRECTION.DESC | 'asc' | 'desc';
-interface SortFields {
-  field: string;
-  direction: SortDirection | Direction;
-}
-export interface Sorting {
-  sort?: SortFields;
-}
-export type SortingPropType =
-  | boolean
-  | {
-      sort: SortFields;
-    };
-
-type SelectionType = any;
-
-export interface OnTableChangeArg extends Sorting {
-  page?: { index: number; size: number };
-}
-
-type ItemIdTypeFunc = <T>(item: T) => string;
-type ItemIdType =
-  | string // the name of the item id property
-  | ItemIdTypeFunc;
-
-export type EuiInMemoryTableProps<T> = CommonProps & {
-  columns: Array<ColumnType<T>>;
-  hasActions?: boolean;
-  isExpandable?: boolean;
-  isSelectable?: boolean;
-  items?: T[];
-  loading?: boolean;
-  message?: HTMLAttributes<HTMLDivElement>;
-  error?: string;
-  compressed?: boolean;
-  search?: SearchType;
-  pagination?: PaginationProp;
-  sorting?: SortingPropType;
-  // Set `allowNeutralSort` to false to force column sorting. Defaults to true.
-  allowNeutralSort?: boolean;
-  responsive?: boolean;
-  selection?: SelectionType;
-  itemId?: ItemIdType;
-  itemIdToExpandedRowMap?: Record<string, JSX.Element>;
-  rowProps?: (item: T) => void | Record<string, any>;
-  cellProps?: () => void | Record<string, any>;
-  onTableChange?: (arg: OnTableChangeArg) => void;
-};
-
-type EuiInMemoryTableType = typeof EuiInMemoryTable;
-
-interface ComponentWithConstructor<T> extends EuiInMemoryTableType {
-  new (): Component<T>;
-}
-
-export function mlInMemoryTableBasicFactory<T>() {
-  return EuiInMemoryTable as ComponentWithConstructor<EuiInMemoryTableProps<T>>;
-}
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_clone/clone_button.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_clone/clone_button.tsx
index 13f3805cdf613..6b99787a6c9a9 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_clone/clone_button.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_clone/clone_button.tsx
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { EuiButtonEmpty } from '@elastic/eui';
+import { EuiButtonEmpty, EuiToolTip } from '@elastic/eui';
 import React, { FC } from 'react';
 import { isEqual, cloneDeep } from 'lodash';
 import { i18n } from '@kbn/i18n';
@@ -20,7 +20,6 @@ import {
 } from '../../hooks/use_create_analytics_form';
 import { State } from '../../hooks/use_create_analytics_form/state';
 import { DataFrameAnalyticsListRow } from '../analytics_list/common';
-import { checkPermission } from '../../../../../capabilities/check_capabilities';
 import { extractErrorMessage } from '../../../../../../../common/util/errors';
 
 interface PropDefinition {
@@ -328,11 +327,11 @@ export function extractCloningConfig({
   }) as unknown) as CloneDataFrameAnalyticsConfig;
 }
 
-export function getCloneAction(createAnalyticsForm: CreateAnalyticsFormProps) {
-  const buttonText = i18n.translate('xpack.ml.dataframe.analyticsList.cloneJobButtonLabel', {
-    defaultMessage: 'Clone job',
-  });
+const buttonText = i18n.translate('xpack.ml.dataframe.analyticsList.cloneJobButtonLabel', {
+  defaultMessage: 'Clone job',
+});
 
+export function getCloneAction(createAnalyticsForm: CreateAnalyticsFormProps) {
   const { actions } = createAnalyticsForm;
 
   const onClick = async (item: DeepReadonly<DataFrameAnalyticsListRow>) => {
@@ -348,23 +347,7 @@ export function getCloneAction(createAnalyticsForm: CreateAnalyticsFormProps) {
   };
 }
 
-interface CloneButtonProps {
-  item: DataFrameAnalyticsListRow;
-  createAnalyticsForm: CreateAnalyticsFormProps;
-}
-
-/**
- * Temp component to have Clone job button with the same look as the other actions.
- * Replace with {@link getCloneAction} as soon as all the actions are refactored
- * to support EuiContext with a valid DOM structure without nested buttons.
- */
-export const CloneButton: FC<CloneButtonProps> = ({ createAnalyticsForm, item }) => {
-  const canCreateDataFrameAnalytics: boolean = checkPermission('canCreateDataFrameAnalytics');
-
-  const buttonText = i18n.translate('xpack.ml.dataframe.analyticsList.cloneJobButtonLabel', {
-    defaultMessage: 'Clone job',
-  });
-
+export const useNavigateToWizardWithClonedJob = () => {
   const {
     services: {
       application: { navigateToUrl },
@@ -375,7 +358,7 @@ export const CloneButton: FC<CloneButtonProps> = ({ createAnalyticsForm, item })
 
   const savedObjectsClient = savedObjects.client;
 
-  const onClick = async () => {
+  return async (item: DataFrameAnalyticsListRow) => {
     const sourceIndex = Array.isArray(item.config.source.index)
       ? item.config.source.index[0]
       : item.config.source.index;
@@ -419,18 +402,46 @@ export const CloneButton: FC<CloneButtonProps> = ({ createAnalyticsForm, item })
       );
     }
   };
+};
 
-  return (
+interface CloneButtonProps {
+  isDisabled: boolean;
+  onClick: () => void;
+}
+
+/**
+ * Temp component to have Clone job button with the same look as the other actions.
+ * Replace with {@link getCloneAction} as soon as all the actions are refactored
+ * to support EuiContext with a valid DOM structure without nested buttons.
+ */
+export const CloneButton: FC<CloneButtonProps> = ({ isDisabled, onClick }) => {
+  const button = (
     <EuiButtonEmpty
-      data-test-subj="mlAnalyticsJobCloneButton"
-      size="xs"
+      aria-label={buttonText}
       color="text"
+      data-test-subj="mlAnalyticsJobCloneButton"
+      flush="left"
       iconType="copy"
+      isDisabled={isDisabled}
       onClick={onClick}
-      aria-label={buttonText}
-      disabled={canCreateDataFrameAnalytics === false}
+      size="s"
     >
       {buttonText}
     </EuiButtonEmpty>
   );
+
+  if (isDisabled) {
+    return (
+      <EuiToolTip
+        position="top"
+        content={i18n.translate('xpack.ml.dataframe.analyticsList.cloneActionPermissionTooltip', {
+          defaultMessage: 'You do not have permission to clone analytics jobs.',
+        })}
+      >
+        {button}
+      </EuiToolTip>
+    );
+  }
+
+  return button;
 };
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_clone/index.ts b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_clone/index.ts
index b3d7189ff8cda..4e6357c4ea454 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_clone/index.ts
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_clone/index.ts
@@ -7,6 +7,7 @@
 export {
   extractCloningConfig,
   isAdvancedConfig,
+  useNavigateToWizardWithClonedJob,
   CloneButton,
   CloneDataFrameAnalyticsConfig,
 } from './clone_button';
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_delete/action_delete.test.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_delete/action_delete.test.tsx
index 6b745a2c5ff3b..99455a33cf084 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_delete/action_delete.test.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_delete/action_delete.test.tsx
@@ -49,37 +49,20 @@ describe('DeleteAction', () => {
     jest.clearAllMocks();
   });
 
-  test('When canDeleteDataFrameAnalytics permission is false, button should be disabled.', () => {
+  test('When isDisabled prop is true, inner button should be disabled.', () => {
     const { getByTestId } = render(
-      <DeleteButton item={mockAnalyticsListItem} onClick={() => {}} />
+      <DeleteButton isDisabled={true} item={mockAnalyticsListItem} onClick={() => {}} />
     );
+
     expect(getByTestId('mlAnalyticsJobDeleteButton')).toHaveAttribute('disabled');
   });
 
-  test('When canDeleteDataFrameAnalytics permission is true, button should not be disabled.', () => {
-    const mock = jest.spyOn(CheckPrivilige, 'checkPermission');
-    mock.mockImplementation((p) => p === 'canDeleteDataFrameAnalytics');
+  test('When isDisabled prop is true, inner button should not be disabled.', () => {
     const { getByTestId } = render(
-      <DeleteButton item={mockAnalyticsListItem} onClick={() => {}} />
+      <DeleteButton isDisabled={false} item={mockAnalyticsListItem} onClick={() => {}} />
     );
 
     expect(getByTestId('mlAnalyticsJobDeleteButton')).not.toHaveAttribute('disabled');
-
-    mock.mockRestore();
-  });
-
-  test('When job is running, delete button should be disabled.', () => {
-    const { getByTestId } = render(
-      <DeleteButton
-        item={{
-          ...mockAnalyticsListItem,
-          stats: { state: 'started' },
-        }}
-        onClick={() => {}}
-      />
-    );
-
-    expect(getByTestId('mlAnalyticsJobDeleteButton')).toHaveAttribute('disabled');
   });
 
   describe('When delete model is open', () => {
@@ -93,7 +76,11 @@ describe('DeleteAction', () => {
         return (
           <>
             {deleteAction.isModalVisible && <DeleteButtonModal {...deleteAction} />}
-            <DeleteButton item={mockAnalyticsListItem} onClick={deleteAction.openModal} />
+            <DeleteButton
+              isDisabled={false}
+              item={mockAnalyticsListItem}
+              onClick={() => deleteAction.openModal(mockAnalyticsListItem)}
+            />
           </>
         );
       };
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_delete/delete_button.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_delete/delete_button.tsx
index 7da3bced48576..c83fb6cbac387 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_delete/delete_button.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_delete/delete_button.tsx
@@ -6,46 +6,42 @@
 
 import React, { FC } from 'react';
 import { i18n } from '@kbn/i18n';
-import { EuiIcon, EuiLink, EuiToolTip } from '@elastic/eui';
-import {
-  checkPermission,
-  createPermissionFailureMessage,
-} from '../../../../../capabilities/check_capabilities';
+import { EuiButtonEmpty, EuiToolTip } from '@elastic/eui';
+import { createPermissionFailureMessage } from '../../../../../capabilities/check_capabilities';
 import { isDataFrameAnalyticsRunning, DataFrameAnalyticsListRow } from '../analytics_list/common';
 
+const buttonText = i18n.translate('xpack.ml.dataframe.analyticsList.deleteActionName', {
+  defaultMessage: 'Delete',
+});
+
 interface DeleteButtonProps {
+  isDisabled: boolean;
   item: DataFrameAnalyticsListRow;
-  onClick: (item: DataFrameAnalyticsListRow) => void;
+  onClick: () => void;
 }
 
-export const DeleteButton: FC<DeleteButtonProps> = ({ item, onClick }) => {
-  const disabled = isDataFrameAnalyticsRunning(item.stats.state);
-  const canDeleteDataFrameAnalytics: boolean = checkPermission('canDeleteDataFrameAnalytics');
-
-  const buttonDeleteText = i18n.translate('xpack.ml.dataframe.analyticsList.deleteActionName', {
-    defaultMessage: 'Delete',
-  });
-
-  const buttonDisabled = disabled || !canDeleteDataFrameAnalytics;
-  let deleteButton = (
-    <EuiLink
+export const DeleteButton: FC<DeleteButtonProps> = ({ isDisabled, item, onClick }) => {
+  const button = (
+    <EuiButtonEmpty
+      aria-label={buttonText}
+      color="text"
       data-test-subj="mlAnalyticsJobDeleteButton"
-      color={buttonDisabled ? 'subdued' : 'text'}
-      disabled={buttonDisabled}
-      onClick={buttonDisabled ? undefined : () => onClick(item)}
-      aria-label={buttonDeleteText}
-      style={{ padding: 0 }}
+      flush="left"
+      iconType="trash"
+      isDisabled={isDisabled}
+      onClick={onClick}
+      size="s"
     >
-      <EuiIcon type="trash" /> {buttonDeleteText}
-    </EuiLink>
+      {buttonText}
+    </EuiButtonEmpty>
   );
 
-  if (disabled || !canDeleteDataFrameAnalytics) {
-    deleteButton = (
+  if (isDisabled) {
+    return (
       <EuiToolTip
         position="top"
         content={
-          disabled
+          isDataFrameAnalyticsRunning(item.stats.state)
             ? i18n.translate(
                 'xpack.ml.dataframe.analyticsList.deleteActionDisabledToolTipContent',
                 {
@@ -55,10 +51,10 @@ export const DeleteButton: FC<DeleteButtonProps> = ({ item, onClick }) => {
             : createPermissionFailureMessage('canStartStopDataFrameAnalytics')
         }
       >
-        {deleteButton}
+        {button}
       </EuiToolTip>
     );
   }
 
-  return deleteButton;
+  return button;
 };
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_edit/edit_button.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_edit/edit_button.tsx
index 0acb215336faf..764b421821ad0 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_edit/edit_button.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_edit/edit_button.tsx
@@ -8,36 +8,34 @@ import React, { FC } from 'react';
 
 import { i18n } from '@kbn/i18n';
 
-import { EuiIcon, EuiLink, EuiToolTip } from '@elastic/eui';
+import { EuiButtonEmpty, EuiToolTip } from '@elastic/eui';
 
-import { checkPermission } from '../../../../../capabilities/check_capabilities';
+const buttonText = i18n.translate('xpack.ml.dataframe.analyticsList.editActionName', {
+  defaultMessage: 'Edit',
+});
 
 interface EditButtonProps {
+  isDisabled: boolean;
   onClick: () => void;
 }
 
-export const EditButton: FC<EditButtonProps> = ({ onClick }) => {
-  const canCreateDataFrameAnalytics: boolean = checkPermission('canCreateDataFrameAnalytics');
-
-  const buttonEditText = i18n.translate('xpack.ml.dataframe.analyticsList.editActionName', {
-    defaultMessage: 'Edit',
-  });
-
-  const buttonDisabled = !canCreateDataFrameAnalytics;
-  const editButton = (
-    <EuiLink
+export const EditButton: FC<EditButtonProps> = ({ isDisabled, onClick }) => {
+  const button = (
+    <EuiButtonEmpty
+      aria-label={buttonText}
+      color="text"
       data-test-subj="mlAnalyticsJobEditButton"
-      color={buttonDisabled ? 'subdued' : 'text'}
-      disabled={buttonDisabled}
-      onClick={buttonDisabled ? undefined : onClick}
-      aria-label={buttonEditText}
-      style={{ padding: 0 }}
+      flush="left"
+      iconType="pencil"
+      isDisabled={isDisabled}
+      onClick={onClick}
+      size="s"
     >
-      <EuiIcon type="pencil" /> {buttonEditText}
-    </EuiLink>
+      {buttonText}
+    </EuiButtonEmpty>
   );
 
-  if (!canCreateDataFrameAnalytics) {
+  if (isDisabled) {
     return (
       <EuiToolTip
         position="top"
@@ -45,10 +43,10 @@ export const EditButton: FC<EditButtonProps> = ({ onClick }) => {
           defaultMessage: 'You do not have permission to edit analytics jobs.',
         })}
       >
-        {editButton}
+        {button}
       </EuiToolTip>
     );
   }
 
-  return editButton;
+  return button;
 };
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_start/start_button.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_start/start_button.tsx
index 279a335de8f42..3192a30f8312e 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_start/start_button.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_start/start_button.tsx
@@ -6,45 +6,46 @@
 
 import React, { FC } from 'react';
 import { i18n } from '@kbn/i18n';
-import { EuiIcon, EuiLink, EuiToolTip } from '@elastic/eui';
+import { EuiButtonEmpty, EuiToolTip } from '@elastic/eui';
 
-import {
-  checkPermission,
-  createPermissionFailureMessage,
-} from '../../../../../capabilities/check_capabilities';
+import { createPermissionFailureMessage } from '../../../../../capabilities/check_capabilities';
 
-import { DataFrameAnalyticsListRow, isCompletedAnalyticsJob } from '../analytics_list/common';
+import { DataFrameAnalyticsListRow } from '../analytics_list/common';
+
+const buttonText = i18n.translate('xpack.ml.dataframe.analyticsList.startActionName', {
+  defaultMessage: 'Start',
+});
 
 interface StartButtonProps {
+  canStartStopDataFrameAnalytics: boolean;
+  isDisabled: boolean;
   item: DataFrameAnalyticsListRow;
-  onClick: (item: DataFrameAnalyticsListRow) => void;
+  onClick: () => void;
 }
 
-export const StartButton: FC<StartButtonProps> = ({ item, onClick }) => {
-  const canStartStopDataFrameAnalytics: boolean = checkPermission('canStartStopDataFrameAnalytics');
-
-  const buttonStartText = i18n.translate('xpack.ml.dataframe.analyticsList.startActionName', {
-    defaultMessage: 'Start',
-  });
-
-  // Disable start for analytics jobs which have completed.
-  const completeAnalytics = isCompletedAnalyticsJob(item.stats);
-
-  const disabled = !canStartStopDataFrameAnalytics || completeAnalytics;
-
-  let startButton = (
-    <EuiLink
-      color={disabled ? 'subdued' : 'text'}
-      onClick={disabled ? undefined : () => onClick(item)}
-      aria-label={buttonStartText}
+export const StartButton: FC<StartButtonProps> = ({
+  canStartStopDataFrameAnalytics,
+  isDisabled,
+  item,
+  onClick,
+}) => {
+  const button = (
+    <EuiButtonEmpty
+      aria-label={buttonText}
+      color="text"
       data-test-subj="mlAnalyticsJobStartButton"
+      flush="left"
+      iconType="play"
+      isDisabled={isDisabled}
+      onClick={onClick}
+      size="s"
     >
-      <EuiIcon type="play" /> {buttonStartText}
-    </EuiLink>
+      {buttonText}
+    </EuiButtonEmpty>
   );
 
-  if (!canStartStopDataFrameAnalytics || completeAnalytics) {
-    startButton = (
+  if (isDisabled) {
+    return (
       <EuiToolTip
         position="top"
         content={
@@ -57,10 +58,10 @@ export const StartButton: FC<StartButtonProps> = ({ item, onClick }) => {
               })
         }
       >
-        {startButton}
+        {button}
       </EuiToolTip>
     );
   }
 
-  return startButton;
+  return button;
 };
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_stop/stop_button.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_stop/stop_button.tsx
index b8395f2f7c2a0..a3e8f16daf5ef 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_stop/stop_button.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_stop/stop_button.tsx
@@ -9,49 +9,46 @@ import { i18n } from '@kbn/i18n';
 
 import { EuiButtonEmpty, EuiToolTip } from '@elastic/eui';
 
-import {
-  checkPermission,
-  createPermissionFailureMessage,
-} from '../../../../../capabilities/check_capabilities';
-
-import { stopAnalytics } from '../../services/analytics_service';
+import { createPermissionFailureMessage } from '../../../../../capabilities/check_capabilities';
 
 import { DataFrameAnalyticsListRow } from '../analytics_list/common';
 
-const buttonStopText = i18n.translate('xpack.ml.dataframe.analyticsList.stopActionName', {
+const buttonText = i18n.translate('xpack.ml.dataframe.analyticsList.stopActionName', {
   defaultMessage: 'Stop',
 });
 
 interface StopButtonProps {
+  isDisabled: boolean;
   item: DataFrameAnalyticsListRow;
+  onClick: () => void;
 }
 
-export const StopButton: FC<StopButtonProps> = ({ item }) => {
-  const canStartStopDataFrameAnalytics: boolean = checkPermission('canStartStopDataFrameAnalytics');
-
-  const stopButton = (
+export const StopButton: FC<StopButtonProps> = ({ isDisabled, item, onClick }) => {
+  const button = (
     <EuiButtonEmpty
-      size="xs"
+      aria-label={buttonText}
       color="text"
-      disabled={!canStartStopDataFrameAnalytics}
-      iconType="stop"
-      onClick={() => stopAnalytics(item)}
-      aria-label={buttonStopText}
       data-test-subj="mlAnalyticsJobStopButton"
+      flush="left"
+      iconType="stop"
+      isDisabled={isDisabled}
+      onClick={onClick}
+      size="s"
     >
-      {buttonStopText}
+      {buttonText}
     </EuiButtonEmpty>
   );
-  if (!canStartStopDataFrameAnalytics) {
+
+  if (isDisabled) {
     return (
       <EuiToolTip
         position="top"
         content={createPermissionFailureMessage('canStartStopDataFrameAnalytics')}
       >
-        {stopButton}
+        {button}
       </EuiToolTip>
     );
   }
 
-  return stopButton;
+  return button;
 };
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_view/view_button.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_view/view_button.tsx
index 17a18c374dfa6..52b2513d13e39 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_view/view_button.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_view/view_button.tsx
@@ -6,7 +6,7 @@
 
 import React, { FC } from 'react';
 import { i18n } from '@kbn/i18n';
-import { EuiButtonEmpty } from '@elastic/eui';
+import { EuiButtonEmpty, EuiToolTip } from '@elastic/eui';
 
 import {
   getAnalysisType,
@@ -31,7 +31,7 @@ export const ViewButton: FC<ViewButtonProps> = ({ item, isManagementTable }) =>
   } = useMlKibana();
 
   const analysisType = getAnalysisType(item.config.analysis);
-  const isDisabled =
+  const buttonDisabled =
     !isRegressionAnalysis(item.config.analysis) &&
     !isOutlierAnalysis(item.config.analysis) &&
     !isClassificationAnalysis(item.config.analysis);
@@ -41,21 +41,38 @@ export const ViewButton: FC<ViewButtonProps> = ({ item, isManagementTable }) =>
     ? () => navigateToApp('ml', { path: url })
     : () => navigateToUrl(url);
 
-  return (
+  const buttonText = i18n.translate('xpack.ml.dataframe.analyticsList.viewActionName', {
+    defaultMessage: 'View',
+  });
+
+  const button = (
     <EuiButtonEmpty
-      isDisabled={isDisabled}
-      onClick={navigator}
-      size="xs"
+      aria-label={buttonText}
       color="text"
-      iconType="visTable"
-      aria-label={i18n.translate('xpack.ml.dataframe.analyticsList.viewAriaLabel', {
-        defaultMessage: 'View',
-      })}
       data-test-subj="mlAnalyticsJobViewButton"
+      flush="left"
+      iconType="visTable"
+      isDisabled={buttonDisabled}
+      onClick={navigator}
+      size="s"
     >
-      {i18n.translate('xpack.ml.dataframe.analyticsList.viewActionName', {
-        defaultMessage: 'View',
-      })}
+      {buttonText}
     </EuiButtonEmpty>
   );
+
+  if (buttonDisabled) {
+    return (
+      <EuiToolTip
+        position="top"
+        content={i18n.translate('xpack.ml.dataframe.analyticsList.viewActionToolTipContent', {
+          defaultMessage:
+            'There is no results page available for this type of data frame analytics job.',
+        })}
+      >
+        {button}
+      </EuiToolTip>
+    );
+  }
+
+  return button;
 };
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/_analytics_table.scss b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/_analytics_table.scss
index 4472e6dbf64f3..f8071c9210f9c 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/_analytics_table.scss
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/_analytics_table.scss
@@ -17,9 +17,6 @@
     animation: none !important;
   }
 }
-.mlAnalyticsProgressBar {
-  margin-bottom: $euiSizeM;
-}
 
 .mlTaskStateBadge, .mlTaskModeBadge {
   max-width: 100px;
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/analytics_list.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/analytics_list.tsx
index 4080f6cd7a77e..7b5c714c236b3 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/analytics_list.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/analytics_list.tsx
@@ -9,17 +9,18 @@ import React, { FC, useState, useEffect } from 'react';
 import { i18n } from '@kbn/i18n';
 
 import {
+  Direction,
   EuiButtonEmpty,
   EuiCallOut,
   EuiEmptyPrompt,
   EuiFlexGroup,
   EuiFlexItem,
+  EuiInMemoryTable,
+  EuiSearchBarProps,
   EuiSpacer,
-  EuiSearchBar,
 } from '@elastic/eui';
 
 import {
-  getAnalysisType,
   DataFrameAnalyticsId,
   useRefreshAnalyticsList,
   ANALYSIS_CONFIG_TYPE,
@@ -31,25 +32,12 @@ import {
   DataFrameAnalyticsListRow,
   ItemIdToExpandedRowMap,
   DATA_FRAME_TASK_STATE,
-  Query,
-  Clause,
-  TermClause,
-  FieldClause,
 } from './common';
 import { getAnalyticsFactory } from '../../services/analytics_service';
 import { getTaskStateBadge, getJobTypeBadge, useColumns } from './use_columns';
 import { ExpandedRow } from './expanded_row';
-import { stringMatch } from '../../../../../util/string_utils';
-import {
-  ProgressBar,
-  mlInMemoryTableFactory,
-  OnTableChangeArg,
-  SortDirection,
-  SORT_DIRECTION,
-} from '../../../../../components/ml_in_memory_table';
 import { AnalyticStatsBarStats, StatsBar } from '../../../../../components/stats_bar';
 import { CreateAnalyticsButton } from '../create_analytics_button';
-import { CreateAnalyticsFormProps } from '../../hooks/use_create_analytics_form';
 import { getSelectedJobIdFromUrl } from '../../../../../jobs/jobs_list/components/utils';
 import { SourceSelection } from '../source_selection';
 
@@ -66,32 +54,26 @@ function getItemIdToExpandedRowMap(
   }, {} as ItemIdToExpandedRowMap);
 }
 
-const MlInMemoryTable = mlInMemoryTableFactory<DataFrameAnalyticsListRow>();
-
 interface Props {
   isManagementTable?: boolean;
   isMlEnabledInSpace?: boolean;
   blockRefresh?: boolean;
-  createAnalyticsForm?: CreateAnalyticsFormProps;
 }
 export const DataFrameAnalyticsList: FC<Props> = ({
   isManagementTable = false,
   isMlEnabledInSpace = true,
   blockRefresh = false,
-  createAnalyticsForm,
 }) => {
   const [isInitialized, setIsInitialized] = useState(false);
   const [isSourceIndexModalVisible, setIsSourceIndexModalVisible] = useState(false);
   const [isLoading, setIsLoading] = useState(false);
-  const [filterActive, setFilterActive] = useState(false);
 
-  const [queryText, setQueryText] = useState('');
+  const [searchQueryText, setSearchQueryText] = useState('');
 
   const [analytics, setAnalytics] = useState<DataFrameAnalyticsListRow[]>([]);
   const [analyticsStats, setAnalyticsStats] = useState<AnalyticStatsBarStats | undefined>(
     undefined
   );
-  const [filteredAnalytics, setFilteredAnalytics] = useState<DataFrameAnalyticsListRow[]>([]);
   const [expandedRowItemIds, setExpandedRowItemIds] = useState<DataFrameAnalyticsId[]>([]);
 
   const [errorMessage, setErrorMessage] = useState<any>(undefined);
@@ -101,9 +83,8 @@ export const DataFrameAnalyticsList: FC<Props> = ({
   const [pageSize, setPageSize] = useState(10);
 
   const [sortField, setSortField] = useState<string>(DataFrameAnalyticsListColumn.id);
-  const [sortDirection, setSortDirection] = useState<SortDirection>(SORT_DIRECTION.ASC);
+  const [sortDirection, setSortDirection] = useState<Direction>('asc');
 
-  const [jobIdSelected, setJobIdSelected] = useState<boolean>(false);
   const disabled =
     !checkPermission('canCreateDataFrameAnalytics') ||
     !checkPermission('canStartStopDataFrameAnalytics');
@@ -117,18 +98,17 @@ export const DataFrameAnalyticsList: FC<Props> = ({
   );
 
   // Query text/job_id based on url but only after getAnalytics is done first
-  // jobIdSelected makes sure the query is only run once since analytics is being refreshed constantly
-  const selectedId = getSelectedJobIdFromUrl(window.location.href);
+  // selectedJobIdFromUrlInitialized makes sure the query is only run once since analytics is being refreshed constantly
+  const [selectedJobIdFromUrlInitialized, setSelectedJobIdFromUrlInitialized] = useState(false);
   useEffect(() => {
-    if (jobIdSelected === false && analytics.length > 0) {
-      if (selectedId !== undefined) {
-        setJobIdSelected(true);
-        setQueryText(selectedId);
-        const selectedIdQuery: Query = EuiSearchBar.Query.parse(selectedId);
-        onQueryChange({ query: selectedIdQuery, error: undefined });
+    if (selectedJobIdFromUrlInitialized === false && analytics.length > 0) {
+      const selectedJobIdFromUrl = getSelectedJobIdFromUrl(window.location.href);
+      if (selectedJobIdFromUrl !== undefined) {
+        setSelectedJobIdFromUrlInitialized(true);
+        setSearchQueryText(selectedJobIdFromUrl);
       }
     }
-  }, [jobIdSelected, analytics]);
+  }, [selectedJobIdFromUrlInitialized, analytics]);
 
   // Subscribe to the refresh observable to trigger reloading the analytics list.
   useRefreshAnalyticsList({
@@ -136,129 +116,36 @@ export const DataFrameAnalyticsList: FC<Props> = ({
     onRefresh: () => getAnalytics(true),
   });
 
-  const onQueryChange = ({ query, error }: { query: Query; error: any }) => {
-    if (error) {
-      setSearchError(error.message);
-    } else {
-      let clauses: Clause[] = [];
-      if (query && query.ast !== undefined && query.ast.clauses !== undefined) {
-        clauses = query.ast.clauses;
-      }
-      if (clauses.length > 0) {
-        setQueryText(query.text);
-        setFilterActive(true);
-        filterAnalytics(clauses as Array<TermClause | FieldClause>);
-      } else {
-        setFilterActive(false);
-      }
-      setSearchError(undefined);
-    }
-  };
-
-  const filterAnalytics = (clauses: Array<TermClause | FieldClause>) => {
-    setIsLoading(true);
-    // keep count of the number of matches we make as we're looping over the clauses
-    // we only want to return analytics which match all clauses, i.e. each search term is ANDed
-    // { analytics-one:  { analytics: { id: analytics-one, config: {}, state: {}, ... }, count: 0 }, analytics-two: {...} }
-    const matches: Record<string, any> = analytics.reduce((p: Record<string, any>, c) => {
-      p[c.id] = {
-        analytics: c,
-        count: 0,
-      };
-      return p;
-    }, {});
-
-    clauses.forEach((c) => {
-      // the search term could be negated with a minus, e.g. -bananas
-      const bool = c.match === 'must';
-      let ts: DataFrameAnalyticsListRow[];
-
-      if (c.type === 'term') {
-        // filter term based clauses, e.g. bananas
-        // match on id and description
-        // if the term has been negated, AND the matches
-        if (bool === true) {
-          ts = analytics.filter(
-            (d) => stringMatch(d.id, c.value) === bool // ||
-            // stringMatch(d.config.description, c.value) === bool
-          );
-        } else {
-          ts = analytics.filter(
-            (d) => stringMatch(d.id, c.value) === bool // &&
-            // stringMatch(d.config.description, c.value) === bool
-          );
-        }
-      } else {
-        // filter other clauses, i.e. the mode and status filters
-        if (Array.isArray(c.value)) {
-          if (c.field === 'job_type') {
-            ts = analytics.filter((d) =>
-              (c.value as string).includes(getAnalysisType(d.config.analysis))
-            );
-          } else {
-            // the status value is an array of string(s) e.g. ['failed', 'stopped']
-            ts = analytics.filter((d) => (c.value as string).includes(d.stats.state));
-          }
-        } else {
-          ts = analytics.filter((d) => d.mode === c.value);
-        }
-      }
-
-      ts.forEach((t) => matches[t.id].count++);
-    });
-
-    // loop through the matches and return only analytics which have match all the clauses
-    const filtered = Object.values(matches)
-      .filter((m) => (m && m.count) >= clauses.length)
-      .map((m) => m.analytics);
-
-    let pageStart = pageIndex * pageSize;
-    if (pageStart >= filtered.length && filtered.length !== 0) {
-      // if the page start is larger than the number of items due to
-      // filters being applied, calculate a new page start
-      pageStart = Math.floor((filtered.length - 1) / pageSize) * pageSize;
-      setPageIndex(pageStart / pageSize);
-    }
-
-    setFilteredAnalytics(filtered);
-    setIsLoading(false);
-  };
-
   const { columns, modals } = useColumns(
     expandedRowItemIds,
     setExpandedRowItemIds,
     isManagementTable,
-    isMlEnabledInSpace,
-    createAnalyticsForm
+    isMlEnabledInSpace
   );
 
   // Before the analytics have been loaded for the first time, display the loading indicator only.
   // Otherwise a user would see 'No data frame analytics found' during the initial loading.
   if (!isInitialized) {
-    return <ProgressBar isLoading={isLoading} />;
+    return null;
   }
 
   if (typeof errorMessage !== 'undefined') {
     return (
-      <>
-        <ProgressBar isLoading={isLoading} />
-        <EuiCallOut
-          title={i18n.translate('xpack.ml.dataFrame.analyticsList.errorPromptTitle', {
-            defaultMessage: 'An error occurred getting the data frame analytics list.',
-          })}
-          color="danger"
-          iconType="alert"
-        >
-          <pre>{JSON.stringify(errorMessage)}</pre>
-        </EuiCallOut>
-      </>
+      <EuiCallOut
+        title={i18n.translate('xpack.ml.dataFrame.analyticsList.errorPromptTitle', {
+          defaultMessage: 'An error occurred getting the data frame analytics list.',
+        })}
+        color="danger"
+        iconType="alert"
+      >
+        <pre>{JSON.stringify(errorMessage)}</pre>
+      </EuiCallOut>
     );
   }
 
   if (analytics.length === 0) {
     return (
       <>
-        <ProgressBar isLoading={isLoading} />
         <EuiEmptyPrompt
           title={
             <h2>
@@ -268,7 +155,7 @@ export const DataFrameAnalyticsList: FC<Props> = ({
             </h2>
           }
           actions={
-            !isManagementTable && createAnalyticsForm
+            !isManagementTable
               ? [
                   <EuiButtonEmpty
                     onClick={() => setIsSourceIndexModalVisible(true)}
@@ -308,9 +195,20 @@ export const DataFrameAnalyticsList: FC<Props> = ({
     hidePerPageOptions: false,
   };
 
-  const search = {
-    query: queryText,
-    onChange: onQueryChange,
+  const handleSearchOnChange: EuiSearchBarProps['onChange'] = (search) => {
+    if (search.error !== null) {
+      setSearchError(search.error.message);
+      return false;
+    }
+
+    setSearchError(undefined);
+    setSearchQueryText(search.queryText);
+    return true;
+  };
+
+  const search: EuiSearchBarProps = {
+    query: searchQueryText,
+    onChange: handleSearchOnChange,
     box: {
       incremental: true,
     },
@@ -330,7 +228,7 @@ export const DataFrameAnalyticsList: FC<Props> = ({
       },
       {
         type: 'field_value_selection',
-        field: 'state.state',
+        field: 'state',
         name: i18n.translate('xpack.ml.dataframe.analyticsList.statusFilter', {
           defaultMessage: 'Status',
         }),
@@ -344,10 +242,10 @@ export const DataFrameAnalyticsList: FC<Props> = ({
     ],
   };
 
-  const onTableChange = ({
+  const onTableChange: EuiInMemoryTable<DataFrameAnalyticsListRow>['onTableChange'] = ({
     page = { index: 0, size: 10 },
-    sort = { field: DataFrameAnalyticsListColumn.id, direction: SORT_DIRECTION.ASC },
-  }: OnTableChangeArg) => {
+    sort = { field: DataFrameAnalyticsListColumn.id, direction: 'asc' },
+  }) => {
     const { index, size } = page;
     setPageIndex(index);
     setPageSize(size);
@@ -370,10 +268,10 @@ export const DataFrameAnalyticsList: FC<Props> = ({
         </EuiFlexItem>
         <EuiFlexItem grow={false}>
           <EuiFlexGroup alignItems="center" gutterSize="s">
-            {!isManagementTable && createAnalyticsForm && (
+            {!isManagementTable && (
               <EuiFlexItem grow={false}>
                 <CreateAnalyticsButton
-                  {...createAnalyticsForm}
+                  isDisabled={disabled}
                   setIsSourceIndexModalVisible={setIsSourceIndexModalVisible}
                 />
               </EuiFlexItem>
@@ -383,7 +281,7 @@ export const DataFrameAnalyticsList: FC<Props> = ({
       </EuiFlexGroup>
       <EuiSpacer size="m" />
       <div data-test-subj="mlAnalyticsTableContainer">
-        <MlInMemoryTable
+        <EuiInMemoryTable
           allowNeutralSort={false}
           className="mlAnalyticsTable"
           columns={columns}
@@ -391,9 +289,10 @@ export const DataFrameAnalyticsList: FC<Props> = ({
           hasActions={false}
           isExpandable={true}
           isSelectable={false}
-          items={filterActive ? filteredAnalytics : analytics}
+          items={analytics}
           itemId={DataFrameAnalyticsListColumn.id}
           itemIdToExpandedRowMap={itemIdToExpandedRowMap}
+          loading={isLoading}
           onTableChange={onTableChange}
           pagination={pagination}
           sorting={sorting}
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/common.ts b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/common.ts
index 5998c62eeacea..e2d9ecccf0626 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/common.ts
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/common.ts
@@ -9,7 +9,11 @@ import { Query, Ast } from '@elastic/eui';
 import { DATA_FRAME_TASK_STATE } from './data_frame_task_state';
 export { DATA_FRAME_TASK_STATE };
 
-import { DataFrameAnalyticsId, DataFrameAnalyticsConfig } from '../../../../common';
+import {
+  DataFrameAnalyticsId,
+  DataFrameAnalyticsConfig,
+  ANALYSIS_CONFIG_TYPE,
+} from '../../../../common';
 
 export enum DATA_FRAME_MODE {
   BATCH = 'batch',
@@ -98,10 +102,15 @@ export function getDataFrameAnalyticsProgressPhase(
 }
 
 export interface DataFrameAnalyticsListRow {
-  id: DataFrameAnalyticsId;
   checkpointing: object;
   config: DataFrameAnalyticsConfig;
+  id: DataFrameAnalyticsId;
+  job_type:
+    | ANALYSIS_CONFIG_TYPE.CLASSIFICATION
+    | ANALYSIS_CONFIG_TYPE.OUTLIER_DETECTION
+    | ANALYSIS_CONFIG_TYPE.REGRESSION;
   mode: string;
+  state: DataFrameAnalyticsStats['state'];
   stats: DataFrameAnalyticsStats;
 }
 
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/use_actions.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/use_actions.tsx
index cb46a88fa3b21..bc02c81bac0f0 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/use_actions.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/use_actions.tsx
@@ -8,8 +8,11 @@ import React from 'react';
 
 import { EuiTableActionsColumnType } from '@elastic/eui';
 
-import { CreateAnalyticsFormProps } from '../../hooks/use_create_analytics_form';
-import { CloneButton } from '../action_clone';
+import { checkPermission } from '../../../../../capabilities/check_capabilities';
+
+import { stopAnalytics } from '../../services/analytics_service';
+
+import { useNavigateToWizardWithClonedJob, CloneButton } from '../action_clone';
 import { useDeleteAction, DeleteButton, DeleteButtonModal } from '../action_delete';
 import {
   isEditActionFlyoutVisible,
@@ -21,15 +24,22 @@ import { useStartAction, StartButton, StartButtonModal } from '../action_start';
 import { StopButton } from '../action_stop';
 import { getViewAction } from '../action_view';
 
-import { isDataFrameAnalyticsRunning, DataFrameAnalyticsListRow } from './common';
+import {
+  isCompletedAnalyticsJob,
+  isDataFrameAnalyticsRunning,
+  DataFrameAnalyticsListRow,
+} from './common';
 
 export const useActions = (
-  createAnalyticsForm: CreateAnalyticsFormProps,
   isManagementTable: boolean
 ): {
   actions: EuiTableActionsColumnType<DataFrameAnalyticsListRow>['actions'];
   modals: JSX.Element | null;
 } => {
+  const canCreateDataFrameAnalytics: boolean = checkPermission('canCreateDataFrameAnalytics');
+  const canDeleteDataFrameAnalytics: boolean = checkPermission('canDeleteDataFrameAnalytics');
+  const canStartStopDataFrameAnalytics: boolean = checkPermission('canStartStopDataFrameAnalytics');
+
   let modals: JSX.Element | null = null;
 
   const actions: EuiTableActionsColumnType<DataFrameAnalyticsListRow>['actions'] = [
@@ -52,29 +62,93 @@ export const useActions = (
         {isEditActionFlyoutVisible(editAction) && <EditButtonFlyout {...editAction} />}
       </>
     );
+
+    const startButtonEnabled = (item: DataFrameAnalyticsListRow) => {
+      if (!isDataFrameAnalyticsRunning(item.stats.state)) {
+        // Disable start for analytics jobs which have completed.
+        const completeAnalytics = isCompletedAnalyticsJob(item.stats);
+        return canStartStopDataFrameAnalytics && !completeAnalytics;
+      }
+      return canStartStopDataFrameAnalytics;
+    };
+
+    const navigateToWizardWithClonedJob = useNavigateToWizardWithClonedJob();
+
     actions.push(
       ...[
         {
           render: (item: DataFrameAnalyticsListRow) => {
             if (!isDataFrameAnalyticsRunning(item.stats.state)) {
-              return <StartButton item={item} onClick={startAction.openModal} />;
+              return (
+                <StartButton
+                  canStartStopDataFrameAnalytics={canStartStopDataFrameAnalytics}
+                  isDisabled={!startButtonEnabled(item)}
+                  item={item}
+                  onClick={() => {
+                    if (startButtonEnabled(item)) {
+                      startAction.openModal(item);
+                    }
+                  }}
+                />
+              );
             }
-            return <StopButton item={item} />;
+
+            return (
+              <StopButton
+                isDisabled={!canStartStopDataFrameAnalytics}
+                item={item}
+                onClick={() => {
+                  if (canStartStopDataFrameAnalytics) {
+                    stopAnalytics(item);
+                  }
+                }}
+              />
+            );
           },
         },
         {
           render: (item: DataFrameAnalyticsListRow) => {
-            return <EditButton onClick={() => editAction.openFlyout(item)} />;
+            return (
+              <EditButton
+                isDisabled={!canStartStopDataFrameAnalytics}
+                onClick={() => {
+                  if (canStartStopDataFrameAnalytics) {
+                    editAction.openFlyout(item);
+                  }
+                }}
+              />
+            );
           },
         },
         {
           render: (item: DataFrameAnalyticsListRow) => {
-            return <DeleteButton item={item} onClick={deleteAction.openModal} />;
+            return (
+              <DeleteButton
+                isDisabled={
+                  isDataFrameAnalyticsRunning(item.stats.state) || !canDeleteDataFrameAnalytics
+                }
+                item={item}
+                onClick={() => {
+                  if (canStartStopDataFrameAnalytics) {
+                    deleteAction.openModal(item);
+                  }
+                }}
+              />
+            );
           },
         },
         {
           render: (item: DataFrameAnalyticsListRow) => {
-            return <CloneButton item={item} createAnalyticsForm={createAnalyticsForm} />;
+            return (
+              <CloneButton
+                isDisabled={!canCreateDataFrameAnalytics}
+                onClick={() => {
+                  if (canCreateDataFrameAnalytics) {
+                    navigateToWizardWithClonedJob(item);
+                  }
+                }}
+              />
+            );
           },
         },
       ]
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/use_columns.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/use_columns.tsx
index fa88396461cd7..123fdada44866 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/use_columns.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/analytics_list/use_columns.tsx
@@ -22,7 +22,6 @@ import {
 import { getJobIdUrl } from '../../../../../util/get_job_id_url';
 
 import { getAnalysisType, DataFrameAnalyticsId } from '../../../../common';
-import { CreateAnalyticsFormProps } from '../../hooks/use_create_analytics_form';
 import {
   getDataFrameAnalyticsProgress,
   getDataFrameAnalyticsProgressPhase,
@@ -145,10 +144,9 @@ export const useColumns = (
   expandedRowItemIds: DataFrameAnalyticsId[],
   setExpandedRowItemIds: React.Dispatch<React.SetStateAction<DataFrameAnalyticsId[]>>,
   isManagementTable: boolean = false,
-  isMlEnabledInSpace: boolean = true,
-  createAnalyticsForm?: CreateAnalyticsFormProps
+  isMlEnabledInSpace: boolean = true
 ) => {
-  const { actions, modals } = useActions(createAnalyticsForm!, isManagementTable);
+  const { actions, modals } = useActions(isManagementTable);
 
   function toggleDetails(item: DataFrameAnalyticsListRow) {
     const index = expandedRowItemIds.indexOf(item.config.id);
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/create_analytics_button/create_analytics_button.test.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/create_analytics_button/create_analytics_button.test.tsx
index b438a3f006c6c..0597f377d2710 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/create_analytics_button/create_analytics_button.test.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/create_analytics_button/create_analytics_button.test.tsx
@@ -6,37 +6,15 @@
 
 import { mount } from 'enzyme';
 import React from 'react';
-import { mountHook } from 'test_utils/enzyme_helpers';
 
 import { CreateAnalyticsButton } from './create_analytics_button';
 
-import { MlContext } from '../../../../../contexts/ml';
-import { kibanaContextValueMock } from '../../../../../contexts/ml/__mocks__/kibana_context_value';
-
-import { useCreateAnalyticsForm } from '../../hooks/use_create_analytics_form';
-
-const getMountedHook = () =>
-  mountHook(
-    () => useCreateAnalyticsForm(),
-    ({ children }) => (
-      <MlContext.Provider value={kibanaContextValueMock}>{children}</MlContext.Provider>
-    )
-  );
-
-// workaround to make React.memo() work with enzyme
-jest.mock('react', () => {
-  const r = jest.requireActual('react');
-  return { ...r, memo: (x: any) => x };
-});
-
 jest.mock('../../../../../../../shared_imports');
 
 describe('Data Frame Analytics: <CreateAnalyticsButton />', () => {
   test('Minimal initialization', () => {
-    const { getLastHookValue } = getMountedHook();
-    const props = getLastHookValue();
     const wrapper = mount(
-      <CreateAnalyticsButton {...props} setIsSourceIndexModalVisible={jest.fn()} />
+      <CreateAnalyticsButton isDisabled={false} setIsSourceIndexModalVisible={jest.fn()} />
     );
 
     expect(wrapper.find('EuiButton').text()).toBe('Create job');
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/create_analytics_button/create_analytics_button.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/create_analytics_button/create_analytics_button.tsx
index c7c33787c37bc..e05684b23167c 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/create_analytics_button/create_analytics_button.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/create_analytics_button/create_analytics_button.tsx
@@ -8,26 +8,20 @@ import React, { FC } from 'react';
 import { EuiButton, EuiToolTip } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { createPermissionFailureMessage } from '../../../../../capabilities/check_capabilities';
-import { CreateAnalyticsFormProps } from '../../hooks/use_create_analytics_form';
 
-interface Props extends CreateAnalyticsFormProps {
+interface Props {
+  isDisabled: boolean;
   setIsSourceIndexModalVisible: React.Dispatch<React.SetStateAction<any>>;
 }
 
-export const CreateAnalyticsButton: FC<Props> = ({
-  state,
-  actions,
-  setIsSourceIndexModalVisible,
-}) => {
-  const { disabled } = state;
-
+export const CreateAnalyticsButton: FC<Props> = ({ isDisabled, setIsSourceIndexModalVisible }) => {
   const handleClick = () => {
     setIsSourceIndexModalVisible(true);
   };
 
   const button = (
     <EuiButton
-      disabled={disabled}
+      disabled={isDisabled}
       fill
       onClick={handleClick}
       iconType="plusInCircle"
@@ -40,7 +34,7 @@ export const CreateAnalyticsButton: FC<Props> = ({
     </EuiButton>
   );
 
-  if (disabled) {
+  if (isDisabled) {
     return (
       <EuiToolTip
         position="top"
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/page.tsx b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/page.tsx
index 07442124959d0..1e83e6c7d0e03 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/page.tsx
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/page.tsx
@@ -26,7 +26,6 @@ import { DatePickerWrapper } from '../../../components/navigation_menu/date_pick
 import { DataFrameAnalyticsList } from './components/analytics_list';
 import { useRefreshInterval } from './components/analytics_list/use_refresh_interval';
 import { RefreshAnalyticsListButton } from './components/refresh_analytics_list_button';
-import { useCreateAnalyticsForm } from './hooks/use_create_analytics_form';
 import { NodeAvailableWarning } from '../../../components/node_available_warning';
 import { UpgradeWarning } from '../../../components/upgrade';
 
@@ -35,8 +34,6 @@ export const Page: FC = () => {
 
   useRefreshInterval(setBlockRefresh);
 
-  const createAnalyticsForm = useCreateAnalyticsForm();
-
   return (
     <Fragment>
       <NavigationMenu tabId="data_frame_analytics" />
@@ -84,10 +81,7 @@ export const Page: FC = () => {
           <UpgradeWarning />
 
           <EuiPageContent>
-            <DataFrameAnalyticsList
-              blockRefresh={blockRefresh}
-              createAnalyticsForm={createAnalyticsForm}
-            />
+            <DataFrameAnalyticsList blockRefresh={blockRefresh} />
           </EuiPageContent>
         </EuiPageBody>
       </EuiPage>
diff --git a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/services/analytics_service/get_analytics.ts b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/services/analytics_service/get_analytics.ts
index 964e8e4062b38..41f3bab8113f0 100644
--- a/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/services/analytics_service/get_analytics.ts
+++ b/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/services/analytics_service/get_analytics.ts
@@ -10,7 +10,11 @@ import {
   GetDataFrameAnalyticsStatsResponseError,
   GetDataFrameAnalyticsStatsResponseOk,
 } from '../../../../../services/ml_api_service/data_frame_analytics';
-import { REFRESH_ANALYTICS_LIST_STATE, refreshAnalyticsList$ } from '../../../../common';
+import {
+  ANALYSIS_CONFIG_TYPE,
+  REFRESH_ANALYTICS_LIST_STATE,
+  refreshAnalyticsList$,
+} from '../../../../common';
 
 import {
   DATA_FRAME_MODE,
@@ -136,10 +140,12 @@ export const getAnalyticsFactory = (
 
             // Table with expandable rows requires `id` on the outer most level
             reducedtableRows.push({
+              checkpointing: {},
               config,
               id: config.id,
-              checkpointing: {},
+              job_type: Object.keys(config.analysis)[0] as ANALYSIS_CONFIG_TYPE,
               mode: DATA_FRAME_MODE.BATCH,
+              state: stats.state,
               stats,
             });
             return reducedtableRows;
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/utils/new_job_utils.test.ts b/x-pack/plugins/ml/public/application/jobs/new_job/utils/new_job_utils.test.ts
new file mode 100644
index 0000000000000..b7c29abc96fb8
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/utils/new_job_utils.test.ts
@@ -0,0 +1,209 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IUiSettingsClient } from 'kibana/public';
+import { IIndexPattern } from '../../../../../../../../src/plugins/data/common/index_patterns';
+import { SavedSearchSavedObject } from '../../../../../common/types/kibana';
+import { createSearchItems } from './new_job_utils';
+
+describe('createSearchItems', () => {
+  const kibanaConfig = {} as IUiSettingsClient;
+  const indexPattern = ({
+    fields: [],
+  } as unknown) as IIndexPattern;
+
+  let savedSearch = ({} as unknown) as SavedSearchSavedObject;
+  beforeEach(() => {
+    savedSearch = ({
+      client: {
+        http: {
+          basePath: {
+            basePath: '/abc',
+            serverBasePath: '/abc',
+          },
+          anonymousPaths: {},
+        },
+        batchQueue: [],
+      },
+      attributes: {
+        title: 'not test',
+        description: '',
+        hits: 0,
+        columns: ['_source'],
+        sort: [],
+        version: 1,
+        kibanaSavedObjectMeta: {
+          searchSourceJSON: '',
+        },
+      },
+      _version: 'WzI0OSw0XQ==',
+      id: '4b9b1010-c678-11ea-b6e6-e942978da29c',
+      type: 'search',
+      migrationVersion: {
+        search: '7.4.0',
+      },
+      references: [
+        {
+          name: 'kibanaSavedObjectMeta.searchSourceJSON.index',
+          type: 'index-pattern',
+          id: '7e252840-bd27-11ea-8a6c-75d1a0bd08ab',
+        },
+      ],
+    } as unknown) as SavedSearchSavedObject;
+  });
+
+  test('should match index pattern', () => {
+    const resp = createSearchItems(kibanaConfig, indexPattern, null);
+    expect(resp).toStrictEqual({
+      combinedQuery: { bool: { must: [{ match_all: {} }] } },
+      query: { query: '', language: 'lucene' },
+    });
+  });
+
+  test('should match saved search with kuery and condition', () => {
+    const searchSource = {
+      highlightAll: true,
+      version: true,
+      query: { query: 'airline : "AAL" ', language: 'kuery' },
+      filter: [],
+      indexRefName: 'kibanaSavedObjectMeta.searchSourceJSON.index',
+    };
+    savedSearch.attributes.kibanaSavedObjectMeta.searchSourceJSON = JSON.stringify(searchSource);
+
+    const resp = createSearchItems(kibanaConfig, indexPattern, savedSearch);
+    expect(resp).toStrictEqual({
+      combinedQuery: {
+        bool: {
+          should: [{ match_phrase: { airline: 'AAL' } }],
+          minimum_should_match: 1,
+          filter: [],
+          must_not: [],
+        },
+      },
+      query: {
+        language: 'kuery',
+        query: 'airline : "AAL" ',
+      },
+    });
+  });
+
+  test('should match saved search with kuery and not condition', () => {
+    const searchSource = {
+      highlightAll: true,
+      version: true,
+      query: { query: 'NOT airline : "AAL" ', language: 'kuery' },
+      filter: [],
+      indexRefName: 'kibanaSavedObjectMeta.searchSourceJSON.index',
+    };
+    savedSearch.attributes.kibanaSavedObjectMeta.searchSourceJSON = JSON.stringify(searchSource);
+
+    const resp = createSearchItems(kibanaConfig, indexPattern, savedSearch);
+    expect(resp).toStrictEqual({
+      combinedQuery: {
+        bool: {
+          filter: [],
+          must_not: [
+            {
+              bool: {
+                minimum_should_match: 1,
+                should: [
+                  {
+                    match_phrase: {
+                      airline: 'AAL',
+                    },
+                  },
+                ],
+              },
+            },
+          ],
+        },
+      },
+      query: {
+        language: 'kuery',
+        query: 'NOT airline : "AAL" ',
+      },
+    });
+  });
+
+  test('should match saved search with kuery and condition and not condition', () => {
+    const searchSource = {
+      highlightAll: true,
+      version: true,
+      query: { query: 'airline : "AAL" and NOT airline : "AWE" ', language: 'kuery' },
+      filter: [],
+      indexRefName: 'kibanaSavedObjectMeta.searchSourceJSON.index',
+    };
+    savedSearch.attributes.kibanaSavedObjectMeta.searchSourceJSON = JSON.stringify(searchSource);
+
+    const resp = createSearchItems(kibanaConfig, indexPattern, savedSearch);
+    expect(resp).toStrictEqual({
+      combinedQuery: {
+        bool: {
+          filter: [
+            { bool: { should: [{ match_phrase: { airline: 'AAL' } }], minimum_should_match: 1 } },
+            {
+              bool: {
+                must_not: {
+                  bool: { should: [{ match_phrase: { airline: 'AWE' } }], minimum_should_match: 1 },
+                },
+              },
+            },
+          ],
+          must_not: [],
+        },
+      },
+      query: { query: 'airline : "AAL" and NOT airline : "AWE" ', language: 'kuery' },
+    });
+  });
+
+  test('should match saved search with kuery and filter', () => {
+    const searchSource = {
+      highlightAll: true,
+      version: true,
+      query: {
+        language: 'kuery',
+        query: '',
+      },
+      filter: [
+        {
+          meta: {
+            alias: null,
+            negate: false,
+            disabled: false,
+            type: 'phrase',
+            key: 'airline',
+            params: {
+              query: 'AAL',
+            },
+            indexRefName: 'kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index',
+          },
+          query: {
+            match_phrase: {
+              airline: 'AAL',
+            },
+          },
+          $state: {
+            store: 'appState',
+          },
+        },
+      ],
+      indexRefName: 'kibanaSavedObjectMeta.searchSourceJSON.index',
+    };
+    savedSearch.attributes.kibanaSavedObjectMeta.searchSourceJSON = JSON.stringify(searchSource);
+
+    const resp = createSearchItems(kibanaConfig, indexPattern, savedSearch);
+    expect(resp).toStrictEqual({
+      combinedQuery: {
+        bool: {
+          must: [{ match_all: {} }],
+          filter: [{ match_phrase: { airline: 'AAL' } }],
+          must_not: [],
+        },
+      },
+      query: { language: 'kuery', query: '' },
+    });
+  });
+});
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/utils/new_job_utils.ts b/x-pack/plugins/ml/public/application/jobs/new_job/utils/new_job_utils.ts
index 9ba10dc21000e..5fa6c817ec4c1 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/utils/new_job_utils.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/utils/new_job_utils.ts
@@ -52,12 +52,16 @@ export function createSearchItems(
       }
       const filterQuery = esQuery.buildQueryFromFilters(filters, indexPattern);
 
-      if (combinedQuery.bool.filter === undefined) {
-        combinedQuery.bool.filter = [];
+      if (Array.isArray(combinedQuery.bool.filter) === false) {
+        combinedQuery.bool.filter =
+          combinedQuery.bool.filter === undefined ? [] : [combinedQuery.bool.filter];
       }
-      if (combinedQuery.bool.must_not === undefined) {
-        combinedQuery.bool.must_not = [];
+
+      if (Array.isArray(combinedQuery.bool.must_not) === false) {
+        combinedQuery.bool.must_not =
+          combinedQuery.bool.must_not === undefined ? [] : [combinedQuery.bool.must_not];
       }
+
       combinedQuery.bool.filter = [...combinedQuery.bool.filter, ...filterQuery.filter];
       combinedQuery.bool.must_not = [...combinedQuery.bool.must_not, ...filterQuery.must_not];
     } else {
diff --git a/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/_analytics_table.scss b/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/_analytics_table.scss
index 1151599a526e4..f134c467e11b2 100644
--- a/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/_analytics_table.scss
+++ b/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/_analytics_table.scss
@@ -19,10 +19,6 @@
   }
 }
 
-.mlAnalyticsProgressBar {
-  margin-bottom: $euiSizeM;
-}
-
 .mlTaskStateBadge {
   max-width: 100px;
 }
diff --git a/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/jobs_list_page.tsx b/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/jobs_list_page.tsx
index e3c45c6cd0b04..33bb78c51e013 100644
--- a/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/jobs_list_page.tsx
+++ b/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/jobs_list_page.tsx
@@ -27,6 +27,7 @@ import { getDocLinks } from '../../../../util/dependency_cache';
 // @ts-ignore undeclared module
 import { JobsListView } from '../../../../jobs/jobs_list/components/jobs_list_view/index';
 import { DataFrameAnalyticsList } from '../../../../data_frame_analytics/pages/analytics_management/components/analytics_list';
+import { AccessDeniedPage } from '../access_denied_page';
 
 interface Tab {
   id: string;
@@ -68,6 +69,7 @@ function getTabs(isMlEnabledInSpace: boolean): Tab[] {
 
 export const JobsListPage: FC<{ coreStart: CoreStart }> = ({ coreStart }) => {
   const [initialized, setInitialized] = useState(false);
+  const [accessDenied, setAccessDenied] = useState(false);
   const [isMlEnabledInSpace, setIsMlEnabledInSpace] = useState(false);
   const tabs = getTabs(isMlEnabledInSpace);
   const [currentTabId, setCurrentTabId] = useState(tabs[0].id);
@@ -76,12 +78,11 @@ export const JobsListPage: FC<{ coreStart: CoreStart }> = ({ coreStart }) => {
   const check = async () => {
     try {
       const checkPrivilege = await checkGetManagementMlJobsResolver();
-      setInitialized(true);
       setIsMlEnabledInSpace(checkPrivilege.mlFeatureEnabledInSpace);
     } catch (e) {
-      // Silent fail, `checkGetManagementMlJobs()` should redirect when
-      // there are insufficient permissions.
+      setAccessDenied(true);
     }
+    setInitialized(true);
   };
 
   useEffect(() => {
@@ -120,6 +121,10 @@ export const JobsListPage: FC<{ coreStart: CoreStart }> = ({ coreStart }) => {
     );
   }
 
+  if (accessDenied) {
+    return <AccessDeniedPage />;
+  }
+
   return (
     <I18nContext>
       <KibanaContextProvider services={{ ...coreStart }}>
diff --git a/x-pack/plugins/ml/public/application/management/management_urls.ts b/x-pack/plugins/ml/public/application/management/management_urls.ts
index f346940e91ed0..1a83fd2fb4d42 100644
--- a/x-pack/plugins/ml/public/application/management/management_urls.ts
+++ b/x-pack/plugins/ml/public/application/management/management_urls.ts
@@ -9,4 +9,3 @@ type Path = string;
 export const MANAGEMENT_PATH: Path = '/management';
 export const ML_PATH: Path = `${MANAGEMENT_PATH}/ml`;
 export const JOBS_LIST_PATH: Path = `${ML_PATH}/jobs_list`;
-export const ACCESS_DENIED_PATH: Path = `${ML_PATH}/access_denied`;
diff --git a/x-pack/plugins/ml/public/application/overview/components/analytics_panel/table.tsx b/x-pack/plugins/ml/public/application/overview/components/analytics_panel/table.tsx
index 1eeff6287867d..b28729dcf157f 100644
--- a/x-pack/plugins/ml/public/application/overview/components/analytics_panel/table.tsx
+++ b/x-pack/plugins/ml/public/application/overview/components/analytics_panel/table.tsx
@@ -5,15 +5,15 @@
  */
 
 import React, { FC, useState } from 'react';
-import { EuiBadge } from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
 import {
-  mlInMemoryTableFactory,
-  SortDirection,
-  SORT_DIRECTION,
-  OnTableChangeArg,
-  ColumnType,
-} from '../../../components/ml_in_memory_table';
+  Direction,
+  EuiBadge,
+  EuiInMemoryTable,
+  EuiTableActionsColumnType,
+  EuiTableComputedColumnType,
+  EuiTableFieldDataColumnType,
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
 import { getAnalysisType } from '../../../data_frame_analytics/common/analytics';
 import {
   DataFrameAnalyticsListColumn,
@@ -26,7 +26,14 @@ import {
 import { getViewAction } from '../../../data_frame_analytics/pages/analytics_management/components/action_view';
 import { formatHumanReadableDateTimeSeconds } from '../../../util/date_utils';
 
-const MlInMemoryTable = mlInMemoryTableFactory<DataFrameAnalyticsListRow>();
+type DataFrameAnalyticsTableColumns = [
+  EuiTableFieldDataColumnType<DataFrameAnalyticsListRow>,
+  EuiTableComputedColumnType<DataFrameAnalyticsListRow>,
+  EuiTableComputedColumnType<DataFrameAnalyticsListRow>,
+  EuiTableComputedColumnType<DataFrameAnalyticsListRow>,
+  EuiTableFieldDataColumnType<DataFrameAnalyticsListRow>,
+  EuiTableActionsColumnType<DataFrameAnalyticsListRow>
+];
 
 interface Props {
   items: DataFrameAnalyticsListRow[];
@@ -36,10 +43,10 @@ export const AnalyticsTable: FC<Props> = ({ items }) => {
   const [pageSize, setPageSize] = useState(10);
 
   const [sortField, setSortField] = useState<string>(DataFrameAnalyticsListColumn.id);
-  const [sortDirection, setSortDirection] = useState<SortDirection>(SORT_DIRECTION.ASC);
+  const [sortDirection, setSortDirection] = useState<Direction>('asc');
 
   // id, type, status, progress, created time, view icon
-  const columns: Array<ColumnType<DataFrameAnalyticsListRow>> = [
+  const columns: DataFrameAnalyticsTableColumns = [
     {
       field: DataFrameAnalyticsListColumn.id,
       name: i18n.translate('xpack.ml.overview.analyticsList.id', { defaultMessage: 'ID' }),
@@ -87,10 +94,10 @@ export const AnalyticsTable: FC<Props> = ({ items }) => {
     },
   ];
 
-  const onTableChange = ({
+  const onTableChange: EuiInMemoryTable<DataFrameAnalyticsListRow>['onTableChange'] = ({
     page = { index: 0, size: 10 },
-    sort = { field: DataFrameAnalyticsListColumn.id, direction: SORT_DIRECTION.ASC },
-  }: OnTableChangeArg) => {
+    sort = { field: DataFrameAnalyticsListColumn.id, direction: 'asc' },
+  }) => {
     const { index, size } = page;
     setPageIndex(index);
     setPageSize(size);
@@ -116,7 +123,7 @@ export const AnalyticsTable: FC<Props> = ({ items }) => {
   };
 
   return (
-    <MlInMemoryTable
+    <EuiInMemoryTable
       allowNeutralSort={false}
       className="mlAnalyticsTable"
       columns={columns}
diff --git a/x-pack/plugins/ml/public/application/overview/components/anomaly_detection_panel/table.tsx b/x-pack/plugins/ml/public/application/overview/components/anomaly_detection_panel/table.tsx
index cd45721d54a68..945116b0534bb 100644
--- a/x-pack/plugins/ml/public/application/overview/components/anomaly_detection_panel/table.tsx
+++ b/x-pack/plugins/ml/public/application/overview/components/anomaly_detection_panel/table.tsx
@@ -6,23 +6,20 @@
 
 import React, { FC, Fragment, useState } from 'react';
 import {
+  Direction,
   EuiFlexGroup,
   EuiFlexItem,
   EuiHealth,
   EuiIcon,
+  EuiInMemoryTable,
   EuiLoadingSpinner,
   EuiSpacer,
+  EuiTableComputedColumnType,
+  EuiTableFieldDataColumnType,
   EuiText,
   EuiToolTip,
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
-import {
-  mlInMemoryTableFactory,
-  SortDirection,
-  SORT_DIRECTION,
-  OnTableChangeArg,
-  ColumnType,
-} from '../../../components/ml_in_memory_table';
 import { formatHumanReadableDateTimeSeconds } from '../../../util/date_utils';
 import { ExplorerLink } from './actions';
 import { getJobsFromGroup } from './utils';
@@ -34,8 +31,6 @@ import { JobSelectorBadge } from '../../../components/job_selector/job_selector_
 import { toLocaleString } from '../../../util/string_utils';
 import { getSeverityColor } from '../../../../../common/util/anomaly_utils';
 
-const MlInMemoryTable = mlInMemoryTableFactory<Group>();
-
 // Used to pass on attribute names to table columns
 export enum AnomalyDetectionListColumns {
   id = 'id',
@@ -46,6 +41,15 @@ export enum AnomalyDetectionListColumns {
   jobsInGroup = 'jobs_in_group',
 }
 
+type AnomalyDetectionTableColumns = [
+  EuiTableFieldDataColumnType<Group>,
+  EuiTableFieldDataColumnType<Group>,
+  EuiTableFieldDataColumnType<Group>,
+  EuiTableFieldDataColumnType<Group>,
+  EuiTableFieldDataColumnType<Group>,
+  EuiTableComputedColumnType<Group>
+];
+
 interface Props {
   items: GroupsDictionary;
   statsBarData: JobStatsBarStats;
@@ -58,10 +62,10 @@ export const AnomalyDetectionTable: FC<Props> = ({ items, jobsList, statsBarData
   const [pageSize, setPageSize] = useState(10);
 
   const [sortField, setSortField] = useState<string>(AnomalyDetectionListColumns.id);
-  const [sortDirection, setSortDirection] = useState<SortDirection>(SORT_DIRECTION.ASC);
+  const [sortDirection, setSortDirection] = useState<Direction>('asc');
 
   // columns: group, max anomaly, jobs in group, latest timestamp, docs processed, action to explorer
-  const columns: Array<ColumnType<Group>> = [
+  const columns: AnomalyDetectionTableColumns = [
     {
       field: AnomalyDetectionListColumns.id,
       name: i18n.translate('xpack.ml.overview.anomalyDetection.tableId', {
@@ -169,17 +173,17 @@ export const AnomalyDetectionTable: FC<Props> = ({ items, jobsList, statsBarData
     },
   ];
 
-  const onTableChange = ({
+  const onTableChange: EuiInMemoryTable<Group>['onTableChange'] = ({
     page = { index: 0, size: 10 },
-    sort = { field: AnomalyDetectionListColumns.id, direction: SORT_DIRECTION.ASC },
-  }: OnTableChangeArg) => {
+    sort = { field: AnomalyDetectionListColumns.id, direction: 'asc' },
+  }) => {
     const { index, size } = page;
     setPageIndex(index);
     setPageSize(size);
 
     const { field, direction } = sort;
-    setSortField(field);
-    setSortDirection(direction);
+    setSortField(field as string);
+    setSortDirection(direction as Direction);
   };
 
   const pagination = {
@@ -214,7 +218,7 @@ export const AnomalyDetectionTable: FC<Props> = ({ items, jobsList, statsBarData
         </EuiFlexItem>
       </EuiFlexGroup>
       <EuiSpacer />
-      <MlInMemoryTable
+      <EuiInMemoryTable
         allowNeutralSort={false}
         className="mlAnomalyDetectionTable"
         columns={columns}
diff --git a/x-pack/plugins/monitoring/public/plugin.ts b/x-pack/plugins/monitoring/public/plugin.ts
index 1b9ae75a0968e..cfac5e195a127 100644
--- a/x-pack/plugins/monitoring/public/plugin.ts
+++ b/x-pack/plugins/monitoring/public/plugin.ts
@@ -74,7 +74,7 @@ export class MonitoringPlugin
     const app: App = {
       id,
       title,
-      order: 9002,
+      order: 9030,
       euiIconType: icon,
       category: DEFAULT_APP_CATEGORIES.management,
       mount: async (params: AppMountParameters) => {
diff --git a/x-pack/plugins/observability/public/data_handler.test.ts b/x-pack/plugins/observability/public/data_handler.test.ts
index 7170ffe1486dc..935fc0682c414 100644
--- a/x-pack/plugins/observability/public/data_handler.test.ts
+++ b/x-pack/plugins/observability/public/data_handler.test.ts
@@ -3,8 +3,19 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import { registerDataHandler, getDataHandler } from './data_handler';
+import {
+  registerDataHandler,
+  getDataHandler,
+  unregisterDataHandler,
+  fetchHasData,
+} from './data_handler';
 import moment from 'moment';
+import {
+  ApmFetchDataResponse,
+  LogsFetchDataResponse,
+  MetricsFetchDataResponse,
+  UptimeFetchDataResponse,
+} from './typings';
 
 const params = {
   absoluteTime: {
@@ -19,6 +30,16 @@ const params = {
 };
 
 describe('registerDataHandler', () => {
+  const originalConsole = global.console;
+  beforeAll(() => {
+    // mocks console to avoid poluting the test output
+    global.console = ({ error: jest.fn() } as unknown) as typeof console;
+  });
+
+  afterAll(() => {
+    global.console = originalConsole;
+  });
+
   describe('APM', () => {
     registerDataHandler({
       appName: 'apm',
@@ -369,4 +390,163 @@ describe('registerDataHandler', () => {
       expect(hasData).toBeTruthy();
     });
   });
+  describe('fetchHasData', () => {
+    it('returns false when an exception happens', async () => {
+      unregisterDataHandler({ appName: 'apm' });
+      unregisterDataHandler({ appName: 'infra_logs' });
+      unregisterDataHandler({ appName: 'infra_metrics' });
+      unregisterDataHandler({ appName: 'uptime' });
+
+      registerDataHandler({
+        appName: 'apm',
+        fetchData: async () => (({} as unknown) as ApmFetchDataResponse),
+        hasData: async () => {
+          throw new Error('BOOM');
+        },
+      });
+      registerDataHandler({
+        appName: 'infra_logs',
+        fetchData: async () => (({} as unknown) as LogsFetchDataResponse),
+        hasData: async () => {
+          throw new Error('BOOM');
+        },
+      });
+      registerDataHandler({
+        appName: 'infra_metrics',
+        fetchData: async () => (({} as unknown) as MetricsFetchDataResponse),
+        hasData: async () => {
+          throw new Error('BOOM');
+        },
+      });
+      registerDataHandler({
+        appName: 'uptime',
+        fetchData: async () => (({} as unknown) as UptimeFetchDataResponse),
+        hasData: async () => {
+          throw new Error('BOOM');
+        },
+      });
+      expect(await fetchHasData()).toEqual({
+        apm: false,
+        uptime: false,
+        infra_logs: false,
+        infra_metrics: false,
+      });
+    });
+    it('returns true when has data and false when an exception happens', async () => {
+      unregisterDataHandler({ appName: 'apm' });
+      unregisterDataHandler({ appName: 'infra_logs' });
+      unregisterDataHandler({ appName: 'infra_metrics' });
+      unregisterDataHandler({ appName: 'uptime' });
+
+      registerDataHandler({
+        appName: 'apm',
+        fetchData: async () => (({} as unknown) as ApmFetchDataResponse),
+        hasData: async () => true,
+      });
+      registerDataHandler({
+        appName: 'infra_logs',
+        fetchData: async () => (({} as unknown) as LogsFetchDataResponse),
+        hasData: async () => true,
+      });
+      registerDataHandler({
+        appName: 'infra_metrics',
+        fetchData: async () => (({} as unknown) as MetricsFetchDataResponse),
+        hasData: async () => {
+          throw new Error('BOOM');
+        },
+      });
+      registerDataHandler({
+        appName: 'uptime',
+        fetchData: async () => (({} as unknown) as UptimeFetchDataResponse),
+        hasData: async () => {
+          throw new Error('BOOM');
+        },
+      });
+      expect(await fetchHasData()).toEqual({
+        apm: true,
+        uptime: false,
+        infra_logs: true,
+        infra_metrics: false,
+      });
+    });
+    it('returns true when has data', async () => {
+      unregisterDataHandler({ appName: 'apm' });
+      unregisterDataHandler({ appName: 'infra_logs' });
+      unregisterDataHandler({ appName: 'infra_metrics' });
+      unregisterDataHandler({ appName: 'uptime' });
+
+      registerDataHandler({
+        appName: 'apm',
+        fetchData: async () => (({} as unknown) as ApmFetchDataResponse),
+        hasData: async () => true,
+      });
+      registerDataHandler({
+        appName: 'infra_logs',
+        fetchData: async () => (({} as unknown) as LogsFetchDataResponse),
+        hasData: async () => true,
+      });
+      registerDataHandler({
+        appName: 'infra_metrics',
+        fetchData: async () => (({} as unknown) as MetricsFetchDataResponse),
+        hasData: async () => true,
+      });
+      registerDataHandler({
+        appName: 'uptime',
+        fetchData: async () => (({} as unknown) as UptimeFetchDataResponse),
+        hasData: async () => true,
+      });
+      expect(await fetchHasData()).toEqual({
+        apm: true,
+        uptime: true,
+        infra_logs: true,
+        infra_metrics: true,
+      });
+    });
+    it('returns false when has no data', async () => {
+      unregisterDataHandler({ appName: 'apm' });
+      unregisterDataHandler({ appName: 'infra_logs' });
+      unregisterDataHandler({ appName: 'infra_metrics' });
+      unregisterDataHandler({ appName: 'uptime' });
+
+      registerDataHandler({
+        appName: 'apm',
+        fetchData: async () => (({} as unknown) as ApmFetchDataResponse),
+        hasData: async () => false,
+      });
+      registerDataHandler({
+        appName: 'infra_logs',
+        fetchData: async () => (({} as unknown) as LogsFetchDataResponse),
+        hasData: async () => false,
+      });
+      registerDataHandler({
+        appName: 'infra_metrics',
+        fetchData: async () => (({} as unknown) as MetricsFetchDataResponse),
+        hasData: async () => false,
+      });
+      registerDataHandler({
+        appName: 'uptime',
+        fetchData: async () => (({} as unknown) as UptimeFetchDataResponse),
+        hasData: async () => false,
+      });
+      expect(await fetchHasData()).toEqual({
+        apm: false,
+        uptime: false,
+        infra_logs: false,
+        infra_metrics: false,
+      });
+    });
+    it('returns false when has data was not registered', async () => {
+      unregisterDataHandler({ appName: 'apm' });
+      unregisterDataHandler({ appName: 'infra_logs' });
+      unregisterDataHandler({ appName: 'infra_metrics' });
+      unregisterDataHandler({ appName: 'uptime' });
+
+      expect(await fetchHasData()).toEqual({
+        apm: false,
+        uptime: false,
+        infra_logs: false,
+        infra_metrics: false,
+      });
+    });
+  });
 });
diff --git a/x-pack/plugins/observability/public/data_handler.ts b/x-pack/plugins/observability/public/data_handler.ts
index 73e34f214da28..834d7a52d767f 100644
--- a/x-pack/plugins/observability/public/data_handler.ts
+++ b/x-pack/plugins/observability/public/data_handler.ts
@@ -28,9 +28,27 @@ export function getDataHandler<T extends ObservabilityApp>(appName: T) {
   }
 }
 
-export async function fetchHasData() {
+export async function fetchHasData(): Promise<Record<ObservabilityApp, boolean>> {
   const apps: ObservabilityApp[] = ['apm', 'uptime', 'infra_logs', 'infra_metrics'];
-  const promises = apps.map((app) => getDataHandler(app)?.hasData());
-  const [apm, uptime, logs, metrics] = await Promise.allSettled(promises);
-  return { apm, uptime, infra_logs: logs, infra_metrics: metrics };
+
+  const promises = apps.map(async (app) => getDataHandler(app)?.hasData() || false);
+
+  const results = await Promise.allSettled(promises);
+
+  const [apm, uptime, logs, metrics] = results.map((result) => {
+    if (result.status === 'fulfilled') {
+      return result.value;
+    }
+
+    // eslint-disable-next-line no-console
+    console.error('Error while fetching has data', result.reason);
+    return false;
+  });
+
+  return {
+    apm,
+    uptime,
+    infra_logs: logs,
+    infra_metrics: metrics,
+  };
 }
diff --git a/x-pack/plugins/observability/public/pages/overview/empty_section.ts b/x-pack/plugins/observability/public/pages/overview/empty_section.ts
index e30eda9f3e056..0330ba5cc04b4 100644
--- a/x-pack/plugins/observability/public/pages/overview/empty_section.ts
+++ b/x-pack/plugins/observability/public/pages/overview/empty_section.ts
@@ -22,7 +22,7 @@ export const getEmptySections = ({ core }: { core: AppMountContext['core'] }): I
       linkTitle: i18n.translate('xpack.observability.emptySection.apps.logs.link', {
         defaultMessage: 'Install Filebeat',
       }),
-      href: 'https://www.elastic.co',
+      href: core.http.basePath.prepend('/app/home#/tutorial_directory/logging'),
     },
     {
       id: 'apm',
@@ -35,9 +35,9 @@ export const getEmptySections = ({ core }: { core: AppMountContext['core'] }): I
           'Trace transactions through a distributed architecture and map your services’ interactions to easily spot performance bottlenecks.',
       }),
       linkTitle: i18n.translate('xpack.observability.emptySection.apps.apm.link', {
-        defaultMessage: 'Install agent',
+        defaultMessage: 'Install Agent',
       }),
-      href: 'https://www.elastic.co',
+      href: core.http.basePath.prepend('/app/home#/tutorial/apm'),
     },
     {
       id: 'infra_metrics',
@@ -50,9 +50,9 @@ export const getEmptySections = ({ core }: { core: AppMountContext['core'] }): I
           'Analyze metrics from your infrastructure, apps, and services. Discover trends, forecast behavior, get alerts on anomalies, and more.',
       }),
       linkTitle: i18n.translate('xpack.observability.emptySection.apps.metrics.link', {
-        defaultMessage: 'Install metrics module',
+        defaultMessage: 'Install Metricbeat',
       }),
-      href: 'https://www.elastic.co',
+      href: core.http.basePath.prepend('/app/home#/tutorial_directory/metrics'),
     },
     {
       id: 'uptime',
@@ -67,7 +67,7 @@ export const getEmptySections = ({ core }: { core: AppMountContext['core'] }): I
       linkTitle: i18n.translate('xpack.observability.emptySection.apps.uptime.link', {
         defaultMessage: 'Install Heartbeat',
       }),
-      href: 'https://www.elastic.co',
+      href: core.http.basePath.prepend('/app/home#/tutorial/uptimeMonitors'),
     },
     {
       id: 'alert',
diff --git a/x-pack/plugins/observability/public/pages/overview/overview.stories.tsx b/x-pack/plugins/observability/public/pages/overview/overview.stories.tsx
index 896cad7b72ecd..79f3c63a98051 100644
--- a/x-pack/plugins/observability/public/pages/overview/overview.stories.tsx
+++ b/x-pack/plugins/observability/public/pages/overview/overview.stories.tsx
@@ -495,7 +495,7 @@ storiesOf('app/Overview', module)
       fetchData: fetchApmData,
       // @ts-ignore thows an error instead
       hasData: async () => {
-        new Error('Error has data');
+        throw new Error('Error has data');
       },
     });
     registerDataHandler({
@@ -503,7 +503,7 @@ storiesOf('app/Overview', module)
       fetchData: fetchLogsData,
       // @ts-ignore thows an error instead
       hasData: async () => {
-        new Error('Error has data');
+        throw new Error('Error has data');
       },
     });
     registerDataHandler({
@@ -511,7 +511,7 @@ storiesOf('app/Overview', module)
       fetchData: fetchMetricsData,
       // @ts-ignore thows an error instead
       hasData: async () => {
-        new Error('Error has data');
+        throw new Error('Error has data');
       },
     });
     registerDataHandler({
@@ -519,7 +519,7 @@ storiesOf('app/Overview', module)
       fetchData: fetchUptimeData,
       // @ts-ignore thows an error instead
       hasData: async () => {
-        new Error('Error has data');
+        throw new Error('Error has data');
       },
     });
     return (
@@ -545,7 +545,7 @@ storiesOf('app/Overview', module)
       fetchData: fetchApmData,
       // @ts-ignore thows an error instead
       hasData: async () => {
-        new Error('Error has data');
+        throw new Error('Error has data');
       },
     });
     registerDataHandler({
@@ -553,7 +553,7 @@ storiesOf('app/Overview', module)
       fetchData: fetchLogsData,
       // @ts-ignore thows an error instead
       hasData: async () => {
-        new Error('Error has data');
+        throw new Error('Error has data');
       },
     });
     registerDataHandler({
@@ -561,7 +561,7 @@ storiesOf('app/Overview', module)
       fetchData: fetchMetricsData,
       // @ts-ignore thows an error instead
       hasData: async () => {
-        new Error('Error has data');
+        throw new Error('Error has data');
       },
     });
     registerDataHandler({
@@ -569,7 +569,7 @@ storiesOf('app/Overview', module)
       fetchData: fetchUptimeData,
       // @ts-ignore thows an error instead
       hasData: async () => {
-        new Error('Error has data');
+        throw new Error('Error has data');
       },
     });
     return (
diff --git a/x-pack/plugins/observability/public/services/get_news_feed.test.ts b/x-pack/plugins/observability/public/services/get_news_feed.test.ts
index 49eb2da803ab6..eca0108095b24 100644
--- a/x-pack/plugins/observability/public/services/get_news_feed.test.ts
+++ b/x-pack/plugins/observability/public/services/get_news_feed.test.ts
@@ -7,6 +7,15 @@ import { getNewsFeed } from './get_news_feed';
 import { AppMountContext } from 'kibana/public';
 
 describe('getNewsFeed', () => {
+  const originalConsole = global.console;
+  beforeAll(() => {
+    // mocks console to avoid poluting the test output
+    global.console = ({ error: jest.fn() } as unknown) as typeof console;
+  });
+
+  afterAll(() => {
+    global.console = originalConsole;
+  });
   it('Returns empty array when api throws exception', async () => {
     const core = ({
       http: {
diff --git a/x-pack/plugins/observability/public/services/get_observability_alerts.test.ts b/x-pack/plugins/observability/public/services/get_observability_alerts.test.ts
index 36ef1241983a5..64f5f4aab1c2b 100644
--- a/x-pack/plugins/observability/public/services/get_observability_alerts.test.ts
+++ b/x-pack/plugins/observability/public/services/get_observability_alerts.test.ts
@@ -10,6 +10,15 @@ import { getObservabilityAlerts } from './get_observability_alerts';
 const basePath = { prepend: (path: string) => path };
 
 describe('getObservabilityAlerts', () => {
+  const originalConsole = global.console;
+  beforeAll(() => {
+    // mocks console to avoid poluting the test output
+    global.console = ({ error: jest.fn() } as unknown) as typeof console;
+  });
+
+  afterAll(() => {
+    global.console = originalConsole;
+  });
   it('Returns empty array when api throws exception', async () => {
     const core = ({
       http: {
@@ -40,7 +49,43 @@ describe('getObservabilityAlerts', () => {
     expect(alerts).toEqual([]);
   });
 
-  it('Shows alerts from Observability', async () => {
+  it('Returns empty array when alerts are not allowed based on consumer type', async () => {
+    const core = ({
+      http: {
+        get: async () => {
+          return {
+            data: [
+              {
+                id: 1,
+                consumer: 'siem',
+              },
+              {
+                id: 2,
+                consumer: 'kibana',
+              },
+              {
+                id: 3,
+                consumer: 'index',
+              },
+              {
+                id: 4,
+                consumer: 'foo',
+              },
+              {
+                id: 5,
+                consumer: 'bar',
+              },
+            ],
+          };
+        },
+        basePath,
+      },
+    } as unknown) as AppMountContext['core'];
+    const alerts = await getObservabilityAlerts({ core });
+    expect(alerts).toEqual([]);
+  });
+
+  it('Shows alerts from Observability and Alerts', async () => {
     const core = ({
       http: {
         get: async () => {
@@ -66,6 +111,10 @@ describe('getObservabilityAlerts', () => {
                 id: 5,
                 consumer: 'metrics',
               },
+              {
+                id: 6,
+                consumer: 'alerts',
+              },
             ],
           };
         },
@@ -91,6 +140,10 @@ describe('getObservabilityAlerts', () => {
         id: 5,
         consumer: 'metrics',
       },
+      {
+        id: 6,
+        consumer: 'alerts',
+      },
     ]);
   });
 });
diff --git a/x-pack/plugins/observability/public/services/get_observability_alerts.ts b/x-pack/plugins/observability/public/services/get_observability_alerts.ts
index 58ff9c92acbff..fe5451597688a 100644
--- a/x-pack/plugins/observability/public/services/get_observability_alerts.ts
+++ b/x-pack/plugins/observability/public/services/get_observability_alerts.ts
@@ -7,6 +7,8 @@
 import { AppMountContext } from 'kibana/public';
 import { Alert } from '../../../alerts/common';
 
+const allowedConsumers = ['apm', 'uptime', 'logs', 'metrics', 'alerts'];
+
 export async function getObservabilityAlerts({ core }: { core: AppMountContext['core'] }) {
   try {
     const { data = [] }: { data: Alert[] } = await core.http.get(
@@ -19,11 +21,7 @@ export async function getObservabilityAlerts({ core }: { core: AppMountContext['
       }
     );
 
-    return data.filter(({ consumer }) => {
-      return (
-        consumer === 'apm' || consumer === 'uptime' || consumer === 'logs' || consumer === 'metrics'
-      );
-    });
+    return data.filter(({ consumer }) => allowedConsumers.includes(consumer));
   } catch (e) {
     // eslint-disable-next-line no-console
     console.error('Error while fetching alerts', e);
diff --git a/x-pack/plugins/security_solution/common/endpoint/models/event.ts b/x-pack/plugins/security_solution/common/endpoint/models/event.ts
index f8a6807196557..f53da8fb1f096 100644
--- a/x-pack/plugins/security_solution/common/endpoint/models/event.ts
+++ b/x-pack/plugins/security_solution/common/endpoint/models/event.ts
@@ -32,9 +32,9 @@ export function eventName(event: ResolverEvent): string {
   }
 }
 
-export function eventId(event: ResolverEvent): string {
+export function eventId(event: ResolverEvent): number | undefined | string {
   if (isLegacyEvent(event)) {
-    return event.endgame.serial_event_id ? String(event.endgame.serial_event_id) : '';
+    return event.endgame.serial_event_id;
   }
   return event.event.id;
 }
diff --git a/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_prebuilt.spec.ts b/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_prebuilt.spec.ts
index 00ddc85a73650..17f905b091e08 100644
--- a/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_prebuilt.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_prebuilt.spec.ts
@@ -67,7 +67,7 @@ describe('Alerts rules, prebuilt rules', () => {
   });
 });
 
-// https://github.com/elastic/kibana/issues/71814
+// FLAKY: https://github.com/elastic/kibana/issues/71814
 describe.skip('Deleting prebuilt rules', () => {
   beforeEach(() => {
     const expectedNumberOfRules = totalNumberOfPrebuiltRules;
diff --git a/x-pack/plugins/security_solution/public/cases/components/add_comment/index.tsx b/x-pack/plugins/security_solution/public/cases/components/add_comment/index.tsx
index 980083e8e9d20..a54cf142c18b7 100644
--- a/x-pack/plugins/security_solution/public/cases/components/add_comment/index.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/add_comment/index.tsx
@@ -47,7 +47,7 @@ export const AddComment = React.memo<AddCommentProps>(
       options: { stripEmptyFields: false },
       schema,
     });
-
+    const { getFormData, setFieldValue, reset, submit } = form;
     const { handleCursorChange, handleOnTimelineChange } = useInsertTimeline<CommentRequest>(
       form,
       'comment'
@@ -55,26 +55,23 @@ export const AddComment = React.memo<AddCommentProps>(
 
     useEffect(() => {
       if (insertQuote !== null) {
-        const { comment } = form.getFormData();
-        form.setFieldValue(
-          'comment',
-          `${comment}${comment.length > 0 ? '\n\n' : ''}${insertQuote}`
-        );
+        const { comment } = getFormData();
+        setFieldValue('comment', `${comment}${comment.length > 0 ? '\n\n' : ''}${insertQuote}`);
       }
-    }, [form, insertQuote]);
+    }, [getFormData, insertQuote, setFieldValue]);
 
     const handleTimelineClick = useTimelineClick();
 
     const onSubmit = useCallback(async () => {
-      const { isValid, data } = await form.submit();
+      const { isValid, data } = await submit();
       if (isValid) {
         if (onCommentSaving != null) {
           onCommentSaving();
         }
         postComment(data, onCommentPosted);
-        form.reset();
+        reset();
       }
-    }, [form, onCommentPosted, onCommentSaving, postComment]);
+    }, [onCommentPosted, onCommentSaving, postComment, reset, submit]);
 
     return (
       <span id="add-comment-permLink">
diff --git a/x-pack/plugins/security_solution/public/cases/components/create/index.tsx b/x-pack/plugins/security_solution/public/cases/components/create/index.tsx
index 1a2697bb132b0..31e6da4269ead 100644
--- a/x-pack/plugins/security_solution/public/cases/components/create/index.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/create/index.tsx
@@ -69,6 +69,7 @@ export const Create = React.memo(() => {
     options: { stripEmptyFields: false },
     schema,
   });
+  const { submit } = form;
   const { tags: tagOptions } = useGetTags();
   const [options, setOptions] = useState(
     tagOptions.map((label) => ({
@@ -91,12 +92,12 @@ export const Create = React.memo(() => {
   const handleTimelineClick = useTimelineClick();
 
   const onSubmit = useCallback(async () => {
-    const { isValid, data } = await form.submit();
+    const { isValid, data } = await submit();
     if (isValid) {
       // `postCase`'s type is incorrect, it actually returns a promise
       await postCase(data);
     }
-  }, [form, postCase]);
+  }, [submit, postCase]);
 
   const handleSetIsCancel = useCallback(() => {
     history.push('/');
diff --git a/x-pack/plugins/security_solution/public/cases/components/edit_connector/index.tsx b/x-pack/plugins/security_solution/public/cases/components/edit_connector/index.tsx
index ba0b97b6088a8..11938a55181d3 100644
--- a/x-pack/plugins/security_solution/public/cases/components/edit_connector/index.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/edit_connector/index.tsx
@@ -46,11 +46,13 @@ export const EditConnector = React.memo(
     onSubmit,
     selectedConnector,
   }: EditConnectorProps) => {
+    const initialState = { connectors };
     const { form } = useForm({
-      defaultValue: { connectors },
+      defaultValue: initialState,
       options: { stripEmptyFields: false },
       schema,
     });
+    const { setFieldValue, submit } = form;
     const [connectorHasChanged, setConnectorHasChanged] = useState(false);
     const onChangeConnector = useCallback(
       (connectorId) => {
@@ -60,17 +62,18 @@ export const EditConnector = React.memo(
     );
 
     const onCancelConnector = useCallback(() => {
-      form.setFieldValue('connector', selectedConnector);
+      setFieldValue('connector', selectedConnector);
       setConnectorHasChanged(false);
-    }, [form, selectedConnector]);
+    }, [selectedConnector, setFieldValue]);
 
     const onSubmitConnector = useCallback(async () => {
-      const { isValid, data: newData } = await form.submit();
+      const { isValid, data: newData } = await submit();
       if (isValid && newData.connector) {
         onSubmit(newData.connector);
         setConnectorHasChanged(false);
       }
-    }, [form, onSubmit]);
+    }, [submit, onSubmit]);
+
     return (
       <EuiText>
         <MyFlexGroup alignItems="center" gutterSize="xs" justifyContent="spaceBetween">
diff --git a/x-pack/plugins/security_solution/public/cases/components/tag_list/index.tsx b/x-pack/plugins/security_solution/public/cases/components/tag_list/index.tsx
index 5f8404ca2dcc4..7bb10c743a418 100644
--- a/x-pack/plugins/security_solution/public/cases/components/tag_list/index.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/tag_list/index.tsx
@@ -42,20 +42,23 @@ const MyFlexGroup = styled(EuiFlexGroup)`
 
 export const TagList = React.memo(
   ({ disabled = false, isLoading, onSubmit, tags }: TagListProps) => {
+    const initialState = { tags };
     const { form } = useForm({
-      defaultValue: { tags },
+      defaultValue: initialState,
       options: { stripEmptyFields: false },
       schema,
     });
+    const { submit } = form;
     const [isEditTags, setIsEditTags] = useState(false);
 
     const onSubmitTags = useCallback(async () => {
-      const { isValid, data: newData } = await form.submit();
+      const { isValid, data: newData } = await submit();
       if (isValid && newData.tags) {
         onSubmit(newData.tags);
         setIsEditTags(false);
       }
-    }, [form, onSubmit]);
+    }, [onSubmit, submit]);
+
     const { tags: tagOptions } = useGetTags();
     const [options, setOptions] = useState(
       tagOptions.map((label) => ({
diff --git a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_markdown.tsx b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_markdown.tsx
index 0a8167049266f..da081fea5eac0 100644
--- a/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_markdown.tsx
+++ b/x-pack/plugins/security_solution/public/cases/components/user_action_tree/user_action_markdown.tsx
@@ -6,7 +6,7 @@
 
 import { EuiFlexGroup, EuiFlexItem, EuiButtonEmpty, EuiButton } from '@elastic/eui';
 import React, { useCallback } from 'react';
-import styled, { css } from 'styled-components';
+import styled from 'styled-components';
 
 import * as i18n from '../case_view/translations';
 import { Markdown } from '../../../common/components/markdown';
@@ -18,9 +18,7 @@ import { MarkdownEditorForm } from '../../../common/components//markdown_editor/
 import { useTimelineClick } from '../utils/use_timeline_click';
 
 const ContentWrapper = styled.div`
-  ${({ theme }) => css`
-    padding: ${theme.eui.euiSizeM} ${theme.eui.euiSizeL};
-  `}
+  padding: ${({ theme }) => `${theme.eui.euiSizeM} ${theme.eui.euiSizeL}`};
 `;
 
 interface UserActionMarkdownProps {
@@ -37,11 +35,13 @@ export const UserActionMarkdown = ({
   onChangeEditable,
   onSaveContent,
 }: UserActionMarkdownProps) => {
+  const initialState = { content };
   const { form } = useForm<Content>({
-    defaultValue: { content },
+    defaultValue: initialState,
     options: { stripEmptyFields: false },
     schema,
   });
+  const { submit } = form;
   const { handleCursorChange, handleOnTimelineChange } = useInsertTimeline<Content>(
     form,
     'content'
@@ -53,45 +53,43 @@ export const UserActionMarkdown = ({
   const handleTimelineClick = useTimelineClick();
 
   const handleSaveAction = useCallback(async () => {
-    const { isValid, data } = await form.submit();
+    const { isValid, data } = await submit();
     if (isValid) {
       onSaveContent(data.content);
     }
     onChangeEditable(id);
-  }, [form, id, onChangeEditable, onSaveContent]);
+  }, [id, onChangeEditable, onSaveContent, submit]);
 
   const renderButtons = useCallback(
-    ({ cancelAction, saveAction }) => {
-      return (
-        <EuiFlexGroup gutterSize="s" alignItems="center">
-          <EuiFlexItem grow={false}>
-            <EuiButtonEmpty
-              data-test-subj="user-action-cancel-markdown"
-              size="s"
-              onClick={cancelAction}
-              iconType="cross"
-            >
-              {i18n.CANCEL}
-            </EuiButtonEmpty>
-          </EuiFlexItem>
-          <EuiFlexItem grow={false}>
-            <EuiButton
-              data-test-subj="user-action-save-markdown"
-              color="secondary"
-              fill
-              iconType="save"
-              onClick={saveAction}
-              size="s"
-            >
-              {i18n.SAVE}
-            </EuiButton>
-          </EuiFlexItem>
-        </EuiFlexGroup>
-      );
-    },
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-    [handleCancelAction, handleSaveAction]
+    ({ cancelAction, saveAction }) => (
+      <EuiFlexGroup gutterSize="s" alignItems="center">
+        <EuiFlexItem grow={false}>
+          <EuiButtonEmpty
+            data-test-subj="user-action-cancel-markdown"
+            size="s"
+            onClick={cancelAction}
+            iconType="cross"
+          >
+            {i18n.CANCEL}
+          </EuiButtonEmpty>
+        </EuiFlexItem>
+        <EuiFlexItem grow={false}>
+          <EuiButton
+            data-test-subj="user-action-save-markdown"
+            color="secondary"
+            fill
+            iconType="save"
+            onClick={saveAction}
+            size="s"
+          >
+            {i18n.SAVE}
+          </EuiButton>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    ),
+    []
   );
+
   return isEditable ? (
     <Form form={form} data-test-subj="user-action-markdown-form">
       <UseField
diff --git a/x-pack/plugins/security_solution/public/cases/pages/saved_object_no_permissions.tsx b/x-pack/plugins/security_solution/public/cases/pages/saved_object_no_permissions.tsx
index a560f697de415..7129aa04bdf69 100644
--- a/x-pack/plugins/security_solution/public/cases/pages/saved_object_no_permissions.tsx
+++ b/x-pack/plugins/security_solution/public/cases/pages/saved_object_no_permissions.tsx
@@ -17,7 +17,7 @@ export const CaseSavedObjectNoPermissions = React.memo(() => {
     <EmptyPage
       actionPrimaryIcon="documents"
       actionPrimaryLabel={i18n.GO_TO_DOCUMENTATION}
-      actionPrimaryUrl={`${docLinks.ELASTIC_WEBSITE_URL}guide/en/siem/guide/${docLinks.DOC_LINK_VERSION}s`}
+      actionPrimaryUrl={`${docLinks.ELASTIC_WEBSITE_URL}guide/en/security/${docLinks.DOC_LINK_VERSION}s`}
       actionPrimaryTarget="_blank"
       message={i18n.SAVED_OBJECT_NO_PERMISSIONS_MSG}
       data-test-subj="no_saved_objects_permissions"
diff --git a/x-pack/plugins/security_solution/public/common/components/drag_and_drop/draggable_wrapper_hover_content.test.tsx b/x-pack/plugins/security_solution/public/common/components/drag_and_drop/draggable_wrapper_hover_content.test.tsx
index 3f06a8168b5ce..8e76a88572e42 100644
--- a/x-pack/plugins/security_solution/public/common/components/drag_and_drop/draggable_wrapper_hover_content.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/drag_and_drop/draggable_wrapper_hover_content.test.tsx
@@ -436,14 +436,14 @@ describe('DraggableWrapperHoverContent', () => {
       expect(wrapper.find('[data-test-subj="show-top-field"]').first().exists()).toBe(true);
     });
 
-    test(`it renders the 'Show top field' button when showTopN is false and a whitelisted signal field is provided`, async () => {
-      const whitelistedField = 'signal.rule.name';
+    test(`it renders the 'Show top field' button when showTopN is false and a allowlisted signal field is provided`, async () => {
+      const allowlistedField = 'signal.rule.name';
       const wrapper = mount(
         <TestProviders>
           <DraggableWrapperHoverContent
             {...{
               ...defaultProps,
-              field: whitelistedField,
+              field: allowlistedField,
             }}
           />
         </TestProviders>
@@ -473,13 +473,13 @@ describe('DraggableWrapperHoverContent', () => {
     });
 
     test(`it should invokes goGetTimelineId when user is over the 'Show top field' button`, () => {
-      const whitelistedField = 'signal.rule.name';
+      const allowlistedField = 'signal.rule.name';
       const wrapper = mount(
         <TestProviders>
           <DraggableWrapperHoverContent
             {...{
               ...defaultProps,
-              field: whitelistedField,
+              field: allowlistedField,
               timelineId: undefined,
             }}
           />
@@ -491,13 +491,13 @@ describe('DraggableWrapperHoverContent', () => {
     });
 
     test(`invokes the toggleTopN function when the 'Show top field' button is clicked`, async () => {
-      const whitelistedField = 'signal.rule.name';
+      const allowlistedField = 'signal.rule.name';
       const wrapper = mount(
         <TestProviders>
           <DraggableWrapperHoverContent
             {...{
               ...defaultProps,
-              field: whitelistedField,
+              field: allowlistedField,
             }}
           />
         </TestProviders>
@@ -512,13 +512,13 @@ describe('DraggableWrapperHoverContent', () => {
     });
 
     test(`it does NOT render the Top N histogram when when showTopN is false`, async () => {
-      const whitelistedField = 'signal.rule.name';
+      const allowlistedField = 'signal.rule.name';
       const wrapper = mount(
         <TestProviders>
           <DraggableWrapperHoverContent
             {...{
               ...defaultProps,
-              field: whitelistedField,
+              field: allowlistedField,
             }}
           />
         </TestProviders>
@@ -532,13 +532,13 @@ describe('DraggableWrapperHoverContent', () => {
     });
 
     test(`it does NOT render the 'Show top field' button when showTopN is true`, async () => {
-      const whitelistedField = 'signal.rule.name';
+      const allowlistedField = 'signal.rule.name';
       const wrapper = mount(
         <TestProviders>
           <DraggableWrapperHoverContent
             {...{
               ...defaultProps,
-              field: whitelistedField,
+              field: allowlistedField,
               showTopN: true,
             }}
           />
@@ -551,13 +551,13 @@ describe('DraggableWrapperHoverContent', () => {
     });
 
     test(`it renders the Top N histogram when when showTopN is true`, async () => {
-      const whitelistedField = 'signal.rule.name';
+      const allowlistedField = 'signal.rule.name';
       const wrapper = mount(
         <TestProviders>
           <DraggableWrapperHoverContent
             {...{
               ...defaultProps,
-              field: whitelistedField,
+              field: allowlistedField,
               showTopN: true,
             }}
           />
diff --git a/x-pack/plugins/security_solution/public/common/components/drag_and_drop/helpers.test.ts b/x-pack/plugins/security_solution/public/common/components/drag_and_drop/helpers.test.ts
index afdfde6e08224..68032fb7dc512 100644
--- a/x-pack/plugins/security_solution/public/common/components/drag_and_drop/helpers.test.ts
+++ b/x-pack/plugins/security_solution/public/common/components/drag_and_drop/helpers.test.ts
@@ -658,7 +658,7 @@ describe('helpers', () => {
       ).toBe(true);
     });
 
-    test('it returns true for a whitelisted non-BrowserField', () => {
+    test('it returns true for a allowlisted non-BrowserField', () => {
       expect(
         allowTopN({
           browserField: undefined,
@@ -717,11 +717,11 @@ describe('helpers', () => {
       ).toBe(false);
     });
 
-    test('it returns false for a non-whitelisted field when a BrowserField is not provided', () => {
+    test('it returns false for a non-allowlisted field when a BrowserField is not provided', () => {
       expect(
         allowTopN({
           browserField: undefined,
-          fieldName: 'non-whitelisted',
+          fieldName: 'non-allowlisted',
         })
       ).toBe(false);
     });
diff --git a/x-pack/plugins/security_solution/public/common/components/drag_and_drop/helpers.ts b/x-pack/plugins/security_solution/public/common/components/drag_and_drop/helpers.ts
index ba328eff62e51..132ab054c3afd 100644
--- a/x-pack/plugins/security_solution/public/common/components/drag_and_drop/helpers.ts
+++ b/x-pack/plugins/security_solution/public/common/components/drag_and_drop/helpers.ts
@@ -264,8 +264,8 @@ export const allowTopN = ({
     'string',
   ].includes(fieldType);
 
-  // TODO: remove this explicit whitelist when the ECS documentation includes alerts
-  const isWhitelistedNonBrowserField = [
+  // TODO: remove this explicit allowlist when the ECS documentation includes alerts
+  const isAllowlistedNonBrowserField = [
     'signal.ancestors.depth',
     'signal.ancestors.id',
     'signal.ancestors.rule',
@@ -336,7 +336,7 @@ export const allowTopN = ({
     'signal.status',
   ].includes(fieldName);
 
-  return isWhitelistedNonBrowserField || (isAggregatable && isAllowedType);
+  return isAllowlistedNonBrowserField || (isAggregatable && isAllowedType);
 };
 
 export const getTimelineIdFromColumnDroppableId = (droppableId: string) =>
diff --git a/x-pack/plugins/security_solution/public/common/components/help_menu/index.tsx b/x-pack/plugins/security_solution/public/common/components/help_menu/index.tsx
index 56f0c825aa59e..f4477740f7b58 100644
--- a/x-pack/plugins/security_solution/public/common/components/help_menu/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/help_menu/index.tsx
@@ -14,12 +14,12 @@ export const HelpMenu = React.memo(() => {
   useEffect(() => {
     chrome.setHelpExtension({
       appName: i18n.translate('xpack.securitySolution.chrome.help.appName', {
-        defaultMessage: 'SIEM',
+        defaultMessage: 'Security',
       }),
       links: [
         {
           content: i18n.translate('xpack.securitySolution.chrome.helpMenu.documentation', {
-            defaultMessage: 'SIEM documentation',
+            defaultMessage: 'Security documentation',
           }),
           href: docLinks.links.siem.guide,
           iconType: 'documents',
diff --git a/x-pack/plugins/security_solution/public/common/components/links/index.tsx b/x-pack/plugins/security_solution/public/common/components/links/index.tsx
index 3b92faff91517..4a9ad94d8f36d 100644
--- a/x-pack/plugins/security_solution/public/common/components/links/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/links/index.tsx
@@ -78,7 +78,7 @@ const HostDetailsLinkComponent: React.FC<{ children?: React.ReactNode; hostName:
 };
 export const HostDetailsLink = React.memo(HostDetailsLinkComponent);
 
-const whitelistUrlSchemes = ['http://', 'https://'];
+const allowedUrlSchemes = ['http://', 'https://'];
 export const ExternalLink = React.memo<{
   url: string;
   children?: React.ReactNode;
@@ -96,8 +96,8 @@ export const ExternalLink = React.memo<{
     const lastVisibleItemIndex = overflowIndexStart - 1;
     const lastItemIndex = allItemsLimit - 1;
     const lastIndexToShow = Math.max(0, Math.min(lastVisibleItemIndex, lastItemIndex));
-    const inWhitelist = whitelistUrlSchemes.some((scheme) => url.indexOf(scheme) === 0);
-    return url && inWhitelist && !isUrlInvalid(url) && children ? (
+    const inAllowlist = allowedUrlSchemes.some((scheme) => url.indexOf(scheme) === 0);
+    return url && inAllowlist && !isUrlInvalid(url) && children ? (
       <EuiToolTip content={url} position="top" data-test-subj="externalLinkTooltip">
         <EuiLink href={url} target="_blank" rel="noopener" data-test-subj="externalLink">
           {children}
diff --git a/x-pack/plugins/security_solution/public/common/components/ml/tables/anomalies_host_table.tsx b/x-pack/plugins/security_solution/public/common/components/ml/tables/anomalies_host_table.tsx
index d6e343265b6e7..78cd23e6647c0 100644
--- a/x-pack/plugins/security_solution/public/common/components/ml/tables/anomalies_host_table.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/ml/tables/anomalies_host_table.tsx
@@ -79,7 +79,6 @@ const AnomaliesHostTableComponent: React.FC<AnomaliesHostTableProps> = ({
         <BasicTable
           // @ts-ignore the Columns<T, U> type is not as specific as EUI's...
           columns={columns}
-          compressed
           // @ts-ignore ...which leads to `networks` not "matching" the columns
           items={hosts}
           pagination={pagination}
diff --git a/x-pack/plugins/security_solution/public/common/components/ml/tables/anomalies_network_table.tsx b/x-pack/plugins/security_solution/public/common/components/ml/tables/anomalies_network_table.tsx
index c7a49202bf239..73fe7b1ea5f6e 100644
--- a/x-pack/plugins/security_solution/public/common/components/ml/tables/anomalies_network_table.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/ml/tables/anomalies_network_table.tsx
@@ -69,7 +69,6 @@ const AnomaliesNetworkTableComponent: React.FC<AnomaliesNetworkTableProps> = ({
         <BasicTable
           // @ts-ignore the Columns<T, U> type is not as specific as EUI's...
           columns={columns}
-          compressed
           // @ts-ignore ...which leads to `networks` not "matching" the columns
           items={networks}
           pagination={pagination}
diff --git a/x-pack/plugins/security_solution/public/common/components/ml_popover/jobs_table/__snapshots__/jobs_table.test.tsx.snap b/x-pack/plugins/security_solution/public/common/components/ml_popover/jobs_table/__snapshots__/jobs_table.test.tsx.snap
index d8b8ae63cf41f..60088a77878ad 100644
--- a/x-pack/plugins/security_solution/public/common/components/ml_popover/jobs_table/__snapshots__/jobs_table.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/common/components/ml_popover/jobs_table/__snapshots__/jobs_table.test.tsx.snap
@@ -21,7 +21,6 @@ exports[`JobsTableComponent renders correctly against snapshot 1`] = `
       },
     ]
   }
-  compressed={true}
   data-test-subj="jobs-table"
   items={
     Array [
diff --git a/x-pack/plugins/security_solution/public/common/components/ml_popover/jobs_table/jobs_table.tsx b/x-pack/plugins/security_solution/public/common/components/ml_popover/jobs_table/jobs_table.tsx
index 40097ed68684f..f28a99c9947d5 100644
--- a/x-pack/plugins/security_solution/public/common/components/ml_popover/jobs_table/jobs_table.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/ml_popover/jobs_table/jobs_table.tsx
@@ -115,7 +115,6 @@ export const JobsTableComponent = ({ isLoading, jobs, onJobStateChange }: JobTab
   return (
     <EuiBasicTable
       data-test-subj="jobs-table"
-      compressed={true}
       columns={getJobsTableColumns(isLoading, onJobStateChange, basePath)}
       items={getPaginatedItems(jobs, pageIndex, pageSize)}
       loading={isLoading}
diff --git a/x-pack/plugins/security_solution/public/common/components/ml_popover/ml_popover.tsx b/x-pack/plugins/security_solution/public/common/components/ml_popover/ml_popover.tsx
index a34dfb5753d92..0ebf367471848 100644
--- a/x-pack/plugins/security_solution/public/common/components/ml_popover/ml_popover.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/ml_popover/ml_popover.tsx
@@ -177,7 +177,7 @@ export const MlPopover = React.memo(() => {
                     values={{
                       mlDocs: (
                         <a
-                          href={`${docLinks.ELASTIC_WEBSITE_URL}guide/en/siem/guide/${docLinks.DOC_LINK_VERSION}/machine-learning.html`}
+                          href={`${docLinks.ELASTIC_WEBSITE_URL}guide/en/security/${docLinks.DOC_LINK_VERSION}/machine-learning.html`}
                           rel="noopener noreferrer"
                           target="_blank"
                         >
diff --git a/x-pack/plugins/security_solution/public/common/components/paginated_table/index.tsx b/x-pack/plugins/security_solution/public/common/components/paginated_table/index.tsx
index 9f95284d989a9..448fa58443407 100644
--- a/x-pack/plugins/security_solution/public/common/components/paginated_table/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/paginated_table/index.tsx
@@ -249,7 +249,6 @@ const PaginatedTableComponent: FC<SiemTables> = ({
           <>
             <BasicTable
               columns={columns}
-              compressed
               items={pageOfItems}
               onChange={onChange}
               sorting={
diff --git a/x-pack/plugins/security_solution/public/common/utils/test_utils.ts b/x-pack/plugins/security_solution/public/common/utils/test_utils.ts
deleted file mode 100644
index 5a3cddb74657d..0000000000000
--- a/x-pack/plugins/security_solution/public/common/utils/test_utils.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { ReactWrapper } from 'enzyme';
-import { act } from 'react-dom/test-utils';
-
-// Temporary fix for https://github.com/enzymejs/enzyme/issues/2073
-export const waitForUpdates = async <P>(wrapper: ReactWrapper<P>) => {
-  await act(async () => {
-    await new Promise((resolve) => setTimeout(resolve, 0));
-    wrapper.update();
-  });
-};
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/pre_packaged_rules/update_callout.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/pre_packaged_rules/update_callout.tsx
index 3be2b853925f6..4b454a9ed4d4a 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/pre_packaged_rules/update_callout.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/pre_packaged_rules/update_callout.tsx
@@ -56,7 +56,7 @@ const UpdatePrePackagedRulesCallOutComponent: React.FC<UpdatePrePackagedRulesCal
         {prepackagedRulesOrTimelines?.callOutMessage}
         <br />
         <EuiLink
-          href={`${services.docLinks.ELASTIC_WEBSITE_URL}guide/en/siem/guide/${services.docLinks.DOC_LINK_VERSION}/prebuilt-rules-changelog.html`}
+          href={`${services.docLinks.ELASTIC_WEBSITE_URL}guide/en/security/${services.docLinks.DOC_LINK_VERSION}/prebuilt-rules-changelog.html`}
           target="_blank"
         >
           {i18n.RELEASE_NOTES_HELP}
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/index.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/index.tsx
index 4d91460bfd2c8..1fc88da5fd7c7 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/step_about_rule/index.tsx
@@ -7,7 +7,6 @@
 import { EuiAccordion, EuiFlexItem, EuiSpacer, EuiButtonEmpty, EuiFormRow } from '@elastic/eui';
 import React, { FC, memo, useCallback, useEffect, useState } from 'react';
 import styled from 'styled-components';
-import deepEqual from 'fast-deep-equal';
 
 import {
   RuleStepProps,
@@ -35,7 +34,6 @@ import * as I18n from './translations';
 import { StepContentWrapper } from '../step_content_wrapper';
 import { NextStep } from '../next_step';
 import { MarkdownEditorForm } from '../../../../common/components/markdown_editor/form';
-import { setFieldValue } from '../../../pages/detection_engine/rules/helpers';
 import { SeverityField } from '../severity_mapping';
 import { RiskScoreField } from '../risk_score_mapping';
 import { useFetchIndexPatterns } from '../../../containers/detection_engine/rules';
@@ -44,8 +42,8 @@ import { AutocompleteField } from '../autocomplete_field';
 const CommonUseField = getUseField({ component: Field });
 
 interface StepAboutRuleProps extends RuleStepProps {
-  defaultValues?: AboutStepRule | null;
-  defineRuleData?: DefineStepRule | null;
+  defaultValues?: AboutStepRule;
+  defineRuleData?: DefineStepRule;
 }
 
 const ThreeQuartersContainer = styled.div`
@@ -91,48 +89,35 @@ const StepAboutRuleComponent: FC<StepAboutRuleProps> = ({
   setForm,
   setStepData,
 }) => {
-  const [myStepData, setMyStepData] = useState<AboutStepRule>(stepAboutDefaultValue);
+  const initialState = defaultValues ?? stepAboutDefaultValue;
+  const [myStepData, setMyStepData] = useState<AboutStepRule>(initialState);
   const [{ isLoading: indexPatternLoading, indexPatterns }] = useFetchIndexPatterns(
     defineRuleData?.index ?? []
   );
 
   const { form } = useForm({
-    defaultValue: myStepData,
+    defaultValue: initialState,
     options: { stripEmptyFields: false },
     schema,
   });
+  const { getFields, submit } = form;
 
   const onSubmit = useCallback(async () => {
     if (setStepData) {
       setStepData(RuleStep.aboutRule, null, false);
-      const { isValid, data } = await form.submit();
+      const { isValid, data } = await submit();
       if (isValid) {
         setStepData(RuleStep.aboutRule, data, isValid);
         setMyStepData({ ...data, isNew: false } as AboutStepRule);
       }
     }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [form]);
+  }, [setStepData, submit]);
 
   useEffect(() => {
-    const { isNew, ...initDefaultValue } = myStepData;
-    if (defaultValues != null && !deepEqual(initDefaultValue, defaultValues)) {
-      const myDefaultValues = {
-        ...defaultValues,
-        isNew: false,
-      };
-      setMyStepData(myDefaultValues);
-      setFieldValue(form, schema, myDefaultValues);
-    }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [defaultValues]);
-
-  useEffect(() => {
-    if (setForm != null) {
+    if (setForm) {
       setForm(RuleStep.aboutRule, form);
     }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [form]);
+  }, [setForm, form]);
 
   return isReadOnlyView && myStepData.name != null ? (
     <StepContentWrapper data-test-subj="aboutStep" addPadding={addPadding}>
@@ -338,8 +323,8 @@ const StepAboutRuleComponent: FC<StepAboutRuleProps> = ({
           <FormDataProvider pathsToWatch="severity">
             {({ severity }) => {
               const newRiskScore = defaultRiskScoreBySeverity[severity as SeverityValue];
-              const severityField = form.getFields().severity;
-              const riskScoreField = form.getFields().riskScore;
+              const severityField = getFields().severity;
+              const riskScoreField = getFields().riskScore;
               if (
                 severityField.value !== severity &&
                 newRiskScore != null &&
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/index.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/index.tsx
index c7d70684b34cf..51e9291f31941 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/index.tsx
@@ -17,7 +17,6 @@ import { useFetchIndexPatterns } from '../../../containers/detection_engine/rule
 import { DEFAULT_TIMELINE_TITLE } from '../../../../timelines/components/timeline/translations';
 import { useMlCapabilities } from '../../../../common/components/ml_popover/hooks/use_ml_capabilities';
 import { useUiSetting$ } from '../../../../common/lib/kibana';
-import { setFieldValue } from '../../../pages/detection_engine/rules/helpers';
 import {
   filterRuleFieldsForType,
   RuleFields,
@@ -109,58 +108,46 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
   const mlCapabilities = useMlCapabilities();
   const [openTimelineSearch, setOpenTimelineSearch] = useState(false);
   const [indexModified, setIndexModified] = useState(false);
-  const [localRuleType, setLocalRuleType] = useState(
-    defaultValues?.ruleType || stepDefineDefaultValue.ruleType
-  );
   const [indicesConfig] = useUiSetting$<string[]>(DEFAULT_INDEX_KEY);
-  const [myStepData, setMyStepData] = useState<DefineStepRule>({
+  const initialState = defaultValues ?? {
     ...stepDefineDefaultValue,
     index: indicesConfig ?? [],
-  });
+  };
+  const [localRuleType, setLocalRuleType] = useState(initialState.ruleType);
+  const [myStepData, setMyStepData] = useState<DefineStepRule>(initialState);
   const [
     { browserFields, indexPatterns: indexPatternQueryBar, isLoading: indexPatternLoadingQueryBar },
   ] = useFetchIndexPatterns(myStepData.index);
 
   const { form } = useForm({
-    defaultValue: myStepData,
+    defaultValue: initialState,
     options: { stripEmptyFields: false },
     schema,
   });
-  const clearErrors = useCallback(() => form.reset({ resetValues: false }), [form]);
+  const { getFields, reset, submit } = form;
+  const clearErrors = useCallback(() => reset({ resetValues: false }), [reset]);
 
   const onSubmit = useCallback(async () => {
     if (setStepData) {
       setStepData(RuleStep.defineRule, null, false);
-      const { isValid, data } = await form.submit();
+      const { isValid, data } = await submit();
       if (isValid && setStepData) {
         setStepData(RuleStep.defineRule, data, isValid);
         setMyStepData({ ...data, isNew: false } as DefineStepRule);
       }
     }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [form]);
-
-  useEffect(() => {
-    const { isNew, ...values } = myStepData;
-    if (defaultValues != null && !deepEqual(values, defaultValues)) {
-      const newValues = { ...values, ...defaultValues, isNew: false };
-      setMyStepData(newValues);
-      setFieldValue(form, schema, newValues);
-    }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [defaultValues, setMyStepData, setFieldValue]);
+  }, [setStepData, submit]);
 
   useEffect(() => {
-    if (setForm != null) {
+    if (setForm) {
       setForm(RuleStep.defineRule, form);
     }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [form]);
+  }, [form, setForm]);
 
   const handleResetIndices = useCallback(() => {
-    const indexField = form.getFields().index;
+    const indexField = getFields().index;
     indexField.setValue(indicesConfig);
-  }, [form, indicesConfig]);
+  }, [getFields, indicesConfig]);
 
   const handleOpenTimelineSearch = useCallback(() => {
     setOpenTimelineSearch(true);
@@ -281,11 +268,11 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
                 fields={{
                   thresholdField: {
                     path: 'threshold.field',
-                    defaultValue: defaultValues?.threshold?.field,
+                    defaultValue: initialState.threshold.field,
                   },
                   thresholdValue: {
                     path: 'threshold.value',
-                    defaultValue: defaultValues?.threshold?.value,
+                    defaultValue: initialState.threshold.value,
                   },
                 }}
               >
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/step_rule_actions/index.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/step_rule_actions/index.tsx
index 7005bfb25f4a6..7bf151adde5cc 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/step_rule_actions/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/step_rule_actions/index.tsx
@@ -14,9 +14,7 @@ import {
 } from '@elastic/eui';
 import { findIndex } from 'lodash/fp';
 import React, { FC, memo, useCallback, useEffect, useMemo, useState } from 'react';
-import deepEqual from 'fast-deep-equal';
 
-import { setFieldValue } from '../../../pages/detection_engine/rules/helpers';
 import {
   RuleStep,
   RuleStepProps,
@@ -71,7 +69,8 @@ const StepRuleActionsComponent: FC<StepRuleActionsProps> = ({
   setForm,
   actionMessageParams,
 }) => {
-  const [myStepData, setMyStepData] = useState<ActionsStepRule>(stepActionsDefaultValue);
+  const initialState = defaultValues ?? stepActionsDefaultValue;
+  const [myStepData, setMyStepData] = useState<ActionsStepRule>(initialState);
   const {
     services: {
       application,
@@ -81,10 +80,11 @@ const StepRuleActionsComponent: FC<StepRuleActionsProps> = ({
   const schema = useMemo(() => getSchema({ actionTypeRegistry }), [actionTypeRegistry]);
 
   const { form } = useForm({
-    defaultValue: myStepData,
+    defaultValue: initialState,
     options: { stripEmptyFields: false },
     schema,
   });
+  const { submit } = form;
 
   // TO DO need to make sure that logic is still valid
   const kibanaAbsoluteUrl = useMemo(() => {
@@ -101,36 +101,21 @@ const StepRuleActionsComponent: FC<StepRuleActionsProps> = ({
     async (enabled: boolean) => {
       if (setStepData) {
         setStepData(RuleStep.ruleActions, null, false);
-        const { isValid: newIsValid, data } = await form.submit();
+        const { isValid: newIsValid, data } = await submit();
         if (newIsValid) {
           setStepData(RuleStep.ruleActions, { ...data, enabled }, newIsValid);
           setMyStepData({ ...data, isNew: false } as ActionsStepRule);
         }
       }
     },
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-    [form]
+    [setStepData, submit]
   );
 
   useEffect(() => {
-    const { isNew, ...initDefaultValue } = myStepData;
-    if (defaultValues != null && !deepEqual(initDefaultValue, defaultValues)) {
-      const myDefaultValues = {
-        ...defaultValues,
-        isNew: false,
-      };
-      setMyStepData(myDefaultValues);
-      setFieldValue(form, schema, myDefaultValues);
-    }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [defaultValues]);
-
-  useEffect(() => {
-    if (setForm != null) {
+    if (setForm) {
       setForm(RuleStep.ruleActions, form);
     }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [form]);
+  }, [form, setForm]);
 
   const updateThrottle = useCallback((throttle) => setMyStepData({ ...myStepData, throttle }), [
     myStepData,
diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/step_schedule_rule/index.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/step_schedule_rule/index.tsx
index fa0f4dbd3668c..52f04f8423bec 100644
--- a/x-pack/plugins/security_solution/public/detections/components/rules/step_schedule_rule/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/rules/step_schedule_rule/index.tsx
@@ -5,9 +5,7 @@
  */
 
 import React, { FC, memo, useCallback, useEffect, useState } from 'react';
-import deepEqual from 'fast-deep-equal';
 
-import { setFieldValue } from '../../../pages/detection_engine/rules/helpers';
 import {
   RuleStep,
   RuleStepProps,
@@ -40,45 +38,32 @@ const StepScheduleRuleComponent: FC<StepScheduleRuleProps> = ({
   setStepData,
   setForm,
 }) => {
-  const [myStepData, setMyStepData] = useState<ScheduleStepRule>(stepScheduleDefaultValue);
+  const initialState = defaultValues ?? stepScheduleDefaultValue;
+  const [myStepData, setMyStepData] = useState<ScheduleStepRule>(initialState);
 
   const { form } = useForm({
-    defaultValue: myStepData,
+    defaultValue: initialState,
     options: { stripEmptyFields: false },
     schema,
   });
+  const { submit } = form;
 
   const onSubmit = useCallback(async () => {
     if (setStepData) {
       setStepData(RuleStep.scheduleRule, null, false);
-      const { isValid: newIsValid, data } = await form.submit();
+      const { isValid: newIsValid, data } = await submit();
       if (newIsValid) {
         setStepData(RuleStep.scheduleRule, { ...data }, newIsValid);
         setMyStepData({ ...data, isNew: false } as ScheduleStepRule);
       }
     }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [form]);
+  }, [setStepData, submit]);
 
   useEffect(() => {
-    const { isNew, ...initDefaultValue } = myStepData;
-    if (defaultValues != null && !deepEqual(initDefaultValue, defaultValues)) {
-      const myDefaultValues = {
-        ...defaultValues,
-        isNew: false,
-      };
-      setMyStepData(myDefaultValues);
-      setFieldValue(form, schema, myDefaultValues);
-    }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [defaultValues]);
-
-  useEffect(() => {
-    if (setForm != null) {
+    if (setForm) {
       setForm(RuleStep.scheduleRule, form);
     }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [form]);
+  }, [form, setForm]);
 
   return isReadOnlyView && myStepData != null ? (
     <StepContentWrapper addPadding={addPadding}>
diff --git a/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/form.test.tsx b/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/form.test.tsx
index ce5d19259e9ee..e2e793b34eaf9 100644
--- a/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/form.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/form.test.tsx
@@ -7,7 +7,6 @@ import React, { FormEvent } from 'react';
 import { mount, ReactWrapper } from 'enzyme';
 import { act } from 'react-dom/test-utils';
 
-import { waitForUpdates } from '../../../common/utils/test_utils';
 import { TestProviders } from '../../../common/mock';
 import { ValueListsForm } from './form';
 import { useImportList } from '../../../shared_imports';
@@ -30,10 +29,6 @@ const mockSelectFile: <P>(container: ReactWrapper<P>, file: File) => Promise<voi
       fileChange(([file] as unknown) as FormEvent);
     }
   });
-  await waitForUpdates(container);
-  expect(
-    container.find('button[data-test-subj="value-lists-form-import-action"]').prop('disabled')
-  ).not.toEqual(true);
 };
 
 describe('ValueListsForm', () => {
@@ -68,7 +63,6 @@ describe('ValueListsForm', () => {
     await mockSelectFile(container, mockFile);
 
     container.find('button[data-test-subj="value-lists-form-import-action"]').simulate('click');
-    await waitForUpdates(container);
 
     expect(mockImportList).toHaveBeenCalledWith(expect.objectContaining({ file: mockFile }));
   });
@@ -80,12 +74,11 @@ describe('ValueListsForm', () => {
     }));
 
     const onError = jest.fn();
-    const container = mount(
+    mount(
       <TestProviders>
         <ValueListsForm onError={onError} onSuccess={jest.fn()} />
       </TestProviders>
     );
-    await waitForUpdates(container);
 
     expect(onError).toHaveBeenCalledWith('whoops');
   });
@@ -97,12 +90,11 @@ describe('ValueListsForm', () => {
     }));
 
     const onSuccess = jest.fn();
-    const container = mount(
+    mount(
       <TestProviders>
         <ValueListsForm onSuccess={onSuccess} onError={jest.fn()} />
       </TestProviders>
     );
-    await waitForUpdates(container);
 
     expect(onSuccess).toHaveBeenCalledWith({ mockResult: true });
   });
diff --git a/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/modal.test.tsx b/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/modal.test.tsx
index ab2bc9b2e90e1..175882de551cb 100644
--- a/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/modal.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/value_lists_management_modal/modal.test.tsx
@@ -9,10 +9,8 @@ import { mount } from 'enzyme';
 
 import { TestProviders } from '../../../common/mock';
 import { ValueListsModal } from './modal';
-import { waitForUpdates } from '../../../common/utils/test_utils';
 
-// TODO: These are occasionally timing out
-describe.skip('ValueListsModal', () => {
+describe('ValueListsModal', () => {
   it('renders nothing if showModal is false', () => {
     const container = mount(
       <TestProviders>
@@ -21,20 +19,21 @@ describe.skip('ValueListsModal', () => {
     );
 
     expect(container.find('EuiModal')).toHaveLength(0);
+    container.unmount();
   });
 
-  it('renders modal if showModal is true', async () => {
+  it('renders modal if showModal is true', () => {
     const container = mount(
       <TestProviders>
         <ValueListsModal showModal={true} onClose={jest.fn()} />
       </TestProviders>
     );
-    await waitForUpdates(container);
 
     expect(container.find('EuiModal')).toHaveLength(1);
+    container.unmount();
   });
 
-  it('calls onClose when modal is closed', async () => {
+  it('calls onClose when modal is closed', () => {
     const onClose = jest.fn();
     const container = mount(
       <TestProviders>
@@ -44,21 +43,19 @@ describe.skip('ValueListsModal', () => {
 
     container.find('button[data-test-subj="value-lists-modal-close-action"]').simulate('click');
 
-    await waitForUpdates(container);
-
     expect(onClose).toHaveBeenCalled();
+    container.unmount();
   });
 
-  it('renders ValueListsForm and ValueListsTable', async () => {
+  it('renders ValueListsForm and ValueListsTable', () => {
     const container = mount(
       <TestProviders>
         <ValueListsModal showModal={true} onClose={jest.fn()} />
       </TestProviders>
     );
 
-    await waitForUpdates(container);
-
     expect(container.find('ValueListsForm')).toHaveLength(1);
     expect(container.find('ValueListsTable')).toHaveLength(1);
+    container.unmount();
   });
 });
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_no_signal_index.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_no_signal_index.tsx
index 59267b5d62a26..32ae585aec191 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_no_signal_index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_no_signal_index.tsx
@@ -16,7 +16,7 @@ export const DetectionEngineNoIndex = React.memo(() => {
     <EmptyPage
       actionPrimaryIcon="documents"
       actionPrimaryLabel={i18n.GO_TO_DOCUMENTATION}
-      actionPrimaryUrl={`${docLinks.ELASTIC_WEBSITE_URL}guide/en/siem/guide/${docLinks.DOC_LINK_VERSION}/detection-engine-overview.html#detections-permissions`}
+      actionPrimaryUrl={`${docLinks.ELASTIC_WEBSITE_URL}guide/en/security/${docLinks.DOC_LINK_VERSION}/detection-engine-overview.html#detections-permissions`}
       actionPrimaryTarget="_blank"
       message={i18n.NO_INDEX_MSG_BODY}
       data-test-subj="no_index"
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_user_unauthenticated.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_user_unauthenticated.tsx
index a353be80c7239..6123e3740e306 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_user_unauthenticated.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/detection_engine_user_unauthenticated.tsx
@@ -17,7 +17,7 @@ export const DetectionEngineUserUnauthenticated = React.memo(() => {
     <EmptyPage
       actionPrimaryIcon="documents"
       actionPrimaryLabel={i18n.GO_TO_DOCUMENTATION}
-      actionPrimaryUrl={`${docLinks.ELASTIC_WEBSITE_URL}guide/en/security/guide/${docLinks.DOC_LINK_VERSION}/detection-engine-overview.html#detections-permissions`}
+      actionPrimaryUrl={`${docLinks.ELASTIC_WEBSITE_URL}guide/en/security/${docLinks.DOC_LINK_VERSION}/detection-engine-overview.html#detections-permissions`}
       actionPrimaryTarget="_blank"
       message={i18n.USER_UNAUTHENTICATED_MSG_BODY}
       data-test-subj="no_index"
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/index.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/index.tsx
index f6e13786e98d0..6ba65ceca8fe9 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/create/index.tsx
@@ -109,10 +109,10 @@ const CreateRulePageComponent: React.FC = () => {
     [RuleStep.ruleActions]: null,
   });
   const stepsData = useRef<Record<RuleStep, RuleStepData>>({
-    [RuleStep.defineRule]: { isValid: false, data: {} },
-    [RuleStep.aboutRule]: { isValid: false, data: {} },
-    [RuleStep.scheduleRule]: { isValid: false, data: {} },
-    [RuleStep.ruleActions]: { isValid: false, data: {} },
+    [RuleStep.defineRule]: { isValid: false, data: undefined },
+    [RuleStep.aboutRule]: { isValid: false, data: undefined },
+    [RuleStep.scheduleRule]: { isValid: false, data: undefined },
+    [RuleStep.ruleActions]: { isValid: false, data: undefined },
   });
   const [isStepRuleInReadOnlyView, setIsStepRuleInEditView] = useState<Record<RuleStep, boolean>>({
     [RuleStep.defineRule]: false,
@@ -123,7 +123,7 @@ const CreateRulePageComponent: React.FC = () => {
   const [{ isLoading, isSaved }, setRule] = usePersistRule();
   const actionMessageParams = useMemo(
     () =>
-      getActionMessageParams((stepsData.current['define-rule'].data as DefineStepRule).ruleType),
+      getActionMessageParams((stepsData.current['define-rule'].data as DefineStepRule)?.ruleType),
     // eslint-disable-next-line react-hooks/exhaustive-deps
     [stepsData.current['define-rule'].data]
   );
@@ -335,9 +335,7 @@ const CreateRulePageComponent: React.FC = () => {
             <EuiHorizontalRule margin="m" />
             <StepDefineRule
               addPadding={true}
-              defaultValues={
-                (stepsData.current[RuleStep.defineRule].data as DefineStepRule) ?? null
-              }
+              defaultValues={stepsData.current[RuleStep.defineRule].data as DefineStepRule}
               isReadOnlyView={isStepRuleInReadOnlyView[RuleStep.defineRule]}
               isLoading={isLoading || loading}
               setForm={setStepsForm}
@@ -370,10 +368,8 @@ const CreateRulePageComponent: React.FC = () => {
             <EuiHorizontalRule margin="m" />
             <StepAboutRule
               addPadding={true}
-              defaultValues={(stepsData.current[RuleStep.aboutRule].data as AboutStepRule) ?? null}
-              defineRuleData={
-                (stepsData.current[RuleStep.defineRule].data as DefineStepRule) ?? null
-              }
+              defaultValues={stepsData.current[RuleStep.aboutRule].data as AboutStepRule}
+              defineRuleData={stepsData.current[RuleStep.defineRule].data as DefineStepRule}
               descriptionColumns="singleSplit"
               isReadOnlyView={isStepRuleInReadOnlyView[RuleStep.aboutRule]}
               isLoading={isLoading || loading}
@@ -406,9 +402,7 @@ const CreateRulePageComponent: React.FC = () => {
             <EuiHorizontalRule margin="m" />
             <StepScheduleRule
               addPadding={true}
-              defaultValues={
-                (stepsData.current[RuleStep.scheduleRule].data as ScheduleStepRule) ?? null
-              }
+              defaultValues={stepsData.current[RuleStep.scheduleRule].data as ScheduleStepRule}
               descriptionColumns="singleSplit"
               isReadOnlyView={isStepRuleInReadOnlyView[RuleStep.scheduleRule]}
               isLoading={isLoading || loading}
diff --git a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/helpers.tsx b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/helpers.tsx
index 5df711ea7cd8e..3de508dcbb3be 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/helpers.tsx
@@ -5,7 +5,6 @@
  */
 
 import dateMath from '@elastic/datemath';
-import { get } from 'lodash/fp';
 import moment from 'moment';
 import memoizeOne from 'memoize-one';
 import { useLocation } from 'react-router-dom';
@@ -15,7 +14,6 @@ import { isMlRule } from '../../../../../common/machine_learning/helpers';
 import { transformRuleToAlertAction } from '../../../../../common/detection_engine/transform_actions';
 import { Filter } from '../../../../../../../../src/plugins/data/public';
 import { Rule } from '../../../containers/detection_engine/rules';
-import { FormData, FormHook, FormSchema } from '../../../../shared_imports';
 import {
   AboutStepRule,
   AboutStepRuleDetails,
@@ -273,17 +271,6 @@ export const getPrePackagedTimelineStatus = (
   }
   return 'unknown';
 };
-export const setFieldValue = (
-  form: FormHook<FormData>,
-  schema: FormSchema<FormData>,
-  defaultValues: unknown
-) =>
-  Object.keys(schema).forEach((key) => {
-    const val = get(key, defaultValues);
-    if (val != null) {
-      form.setFieldValue(key, val);
-    }
-  });
 
 export const redirectToDetections = (
   isSignalIndexExists: boolean | null,
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/agents_summary.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/agents_summary.tsx
index fca3408b79c54..921493e239c0f 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/agents_summary.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/agents_summary.tsx
@@ -73,7 +73,7 @@ export const AgentsSummary = memo<AgentsSummaryProps>((props) => {
   }, []);
 
   return (
-    <EuiFlexGroup gutterSize="xl" data-test-subj="policyAgentsSummary">
+    <EuiFlexGroup gutterSize="xl" responsive={false} data-test-subj="policyAgentsSummary">
       {stats.map(({ key, title, health }) => {
         return (
           <EuiFlexItem grow={false} key={key}>
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_details.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_details.tsx
index 8fbc167670b41..9576e1aedcaf1 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_details.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/policy_details.tsx
@@ -16,6 +16,7 @@ import {
   EuiConfirmModal,
   EuiCallOut,
   EuiLoadingSpinner,
+  EuiHideFor,
 } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { i18n } from '@kbn/i18n';
@@ -182,9 +183,11 @@ export const PolicyDetails = React.memo(() => {
           error={policyAgentStatusSummary?.error ?? 0}
         />
       </EuiFlexItem>
-      <EuiFlexItem>
-        <VerticalDivider spacing="l" />
-      </EuiFlexItem>
+      <EuiHideFor sizes={['xs', 's']}>
+        <EuiFlexItem>
+          <VerticalDivider spacing="l" />
+        </EuiFlexItem>
+      </EuiHideFor>
       <EuiFlexItem grow={false}>
         <EuiButtonEmpty onClick={handleCancelOnClick} data-test-subj="policyDetailsCancelButton">
           <FormattedMessage
diff --git a/x-pack/plugins/security_solution/public/network/components/embeddables/__snapshots__/embedded_map.test.tsx.snap b/x-pack/plugins/security_solution/public/network/components/embeddables/__snapshots__/embedded_map.test.tsx.snap
index d5de7ab508a73..456e07cf9cd15 100644
--- a/x-pack/plugins/security_solution/public/network/components/embeddables/__snapshots__/embedded_map.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/network/components/embeddables/__snapshots__/embedded_map.test.tsx.snap
@@ -9,7 +9,7 @@ exports[`EmbeddedMapComponent renders correctly against snapshot 1`] = `
       size="xs"
     >
       <EuiLink
-        href="https://www.elastic.co/guide/en/siem/guide/mocked-test-branch/conf-map-ui.html"
+        href="https://www.elastic.co/guide/en/security/mocked-test-branch/conf-map-ui.html"
         target="_blank"
       >
         Map configuration help
diff --git a/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map.tsx b/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map.tsx
index 828e4d3eaaaa0..4d96c213818aa 100644
--- a/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map.tsx
+++ b/x-pack/plugins/security_solution/public/network/components/embeddables/embedded_map.tsx
@@ -185,7 +185,7 @@ export const EmbeddedMapComponent = ({
       <EmbeddableHeader title={i18n.EMBEDDABLE_HEADER_TITLE}>
         <EuiText size="xs">
           <EuiLink
-            href={`${services.docLinks.ELASTIC_WEBSITE_URL}guide/en/siem/guide/${services.docLinks.DOC_LINK_VERSION}/conf-map-ui.html`}
+            href={`${services.docLinks.ELASTIC_WEBSITE_URL}guide/en/security/${services.docLinks.DOC_LINK_VERSION}/conf-map-ui.html`}
             target="_blank"
           >
             {i18n.EMBEDDABLE_HEADER_HELP}
diff --git a/x-pack/plugins/security_solution/public/overview/pages/overview.test.tsx b/x-pack/plugins/security_solution/public/overview/pages/overview.test.tsx
index f7c77bc2dfdf8..286cc870378e1 100644
--- a/x-pack/plugins/security_solution/public/overview/pages/overview.test.tsx
+++ b/x-pack/plugins/security_solution/public/overview/pages/overview.test.tsx
@@ -9,7 +9,6 @@ import React from 'react';
 import { MemoryRouter } from 'react-router-dom';
 
 import '../../common/mock/match_media';
-import { waitForUpdates } from '../../common/utils/test_utils';
 import { TestProviders } from '../../common/mock';
 import { useWithSource } from '../../common/containers/source';
 import {
@@ -65,7 +64,7 @@ describe('Overview', () => {
         mockuseMessagesStorage.mockImplementation(() => endpointNoticeMessage(false));
       });
 
-      it('renders the Setup Instructions text', async () => {
+      it('renders the Setup Instructions text', () => {
         const wrapper = mount(
           <TestProviders>
             <MemoryRouter>
@@ -73,11 +72,10 @@ describe('Overview', () => {
             </MemoryRouter>
           </TestProviders>
         );
-        await waitForUpdates(wrapper);
         expect(wrapper.find('[data-test-subj="empty-page"]').exists()).toBe(true);
       });
 
-      it('does not show Endpoint get ready button when ingest is not enabled', async () => {
+      it('does not show Endpoint get ready button when ingest is not enabled', () => {
         const wrapper = mount(
           <TestProviders>
             <MemoryRouter>
@@ -85,11 +83,10 @@ describe('Overview', () => {
             </MemoryRouter>
           </TestProviders>
         );
-        await waitForUpdates(wrapper);
         expect(wrapper.find('[data-test-subj="empty-page-secondary-action"]').exists()).toBe(false);
       });
 
-      it('shows Endpoint get ready button when ingest is enabled', async () => {
+      it('shows Endpoint get ready button when ingest is enabled', () => {
         (useIngestEnabledCheck as jest.Mock).mockReturnValue({ allEnabled: true });
         const wrapper = mount(
           <TestProviders>
@@ -98,12 +95,11 @@ describe('Overview', () => {
             </MemoryRouter>
           </TestProviders>
         );
-        await waitForUpdates(wrapper);
         expect(wrapper.find('[data-test-subj="empty-page-secondary-action"]').exists()).toBe(true);
       });
     });
 
-    it('it DOES NOT render the Getting started text when an index is available', async () => {
+    it('it DOES NOT render the Getting started text when an index is available', () => {
       (useWithSource as jest.Mock).mockReturnValue({
         indicesExist: true,
         indexPattern: {},
@@ -120,12 +116,12 @@ describe('Overview', () => {
           </MemoryRouter>
         </TestProviders>
       );
-      await waitForUpdates(wrapper);
 
       expect(wrapper.find('[data-test-subj="empty-page"]').exists()).toBe(false);
+      wrapper.unmount();
     });
 
-    test('it DOES render the Endpoint banner when the endpoint index is NOT available AND storage is NOT set', async () => {
+    test('it DOES render the Endpoint banner when the endpoint index is NOT available AND storage is NOT set', () => {
       (useWithSource as jest.Mock).mockReturnValueOnce({
         indicesExist: true,
         indexPattern: {},
@@ -147,12 +143,12 @@ describe('Overview', () => {
           </MemoryRouter>
         </TestProviders>
       );
-      await waitForUpdates(wrapper);
 
       expect(wrapper.find('[data-test-subj="endpoint-prompt-banner"]').exists()).toBe(true);
+      wrapper.unmount();
     });
 
-    test('it does NOT render the Endpoint banner when the endpoint index is NOT available but storage is set', async () => {
+    test('it does NOT render the Endpoint banner when the endpoint index is NOT available but storage is set', () => {
       (useWithSource as jest.Mock).mockReturnValueOnce({
         indicesExist: true,
         indexPattern: {},
@@ -174,12 +170,12 @@ describe('Overview', () => {
           </MemoryRouter>
         </TestProviders>
       );
-      await waitForUpdates(wrapper);
 
       expect(wrapper.find('[data-test-subj="endpoint-prompt-banner"]').exists()).toBe(false);
+      wrapper.unmount();
     });
 
-    test('it does NOT render the Endpoint banner when the endpoint index is available AND storage is set', async () => {
+    test('it does NOT render the Endpoint banner when the endpoint index is available AND storage is set', () => {
       (useWithSource as jest.Mock).mockReturnValue({
         indicesExist: true,
         indexPattern: {},
@@ -196,12 +192,12 @@ describe('Overview', () => {
           </MemoryRouter>
         </TestProviders>
       );
-      await waitForUpdates(wrapper);
 
       expect(wrapper.find('[data-test-subj="endpoint-prompt-banner"]').exists()).toBe(false);
+      wrapper.unmount();
     });
 
-    test('it does NOT render the Endpoint banner when an index IS available but storage is NOT set', async () => {
+    test('it does NOT render the Endpoint banner when an index IS available but storage is NOT set', () => {
       (useWithSource as jest.Mock).mockReturnValue({
         indicesExist: true,
         indexPattern: {},
@@ -219,9 +215,10 @@ describe('Overview', () => {
         </TestProviders>
       );
       expect(wrapper.find('[data-test-subj="endpoint-prompt-banner"]').exists()).toBe(false);
+      wrapper.unmount();
     });
 
-    test('it does NOT render the Endpoint banner when Ingest is NOT available', async () => {
+    test('it does NOT render the Endpoint banner when Ingest is NOT available', () => {
       (useWithSource as jest.Mock).mockReturnValue({
         indicesExist: true,
         indexPattern: {},
@@ -238,9 +235,9 @@ describe('Overview', () => {
           </MemoryRouter>
         </TestProviders>
       );
-      await waitForUpdates(wrapper);
 
       expect(wrapper.find('[data-test-subj="endpoint-prompt-banner"]').exists()).toBe(false);
+      wrapper.unmount();
     });
   });
 });
diff --git a/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/__snapshots__/isometric_taxi_layout.test.ts.snap b/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/__snapshots__/isometric_taxi_layout.test.ts.snap
index 74efb41c4c595..6f26bfe063c05 100644
--- a/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/__snapshots__/isometric_taxi_layout.test.ts.snap
+++ b/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/__snapshots__/isometric_taxi_layout.test.ts.snap
@@ -2,6 +2,7 @@
 
 exports[`resolver graph layout when rendering no nodes renders right 1`] = `
 Object {
+  "ariaLevels": Map {},
   "edgeLineSegments": Array [],
   "processNodePositions": Map {},
 }
@@ -9,6 +10,22 @@ Object {
 
 exports[`resolver graph layout when rendering one node renders right 1`] = `
 Object {
+  "ariaLevels": Map {
+    Object {
+      "@timestamp": 1582233383000,
+      "agent": Object {
+        "id": "",
+        "type": "",
+        "version": "",
+      },
+      "endgame": Object {
+        "event_subtype_full": "creation_event",
+        "event_type_full": "process_event",
+        "process_name": "",
+        "unique_pid": 0,
+      },
+    } => 1,
+  },
   "edgeLineSegments": Array [],
   "processNodePositions": Map {
     Object {
@@ -34,6 +51,134 @@ Object {
 
 exports[`resolver graph layout when rendering two forks, and one fork has an extra long tine renders right 1`] = `
 Object {
+  "ariaLevels": Map {
+    Object {
+      "@timestamp": 1582233383000,
+      "agent": Object {
+        "id": "",
+        "type": "",
+        "version": "",
+      },
+      "endgame": Object {
+        "event_subtype_full": "creation_event",
+        "event_type_full": "process_event",
+        "process_name": "",
+        "unique_pid": 0,
+      },
+    } => 1,
+    Object {
+      "@timestamp": 1582233383000,
+      "agent": Object {
+        "id": "",
+        "type": "",
+        "version": "",
+      },
+      "endgame": Object {
+        "event_subtype_full": "already_running",
+        "event_type_full": "process_event",
+        "unique_pid": 1,
+        "unique_ppid": 0,
+      },
+    } => 2,
+    Object {
+      "@timestamp": 1582233383000,
+      "agent": Object {
+        "id": "",
+        "type": "",
+        "version": "",
+      },
+      "endgame": Object {
+        "event_subtype_full": "creation_event",
+        "event_type_full": "process_event",
+        "unique_pid": 2,
+        "unique_ppid": 0,
+      },
+    } => 2,
+    Object {
+      "@timestamp": 1582233383000,
+      "agent": Object {
+        "id": "",
+        "type": "",
+        "version": "",
+      },
+      "endgame": Object {
+        "event_subtype_full": "termination_event",
+        "event_type_full": "process_event",
+        "unique_pid": 8,
+        "unique_ppid": 0,
+      },
+    } => 2,
+    Object {
+      "@timestamp": 1582233383000,
+      "agent": Object {
+        "id": "",
+        "type": "",
+        "version": "",
+      },
+      "endgame": Object {
+        "event_subtype_full": "creation_event",
+        "event_type_full": "process_event",
+        "unique_pid": 3,
+        "unique_ppid": 1,
+      },
+    } => 3,
+    Object {
+      "@timestamp": 1582233383000,
+      "agent": Object {
+        "id": "",
+        "type": "",
+        "version": "",
+      },
+      "endgame": Object {
+        "event_subtype_full": "creation_event",
+        "event_type_full": "process_event",
+        "unique_pid": 4,
+        "unique_ppid": 1,
+      },
+    } => 3,
+    Object {
+      "@timestamp": 1582233383000,
+      "agent": Object {
+        "id": "",
+        "type": "",
+        "version": "",
+      },
+      "endgame": Object {
+        "event_subtype_full": "creation_event",
+        "event_type_full": "process_event",
+        "unique_pid": 5,
+        "unique_ppid": 2,
+      },
+    } => 3,
+    Object {
+      "@timestamp": 1582233383000,
+      "agent": Object {
+        "id": "",
+        "type": "",
+        "version": "",
+      },
+      "endgame": Object {
+        "event_subtype_full": "creation_event",
+        "event_type_full": "process_event",
+        "unique_pid": 6,
+        "unique_ppid": 2,
+      },
+    } => 3,
+    Object {
+      "@timestamp": 1582233383000,
+      "agent": Object {
+        "id": "",
+        "type": "",
+        "version": "",
+      },
+      "endgame": Object {
+        "event_subtype_full": "creation_event",
+        "event_type_full": "process_event",
+        "unique_pid": 7,
+        "unique_ppid": 6,
+      },
+    } => 4,
+  },
   "edgeLineSegments": Array [
     Object {
       "metadata": Object {
@@ -406,6 +551,36 @@ Object {
 
 exports[`resolver graph layout when rendering two nodes, one being the parent of the other renders right 1`] = `
 Object {
+  "ariaLevels": Map {
+    Object {
+      "@timestamp": 1582233383000,
+      "agent": Object {
+        "id": "",
+        "type": "",
+        "version": "",
+      },
+      "endgame": Object {
+        "event_subtype_full": "creation_event",
+        "event_type_full": "process_event",
+        "process_name": "",
+        "unique_pid": 0,
+      },
+    } => 1,
+    Object {
+      "@timestamp": 1582233383000,
+      "agent": Object {
+        "id": "",
+        "type": "",
+        "version": "",
+      },
+      "endgame": Object {
+        "event_subtype_full": "already_running",
+        "event_type_full": "process_event",
+        "unique_pid": 1,
+        "unique_ppid": 0,
+      },
+    } => 2,
+  },
   "edgeLineSegments": Array [
     Object {
       "metadata": Object {
diff --git a/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/index.ts b/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/index.ts
index b322de0f34526..35a32d91d8a02 100644
--- a/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/index.ts
+++ b/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/index.ts
@@ -4,99 +4,46 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { uniquePidForProcess, uniqueParentPidForProcess } from '../process_event';
-import { IndexedProcessTree, AdjacentProcessMap } from '../../types';
+import { uniquePidForProcess, uniqueParentPidForProcess, orderByTime } from '../process_event';
+import { IndexedProcessTree } from '../../types';
 import { ResolverEvent } from '../../../../common/endpoint/types';
 import { levelOrder as baseLevelOrder } from '../../lib/tree_sequencers';
 
 /**
- * Create a new IndexedProcessTree from an array of ProcessEvents
+ * Create a new IndexedProcessTree from an array of ProcessEvents.
+ * siblings will be ordered by timestamp
  */
-export function factory(processes: ResolverEvent[]): IndexedProcessTree {
+export function factory(
+  // Array of processes to index as a tree
+  processes: ResolverEvent[]
+): IndexedProcessTree {
   const idToChildren = new Map<string | undefined, ResolverEvent[]>();
   const idToValue = new Map<string, ResolverEvent>();
-  const idToAdjacent = new Map<string, AdjacentProcessMap>();
-
-  function emptyAdjacencyMap(id: string): AdjacentProcessMap {
-    return {
-      self: id,
-      parent: null,
-      firstChild: null,
-      previousSibling: null,
-      nextSibling: null,
-      level: 1,
-    };
-  }
-
-  const roots: ResolverEvent[] = [];
 
   for (const process of processes) {
     const uniqueProcessPid = uniquePidForProcess(process);
     idToValue.set(uniqueProcessPid, process);
 
-    const currentProcessAdjacencyMap: AdjacentProcessMap =
-      idToAdjacent.get(uniqueProcessPid) || emptyAdjacencyMap(uniqueProcessPid);
-    idToAdjacent.set(uniqueProcessPid, currentProcessAdjacencyMap);
-
     const uniqueParentPid = uniqueParentPidForProcess(process);
-    const currentProcessSiblings = idToChildren.get(uniqueParentPid);
-
-    if (currentProcessSiblings) {
-      const previousProcessId = uniquePidForProcess(
-        currentProcessSiblings[currentProcessSiblings.length - 1]
-      );
-      currentProcessSiblings.push(process);
-      /**
-       * Update adjacency maps for current and previous entries
-       */
-      idToAdjacent.get(previousProcessId)!.nextSibling = uniqueProcessPid;
-      currentProcessAdjacencyMap.previousSibling = previousProcessId;
-      if (uniqueParentPid) {
-        currentProcessAdjacencyMap.parent = uniqueParentPid;
+    // if its defined and not ''
+    if (uniqueParentPid) {
+      let siblings = idToChildren.get(uniqueParentPid);
+      if (!siblings) {
+        siblings = [];
+        idToChildren.set(uniqueParentPid, siblings);
       }
-    } else {
-      if (uniqueParentPid) {
-        idToChildren.set(uniqueParentPid, [process]);
-        /**
-         * Get the parent's map, otherwise set an empty one
-         */
-        const parentAdjacencyMap =
-          idToAdjacent.get(uniqueParentPid) ||
-          (idToAdjacent.set(uniqueParentPid, emptyAdjacencyMap(uniqueParentPid)),
-          idToAdjacent.get(uniqueParentPid))!;
-        // set firstChild for parent
-        parentAdjacencyMap.firstChild = uniqueProcessPid;
-        // set parent for current
-        currentProcessAdjacencyMap.parent = uniqueParentPid || null;
-      } else {
-        // In this case (no unique parent id), it must be a root
-        roots.push(process);
-      }
-    }
-  }
-
-  /**
-   * Scan adjacency maps from the top down and assign levels
-   */
-  function traverseLevels(currentProcessMap: AdjacentProcessMap, level: number = 1): void {
-    const nextLevel = level + 1;
-    if (currentProcessMap.nextSibling) {
-      traverseLevels(idToAdjacent.get(currentProcessMap.nextSibling)!, level);
-    }
-    if (currentProcessMap.firstChild) {
-      traverseLevels(idToAdjacent.get(currentProcessMap.firstChild)!, nextLevel);
+      siblings.push(process);
     }
-    currentProcessMap.level = level;
   }
 
-  for (const treeRoot of roots) {
-    traverseLevels(idToAdjacent.get(uniquePidForProcess(treeRoot))!);
+  // sort the children of each node
+  for (const siblings of idToChildren.values()) {
+    siblings.sort(orderByTime);
   }
 
   return {
     idToChildren,
     idToProcess: idToValue,
-    idToAdjacent,
   };
 }
 
@@ -109,6 +56,13 @@ export function children(tree: IndexedProcessTree, process: ResolverEvent): Reso
   return currentProcessSiblings === undefined ? [] : currentProcessSiblings;
 }
 
+/**
+ * Get the indexed process event for the ID
+ */
+export function processEvent(tree: IndexedProcessTree, entityID: string): ResolverEvent | null {
+  return tree.idToProcess.get(entityID) ?? null;
+}
+
 /**
  * Returns the parent ProcessEvent, if any, for the passed in `childProcess`
  */
@@ -124,6 +78,31 @@ export function parent(
   }
 }
 
+/**
+ * Returns the following sibling
+ */
+export function nextSibling(
+  tree: IndexedProcessTree,
+  sibling: ResolverEvent
+): ResolverEvent | undefined {
+  const parentNode = parent(tree, sibling);
+  if (parentNode) {
+    // The siblings of `sibling` are the children of its parent.
+    const siblings = children(tree, parentNode);
+
+    // Find the sibling
+    const index = siblings.indexOf(sibling);
+
+    // if the sibling wasn't found, or if it was the last element in the array, return undefined
+    if (index === -1 || index === siblings.length - 1) {
+      return undefined;
+    }
+
+    // return the next sibling
+    return siblings[index + 1];
+  }
+}
+
 /**
  * Number of processes in the tree
  */
@@ -138,7 +117,10 @@ export function root(tree: IndexedProcessTree) {
   if (size(tree) === 0) {
     return null;
   }
+  // any node will do
   let current: ResolverEvent = tree.idToProcess.values().next().value;
+
+  // iteratively swap current w/ its parent
   while (parent(tree, current) !== undefined) {
     current = parent(tree, current)!;
   }
diff --git a/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/isometric_taxi_layout.test.ts b/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/isometric_taxi_layout.test.ts
index 72d8e878465f7..bd534dcb989e3 100644
--- a/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/isometric_taxi_layout.test.ts
+++ b/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/isometric_taxi_layout.test.ts
@@ -148,5 +148,24 @@ describe('resolver graph layout', () => {
     it('renders right', () => {
       expect(layout()).toMatchSnapshot();
     });
+    it('should have node a at level 1', () => {
+      expect(layout().ariaLevels.get(processA)).toBe(1);
+    });
+    it('should have nodes b and c at level 2', () => {
+      expect(layout().ariaLevels.get(processB)).toBe(2);
+      expect(layout().ariaLevels.get(processC)).toBe(2);
+    });
+    it('should have nodes d, e, f, and g at level 3', () => {
+      expect(layout().ariaLevels.get(processD)).toBe(3);
+      expect(layout().ariaLevels.get(processE)).toBe(3);
+      expect(layout().ariaLevels.get(processF)).toBe(3);
+      expect(layout().ariaLevels.get(processG)).toBe(3);
+    });
+    it('should have node h at level 4', () => {
+      expect(layout().ariaLevels.get(processH)).toBe(4);
+    });
+    it('should have 9 items in the map of aria levels', () => {
+      expect(layout().ariaLevels.size).toBe(9);
+    });
   });
 });
diff --git a/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/isometric_taxi_layout.ts b/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/isometric_taxi_layout.ts
index 61363ffa05d94..6058a40037ad2 100644
--- a/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/isometric_taxi_layout.ts
+++ b/x-pack/plugins/security_solution/public/resolver/models/indexed_process_tree/isometric_taxi_layout.ts
@@ -73,9 +73,34 @@ export function isometricTaxiLayout(indexedProcessTree: IndexedProcessTree): Iso
   return {
     processNodePositions: transformedPositions,
     edgeLineSegments: transformedEdgeLineSegments,
+    ariaLevels: ariaLevels(indexedProcessTree),
   };
 }
 
+/**
+ * Calculate a level (starting at 1) for each node.
+ */
+function ariaLevels(indexedProcessTree: IndexedProcessTree): Map<ResolverEvent, number> {
+  const map: Map<ResolverEvent, number> = new Map();
+  for (const node of model.levelOrder(indexedProcessTree)) {
+    const parentNode = model.parent(indexedProcessTree, node);
+    if (parentNode === undefined) {
+      // nodes at the root have a level of 1
+      map.set(node, 1);
+    } else {
+      const parentLevel: number | undefined = map.get(parentNode);
+
+      // because we're iterating in level order, we should have processed the parent of any node that has one.
+      if (parentLevel === undefined) {
+        throw new Error('failed to calculate aria levels');
+      }
+
+      map.set(node, parentLevel + 1);
+    }
+  }
+  return map;
+}
+
 /**
  * In laying out the graph, we precalculate the 'width' of each subtree. The 'width' of the subtree is determined by its
  * descedants and the rule that each process node must be at least 1 unit apart. Enforcing that all nodes are at least
diff --git a/x-pack/plugins/security_solution/public/resolver/models/process_event.test.ts b/x-pack/plugins/security_solution/public/resolver/models/process_event.test.ts
index 04a3f9ccff772..7eb692851bc9b 100644
--- a/x-pack/plugins/security_solution/public/resolver/models/process_event.test.ts
+++ b/x-pack/plugins/security_solution/public/resolver/models/process_event.test.ts
@@ -3,10 +3,10 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import { eventType } from './process_event';
+import { eventType, orderByTime } from './process_event';
 
 import { mockProcessEvent } from './process_event_test_helpers';
-import { LegacyEndpointEvent } from '../../../common/endpoint/types';
+import { LegacyEndpointEvent, ResolverEvent } from '../../../common/endpoint/types';
 
 describe('process event', () => {
   describe('eventType', () => {
@@ -24,4 +24,86 @@ describe('process event', () => {
       expect(eventType(event)).toEqual('processCreated');
     });
   });
+  describe('orderByTime', () => {
+    let mock: (time: number, eventID: string) => ResolverEvent;
+    let events: ResolverEvent[];
+    beforeEach(() => {
+      mock = (time, eventID) => {
+        return {
+          '@timestamp': time,
+          event: {
+            id: eventID,
+          },
+        } as ResolverEvent;
+      };
+      // 2 events each for numbers -1, 0, 1, and NaN
+      // each event has a unique id, a through h
+      // order is arbitrary
+      events = [
+        mock(-1, 'a'),
+        mock(0, 'c'),
+        mock(1, 'e'),
+        mock(NaN, 'g'),
+        mock(-1, 'b'),
+        mock(0, 'd'),
+        mock(1, 'f'),
+        mock(NaN, 'h'),
+      ];
+    });
+    it('sorts events as expected', () => {
+      events.sort(orderByTime);
+      expect(events).toMatchInlineSnapshot(`
+        Array [
+          Object {
+            "@timestamp": -1,
+            "event": Object {
+              "id": "a",
+            },
+          },
+          Object {
+            "@timestamp": -1,
+            "event": Object {
+              "id": "b",
+            },
+          },
+          Object {
+            "@timestamp": 0,
+            "event": Object {
+              "id": "c",
+            },
+          },
+          Object {
+            "@timestamp": 0,
+            "event": Object {
+              "id": "d",
+            },
+          },
+          Object {
+            "@timestamp": 1,
+            "event": Object {
+              "id": "e",
+            },
+          },
+          Object {
+            "@timestamp": 1,
+            "event": Object {
+              "id": "f",
+            },
+          },
+          Object {
+            "@timestamp": NaN,
+            "event": Object {
+              "id": "g",
+            },
+          },
+          Object {
+            "@timestamp": NaN,
+            "event": Object {
+              "id": "h",
+            },
+          },
+        ]
+      `);
+    });
+  });
 });
diff --git a/x-pack/plugins/security_solution/public/resolver/models/process_event.ts b/x-pack/plugins/security_solution/public/resolver/models/process_event.ts
index 0286cca93b43f..4f8df87b3ac0b 100644
--- a/x-pack/plugins/security_solution/public/resolver/models/process_event.ts
+++ b/x-pack/plugins/security_solution/public/resolver/models/process_event.ts
@@ -28,6 +28,19 @@ export function isTerminatedProcess(passedEvent: ResolverEvent) {
   return eventType(passedEvent) === 'processTerminated';
 }
 
+/**
+ * ms since unix epoc, based on timestamp.
+ * may return NaN if the timestamp wasn't present or was invalid.
+ */
+export function datetime(passedEvent: ResolverEvent): number | null {
+  const timestamp = event.eventTimestamp(passedEvent);
+
+  const time = timestamp === undefined ? 0 : new Date(timestamp).getTime();
+
+  // if the date could not be parsed, return null
+  return isNaN(time) ? null : time;
+}
+
 /**
  * Returns a custom event type for a process event based on the event's metadata.
  */
@@ -161,3 +174,22 @@ export function argsForProcess(passedEvent: ResolverEvent): string | undefined {
   }
   return passedEvent?.process?.args;
 }
+
+/**
+ * used to sort events
+ */
+export function orderByTime(first: ResolverEvent, second: ResolverEvent): number {
+  const firstDatetime: number | null = datetime(first);
+  const secondDatetime: number | null = datetime(second);
+
+  if (firstDatetime === secondDatetime) {
+    // break ties using an arbitrary (stable) comparison of `eventId` (which should be unique)
+    return String(event.eventId(first)).localeCompare(String(event.eventId(second)));
+  } else if (firstDatetime === null || secondDatetime === null) {
+    // sort `null`'s as higher than numbers
+    return (firstDatetime === null ? 1 : 0) - (secondDatetime === null ? 1 : 0);
+  } else {
+    // sort in ascending order.
+    return firstDatetime - secondDatetime;
+  }
+}
diff --git a/x-pack/plugins/security_solution/public/resolver/store/data/selectors.ts b/x-pack/plugins/security_solution/public/resolver/store/data/selectors.ts
index 475546cfc3966..dc17fc70ef8af 100644
--- a/x-pack/plugins/security_solution/public/resolver/store/data/selectors.ts
+++ b/x-pack/plugins/security_solution/public/resolver/store/data/selectors.ts
@@ -8,7 +8,6 @@ import rbush from 'rbush';
 import { createSelector, defaultMemoize } from 'reselect';
 import {
   DataState,
-  AdjacentProcessMap,
   Vector2,
   IndexedEntity,
   IndexedEdgeLineSegment,
@@ -21,7 +20,7 @@ import {
   isTerminatedProcess,
   uniquePidForProcess,
 } from '../../models/process_event';
-import { factory as indexedProcessTreeFactory } from '../../models/indexed_process_tree';
+import * as indexedProcessTreeModel from '../../models/indexed_process_tree';
 import { isEqual } from '../../models/aabb';
 
 import {
@@ -107,7 +106,7 @@ export const indexedProcessTree = createSelector(graphableProcesses, function in
   graphableProcesses
   /* eslint-enable no-shadow */
 ) {
-  return indexedProcessTreeFactory(graphableProcesses);
+  return indexedProcessTreeModel.factory(graphableProcesses);
 });
 
 /**
@@ -170,27 +169,6 @@ export function relatedEventsReady(data: DataState): Map<string, boolean> {
   return data.relatedEventsReady;
 }
 
-export const processAdjacencies = createSelector(
-  indexedProcessTree,
-  graphableProcesses,
-  function selectProcessAdjacencies(
-    /* eslint-disable no-shadow */
-    indexedProcessTree,
-    graphableProcesses
-    /* eslint-enable no-shadow */
-  ) {
-    const processToAdjacencyMap = new Map<ResolverEvent, AdjacentProcessMap>();
-    const { idToAdjacent } = indexedProcessTree;
-
-    for (const graphableProcess of graphableProcesses) {
-      const processPid = uniquePidForProcess(graphableProcess);
-      const adjacencyMap = idToAdjacent.get(processPid)!;
-      processToAdjacencyMap.set(graphableProcess, adjacencyMap);
-    }
-    return { processToAdjacencyMap };
-  }
-);
-
 /**
  * `true` if there were more children than we got in the last request.
  */
@@ -230,7 +208,7 @@ export const relatedEventInfoByEntityId: (
   ) {
     if (!relatedEventsStats) {
       // If there are no related event stats, there are no related event info objects
-      return (entityId: string) => null;
+      return () => null;
     }
     return (entityId) => {
       const stats = relatedEventsStats.get(entityId);
@@ -334,7 +312,8 @@ export function databaseDocumentIDToFetch(state: DataState): string | null {
     return null;
   }
 }
-export const processNodePositionsAndEdgeLineSegments = createSelector(
+
+export const layout = createSelector(
   indexedProcessTree,
   function processNodePositionsAndEdgeLineSegments(
     /* eslint-disable no-shadow */
@@ -345,9 +324,62 @@ export const processNodePositionsAndEdgeLineSegments = createSelector(
   }
 );
 
-const indexedProcessNodePositionsAndEdgeLineSegments = createSelector(
-  processNodePositionsAndEdgeLineSegments,
-  function visibleProcessNodePositionsAndEdgeLineSegments({
+/**
+ * Given a nodeID (aka entity_id) get the indexed process event.
+ * Legacy functions take process events instead of nodeID, use this to get
+ * process events for them.
+ */
+export const processEventForID: (
+  state: DataState
+) => (nodeID: string) => ResolverEvent | null = createSelector(
+  indexedProcessTree,
+  (tree) => (nodeID: string) => indexedProcessTreeModel.processEvent(tree, nodeID)
+);
+
+/**
+ * Takes a nodeID (aka entity_id) and returns the associated aria level as a number or null if the node ID isn't in the tree.
+ */
+export const ariaLevel: (state: DataState) => (nodeID: string) => number | null = createSelector(
+  layout,
+  processEventForID,
+  ({ ariaLevels }, processEventGetter) => (nodeID: string) => {
+    const node = processEventGetter(nodeID);
+    return node ? ariaLevels.get(node) ?? null : null;
+  }
+);
+
+/**
+ * Returns the following sibling if there is one, or `null`.
+ */
+export const followingSibling: (
+  state: DataState
+) => (nodeID: string) => string | null = createSelector(
+  indexedProcessTree,
+  processEventForID,
+  (tree, eventGetter) => {
+    return (nodeID: string) => {
+      const event = eventGetter(nodeID);
+
+      // event not found
+      if (event === null) {
+        return null;
+      }
+      const nextSibling = indexedProcessTreeModel.nextSibling(tree, event);
+
+      // next sibling not found
+      if (nextSibling === undefined) {
+        return null;
+      }
+
+      // return the node ID
+      return uniquePidForProcess(nextSibling);
+    };
+  }
+);
+
+const spatiallyIndexedLayout: (state: DataState) => rbush<IndexedEntity> = createSelector(
+  layout,
+  function ({
     /* eslint-disable no-shadow */
     processNodePositions,
     edgeLineSegments,
@@ -394,47 +426,46 @@ const indexedProcessNodePositionsAndEdgeLineSegments = createSelector(
   }
 );
 
-export const visibleProcessNodePositionsAndEdgeLineSegments = createSelector(
-  indexedProcessNodePositionsAndEdgeLineSegments,
-  function visibleProcessNodePositionsAndEdgeLineSegments(tree) {
-    // memoize the results of this call to avoid unnecessarily rerunning
-    let lastBoundingBox: AABB | null = null;
-    let currentlyVisible: VisibleEntites = {
-      processNodePositions: new Map<ResolverEvent, Vector2>(),
-      connectingEdgeLineSegments: [],
-    };
-    return (boundingBox: AABB) => {
-      if (lastBoundingBox !== null && isEqual(lastBoundingBox, boundingBox)) {
-        return currentlyVisible;
-      } else {
-        const {
-          minimum: [minX, minY],
-          maximum: [maxX, maxY],
-        } = boundingBox;
-        const entities = tree.search({
-          minX,
-          minY,
-          maxX,
-          maxY,
-        });
-        const visibleProcessNodePositions = new Map<ResolverEvent, Vector2>(
-          entities
-            .filter((entity): entity is IndexedProcessNode => entity.type === 'processNode')
-            .map((node) => [node.entity, node.position])
-        );
-        const connectingEdgeLineSegments = entities
-          .filter((entity): entity is IndexedEdgeLineSegment => entity.type === 'edgeLine')
-          .map((node) => node.entity);
-        currentlyVisible = {
-          processNodePositions: visibleProcessNodePositions,
-          connectingEdgeLineSegments,
-        };
-        lastBoundingBox = boundingBox;
-        return currentlyVisible;
-      }
-    };
-  }
-);
+export const nodesAndEdgelines: (
+  state: DataState
+) => (query: AABB) => VisibleEntites = createSelector(spatiallyIndexedLayout, function (tree) {
+  // memoize the results of this call to avoid unnecessarily rerunning
+  let lastBoundingBox: AABB | null = null;
+  let currentlyVisible: VisibleEntites = {
+    processNodePositions: new Map<ResolverEvent, Vector2>(),
+    connectingEdgeLineSegments: [],
+  };
+  return (boundingBox: AABB) => {
+    if (lastBoundingBox !== null && isEqual(lastBoundingBox, boundingBox)) {
+      return currentlyVisible;
+    } else {
+      const {
+        minimum: [minX, minY],
+        maximum: [maxX, maxY],
+      } = boundingBox;
+      const entities = tree.search({
+        minX,
+        minY,
+        maxX,
+        maxY,
+      });
+      const visibleProcessNodePositions = new Map<ResolverEvent, Vector2>(
+        entities
+          .filter((entity): entity is IndexedProcessNode => entity.type === 'processNode')
+          .map((node) => [node.entity, node.position])
+      );
+      const connectingEdgeLineSegments = entities
+        .filter((entity): entity is IndexedEdgeLineSegment => entity.type === 'edgeLine')
+        .map((node) => node.entity);
+      currentlyVisible = {
+        processNodePositions: visibleProcessNodePositions,
+        connectingEdgeLineSegments,
+      };
+      lastBoundingBox = boundingBox;
+      return currentlyVisible;
+    }
+  };
+});
 
 /**
  * If there is a pending request that's for a entity ID that doesn't matche the `entityID`, then we should cancel it.
diff --git a/x-pack/plugins/security_solution/public/resolver/store/data/visible_entities.test.ts b/x-pack/plugins/security_solution/public/resolver/store/data/visible_entities.test.ts
index eb2b402a694a5..e91c455c9445f 100644
--- a/x-pack/plugins/security_solution/public/resolver/store/data/visible_entities.test.ts
+++ b/x-pack/plugins/security_solution/public/resolver/store/data/visible_entities.test.ts
@@ -9,7 +9,7 @@ import { ResolverAction } from '../actions';
 import { resolverReducer } from '../reducer';
 import { ResolverState } from '../../types';
 import { LegacyEndpointEvent, ResolverEvent } from '../../../../common/endpoint/types';
-import { visibleProcessNodePositionsAndEdgeLineSegments } from '../selectors';
+import { visibleNodesAndEdgeLines } from '../selectors';
 import { mockProcessEvent } from '../../models/process_event_test_helpers';
 import { mock as mockResolverTree } from '../../models/resolver_tree';
 
@@ -119,15 +119,11 @@ describe('resolver visible entities', () => {
       store.dispatch(cameraAction);
     });
     it('the visibleProcessNodePositions list should only include 2 nodes', () => {
-      const { processNodePositions } = visibleProcessNodePositionsAndEdgeLineSegments(
-        store.getState()
-      )(0);
+      const { processNodePositions } = visibleNodesAndEdgeLines(store.getState())(0);
       expect([...processNodePositions.keys()].length).toEqual(2);
     });
     it('the visibleEdgeLineSegments list should only include one edge line', () => {
-      const { connectingEdgeLineSegments } = visibleProcessNodePositionsAndEdgeLineSegments(
-        store.getState()
-      )(0);
+      const { connectingEdgeLineSegments } = visibleNodesAndEdgeLines(store.getState())(0);
       expect(connectingEdgeLineSegments.length).toEqual(1);
     });
   });
@@ -151,15 +147,11 @@ describe('resolver visible entities', () => {
       store.dispatch(cameraAction);
     });
     it('the visibleProcessNodePositions list should include all process nodes', () => {
-      const { processNodePositions } = visibleProcessNodePositionsAndEdgeLineSegments(
-        store.getState()
-      )(0);
+      const { processNodePositions } = visibleNodesAndEdgeLines(store.getState())(0);
       expect([...processNodePositions.keys()].length).toEqual(5);
     });
     it('the visibleEdgeLineSegments list include all lines', () => {
-      const { connectingEdgeLineSegments } = visibleProcessNodePositionsAndEdgeLineSegments(
-        store.getState()
-      )(0);
+      const { connectingEdgeLineSegments } = visibleNodesAndEdgeLines(store.getState())(0);
       expect(connectingEdgeLineSegments.length).toEqual(4);
     });
   });
diff --git a/x-pack/plugins/security_solution/public/resolver/store/index.ts b/x-pack/plugins/security_solution/public/resolver/store/index.ts
index 9809e443d2d13..d9e750241ced1 100644
--- a/x-pack/plugins/security_solution/public/resolver/store/index.ts
+++ b/x-pack/plugins/security_solution/public/resolver/store/index.ts
@@ -16,10 +16,10 @@ import { ResolverAction } from './actions';
 export const storeFactory = (
   context?: KibanaReactContextValue<StartServices>
 ): Store<ResolverState, ResolverAction> => {
-  const actionsBlacklist: Array<ResolverAction['type']> = ['userMovedPointer'];
+  const actionsDenylist: Array<ResolverAction['type']> = ['userMovedPointer'];
   const composeEnhancers = composeWithDevTools({
     name: 'Resolver',
-    actionsBlacklist,
+    actionsBlacklist: actionsDenylist,
   });
   const middlewareEnhancer = applyMiddleware(resolverMiddlewareFactory(context));
 
diff --git a/x-pack/plugins/security_solution/public/resolver/store/methods.ts b/x-pack/plugins/security_solution/public/resolver/store/methods.ts
index 3890770259156..ad06ddf36161a 100644
--- a/x-pack/plugins/security_solution/public/resolver/store/methods.ts
+++ b/x-pack/plugins/security_solution/public/resolver/store/methods.ts
@@ -5,7 +5,7 @@
  */
 
 import { animatePanning } from './camera/methods';
-import { processNodePositionsAndEdgeLineSegments } from './selectors';
+import { layout } from './selectors';
 import { ResolverState } from '../types';
 import { ResolverEvent } from '../../../common/endpoint/types';
 
@@ -19,7 +19,7 @@ export function animateProcessIntoView(
   startTime: number,
   process: ResolverEvent
 ): ResolverState {
-  const { processNodePositions } = processNodePositionsAndEdgeLineSegments(state);
+  const { processNodePositions } = layout(state);
   const position = processNodePositions.get(process);
   if (position) {
     return {
diff --git a/x-pack/plugins/security_solution/public/resolver/store/selectors.test.ts b/x-pack/plugins/security_solution/public/resolver/store/selectors.test.ts
new file mode 100644
index 0000000000000..ba4a5a169c549
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/resolver/store/selectors.test.ts
@@ -0,0 +1,259 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { ResolverState } from '../types';
+import { createStore } from 'redux';
+import { ResolverAction } from './actions';
+import { resolverReducer } from './reducer';
+import * as selectors from './selectors';
+import { EndpointEvent, ResolverEvent, ResolverTree } from '../../../common/endpoint/types';
+
+describe('resolver selectors', () => {
+  const actions: ResolverAction[] = [];
+
+  /**
+   * Get state, given an ordered collection of actions.
+   */
+  const state: () => ResolverState = () => {
+    const store = createStore(resolverReducer);
+    for (const action of actions) {
+      store.dispatch(action);
+    }
+    return store.getState();
+  };
+  describe('ariaFlowtoNodeID', () => {
+    describe('with a tree with no descendants and 2 ancestors', () => {
+      const originID = 'c';
+      const firstAncestorID = 'b';
+      const secondAncestorID = 'a';
+      beforeEach(() => {
+        actions.push({
+          type: 'serverReturnedResolverData',
+          payload: {
+            result: treeWith2AncestorsAndNoChildren({
+              originID,
+              firstAncestorID,
+              secondAncestorID,
+            }),
+            // this value doesn't matter
+            databaseDocumentID: '',
+          },
+        });
+      });
+      describe('when all nodes are in view', () => {
+        beforeEach(() => {
+          const size = 1000000;
+          actions.push({
+            // set the size of the camera
+            type: 'userSetRasterSize',
+            payload: [size, size],
+          });
+        });
+        it('should return no flowto for the second ancestor', () => {
+          expect(selectors.ariaFlowtoNodeID(state())(0)(secondAncestorID)).toBe(null);
+        });
+        it('should return no flowto for the first ancestor', () => {
+          expect(selectors.ariaFlowtoNodeID(state())(0)(firstAncestorID)).toBe(null);
+        });
+        it('should return no flowto for the origin', () => {
+          expect(selectors.ariaFlowtoNodeID(state())(0)(originID)).toBe(null);
+        });
+      });
+    });
+    describe('with a tree with 2 children and no ancestors', () => {
+      const originID = 'c';
+      const firstChildID = 'd';
+      const secondChildID = 'e';
+      beforeEach(() => {
+        actions.push({
+          type: 'serverReturnedResolverData',
+          payload: {
+            result: treeWithNoAncestorsAnd2Children({ originID, firstChildID, secondChildID }),
+            // this value doesn't matter
+            databaseDocumentID: '',
+          },
+        });
+      });
+      describe('when all nodes are in view', () => {
+        beforeEach(() => {
+          const rasterSize = 1000000;
+          actions.push({
+            // set the size of the camera
+            type: 'userSetRasterSize',
+            payload: [rasterSize, rasterSize],
+          });
+        });
+        it('should return no flowto for the origin', () => {
+          expect(selectors.ariaFlowtoNodeID(state())(0)(originID)).toBe(null);
+        });
+        it('should return the second child as the flowto for the first child', () => {
+          expect(selectors.ariaFlowtoNodeID(state())(0)(firstChildID)).toBe(secondChildID);
+        });
+        it('should return no flowto for second child', () => {
+          expect(selectors.ariaFlowtoNodeID(state())(0)(secondChildID)).toBe(null);
+        });
+      });
+      describe('when only the origin and first child are in view', () => {
+        beforeEach(() => {
+          // set the raster size
+          const rasterSize = 1000000;
+          actions.push({
+            // set the size of the camera
+            type: 'userSetRasterSize',
+            payload: [rasterSize, rasterSize],
+          });
+
+          // get the layout
+          const layout = selectors.layout(state());
+
+          // find the position of the second child
+          const secondChild = selectors.processEventForID(state())(secondChildID);
+          const positionOfSecondChild = layout.processNodePositions.get(secondChild!)!;
+
+          // the child is indexed by an AABB that extends -720/2 to the left
+          const leftSideOfSecondChildAABB = positionOfSecondChild[0] - 720 / 2;
+
+          // adjust the camera so that it doesn't quite see the second child
+          actions.push({
+            // set the position of the camera so that the left edge of the second child is at the right edge
+            // of the viewable area
+            type: 'userSetPositionOfCamera',
+            payload: [rasterSize / -2 + leftSideOfSecondChildAABB, 0],
+          });
+        });
+        it('the origin should be in view', () => {
+          const origin = selectors.processEventForID(state())(originID)!;
+          expect(
+            selectors.visibleNodesAndEdgeLines(state())(0).processNodePositions.has(origin)
+          ).toBe(true);
+        });
+        it('the first child should be in view', () => {
+          const firstChild = selectors.processEventForID(state())(firstChildID)!;
+          expect(
+            selectors.visibleNodesAndEdgeLines(state())(0).processNodePositions.has(firstChild)
+          ).toBe(true);
+        });
+        it('the second child should not be in view', () => {
+          const secondChild = selectors.processEventForID(state())(secondChildID)!;
+          expect(
+            selectors.visibleNodesAndEdgeLines(state())(0).processNodePositions.has(secondChild)
+          ).toBe(false);
+        });
+        it('should return nothing as the flowto for the first child', () => {
+          expect(selectors.ariaFlowtoNodeID(state())(0)(firstChildID)).toBe(null);
+        });
+      });
+    });
+  });
+});
+/**
+ * Simple mock endpoint event that works for tree layouts.
+ */
+function mockEndpointEvent({
+  entityID,
+  name,
+  parentEntityId,
+  timestamp,
+}: {
+  entityID: string;
+  name: string;
+  parentEntityId: string;
+  timestamp: number;
+}): EndpointEvent {
+  return {
+    '@timestamp': timestamp,
+    event: {
+      type: 'start',
+      category: 'process',
+    },
+    process: {
+      entity_id: entityID,
+      name,
+      parent: {
+        entity_id: parentEntityId,
+      },
+    },
+  } as EndpointEvent;
+}
+
+function treeWith2AncestorsAndNoChildren({
+  originID,
+  firstAncestorID,
+  secondAncestorID,
+}: {
+  secondAncestorID: string;
+  firstAncestorID: string;
+  originID: string;
+}): ResolverTree {
+  const secondAncestor: ResolverEvent = mockEndpointEvent({
+    entityID: secondAncestorID,
+    name: 'a',
+    parentEntityId: 'none',
+    timestamp: 0,
+  });
+  const firstAncestor: ResolverEvent = mockEndpointEvent({
+    entityID: firstAncestorID,
+    name: 'b',
+    parentEntityId: secondAncestorID,
+    timestamp: 1,
+  });
+  const originEvent: ResolverEvent = mockEndpointEvent({
+    entityID: originID,
+    name: 'c',
+    parentEntityId: firstAncestorID,
+    timestamp: 2,
+  });
+  return ({
+    entityID: originID,
+    children: {
+      childNodes: [],
+    },
+    ancestry: {
+      ancestors: [{ lifecycle: [secondAncestor] }, { lifecycle: [firstAncestor] }],
+    },
+    lifecycle: [originEvent],
+  } as unknown) as ResolverTree;
+}
+
+function treeWithNoAncestorsAnd2Children({
+  originID,
+  firstChildID,
+  secondChildID,
+}: {
+  originID: string;
+  firstChildID: string;
+  secondChildID: string;
+}): ResolverTree {
+  const origin: ResolverEvent = mockEndpointEvent({
+    entityID: originID,
+    name: 'c',
+    parentEntityId: 'none',
+    timestamp: 0,
+  });
+  const firstChild: ResolverEvent = mockEndpointEvent({
+    entityID: firstChildID,
+    name: 'd',
+    parentEntityId: originID,
+    timestamp: 1,
+  });
+  const secondChild: ResolverEvent = mockEndpointEvent({
+    entityID: secondChildID,
+    name: 'e',
+    parentEntityId: originID,
+    timestamp: 2,
+  });
+
+  return ({
+    entityID: originID,
+    children: {
+      childNodes: [{ lifecycle: [firstChild] }, { lifecycle: [secondChild] }],
+    },
+    ancestry: {
+      ancestors: [],
+    },
+    lifecycle: [origin],
+  } as unknown) as ResolverTree;
+}
diff --git a/x-pack/plugins/security_solution/public/resolver/store/selectors.ts b/x-pack/plugins/security_solution/public/resolver/store/selectors.ts
index 945b2bfed3cfb..ff2179dc3a2ae 100644
--- a/x-pack/plugins/security_solution/public/resolver/store/selectors.ts
+++ b/x-pack/plugins/security_solution/public/resolver/store/selectors.ts
@@ -4,11 +4,13 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { createSelector } from 'reselect';
+import { createSelector, defaultMemoize } from 'reselect';
 import * as cameraSelectors from './camera/selectors';
 import * as dataSelectors from './data/selectors';
 import * as uiSelectors from './ui/selectors';
-import { ResolverState } from '../types';
+import { ResolverState, IsometricTaxiLayout } from '../types';
+import { uniquePidForProcess } from '../models/process_event';
+import { ResolverEvent } from '../../../common/endpoint/types';
 
 /**
  * A matrix that when applied to a Vector2 will convert it from world coordinates to screen coordinates.
@@ -51,9 +53,24 @@ export const userIsPanning = composeSelectors(cameraStateSelector, cameraSelecto
  */
 export const isAnimating = composeSelectors(cameraStateSelector, cameraSelectors.isAnimating);
 
-export const processNodePositionsAndEdgeLineSegments = composeSelectors(
+/**
+ * Given a nodeID (aka entity_id) get the indexed process event.
+ * Legacy functions take process events instead of nodeID, use this to get
+ * process events for them.
+ */
+export const processEventForID: (
+  state: ResolverState
+) => (nodeID: string) => ResolverEvent | null = composeSelectors(
   dataStateSelector,
-  dataSelectors.processNodePositionsAndEdgeLineSegments
+  dataSelectors.processEventForID
+);
+
+/**
+ * The position of nodes and edges.
+ */
+export const layout: (state: ResolverState) => IsometricTaxiLayout = composeSelectors(
+  dataStateSelector,
+  dataSelectors.layout
 );
 
 /**
@@ -74,11 +91,6 @@ export const resolverComponentInstanceID = composeSelectors(
   dataSelectors.resolverComponentInstanceID
 );
 
-export const processAdjacencies = composeSelectors(
-  dataStateSelector,
-  dataSelectors.processAdjacencies
-);
-
 export const terminatedProcesses = composeSelectors(
   dataStateSelector,
   dataSelectors.terminatedProcesses
@@ -212,10 +224,8 @@ function composeSelectors<OuterState, InnerState, ReturnValue>(
 }
 
 const boundingBox = composeSelectors(cameraStateSelector, cameraSelectors.viewableBoundingBox);
-const indexedProcessNodesAndEdgeLineSegments = composeSelectors(
-  dataStateSelector,
-  dataSelectors.visibleProcessNodePositionsAndEdgeLineSegments
-);
+
+const nodesAndEdgelines = composeSelectors(dataStateSelector, dataSelectors.nodesAndEdgelines);
 
 /**
  * Total count of related events for a process.
@@ -230,15 +240,50 @@ export const relatedEventTotalForProcess = composeSelectors(
  * The bounding box represents what the camera can see. The camera position is a function of time because it can be
  * animated. So in order to get the currently visible entities, we need to pass in time.
  */
-export const visibleProcessNodePositionsAndEdgeLineSegments = createSelector(
-  indexedProcessNodesAndEdgeLineSegments,
-  boundingBox,
-  function (
-    /* eslint-disable no-shadow */
-    indexedProcessNodesAndEdgeLineSegments,
-    boundingBox
-    /* eslint-enable no-shadow */
-  ) {
-    return (time: number) => indexedProcessNodesAndEdgeLineSegments(boundingBox(time));
+export const visibleNodesAndEdgeLines = createSelector(nodesAndEdgelines, boundingBox, function (
+  /* eslint-disable no-shadow */
+  nodesAndEdgelines,
+  boundingBox
+  /* eslint-enable no-shadow */
+) {
+  return (time: number) => nodesAndEdgelines(boundingBox(time));
+});
+
+/**
+ * Takes a nodeID (aka entity_id) and returns the associated aria level as a number or null if the node ID isn't in the tree.
+ */
+export const ariaLevel: (
+  state: ResolverState
+) => (nodeID: string) => number | null = composeSelectors(
+  dataStateSelector,
+  dataSelectors.ariaLevel
+);
+
+/**
+ * Takes a nodeID (aka entity_id) and returns the node ID of the node that aria should 'flowto' or null
+ * If the node has a following sibling that is currently visible, that will be returned, otherwise null.
+ */
+export const ariaFlowtoNodeID: (
+  state: ResolverState
+) => (time: number) => (nodeID: string) => string | null = createSelector(
+  visibleNodesAndEdgeLines,
+  composeSelectors(dataStateSelector, dataSelectors.followingSibling),
+  (visibleNodesAndEdgeLinesAtTime, followingSibling) => {
+    return defaultMemoize((time: number) => {
+      // get the visible nodes at `time`
+      const { processNodePositions } = visibleNodesAndEdgeLinesAtTime(time);
+
+      // get a `Set` containing their node IDs
+      const nodesVisibleAtTime: Set<string> = new Set(
+        [...processNodePositions.keys()].map(uniquePidForProcess)
+      );
+
+      // return the ID of `nodeID`'s following sibling, if it is visible
+      return (nodeID: string): string | null => {
+        const sibling: string | null = followingSibling(nodeID);
+
+        return sibling === null || nodesVisibleAtTime.has(sibling) === false ? null : sibling;
+      };
+    });
   }
 );
diff --git a/x-pack/plugins/security_solution/public/resolver/types.ts b/x-pack/plugins/security_solution/public/resolver/types.ts
index 064634472bbbe..0272de0d8fd2a 100644
--- a/x-pack/plugins/security_solution/public/resolver/types.ts
+++ b/x-pack/plugins/security_solution/public/resolver/types.ts
@@ -269,38 +269,18 @@ export interface ProcessEvent {
   };
 }
 
-/**
- * A map of Process Ids that indicate which processes are adjacent to a given process along
- * directions in two axes: up/down and previous/next.
- */
-export interface AdjacentProcessMap {
-  readonly self: string;
-  parent: string | null;
-  firstChild: string | null;
-  previousSibling: string | null;
-  nextSibling: string | null;
-  /**
-   * To support aria-level, this must be >= 1
-   */
-  level: number;
-}
-
 /**
  * A represention of a process tree with indices for O(1) access to children and values by id.
  */
 export interface IndexedProcessTree {
   /**
-   * Map of ID to a process's children
+   * Map of ID to a process's ordered children
    */
   idToChildren: Map<string | undefined, ResolverEvent[]>;
   /**
    * Map of ID to process
    */
   idToProcess: Map<string, ResolverEvent>;
-  /**
-   * Map of ID to adjacent processes
-   */
-  idToAdjacent: Map<string, AdjacentProcessMap>;
 }
 
 /**
@@ -454,4 +434,9 @@ export interface IsometricTaxiLayout {
    * A map of edgline segments, which graphically connect nodes.
    */
   edgeLineSegments: EdgeLineSegment[];
+
+  /**
+   * defines the aria levels for nodes.
+   */
+  ariaLevels: Map<ResolverEvent, number>;
 }
diff --git a/x-pack/plugins/security_solution/public/resolver/view/map.tsx b/x-pack/plugins/security_solution/public/resolver/view/map.tsx
index 000bf23c5f49d..b366e2f220652 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/map.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/map.tsx
@@ -53,10 +53,13 @@ export const ResolverMap = React.memo(function ({
   useStateSyncingActions({ databaseDocumentID, resolverComponentInstanceID });
 
   const { timestamp } = useContext(SideEffectContext);
+
+  // use this for the entire render in order to keep things in sync
+  const timeAtRender = timestamp();
+
   const { processNodePositions, connectingEdgeLineSegments } = useSelector(
-    selectors.visibleProcessNodePositionsAndEdgeLineSegments
-  )(timestamp());
-  const { processToAdjacencyMap } = useSelector(selectors.processAdjacencies);
+    selectors.visibleNodesAndEdgeLines
+  )(timeAtRender);
   const relatedEventsStats = useSelector(selectors.relatedEventsStats);
   const terminatedProcesses = useSelector(selectors.terminatedProcesses);
   const { projectionMatrix, ref, onMouseDown } = useCamera();
@@ -100,24 +103,19 @@ export const ResolverMap = React.memo(function ({
             />
           ))}
           {[...processNodePositions].map(([processEvent, position]) => {
-            const adjacentNodeMap = processToAdjacencyMap.get(processEvent);
             const processEntityId = entityId(processEvent);
-            if (!adjacentNodeMap) {
-              // This should never happen
-              throw new Error('Issue calculating adjacency node map.');
-            }
             return (
               <ProcessEventDot
                 key={processEntityId}
                 position={position}
                 projectionMatrix={projectionMatrix}
                 event={processEvent}
-                adjacentNodeMap={adjacentNodeMap}
                 relatedEventsStatsForProcess={
                   relatedEventsStats ? relatedEventsStats.get(entityId(processEvent)) : undefined
                 }
                 isProcessTerminated={terminatedProcesses.has(processEntityId)}
                 isProcessOrigin={false}
+                timeAtRender={timeAtRender}
               />
             );
           })}
diff --git a/x-pack/plugins/security_solution/public/resolver/view/panels/panel_content_process_list.tsx b/x-pack/plugins/security_solution/public/resolver/view/panels/panel_content_process_list.tsx
index 0ed677885775f..6f9bfad8c08c2 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/panels/panel_content_process_list.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/panels/panel_content_process_list.tsx
@@ -146,7 +146,7 @@ export const ProcessListWithCounts = memo(function ProcessListWithCounts({
     [pushToQueryParams, handleBringIntoViewClick, isProcessOrigin, isProcessTerminated]
   );
 
-  const { processNodePositions } = useSelector(selectors.processNodePositionsAndEdgeLineSegments);
+  const { processNodePositions } = useSelector(selectors.layout);
   const processTableView: ProcessTableView[] = useMemo(
     () =>
       [...processNodePositions.keys()].map((processEvent) => {
diff --git a/x-pack/plugins/security_solution/public/resolver/view/panels/panel_content_related_list.tsx b/x-pack/plugins/security_solution/public/resolver/view/panels/panel_content_related_list.tsx
index 0878ead72b2a4..9a477fd998bb3 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/panels/panel_content_related_list.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/panels/panel_content_related_list.tsx
@@ -38,7 +38,6 @@ interface MatchingEventEntry {
   eventType: string;
   eventCategory: string;
   name: { subject: string; descriptor?: string };
-  entityId: string;
   setQueryParams: () => void;
 }
 
@@ -202,9 +201,11 @@ export const ProcessEventListNarrowedByType = memo(function ProcessEventListNarr
         eventCategory: `${eventType}`,
         eventType: `${event.ecsEventType(resolverEvent)}`,
         name: event.descriptiveName(resolverEvent),
-        entityId,
         setQueryParams: () => {
-          pushToQueryParams({ crumbId: entityId, crumbEvent: processEntityId });
+          pushToQueryParams({
+            crumbId: entityId === undefined ? '' : String(entityId),
+            crumbEvent: processEntityId,
+          });
         },
       };
     });
diff --git a/x-pack/plugins/security_solution/public/resolver/view/process_event_dot.tsx b/x-pack/plugins/security_solution/public/resolver/view/process_event_dot.tsx
index e20f06ccf0f72..7666d1ac7c88a 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/process_event_dot.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/process_event_dot.tsx
@@ -12,11 +12,12 @@ import { htmlIdGenerator, EuiButton, EuiI18nNumber, EuiFlexGroup, EuiFlexItem }
 import { useSelector } from 'react-redux';
 import { NodeSubMenu, subMenuAssets } from './submenu';
 import { applyMatrix3 } from '../models/vector2';
-import { Vector2, Matrix3, AdjacentProcessMap } from '../types';
+import { Vector2, Matrix3 } from '../types';
 import { SymbolIds, useResolverTheme, calculateResolverFontSize } from './assets';
 import { ResolverEvent, ResolverNodeStats } from '../../../common/endpoint/types';
 import { useResolverDispatch } from './use_resolver_dispatch';
 import * as eventModel from '../../../common/endpoint/models/event';
+import * as processEventModel from '../models/process_event';
 import * as selectors from '../store/selectors';
 import { useResolverQueryParams } from './use_resolver_query_params';
 
@@ -70,10 +71,10 @@ const UnstyledProcessEventDot = React.memo(
     position,
     event,
     projectionMatrix,
-    adjacentNodeMap,
     isProcessTerminated,
     isProcessOrigin,
     relatedEventsStatsForProcess,
+    timeAtRender,
   }: {
     /**
      * A `className` string provided by `styled`
@@ -91,10 +92,6 @@ const UnstyledProcessEventDot = React.memo(
      * projectionMatrix which can be used to convert `position` to screen coordinates.
      */
     projectionMatrix: Matrix3;
-    /**
-     * map of what nodes are "adjacent" to this one in "up, down, previous, next" directions
-     */
-    adjacentNodeMap: AdjacentProcessMap;
     /**
      * Whether or not to show the process as terminated.
      */
@@ -109,7 +106,16 @@ const UnstyledProcessEventDot = React.memo(
      * Statistics for the number of related events and alerts for this process node
      */
     relatedEventsStatsForProcess?: ResolverNodeStats;
+
+    /**
+     * The time (unix epoch) at render.
+     */
+    timeAtRender: number;
   }) => {
+    const resolverComponentInstanceID = useSelector(selectors.resolverComponentInstanceID);
+    // This should be unique to each instance of Resolver
+    const htmlIDPrefix = `resolver:${resolverComponentInstanceID}`;
+
     /**
      * Convert the position, which is in 'world' coordinates, to screen coordinates.
      */
@@ -118,12 +124,22 @@ const UnstyledProcessEventDot = React.memo(
     const [xScale] = projectionMatrix;
 
     // Node (html id=) IDs
-    const selfId = adjacentNodeMap.self;
     const activeDescendantId = useSelector(selectors.uiActiveDescendantId);
     const selectedDescendantId = useSelector(selectors.uiSelectedDescendantId);
+    const nodeID = processEventModel.uniquePidForProcess(event);
 
-    // Entity ID of self
-    const selfEntityId = eventModel.entityId(event);
+    // define a standard way of giving HTML IDs to nodes based on their entity_id/nodeID.
+    // this is used to link nodes via aria attributes
+    const nodeHTMLID = useCallback((id: string) => htmlIdGenerator(htmlIDPrefix)(`${id}:node`), [
+      htmlIDPrefix,
+    ]);
+
+    const ariaLevel: number | null = useSelector(selectors.ariaLevel)(nodeID);
+
+    // the node ID to 'flowto'
+    const ariaFlowtoNodeID: string | null = useSelector(selectors.ariaFlowtoNodeID)(timeAtRender)(
+      nodeID
+    );
 
     const isShowingEventActions = xScale > 0.8;
     const isShowingDescriptionText = xScale >= 0.55;
@@ -204,16 +220,10 @@ const UnstyledProcessEventDot = React.memo(
       strokeColor,
     } = cubeAssetsForNode(isProcessTerminated, isProcessOrigin);
 
-    const resolverNodeIdGenerator = useMemo(() => htmlIdGenerator('resolverNode'), []);
+    const labelHTMLID = htmlIdGenerator('resolver')(`${nodeID}:label`);
 
-    const nodeId = useMemo(() => resolverNodeIdGenerator(selfId), [
-      resolverNodeIdGenerator,
-      selfId,
-    ]);
-    const labelId = useMemo(() => resolverNodeIdGenerator(), [resolverNodeIdGenerator]);
-    const descriptionId = useMemo(() => resolverNodeIdGenerator(), [resolverNodeIdGenerator]);
-    const isActiveDescendant = nodeId === activeDescendantId;
-    const isSelectedDescendant = nodeId === selectedDescendantId;
+    const isAriaCurrent = nodeID === activeDescendantId;
+    const isAriaSelected = nodeID === selectedDescendantId;
 
     const dispatch = useResolverDispatch();
 
@@ -221,34 +231,35 @@ const UnstyledProcessEventDot = React.memo(
       dispatch({
         type: 'userFocusedOnResolverNode',
         payload: {
-          nodeId,
+          nodeId: nodeHTMLID(nodeID),
         },
       });
-    }, [dispatch, nodeId]);
+    }, [dispatch, nodeHTMLID, nodeID]);
 
     const handleRelatedEventRequest = useCallback(() => {
       dispatch({
         type: 'userRequestedRelatedEventData',
-        payload: selfId,
+        payload: nodeID,
       });
-    }, [dispatch, selfId]);
+    }, [dispatch, nodeID]);
 
     const { pushToQueryParams } = useResolverQueryParams();
 
     const handleClick = useCallback(() => {
       if (animationTarget.current !== null) {
+        // This works but the types are missing in the typescript DOM lib
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
         (animationTarget.current as any).beginElement();
       }
       dispatch({
         type: 'userSelectedResolverNode',
         payload: {
-          nodeId,
-          selectedProcessId: selfId,
+          nodeId: nodeHTMLID(nodeID),
+          selectedProcessId: nodeID,
         },
       });
-      pushToQueryParams({ crumbId: selfEntityId, crumbEvent: 'all' });
-    }, [animationTarget, dispatch, nodeId, selfEntityId, pushToQueryParams, selfId]);
+      pushToQueryParams({ crumbId: nodeID, crumbEvent: 'all' });
+    }, [animationTarget, dispatch, pushToQueryParams, nodeID, nodeHTMLID]);
 
     /**
      * Enumerates the stats for related events to display with the node as options,
@@ -280,12 +291,12 @@ const UnstyledProcessEventDot = React.memo(
               },
             });
 
-            pushToQueryParams({ crumbId: selfEntityId, crumbEvent: category });
+            pushToQueryParams({ crumbId: nodeID, crumbEvent: category });
           },
         });
       }
       return relatedStatsList;
-    }, [relatedEventsStatsForProcess, dispatch, event, pushToQueryParams, selfEntityId]);
+    }, [relatedEventsStatsForProcess, dispatch, event, pushToQueryParams, nodeID]);
 
     const relatedEventStatusOrOptions = !relatedEventsStatsForProcess
       ? subMenuAssets.initialMenuStatus
@@ -302,15 +313,14 @@ const UnstyledProcessEventDot = React.memo(
         data-test-subj={'resolverNode'}
         className={`${className} kbn-resetFocusState`}
         role="treeitem"
-        aria-level={adjacentNodeMap.level}
-        aria-flowto={adjacentNodeMap.nextSibling === null ? undefined : adjacentNodeMap.nextSibling}
-        aria-labelledby={labelId}
-        aria-describedby={descriptionId}
-        aria-haspopup={'true'}
-        aria-current={isActiveDescendant ? 'true' : undefined}
-        aria-selected={isSelectedDescendant ? 'true' : undefined}
+        aria-level={ariaLevel === null ? undefined : ariaLevel}
+        aria-flowto={ariaFlowtoNodeID === null ? undefined : nodeHTMLID(ariaFlowtoNodeID)}
+        aria-labelledby={labelHTMLID}
+        aria-haspopup="true"
+        aria-current={isAriaCurrent ? 'true' : undefined}
+        aria-selected={isAriaSelected ? 'true' : undefined}
         style={nodeViewportStyle}
-        id={nodeId}
+        id={nodeHTMLID(nodeID)}
         tabIndex={-1}
       >
         <svg
@@ -373,8 +383,7 @@ const UnstyledProcessEventDot = React.memo(
           </StyledDescriptionText>
           <div
             className={xScale >= 2 ? 'euiButton' : 'euiButton euiButton--small'}
-            data-test-subject="nodeLabel"
-            id={labelId}
+            id={labelHTMLID}
             onClick={handleClick}
             onFocus={handleFocus}
             tabIndex={-1}
@@ -386,9 +395,7 @@ const UnstyledProcessEventDot = React.memo(
           >
             <EuiButton
               color={labelButtonFill}
-              data-test-subject="nodeLabel"
               fill={isLabelFilled}
-              id={labelId}
               size="s"
               style={{
                 maxHeight: `${Math.min(26 + xScale * 3, 32)}px`,
diff --git a/x-pack/plugins/security_solution/public/resolver/view/use_camera.test.tsx b/x-pack/plugins/security_solution/public/resolver/view/use_camera.test.tsx
index 3476764a88733..a27f157bc9364 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/use_camera.test.tsx
+++ b/x-pack/plugins/security_solution/public/resolver/view/use_camera.test.tsx
@@ -189,9 +189,7 @@ describe('useCamera on an unpainted element', () => {
           throw new Error('failed to create tree');
         }
         const processes: ResolverEvent[] = [
-          ...selectors
-            .processNodePositionsAndEdgeLineSegments(store.getState())
-            .processNodePositions.keys(),
+          ...selectors.layout(store.getState()).processNodePositions.keys(),
         ];
         process = processes[processes.length - 1];
         if (!process) {
diff --git a/x-pack/plugins/security_solution/public/resolver/view/use_resolver_query_params.ts b/x-pack/plugins/security_solution/public/resolver/view/use_resolver_query_params.ts
index 70baef5fa88ea..3c342ae575aa0 100644
--- a/x-pack/plugins/security_solution/public/resolver/view/use_resolver_query_params.ts
+++ b/x-pack/plugins/security_solution/public/resolver/view/use_resolver_query_params.ts
@@ -20,8 +20,8 @@ export function useResolverQueryParams() {
   const history = useHistory();
   const urlSearch = useLocation().search;
   const resolverComponentInstanceID = useSelector(selectors.resolverComponentInstanceID);
-  const uniqueCrumbIdKey: string = `${resolverComponentInstanceID}CrumbId`;
-  const uniqueCrumbEventKey: string = `${resolverComponentInstanceID}CrumbEvent`;
+  const uniqueCrumbIdKey: string = `resolver-id:${resolverComponentInstanceID}`;
+  const uniqueCrumbEventKey: string = `resolver-event:${resolverComponentInstanceID}`;
   const pushToQueryParams = useCallback(
     (newCrumbs: CrumbInfo) => {
       // Construct a new set of params from the current set (minus empty params)
@@ -51,9 +51,15 @@ export function useResolverQueryParams() {
     const parsed = querystring.parse(urlSearch.slice(1));
     const crumbEvent = parsed[uniqueCrumbEventKey];
     const crumbId = parsed[uniqueCrumbIdKey];
+    function valueForParam(param: string | string[]): string {
+      if (Array.isArray(param)) {
+        return param[0] || '';
+      }
+      return param || '';
+    }
     return {
-      crumbEvent: Array.isArray(crumbEvent) ? crumbEvent[0] : crumbEvent,
-      crumbId: Array.isArray(crumbId) ? crumbId[0] : crumbId,
+      crumbEvent: valueForParam(crumbEvent),
+      crumbId: valueForParam(crumbId),
     };
   }, [urlSearch, uniqueCrumbIdKey, uniqueCrumbEventKey]);
 
diff --git a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/timelines_table/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/timelines_table/index.tsx
index 2c55edb9034b5..2d3672b15dd10 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/open_timeline/timelines_table/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/open_timeline/timelines_table/index.tsx
@@ -197,7 +197,6 @@ export const TimelinesTable = React.memo<TimelinesTableProps>(
     return (
       <BasicTable
         columns={columns}
-        compressed
         data-test-subj="timelines-table"
         isExpandable={true}
         isSelectable={actionTimelineToShow.includes('selectable')}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/generic_file_details.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/generic_file_details.test.tsx
index 52c232f377f79..2c207ea8a1562 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/generic_file_details.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/generic_file_details.test.tsx
@@ -1231,8 +1231,8 @@ describe('SystemGenericFileDetails', () => {
       });
     });
 
-    test('it does NOT render the text "via" when eventAction is not a whitelisted action', () => {
-      const eventAction = 'a_non_whitelisted_event_action';
+    test('it does NOT render the text "via" when eventAction is not a allowlisted action', () => {
+      const eventAction = 'a_non_allowlisted_event_action';
 
       const wrapper = mount(
         <TestProviders>
diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/pagination.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/pagination.ts
index 2b107ab1b6db4..150f56cbd70cc 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/pagination.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/pagination.ts
@@ -61,7 +61,7 @@ export class PaginationBuilder {
     const lastResult = results[results.length - 1];
     const cursor = {
       timestamp: lastResult['@timestamp'],
-      eventID: eventId(lastResult),
+      eventID: eventId(lastResult) === undefined ? '' : String(eventId(lastResult)),
     };
     return PaginationBuilder.urlEncodeCursor(cursor);
   }
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/filter_events_with_list.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/filter_events_with_list.ts
index 654ace290f85f..ea52aecb379fa 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/filter_events_with_list.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/filter_events_with_list.ts
@@ -32,6 +32,7 @@ export const filterEventsAgainstList = async ({
   buildRuleMessage,
 }: FilterEventsAgainstList): Promise<SignalSearchResponse> => {
   try {
+    logger.debug(buildRuleMessage(`exceptionsList: ${JSON.stringify(exceptionsList, null, 2)}`));
     if (exceptionsList == null || exceptionsList.length === 0) {
       logger.debug(buildRuleMessage('about to return original search result'));
       return eventSearchResult;
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/search_after_bulk_create.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/search_after_bulk_create.ts
index cd6beb9c68ab2..2a0e39cbbf237 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/search_after_bulk_create.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/search_after_bulk_create.ts
@@ -91,7 +91,7 @@ export const searchAfterAndBulkCreate = async ({
   };
 
   let sortId; // tells us where to start our next search_after query
-  let signalsCreatedCount = 0;
+  let searchResultSize = 0;
 
   /*
     The purpose of `maxResults` is to ensure we do not perform
@@ -127,8 +127,8 @@ export const searchAfterAndBulkCreate = async ({
       toReturn.success = false;
       return toReturn;
     }
-    signalsCreatedCount = 0;
-    while (signalsCreatedCount < tuple.maxSignals) {
+    searchResultSize = 0;
+    while (searchResultSize < tuple.maxSignals) {
       try {
         logger.debug(buildRuleMessage(`sortIds: ${sortId}`));
         const {
@@ -167,6 +167,7 @@ export const searchAfterAndBulkCreate = async ({
                 searchResult.hits.hits[searchResult.hits.hits.length - 1]?._source['@timestamp']
               )
             : null;
+        searchResultSize += searchResult.hits.hits.length;
 
         // filter out the search results that match with the values found in the list.
         // the resulting set are valid signals that are not on the allowlist.
@@ -186,14 +187,6 @@ export const searchAfterAndBulkCreate = async ({
           break;
         }
 
-        // make sure we are not going to create more signals than maxSignals allows
-        if (signalsCreatedCount + filteredEvents.hits.hits.length > tuple.maxSignals) {
-          filteredEvents.hits.hits = filteredEvents.hits.hits.slice(
-            0,
-            tuple.maxSignals - signalsCreatedCount
-          );
-        }
-
         const {
           bulkCreateDuration: bulkDuration,
           createdItemsCount: createdCount,
@@ -218,7 +211,6 @@ export const searchAfterAndBulkCreate = async ({
         });
         logger.debug(buildRuleMessage(`created ${createdCount} signals`));
         toReturn.createdSignalsCount += createdCount;
-        signalsCreatedCount += createdCount;
         if (bulkDuration) {
           toReturn.bulkCreateTimes.push(bulkDuration);
         }
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/action_clone/clone_button.tsx b/x-pack/plugins/transform/public/app/sections/transform_management/components/action_clone/clone_button.tsx
index 4686ede7bc2c2..2b5ffa27e0f82 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/action_clone/clone_button.tsx
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/action_clone/clone_button.tsx
@@ -7,7 +7,7 @@
 import React, { FC, useContext } from 'react';
 import { useHistory } from 'react-router-dom';
 import { i18n } from '@kbn/i18n';
-import { EuiIcon, EuiLink, EuiToolTip } from '@elastic/eui';
+import { EuiButtonEmpty, EuiToolTip } from '@elastic/eui';
 
 import {
   createCapabilityFailureMessage,
@@ -25,7 +25,7 @@ export const CloneButton: FC<CloneActionProps> = ({ itemId }) => {
 
   const { canCreateTransform } = useContext(AuthorizationContext).capabilities;
 
-  const buttonCloneText = i18n.translate('xpack.transform.transformList.cloneActionName', {
+  const buttonText = i18n.translate('xpack.transform.transformList.cloneActionName', {
     defaultMessage: 'Clone',
   });
 
@@ -33,27 +33,30 @@ export const CloneButton: FC<CloneActionProps> = ({ itemId }) => {
     history.push(`/${SECTION_SLUG.CLONE_TRANSFORM}/${itemId}`);
   }
 
-  const cloneButton = (
-    <EuiLink
+  const buttonDisabled = !canCreateTransform;
+
+  const button = (
+    <EuiButtonEmpty
+      aria-label={buttonText}
+      color="text"
       data-test-subj="transformActionClone"
-      color={!canCreateTransform ? 'subdued' : 'text'}
-      disabled={!canCreateTransform}
-      onClick={!canCreateTransform ? undefined : clickHandler}
-      aria-label={buttonCloneText}
+      flush="left"
+      iconType="copy"
+      isDisabled={buttonDisabled}
+      onClick={clickHandler}
+      size="s"
     >
-      <EuiIcon type="copy" /> {buttonCloneText}
-    </EuiLink>
+      {buttonText}
+    </EuiButtonEmpty>
   );
 
-  if (!canCreateTransform) {
-    const content = createCapabilityFailureMessage('canStartStopTransform');
-
+  if (buttonDisabled) {
     return (
-      <EuiToolTip position="top" content={content}>
-        {cloneButton}
+      <EuiToolTip position="top" content={createCapabilityFailureMessage('canStartStopTransform')}>
+        {button}
       </EuiToolTip>
     );
   }
 
-  return <>{cloneButton}</>;
+  return button;
 };
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/action_delete/__snapshots__/delete_button.test.tsx.snap b/x-pack/plugins/transform/public/app/sections/transform_management/components/action_delete/__snapshots__/delete_button.test.tsx.snap
index 3980cc5d5a1ae..7e98fc90cfad4 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/action_delete/__snapshots__/delete_button.test.tsx.snap
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/action_delete/__snapshots__/delete_button.test.tsx.snap
@@ -6,17 +6,17 @@ exports[`Transform: Transform List Actions <DeleteAction /> Minimal initializati
   delay="regular"
   position="top"
 >
-  <EuiLink
+  <EuiButtonEmpty
     aria-label="Delete"
-    color="subdued"
+    color="text"
     data-test-subj="transformActionDelete"
-    disabled={true}
+    flush="left"
+    iconType="trash"
+    isDisabled={true}
+    onClick={[Function]}
+    size="s"
   >
-    <EuiIcon
-      type="trash"
-    />
-     
     Delete
-  </EuiLink>
+  </EuiButtonEmpty>
 </EuiToolTip>
 `;
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/action_delete/delete_button.tsx b/x-pack/plugins/transform/public/app/sections/transform_management/components/action_delete/delete_button.tsx
index b81c3ebc34ca0..2ca48ed734c7f 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/action_delete/delete_button.tsx
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/action_delete/delete_button.tsx
@@ -6,7 +6,7 @@
 
 import React, { FC, useContext } from 'react';
 import { i18n } from '@kbn/i18n';
-import { EuiIcon, EuiLink, EuiToolTip } from '@elastic/eui';
+import { EuiButtonEmpty, EuiToolTip } from '@elastic/eui';
 import { TRANSFORM_STATE } from '../../../../../../common';
 import {
   AuthorizationContext,
@@ -29,7 +29,7 @@ export const DeleteButton: FC<DeleteButtonProps> = ({ items, forceDisable, onCli
   const disabled = items.some(transformCanNotBeDeleted);
   const { canDeleteTransform } = useContext(AuthorizationContext).capabilities;
 
-  const buttonDeleteText = i18n.translate('xpack.transform.transformList.deleteActionName', {
+  const buttonText = i18n.translate('xpack.transform.transformList.deleteActionName', {
     defaultMessage: 'Delete',
   });
   const bulkDeleteButtonDisabledText = i18n.translate(
@@ -46,16 +46,20 @@ export const DeleteButton: FC<DeleteButtonProps> = ({ items, forceDisable, onCli
   );
 
   const buttonDisabled = forceDisable === true || disabled || !canDeleteTransform;
-  let deleteButton = (
-    <EuiLink
+
+  const button = (
+    <EuiButtonEmpty
+      aria-label={buttonText}
+      color="text"
       data-test-subj="transformActionDelete"
-      color={buttonDisabled ? 'subdued' : 'text'}
-      disabled={buttonDisabled}
-      onClick={buttonDisabled ? undefined : () => onClick(items)}
-      aria-label={buttonDeleteText}
+      flush="left"
+      iconType="trash"
+      isDisabled={buttonDisabled}
+      onClick={() => onClick(items)}
+      size="s"
     >
-      <EuiIcon type="trash" /> {buttonDeleteText}
-    </EuiLink>
+      {buttonText}
+    </EuiButtonEmpty>
   );
 
   if (disabled || !canDeleteTransform) {
@@ -66,12 +70,12 @@ export const DeleteButton: FC<DeleteButtonProps> = ({ items, forceDisable, onCli
       content = createCapabilityFailureMessage('canDeleteTransform');
     }
 
-    deleteButton = (
+    return (
       <EuiToolTip position="top" content={content}>
-        {deleteButton}
+        {button}
       </EuiToolTip>
     );
   }
 
-  return deleteButton;
+  return button;
 };
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/action_edit/edit_button.tsx b/x-pack/plugins/transform/public/app/sections/transform_management/components/action_edit/edit_button.tsx
index 6ba8e7aeba20f..40c27cff1e398 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/action_edit/edit_button.tsx
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/action_edit/edit_button.tsx
@@ -8,7 +8,7 @@ import React, { useContext, FC } from 'react';
 
 import { i18n } from '@kbn/i18n';
 
-import { EuiIcon, EuiLink, EuiToolTip } from '@elastic/eui';
+import { EuiButtonEmpty, EuiToolTip } from '@elastic/eui';
 
 import {
   createCapabilityFailureMessage,
@@ -21,31 +21,34 @@ interface EditButtonProps {
 export const EditButton: FC<EditButtonProps> = ({ onClick }) => {
   const { canCreateTransform } = useContext(AuthorizationContext).capabilities;
 
-  const buttonEditText = i18n.translate('xpack.transform.transformList.editActionName', {
+  const buttonText = i18n.translate('xpack.transform.transformList.editActionName', {
     defaultMessage: 'Edit',
   });
 
-  const editButton = (
-    <EuiLink
+  const buttonDisabled = !canCreateTransform;
+
+  const button = (
+    <EuiButtonEmpty
+      aria-label={buttonText}
+      color="text"
       data-test-subj="transformActionEdit"
-      color={!canCreateTransform ? 'subdued' : 'text'}
-      disabled={!canCreateTransform}
-      onClick={!canCreateTransform ? undefined : onClick}
-      aria-label={buttonEditText}
+      flush="left"
+      iconType="pencil"
+      isDisabled={buttonDisabled}
+      onClick={onClick}
+      size="s"
     >
-      <EuiIcon type="pencil" /> {buttonEditText}
-    </EuiLink>
+      {buttonText}
+    </EuiButtonEmpty>
   );
 
   if (!canCreateTransform) {
-    const content = createCapabilityFailureMessage('canStartStopTransform');
-
     return (
-      <EuiToolTip position="top" content={content}>
-        {editButton}
+      <EuiToolTip position="top" content={createCapabilityFailureMessage('canStartStopTransform')}>
+        {button}
       </EuiToolTip>
     );
   }
 
-  return editButton;
+  return button;
 };
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/action_start/__snapshots__/start_button.test.tsx.snap b/x-pack/plugins/transform/public/app/sections/transform_management/components/action_start/__snapshots__/start_button.test.tsx.snap
index 231a1f30f2c31..d8184773e16b5 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/action_start/__snapshots__/start_button.test.tsx.snap
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/action_start/__snapshots__/start_button.test.tsx.snap
@@ -6,15 +6,17 @@ exports[`Transform: Transform List Actions <StartAction /> Minimal initializatio
   delay="regular"
   position="top"
 >
-  <EuiLink
-    color="subdued"
+  <EuiButtonEmpty
+    aria-label="Start"
+    color="text"
     data-test-subj="transformActionStart"
+    flush="left"
+    iconType="play"
+    isDisabled={true}
+    onClick={[Function]}
+    size="s"
   >
-    <EuiIcon
-      type="play"
-    />
-     
     Start
-  </EuiLink>
+  </EuiButtonEmpty>
 </EuiToolTip>
 `;
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/action_start/start_button.tsx b/x-pack/plugins/transform/public/app/sections/transform_management/components/action_start/start_button.tsx
index a0fe1bfbb9544..60f899adc5fb2 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/action_start/start_button.tsx
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/action_start/start_button.tsx
@@ -6,7 +6,7 @@
 
 import React, { FC, useContext } from 'react';
 import { i18n } from '@kbn/i18n';
-import { EuiIcon, EuiLink, EuiToolTip } from '@elastic/eui';
+import { EuiButtonEmpty, EuiToolTip } from '@elastic/eui';
 
 import { TRANSFORM_STATE } from '../../../../../../common';
 
@@ -25,7 +25,7 @@ export const StartButton: FC<StartButtonProps> = ({ items, forceDisable, onClick
   const { canStartStopTransform } = useContext(AuthorizationContext).capabilities;
   const isBulkAction = items.length > 1;
 
-  const buttonStartText = i18n.translate('xpack.transform.transformList.startActionName', {
+  const buttonText = i18n.translate('xpack.transform.transformList.startActionName', {
     defaultMessage: 'Start',
   });
 
@@ -84,23 +84,30 @@ export const StartButton: FC<StartButtonProps> = ({ items, forceDisable, onClick
     }
   }
 
-  const disabled = forceDisable === true || actionIsDisabled;
+  const buttonDisabled = forceDisable === true || actionIsDisabled;
 
-  const startButton = (
-    <EuiLink
+  const button = (
+    <EuiButtonEmpty
+      aria-label={buttonText}
+      color="text"
       data-test-subj="transformActionStart"
-      color={disabled ? 'subdued' : 'text'}
-      onClick={disabled ? undefined : () => onClick(items)}
+      flush="left"
+      iconType="play"
+      isDisabled={buttonDisabled}
+      onClick={() => onClick(items)}
+      size="s"
     >
-      <EuiIcon type="play" /> {buttonStartText}
-    </EuiLink>
+      {buttonText}
+    </EuiButtonEmpty>
   );
-  if (disabled && content !== undefined) {
+
+  if (buttonDisabled && content !== undefined) {
     return (
       <EuiToolTip position="top" content={content}>
-        {startButton}
+        {button}
       </EuiToolTip>
     );
   }
-  return startButton;
+
+  return button;
 };
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/action_stop/__snapshots__/stop_button.test.tsx.snap b/x-pack/plugins/transform/public/app/sections/transform_management/components/action_stop/__snapshots__/stop_button.test.tsx.snap
index dd81bf34bf582..0052dc6254789 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/action_stop/__snapshots__/stop_button.test.tsx.snap
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/action_stop/__snapshots__/stop_button.test.tsx.snap
@@ -6,17 +6,17 @@ exports[`Transform: Transform List Actions <StopAction /> Minimal initialization
   delay="regular"
   position="top"
 >
-  <EuiLink
+  <EuiButtonEmpty
     aria-label="Stop"
-    color="subdued"
+    color="text"
     data-test-subj="transformActionStop"
+    flush="left"
+    iconType="stop"
+    isDisabled={true}
     onClick={[Function]}
+    size="s"
   >
-    <EuiIcon
-      type="stop"
-    />
-     
     Stop
-  </EuiLink>
+  </EuiButtonEmpty>
 </EuiToolTip>
 `;
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/action_stop/stop_button.tsx b/x-pack/plugins/transform/public/app/sections/transform_management/components/action_stop/stop_button.tsx
index 2c67ea3e83ecc..3c5e4323cc69a 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/action_stop/stop_button.tsx
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/action_stop/stop_button.tsx
@@ -6,7 +6,7 @@
 
 import React, { FC, useContext } from 'react';
 import { i18n } from '@kbn/i18n';
-import { EuiIcon, EuiLink, EuiToolTip } from '@elastic/eui';
+import { EuiButtonEmpty, EuiToolTip } from '@elastic/eui';
 
 import { TRANSFORM_STATE } from '../../../../../../common';
 
@@ -25,7 +25,7 @@ export const StopButton: FC<StopButtonProps> = ({ items, forceDisable }) => {
   const isBulkAction = items.length > 1;
   const { canStartStopTransform } = useContext(AuthorizationContext).capabilities;
   const stopTransforms = useStopTransforms();
-  const buttonStopText = i18n.translate('xpack.transform.transformList.stopActionName', {
+  const buttonText = i18n.translate('xpack.transform.transformList.stopActionName', {
     defaultMessage: 'Stop',
   });
 
@@ -56,18 +56,24 @@ export const StopButton: FC<StopButtonProps> = ({ items, forceDisable }) => {
     stopTransforms(items);
   };
 
-  const disabled = forceDisable === true || !canStartStopTransform || stoppedTransform === true;
+  const buttonDisabled =
+    forceDisable === true || !canStartStopTransform || stoppedTransform === true;
 
-  const stopButton = (
-    <EuiLink
+  const button = (
+    <EuiButtonEmpty
+      aria-label={buttonText}
+      color="text"
       data-test-subj="transformActionStop"
-      color={disabled ? 'subdued' : 'text'}
+      flush="left"
+      iconType="stop"
+      isDisabled={buttonDisabled}
       onClick={handleStop}
-      aria-label={buttonStopText}
+      size="s"
     >
-      <EuiIcon type="stop" /> {buttonStopText}
-    </EuiLink>
+      {buttonText}
+    </EuiButtonEmpty>
   );
+
   if (!canStartStopTransform || stoppedTransform) {
     return (
       <EuiToolTip
@@ -78,10 +84,10 @@ export const StopButton: FC<StopButtonProps> = ({ items, forceDisable }) => {
             : stoppedTransformMessage
         }
       >
-        {stopButton}
+        {button}
       </EuiToolTip>
     );
   }
 
-  return stopButton;
+  return button;
 };
diff --git a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/transform_list.tsx b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/transform_list.tsx
index 9df4113fa9a8b..a31251943061a 100644
--- a/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/transform_list.tsx
+++ b/x-pack/plugins/transform/public/app/sections/transform_management/components/transform_list/transform_list.tsx
@@ -292,7 +292,7 @@ export const TransformList: FC<Props> = ({
         button={buttonIcon}
         isOpen={isActionsMenuOpen}
         closePopover={() => setIsActionsMenuOpen(false)}
-        panelPaddingSize="none"
+        panelPaddingSize="s"
         anchorPosition="rightUp"
       >
         {bulkActionMenuItems}
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index a4100ae914b25..f7ff3634d46d4 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -4258,11 +4258,6 @@
     "xpack.apm.metrics.transactionChart.transactionsPerMinuteLabel": "1 分あたりのトランザクション数",
     "xpack.apm.notAvailableLabel": "N/A",
     "xpack.apm.percentOfParent": "({parentType, select, transaction { 件中 {value} 件のトランザクション} トレース {trace} })",
-    "xpack.apm.permission.apm": "APM",
-    "xpack.apm.permission.description": "このユーザーには、すべての APM インデックスへのアクセス権がありません。APM アプリを使用できますが、一部のデータが欠けることがあります。以下のインデックスへのアクセス権が必要です。",
-    "xpack.apm.permission.dismissWarning": "閉じる",
-    "xpack.apm.permission.learnMore": "APM パーミッションの詳細を表示",
-    "xpack.apm.permission.title": "APM へのアクセス権がありません",
     "xpack.apm.propertiesTable.agentFeature.noDataAvailableLabel": "利用可能なデータがありません",
     "xpack.apm.propertiesTable.agentFeature.noResultFound": "\"{value}\"に対する結果が見つかりませんでした。",
     "xpack.apm.propertiesTable.tabs.exceptionStacktraceLabel": "例外のスタックトレース",
@@ -9588,7 +9583,6 @@
     "xpack.ml.dataframe.analyticsList.title": "分析ジョブ",
     "xpack.ml.dataframe.analyticsList.type": "タイプ",
     "xpack.ml.dataframe.analyticsList.viewActionName": "表示",
-    "xpack.ml.dataframe.analyticsList.viewAriaLabel": "表示",
     "xpack.ml.dataframe.stepCreateForm.createDataFrameAnalyticsSuccessMessage": "データフレーム分析 {jobId} の作成リクエストが受け付けられました。",
     "xpack.ml.dataframe.stepDetailsForm.destinationIndexInvalidErrorLink": "インデックス名の制限に関する詳細。",
     "xpack.ml.dataFrameAnalyticsBreadcrumbs.dataFrameExplorationLabel": "データフレーム分析",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index 69e37f3f9f9f0..fc20bd55954c3 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -4262,11 +4262,6 @@
     "xpack.apm.metrics.transactionChart.transactionsPerMinuteLabel": "每分钟事务数",
     "xpack.apm.notAvailableLabel": "不适用",
     "xpack.apm.percentOfParent": "({value} 的 {parentType, select, transaction {事务} trace {trace} })",
-    "xpack.apm.permission.apm": "APM",
-    "xpack.apm.permission.description": "您的用户无权访问所有 APM 索引。您仍可以使用 APM 应用，但部分数据可能缺失。您必须获授以下索引的权限：",
-    "xpack.apm.permission.dismissWarning": "关闭",
-    "xpack.apm.permission.learnMore": "详细了解 APM 权限",
-    "xpack.apm.permission.title": "缺少访问 APM 的权限",
     "xpack.apm.propertiesTable.agentFeature.noDataAvailableLabel": "没有可用数据",
     "xpack.apm.propertiesTable.agentFeature.noResultFound": "没有“{value}”的结果。",
     "xpack.apm.propertiesTable.tabs.exceptionStacktraceLabel": "异常堆栈跟踪",
@@ -9593,7 +9588,6 @@
     "xpack.ml.dataframe.analyticsList.title": "分析作业",
     "xpack.ml.dataframe.analyticsList.type": "类型",
     "xpack.ml.dataframe.analyticsList.viewActionName": "查看",
-    "xpack.ml.dataframe.analyticsList.viewAriaLabel": "查看",
     "xpack.ml.dataframe.stepCreateForm.createDataFrameAnalyticsSuccessMessage": "数据帧分析 {jobId} 创建请求已确认。",
     "xpack.ml.dataframe.stepDetailsForm.destinationIndexInvalidErrorLink": "详细了解索引名称限制。",
     "xpack.ml.dataFrameAnalyticsBreadcrumbs.dataFrameExplorationLabel": "数据帧分析",
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_connectors.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_connectors.test.tsx
index 452d9c288926e..25381614a6c07 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_connectors.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_connectors.test.tsx
@@ -72,6 +72,7 @@ describe('ServiceNowActionConnectorFields renders', () => {
         editActionConfig={() => {}}
         editActionSecrets={() => {}}
         docLinks={deps!.docLinks}
+        consumer={'case'}
       />
     );
     expect(wrapper.find('[data-test-subj="case-servicenow-mappings"]').length > 0).toBeTruthy();
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_connectors.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_connectors.tsx
index a5c4849cb63d9..139ef8fa58ff3 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_connectors.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_connectors.tsx
@@ -12,9 +12,11 @@ import {
   EuiFormRow,
   EuiFieldPassword,
   EuiSpacer,
+  EuiLink,
 } from '@elastic/eui';
 
 import { isEmpty } from 'lodash';
+import { FormattedMessage } from '@kbn/i18n/react';
 import { ActionConnectorFieldsProps } from '../../../../types';
 import * as i18n from './translations';
 import { ServiceNowActionConnector, CasesConfigurationMapping } from './types';
@@ -23,7 +25,7 @@ import { FieldMapping } from './case_mappings/field_mapping';
 
 const ServiceNowConnectorFields: React.FC<ActionConnectorFieldsProps<
   ServiceNowActionConnector
->> = ({ action, editActionSecrets, editActionConfig, errors, consumer }) => {
+>> = ({ action, editActionSecrets, editActionConfig, errors, consumer, docLinks }) => {
   // TODO: remove incidentConfiguration later, when Case ServiceNow will move their fields to the level of action execution
   const { apiUrl, incidentConfiguration, isCaseOwned } = action.config;
   const mapping = incidentConfiguration ? incidentConfiguration.mapping : [];
@@ -79,6 +81,17 @@ const ServiceNowConnectorFields: React.FC<ActionConnectorFieldsProps<
             error={errors.apiUrl}
             isInvalid={isApiUrlInvalid}
             label={i18n.API_URL_LABEL}
+            helpText={
+              <EuiLink
+                href={`${docLinks.ELASTIC_WEBSITE_URL}guide/en/kibana/${docLinks.DOC_LINK_VERSION}/servicenow-action-type.html#configuring-servicenow`}
+                target="_blank"
+              >
+                <FormattedMessage
+                  id="xpack.triggersActionsUI.components.builtinActionTypes.serviceNowAction.apiUrlHelpLabel"
+                  defaultMessage="Configure Personal Developer Instance for ServiceNow"
+                />
+              </EuiLink>
+            }
           >
             <EuiFieldText
               fullWidth
@@ -149,7 +162,7 @@ const ServiceNowConnectorFields: React.FC<ActionConnectorFieldsProps<
           </EuiFormRow>
         </EuiFlexItem>
       </EuiFlexGroup>
-      {isCaseOwned && ( // TODO: remove this block later, when Case ServiceNow will move their fields to the level of action execution
+      {consumer === 'case' && ( // TODO: remove this block later, when Case ServiceNow will move their fields to the level of action execution
         <>
           <EuiSpacer size="l" />
           <EuiFlexGroup>
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_params.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_params.test.tsx
index 3ea628cd65473..1fc856b1e1ab2 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_params.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_params.test.tsx
@@ -39,7 +39,7 @@ describe('ServiceNowParamsFields renders', () => {
     );
     expect(wrapper.find('[data-test-subj="impactSelect"]').length > 0).toBeTruthy();
     expect(wrapper.find('[data-test-subj="titleInput"]').length > 0).toBeTruthy();
-    expect(wrapper.find('[data-test-subj="incidentDescriptionTextArea"]').length > 0).toBeTruthy();
-    expect(wrapper.find('[data-test-subj="incidentCommentTextArea"]').length > 0).toBeTruthy();
+    expect(wrapper.find('[data-test-subj="descriptionTextArea"]').length > 0).toBeTruthy();
+    expect(wrapper.find('[data-test-subj="commentTextArea"]').length > 0).toBeTruthy();
   });
 });
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_params.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_params.tsx
index 67070b6dc8907..1e0f4d1fdc57c 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_params.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/servicenow/servicenow_params.tsx
@@ -5,17 +5,17 @@
  */
 
 import React, { Fragment, useEffect } from 'react';
-import { EuiFormRow, EuiTextArea } from '@elastic/eui';
+import { EuiFormRow } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { EuiSelect } from '@elastic/eui';
 import { EuiFlexGroup } from '@elastic/eui';
 import { EuiFlexItem } from '@elastic/eui';
-import { EuiFieldText } from '@elastic/eui';
 import { EuiSpacer } from '@elastic/eui';
 import { EuiTitle } from '@elastic/eui';
 import { ActionParamsProps } from '../../../../types';
-import { AddMessageVariables } from '../../add_message_variables';
 import { ServiceNowActionParams } from './types';
+import { TextAreaWithMessageVariables } from '../../text_area_with_message_variables';
+import { TextFieldWithMessageVariables } from '../../text_field_with_message_variables';
 
 const ServiceNowParamsFields: React.FunctionComponent<ActionParamsProps<
   ServiceNowActionParams
@@ -76,13 +76,6 @@ const ServiceNowParamsFields: React.FunctionComponent<ActionParamsProps<
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [title, description, comment, severity, impact, urgency]);
 
-  const onSelectMessageVariable = (paramsProperty: string, variable: string) => {
-    editSubActionProperty(
-      paramsProperty,
-      ((actionParams as any).subActionParams[paramsProperty] ?? '').concat(` {{${variable}}}`)
-    );
-  };
-
   return (
     <Fragment>
       <EuiTitle size="s">
@@ -164,96 +157,44 @@ const ServiceNowParamsFields: React.FunctionComponent<ActionParamsProps<
             defaultMessage: 'Short description',
           }
         )}
-        labelAppend={
-          <AddMessageVariables
-            messageVariables={messageVariables}
-            onSelectEventHandler={(variable: string) => onSelectMessageVariable('title', variable)}
-            paramsProperty="title"
-          />
-        }
       >
-        <EuiFieldText
-          fullWidth
-          name="title"
-          data-test-subj="titleInput"
-          isInvalid={errors.title.length > 0 && title !== undefined}
-          value={title || ''}
-          onChange={(e: React.ChangeEvent<HTMLInputElement>) => {
-            editSubActionProperty('title', e.target.value);
-          }}
-          onBlur={() => {
-            if (!title) {
-              editSubActionProperty('title', '');
-            }
-          }}
+        <TextFieldWithMessageVariables
+          index={index}
+          editAction={editSubActionProperty}
+          messageVariables={messageVariables}
+          paramsProperty={'title'}
+          inputTargetValue={title}
+          errors={errors.title as string[]}
         />
       </EuiFormRow>
-      <EuiFormRow
-        fullWidth
+      <TextAreaWithMessageVariables
+        index={index}
+        editAction={editSubActionProperty}
+        messageVariables={messageVariables}
+        paramsProperty={'description'}
+        inputTargetValue={description}
         label={i18n.translate(
           'xpack.triggersActionsUI.components.builtinActionTypes.serviceNow.descriptionTextAreaFieldLabel',
           {
             defaultMessage: 'Description (optional)',
           }
         )}
-        labelAppend={
-          <AddMessageVariables
-            messageVariables={messageVariables}
-            onSelectEventHandler={(variable: string) =>
-              onSelectMessageVariable('description', variable)
-            }
-            paramsProperty="description"
-          />
-        }
-      >
-        <EuiTextArea
-          fullWidth
-          name="description"
-          value={description || ''}
-          data-test-subj="incidentDescriptionTextArea"
-          onChange={(e) => {
-            editSubActionProperty('description', e.target.value);
-          }}
-          onBlur={() => {
-            if (!description) {
-              editSubActionProperty('description', '');
-            }
-          }}
-        />
-      </EuiFormRow>
-      <EuiFormRow
-        fullWidth
+        errors={errors.description as string[]}
+      />
+      <TextAreaWithMessageVariables
+        index={index}
+        editAction={editSubActionProperty}
+        messageVariables={messageVariables}
+        paramsProperty={'comment'}
+        inputTargetValue={comment}
         label={i18n.translate(
           'xpack.triggersActionsUI.components.builtinActionTypes.serviceNow.commentsTextAreaFieldLabel',
           {
             defaultMessage: 'Additional comments (optional)',
           }
         )}
-        labelAppend={
-          <AddMessageVariables
-            messageVariables={messageVariables}
-            onSelectEventHandler={(variable: string) =>
-              onSelectMessageVariable('comment', variable)
-            }
-            paramsProperty="comment"
-          />
-        }
-      >
-        <EuiTextArea
-          fullWidth
-          name="comment"
-          value={comment || ''}
-          data-test-subj="incidentCommentTextArea"
-          onChange={(e) => {
-            editSubActionProperty('comment', e.target.value);
-          }}
-          onBlur={() => {
-            if (!comment) {
-              editSubActionProperty('comment', '');
-            }
-          }}
-        />
-      </EuiFormRow>
+        errors={errors.comment as string[]}
+      />
     </Fragment>
   );
 };
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_form.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_form.tsx
index 9182d5a687eb5..67c7ca91156da 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_form.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_form.tsx
@@ -45,7 +45,6 @@ import { TypeRegistry } from '../../type_registry';
 import { actionTypeCompare } from '../../lib/action_type_compare';
 import { checkActionFormActionTypeEnabled } from '../../lib/check_action_type_enabled';
 import { VIEW_LICENSE_OPTIONS_LINK } from '../../../common/constants';
-import { ServiceNowConnectorConfiguration } from '../../../common';
 
 interface ActionAccordionFormProps {
   actions: AlertAction[];
@@ -132,14 +131,7 @@ export const ActionForm = ({
       try {
         setIsLoadingConnectors(true);
         const loadedConnectors = await loadConnectors({ http });
-        setConnectors(
-          loadedConnectors.filter(
-            (action) =>
-              action.actionTypeId !== ServiceNowConnectorConfiguration.id ||
-              (action.actionTypeId === ServiceNowConnectorConfiguration.id &&
-                !action.config.isCaseOwned)
-          )
-        );
+        setConnectors(loadedConnectors);
       } catch (e) {
         toastNotifications.addDanger({
           title: i18n.translate(
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_list.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_list.tsx
index 0e0691960729d..5d52896cc628f 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_list.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_list.tsx
@@ -20,7 +20,6 @@ import {
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { ServiceNowConnectorConfiguration } from '../../../../common';
 import { useAppDependencies } from '../../../app_context';
 import { loadAllActions, loadActionTypes, deleteActions } from '../../../lib/action_connector_api';
 import ConnectorAddFlyout from '../../action_connector_form/connector_add_flyout';
@@ -119,14 +118,7 @@ export const ActionsConnectorsList: React.FunctionComponent = () => {
     setIsLoadingActions(true);
     try {
       const actionsResponse = await loadAllActions({ http });
-      setActions(
-        actionsResponse.filter(
-          (action) =>
-            action.actionTypeId !== ServiceNowConnectorConfiguration.id ||
-            (action.actionTypeId === ServiceNowConnectorConfiguration.id &&
-              !action.config.isCaseOwned)
-        )
-      );
+      setActions(actionsResponse);
     } catch (e) {
       toastNotifications.addDanger({
         title: i18n.translate(
diff --git a/x-pack/test/alerting_api_integration/basic/tests/actions/builtin_action_types/server_log.ts b/x-pack/test/alerting_api_integration/basic/tests/actions/builtin_action_types/server_log.ts
index ea5f523b396b4..7204581d036e0 100644
--- a/x-pack/test/alerting_api_integration/basic/tests/actions/builtin_action_types/server_log.ts
+++ b/x-pack/test/alerting_api_integration/basic/tests/actions/builtin_action_types/server_log.ts
@@ -9,11 +9,8 @@ import { FtrProviderContext } from '../../../../common/ftr_provider_context';
 // eslint-disable-next-line import/no-default-export
 export default function serverLogTest({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
-  const esArchiver = getService('esArchiver');
 
   describe('server-log action', () => {
-    after(() => esArchiver.unload('empty_kibana'));
-
     it('should return 200 when creating a server-log action', async () => {
       await supertest
         .post('/api/actions/action')
diff --git a/x-pack/test/alerting_api_integration/common/config.ts b/x-pack/test/alerting_api_integration/common/config.ts
index e3281cfdfa9a3..946b3d2f2591b 100644
--- a/x-pack/test/alerting_api_integration/common/config.ts
+++ b/x-pack/test/alerting_api_integration/common/config.ts
@@ -33,6 +33,7 @@ const enabledActionTypes = [
   'test.index-record',
   'test.noop',
   'test.rate-limit',
+  'test.throw',
 ];
 
 // eslint-disable-next-line import/no-default-export
diff --git a/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts/server/action_types.ts b/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts/server/action_types.ts
index 9ce2c2fb58272..fd0d03dc18410 100644
--- a/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts/server/action_types.ts
+++ b/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts/server/action_types.ts
@@ -24,6 +24,14 @@ export function defineActionTypes(
       return { status: 'ok', actionId: '' };
     },
   };
+  const throwActionType: ActionType = {
+    id: 'test.throw',
+    name: 'Test: Throw',
+    minimumLicenseRequired: 'gold',
+    async executor() {
+      throw new Error('this action is intended to fail');
+    },
+  };
   const indexRecordActionType: ActionType = {
     id: 'test.index-record',
     name: 'Test: Index Record',
@@ -193,6 +201,7 @@ export function defineActionTypes(
     },
   };
   actions.registerType(noopActionType);
+  actions.registerType(throwActionType);
   actions.registerType(indexRecordActionType);
   actions.registerType(failingActionType);
   actions.registerType(rateLimitedActionType);
diff --git a/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts/server/alert_types.ts b/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts/server/alert_types.ts
index 1262539ac9570..ee3e0e6646112 100644
--- a/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts/server/alert_types.ts
+++ b/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts/server/alert_types.ts
@@ -286,6 +286,50 @@ export function defineAlertTypes(
     },
     async executor(opts: AlertExecutorOptions) {},
   };
+  const throwAlertType: AlertType = {
+    id: 'test.throw',
+    name: 'Test: Throw',
+    actionGroups: [
+      {
+        id: 'default',
+        name: 'Default',
+      },
+    ],
+    producer: 'alerting',
+    defaultActionGroupId: 'default',
+    async executor({ services, params, state }: AlertExecutorOptions) {
+      throw new Error('this alert is intended to fail');
+    },
+  };
+  const patternFiringAlertType: AlertType = {
+    id: 'test.patternFiring',
+    name: 'Test: Firing on a Pattern',
+    actionGroups: [{ id: 'default', name: 'Default' }],
+    producer: 'alerting',
+    defaultActionGroupId: 'default',
+    async executor(alertExecutorOptions: AlertExecutorOptions) {
+      const { services, state, params } = alertExecutorOptions;
+      const pattern = params.pattern;
+      if (!Array.isArray(pattern)) throw new Error('pattern is not an array');
+      if (pattern.length === 0) throw new Error('pattern is empty');
+
+      // get the pattern index, return if past it
+      const patternIndex = state.patternIndex ?? 0;
+      if (patternIndex > pattern.length) {
+        return { patternIndex };
+      }
+
+      // fire if pattern says to
+      if (pattern[patternIndex]) {
+        services.alertInstanceFactory('instance').scheduleActions('default');
+      }
+
+      return {
+        patternIndex: (patternIndex + 1) % pattern.length,
+      };
+    },
+  };
+
   alerts.registerType(alwaysFiringAlertType);
   alerts.registerType(cumulativeFiringAlertType);
   alerts.registerType(neverFiringAlertType);
@@ -295,4 +339,6 @@ export function defineAlertTypes(
   alerts.registerType(noopAlertType);
   alerts.registerType(onlyContextVariablesAlertType);
   alerts.registerType(onlyStateVariablesAlertType);
+  alerts.registerType(patternFiringAlertType);
+  alerts.registerType(throwAlertType);
 }
diff --git a/x-pack/test/alerting_api_integration/common/lib/get_event_log.ts b/x-pack/test/alerting_api_integration/common/lib/get_event_log.ts
new file mode 100644
index 0000000000000..69eeaafbf64fa
--- /dev/null
+++ b/x-pack/test/alerting_api_integration/common/lib/get_event_log.ts
@@ -0,0 +1,48 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IValidatedEvent } from '../../../../plugins/event_log/server';
+import { getUrlPrefix } from '.';
+import { FtrProviderContext } from '../ftr_provider_context';
+
+interface GetEventLogParams {
+  getService: FtrProviderContext['getService'];
+  spaceId: string;
+  type: string;
+  id: string;
+  provider: string;
+  actions: string[];
+}
+
+// Return event log entries given the specified parameters; for the `actions`
+// parameter, at least one event of each action must be in the returned entries.
+export async function getEventLog(params: GetEventLogParams): Promise<IValidatedEvent[]> {
+  const { getService, spaceId, type, id, provider, actions } = params;
+  const supertest = getService('supertest');
+
+  const spacePrefix = getUrlPrefix(spaceId);
+  const url = `${spacePrefix}/api/event_log/${type}/${id}/_find`;
+
+  const { body: result } = await supertest.get(url).expect(200);
+  if (!result.total) {
+    throw new Error('no events found yet');
+  }
+
+  const events: IValidatedEvent[] = (result.data as IValidatedEvent[]).filter(
+    (event) => event?.event?.provider === provider
+  );
+  const foundActions = new Set(
+    events.map((event) => event?.event?.action).filter((event) => !!event)
+  );
+
+  for (const action of actions) {
+    if (!foundActions.has(action)) {
+      throw new Error(`no event found with action "${action}"`);
+    }
+  }
+
+  return events;
+}
diff --git a/x-pack/test/alerting_api_integration/common/lib/index.ts b/x-pack/test/alerting_api_integration/common/lib/index.ts
index c1e59664f9ce2..eae679cd38c11 100644
--- a/x-pack/test/alerting_api_integration/common/lib/index.ts
+++ b/x-pack/test/alerting_api_integration/common/lib/index.ts
@@ -12,3 +12,4 @@ export { AlertUtils } from './alert_utils';
 export { TaskManagerUtils } from './task_manager_utils';
 export * from './test_assertions';
 export { checkAAD } from './check_aad';
+export { getEventLog } from './get_event_log';
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/email.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/email.ts
index ffbb29b431d8d..1c3d3e3d713e2 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/email.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/email.ts
@@ -11,11 +11,8 @@ import { FtrProviderContext } from '../../../../common/ftr_provider_context';
 // eslint-disable-next-line import/no-default-export
 export default function emailTest({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
-  const esArchiver = getService('esArchiver');
 
   describe('create email action', () => {
-    after(() => esArchiver.unload('empty_kibana'));
-
     let createdActionId = '';
 
     it('should return 200 when creating an email action successfully', async () => {
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/es_index.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/es_index.ts
index c1dc155c17238..61903c2902317 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/es_index.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/es_index.ts
@@ -14,10 +14,8 @@ const ES_TEST_INDEX_NAME = 'functional-test-actions-index';
 export default function indexTest({ getService }: FtrProviderContext) {
   const es = getService('legacyEs');
   const supertest = getService('supertest');
-  const esArchiver = getService('esArchiver');
 
   describe('index action', () => {
-    after(() => esArchiver.unload('empty_kibana'));
     beforeEach(() => clearTestIndex(es));
 
     let createdActionID: string;
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/es_index_preconfigured.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/es_index_preconfigured.ts
index 93daa16e71bcf..09b4b433d4847 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/es_index_preconfigured.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/es_index_preconfigured.ts
@@ -16,10 +16,8 @@ const ES_TEST_INDEX_NAME = 'functional-test-actions-index-preconfigured';
 export default function indexTest({ getService }: FtrProviderContext) {
   const es = getService('legacyEs');
   const supertest = getService('supertest');
-  const esArchiver = getService('esArchiver');
 
   describe('preconfigured index action', () => {
-    after(() => esArchiver.unload('empty_kibana'));
     beforeEach(() => clearTestIndex(es));
 
     it('should execute successfully when expected for a single body', async () => {
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/jira.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/jira.ts
index 19206ce681000..24931f11d4999 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/jira.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/jira.ts
@@ -34,7 +34,6 @@ const mapping = [
 // eslint-disable-next-line import/no-default-export
 export default function jiraTest({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
-  const esArchiver = getService('esArchiver');
   const kibanaServer = getService('kibanaServer');
 
   const mockJira = {
@@ -82,8 +81,6 @@ export default function jiraTest({ getService }: FtrProviderContext) {
       );
     });
 
-    after(() => esArchiver.unload('empty_kibana'));
-
     describe('Jira - Action Creation', () => {
       it('should return 200 when creating a jira action successfully', async () => {
         const { body: createdAction } = await supertest
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/pagerduty.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/pagerduty.ts
index 71ceb731da9f0..f4fcbb65ab5a3 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/pagerduty.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/pagerduty.ts
@@ -16,7 +16,6 @@ import {
 // eslint-disable-next-line import/no-default-export
 export default function pagerdutyTest({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
-  const esArchiver = getService('esArchiver');
   const kibanaServer = getService('kibanaServer');
 
   describe('pagerduty action', () => {
@@ -30,8 +29,6 @@ export default function pagerdutyTest({ getService }: FtrProviderContext) {
       );
     });
 
-    after(() => esArchiver.unload('empty_kibana'));
-
     it('should return successfully when passed valid create parameters', async () => {
       const { body: createdAction } = await supertest
         .post('/api/actions/action')
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/resilient.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/resilient.ts
index a77e0414a19d4..94feabb556a51 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/resilient.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/resilient.ts
@@ -34,7 +34,6 @@ const mapping = [
 // eslint-disable-next-line import/no-default-export
 export default function resilientTest({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
-  const esArchiver = getService('esArchiver');
   const kibanaServer = getService('kibanaServer');
 
   const mockResilient = {
@@ -82,8 +81,6 @@ export default function resilientTest({ getService }: FtrProviderContext) {
       );
     });
 
-    after(() => esArchiver.unload('empty_kibana'));
-
     describe('IBM Resilient - Action Creation', () => {
       it('should return 200 when creating a ibm resilient action successfully', async () => {
         const { body: createdAction } = await supertest
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/server_log.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/server_log.ts
index a915987ce5feb..e8b088abff3c8 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/server_log.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/server_log.ts
@@ -11,11 +11,8 @@ import { FtrProviderContext } from '../../../../common/ftr_provider_context';
 // eslint-disable-next-line import/no-default-export
 export default function serverLogTest({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
-  const esArchiver = getService('esArchiver');
 
   describe('server-log action', () => {
-    after(() => esArchiver.unload('empty_kibana'));
-
     let serverLogActionId: string;
 
     it('should return 200 when creating a builtin server-log action', async () => {
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/servicenow.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/servicenow.ts
index 8205b75cabed5..d3b72d01216d0 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/servicenow.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/servicenow.ts
@@ -34,7 +34,6 @@ const mapping = [
 // eslint-disable-next-line import/no-default-export
 export default function servicenowTest({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
-  const esArchiver = getService('esArchiver');
   const kibanaServer = getService('kibanaServer');
 
   const mockServiceNow = {
@@ -81,8 +80,6 @@ export default function servicenowTest({ getService }: FtrProviderContext) {
       );
     });
 
-    after(() => esArchiver.unload('empty_kibana'));
-
     describe('ServiceNow - Action Creation', () => {
       it('should return 200 when creating a servicenow action successfully', async () => {
         const { body: createdAction } = await supertest
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/slack.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/slack.ts
index 537205360f4aa..f21bc8edeef1e 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/slack.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/slack.ts
@@ -16,7 +16,6 @@ import {
 // eslint-disable-next-line import/no-default-export
 export default function slackTest({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
-  const esArchiver = getService('esArchiver');
   const kibanaServer = getService('kibanaServer');
 
   describe('slack action', () => {
@@ -30,8 +29,6 @@ export default function slackTest({ getService }: FtrProviderContext) {
       );
     });
 
-    after(() => esArchiver.unload('empty_kibana'));
-
     it('should return 200 when creating a slack action successfully', async () => {
       const { body: createdAction } = await supertest
         .post('/api/actions/action')
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/webhook.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/webhook.ts
index 10adf12baf652..7eba753d7e98b 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/webhook.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/webhook.ts
@@ -27,7 +27,6 @@ function parsePort(url: Record<string, string>): Record<string, string | null |
 // eslint-disable-next-line import/no-default-export
 export default function webhookTest({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
-  const esArchiver = getService('esArchiver');
   const kibanaServer = getService('kibanaServer');
 
   async function createWebhookAction(
@@ -71,8 +70,6 @@ export default function webhookTest({ getService }: FtrProviderContext) {
       );
     });
 
-    after(() => esArchiver.unload('empty_kibana'));
-
     it('should return 200 when creating a webhook action successfully', async () => {
       const { body: createdAction } = await supertest
         .post('/api/actions/action')
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/execute.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/execute.ts
index 70a3663c1c798..5d609d001ee5d 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/execute.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/execute.ts
@@ -11,8 +11,12 @@ import {
   ES_TEST_INDEX_NAME,
   getUrlPrefix,
   ObjectRemover,
+  getEventLog,
 } from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
+import { IValidatedEvent } from '../../../../../plugins/event_log/server';
+
+const NANOS_IN_MILLIS = 1000 * 1000;
 
 // eslint-disable-next-line import/no-default-export
 export default function ({ getService }: FtrProviderContext) {
@@ -107,6 +111,13 @@ export default function ({ getService }: FtrProviderContext) {
                 reference,
                 source: 'action:test.index-record',
               });
+
+              await validateEventLog({
+                spaceId: space.id,
+                actionId: createdAction.id,
+                outcome: 'success',
+                message: `action executed: test.index-record:${createdAction.id}: My action`,
+              });
               break;
             default:
               throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
@@ -480,4 +491,66 @@ export default function ({ getService }: FtrProviderContext) {
       });
     }
   });
+
+  interface ValidateEventLogParams {
+    spaceId: string;
+    actionId: string;
+    outcome: string;
+    message: string;
+    errorMessage?: string;
+  }
+
+  async function validateEventLog(params: ValidateEventLogParams): Promise<void> {
+    const { spaceId, actionId, outcome, message, errorMessage } = params;
+
+    const events: IValidatedEvent[] = await retry.try(async () => {
+      return await getEventLog({
+        getService,
+        spaceId,
+        type: 'action',
+        id: actionId,
+        provider: 'actions',
+        actions: ['execute'],
+      });
+    });
+
+    expect(events.length).to.equal(1);
+
+    const event = events[0];
+
+    const duration = event?.event?.duration;
+    const eventStart = Date.parse(event?.event?.start || 'undefined');
+    const eventEnd = Date.parse(event?.event?.end || 'undefined');
+    const dateNow = Date.now();
+
+    expect(typeof duration).to.be('number');
+    expect(eventStart).to.be.ok();
+    expect(eventEnd).to.be.ok();
+
+    const durationDiff = Math.abs(
+      Math.round(duration! / NANOS_IN_MILLIS) - (eventEnd - eventStart)
+    );
+
+    // account for rounding errors
+    expect(durationDiff < 1).to.equal(true);
+    expect(eventStart <= eventEnd).to.equal(true);
+    expect(eventEnd <= dateNow).to.equal(true);
+
+    expect(event?.event?.outcome).to.equal(outcome);
+
+    expect(event?.kibana?.saved_objects).to.eql([
+      {
+        rel: 'primary',
+        type: 'action',
+        id: actionId,
+        namespace: spaceId,
+      },
+    ]);
+
+    expect(event?.message).to.eql(message);
+
+    if (errorMessage) {
+      expect(event?.error?.message).to.eql(errorMessage);
+    }
+  }
 }
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/alerts.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/alerts.ts
index dce809f0b7be9..0f339154bd948 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/alerts.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/alerts.ts
@@ -15,7 +15,11 @@ import {
   ObjectRemover,
   AlertUtils,
   TaskManagerUtils,
+  getEventLog,
 } from '../../../common/lib';
+import { IValidatedEvent } from '../../../../../plugins/event_log/server';
+
+const NANOS_IN_MILLIS = 1000 * 1000;
 
 // eslint-disable-next-line import/no-default-export
 export default function alertTests({ getService }: FtrProviderContext) {
@@ -26,8 +30,7 @@ export default function alertTests({ getService }: FtrProviderContext) {
   const esTestIndexTool = new ESTestIndexTool(es, retry);
   const taskManagerUtils = new TaskManagerUtils(es, retry);
 
-  // Failing ES promotion: https://github.com/elastic/kibana/issues/71582
-  describe.skip('alerts', () => {
+  describe('alerts', () => {
     const authorizationIndex = '.kibana-test-authorization';
     const objectRemover = new ObjectRemover(supertest);
 
@@ -160,6 +163,13 @@ instanceStateValue: true
               });
 
               await taskManagerUtils.waitForActionTaskParamsToBeCleanedUp(testStart);
+
+              await validateEventLog({
+                spaceId: space.id,
+                alertId,
+                outcome: 'success',
+                message: `alert executed: test.always-firing:${alertId}: 'abc'`,
+              });
               break;
             default:
               throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);
@@ -928,4 +938,66 @@ instanceStateValue: true
       });
     }
   });
+
+  interface ValidateEventLogParams {
+    spaceId: string;
+    alertId: string;
+    outcome: string;
+    message: string;
+    errorMessage?: string;
+  }
+
+  async function validateEventLog(params: ValidateEventLogParams): Promise<void> {
+    const { spaceId, alertId, outcome, message, errorMessage } = params;
+
+    const events: IValidatedEvent[] = await retry.try(async () => {
+      return await getEventLog({
+        getService,
+        spaceId,
+        type: 'alert',
+        id: alertId,
+        provider: 'alerting',
+        actions: ['execute'],
+      });
+    });
+
+    expect(events.length).to.be.greaterThan(0);
+
+    const event = events[0];
+
+    const duration = event?.event?.duration;
+    const eventStart = Date.parse(event?.event?.start || 'undefined');
+    const eventEnd = Date.parse(event?.event?.end || 'undefined');
+    const dateNow = Date.now();
+
+    expect(typeof duration).to.be('number');
+    expect(eventStart).to.be.ok();
+    expect(eventEnd).to.be.ok();
+
+    const durationDiff = Math.abs(
+      Math.round(duration! / NANOS_IN_MILLIS) - (eventEnd - eventStart)
+    );
+
+    // account for rounding errors
+    expect(durationDiff < 1).to.equal(true);
+    expect(eventStart <= eventEnd).to.equal(true);
+    expect(eventEnd <= dateNow).to.equal(true);
+
+    expect(event?.event?.outcome).to.equal(outcome);
+
+    expect(event?.kibana?.saved_objects).to.eql([
+      {
+        rel: 'primary',
+        type: 'alert',
+        id: alertId,
+        namespace: spaceId,
+      },
+    ]);
+
+    expect(event?.message).to.eql(message);
+
+    if (errorMessage) {
+      expect(event?.error?.message).to.eql(errorMessage);
+    }
+  }
 }
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/update.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/update.ts
index 37c0116396b1c..2bcc035beb7a9 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/update.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/update.ts
@@ -29,8 +29,7 @@ export default function createUpdateTests({ getService }: FtrProviderContext) {
       .then((response: SupertestResponse) => response.body);
   }
 
-  // Failing ES promotion: https://github.com/elastic/kibana/issues/71558
-  describe.skip('update', () => {
+  describe('update', () => {
     const objectRemover = new ObjectRemover(supertest);
 
     after(() => objectRemover.removeAll());
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/actions/builtin_action_types/es_index.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/actions/builtin_action_types/es_index.ts
index 0822e614464cb..0609e2f3f444f 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/actions/builtin_action_types/es_index.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/actions/builtin_action_types/es_index.ts
@@ -14,10 +14,8 @@ const ES_TEST_INDEX_NAME = 'functional-test-actions-index';
 export default function indexTest({ getService }: FtrProviderContext) {
   const es = getService('legacyEs');
   const supertest = getService('supertest');
-  const esArchiver = getService('esArchiver');
 
   describe('index action', () => {
-    after(() => esArchiver.unload('empty_kibana'));
     beforeEach(() => clearTestIndex(es));
 
     let createdActionID: string;
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/actions/builtin_action_types/webhook.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/actions/builtin_action_types/webhook.ts
index fb8460068cbcf..b3572978cee70 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/actions/builtin_action_types/webhook.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/actions/builtin_action_types/webhook.ts
@@ -15,7 +15,6 @@ import {
 // eslint-disable-next-line import/no-default-export
 export default function webhookTest({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
-  const esArchiver = getService('esArchiver');
   const kibanaServer = getService('kibanaServer');
 
   async function createWebhookAction(
@@ -55,8 +54,6 @@ export default function webhookTest({ getService }: FtrProviderContext) {
       );
     });
 
-    after(() => esArchiver.unload('empty_kibana'));
-
     it('webhook can be executed without username and password', async () => {
       const webhookActionId = await createWebhookAction(webhookSimulatorURL);
       const { body: result } = await supertest
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/actions/execute.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/actions/execute.ts
index 7bbeab7cc8726..f74c6eaa3298a 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/actions/execute.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/actions/execute.ts
@@ -11,8 +11,12 @@ import {
   ES_TEST_INDEX_NAME,
   getUrlPrefix,
   ObjectRemover,
+  getEventLog,
 } from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
+import { IValidatedEvent } from '../../../../../plugins/event_log/server';
+
+const NANOS_IN_MILLIS = 1000 * 1000;
 
 // eslint-disable-next-line import/no-default-export
 export default function ({ getService }: FtrProviderContext) {
@@ -86,6 +90,13 @@ export default function ({ getService }: FtrProviderContext) {
         reference,
         source: 'action:test.index-record',
       });
+
+      await validateEventLog({
+        spaceId: Spaces.space1.id,
+        actionId: createdAction.id,
+        outcome: 'success',
+        message: `action executed: test.index-record:${createdAction.id}: My action`,
+      });
     });
 
     it('should handle failed executions', async () => {
@@ -118,6 +129,14 @@ export default function ({ getService }: FtrProviderContext) {
         serviceMessage: `expected failure for ${ES_TEST_INDEX_NAME} ${reference}`,
         retry: false,
       });
+
+      await validateEventLog({
+        spaceId: Spaces.space1.id,
+        actionId: createdAction.id,
+        outcome: 'failure',
+        message: `action execution failure: test.failing:${createdAction.id}: failing action`,
+        errorMessage: `an error occurred while running the action executor: expected failure for .kibana-alerting-test-data actions-failure-1:space1`,
+      });
     });
 
     it(`shouldn't execute an action from another space`, async () => {
@@ -198,4 +217,66 @@ export default function ({ getService }: FtrProviderContext) {
       });
     });
   });
+
+  interface ValidateEventLogParams {
+    spaceId: string;
+    actionId: string;
+    outcome: string;
+    message: string;
+    errorMessage?: string;
+  }
+
+  async function validateEventLog(params: ValidateEventLogParams): Promise<void> {
+    const { spaceId, actionId, outcome, message, errorMessage } = params;
+
+    const events: IValidatedEvent[] = await retry.try(async () => {
+      return await getEventLog({
+        getService,
+        spaceId,
+        type: 'action',
+        id: actionId,
+        provider: 'actions',
+        actions: ['execute'],
+      });
+    });
+
+    expect(events.length).to.equal(1);
+
+    const event = events[0];
+
+    const duration = event?.event?.duration;
+    const eventStart = Date.parse(event?.event?.start || 'undefined');
+    const eventEnd = Date.parse(event?.event?.end || 'undefined');
+    const dateNow = Date.now();
+
+    expect(typeof duration).to.be('number');
+    expect(eventStart).to.be.ok();
+    expect(eventEnd).to.be.ok();
+
+    const durationDiff = Math.abs(
+      Math.round(duration! / NANOS_IN_MILLIS) - (eventEnd - eventStart)
+    );
+
+    // account for rounding errors
+    expect(durationDiff < 1).to.equal(true);
+    expect(eventStart <= eventEnd).to.equal(true);
+    expect(eventEnd <= dateNow).to.equal(true);
+
+    expect(event?.event?.outcome).to.equal(outcome);
+
+    expect(event?.kibana?.saved_objects).to.eql([
+      {
+        rel: 'primary',
+        type: 'action',
+        id: actionId,
+        namespace: 'space1',
+      },
+    ]);
+
+    expect(event?.message).to.eql(message);
+
+    if (errorMessage) {
+      expect(event?.error?.message).to.eql(errorMessage);
+    }
+  }
 }
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/event_log.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/event_log.ts
new file mode 100644
index 0000000000000..79d25d8d10436
--- /dev/null
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/event_log.ts
@@ -0,0 +1,265 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import expect from '@kbn/expect';
+import { Spaces } from '../../scenarios';
+import { getUrlPrefix, getTestAlertData, ObjectRemover, getEventLog } from '../../../common/lib';
+import { FtrProviderContext } from '../../../common/ftr_provider_context';
+import { IValidatedEvent } from '../../../../../plugins/event_log/server';
+
+const NANOS_IN_MILLIS = 1000 * 1000;
+
+// eslint-disable-next-line import/no-default-export
+export default function eventLogTests({ getService }: FtrProviderContext) {
+  const supertest = getService('supertest');
+  const retry = getService('retry');
+
+  describe('eventLog', () => {
+    const objectRemover = new ObjectRemover(supertest);
+
+    after(() => objectRemover.removeAll());
+
+    it('should generate expected events for normal operation', async () => {
+      const { body: createdAction } = await supertest
+        .post(`${getUrlPrefix(Spaces.space1.id)}/api/actions/action`)
+        .set('kbn-xsrf', 'foo')
+        .send({
+          name: 'MY action',
+          actionTypeId: 'test.noop',
+          config: {},
+          secrets: {},
+        })
+        .expect(200);
+
+      // pattern of when the alert should fire
+      const pattern = [false, true, true];
+
+      const response = await supertest
+        .post(`${getUrlPrefix(Spaces.space1.id)}/api/alerts/alert`)
+        .set('kbn-xsrf', 'foo')
+        .send(
+          getTestAlertData({
+            alertTypeId: 'test.patternFiring',
+            schedule: { interval: '1s' },
+            throttle: null,
+            params: {
+              pattern,
+            },
+            actions: [
+              {
+                id: createdAction.id,
+                group: 'default',
+                params: {},
+              },
+            ],
+          })
+        );
+
+      expect(response.status).to.eql(200);
+      const alertId = response.body.id;
+      objectRemover.add(Spaces.space1.id, alertId, 'alert', 'alerts');
+
+      // get the events we're expecting
+      const events = await retry.try(async () => {
+        return await getEventLog({
+          getService,
+          spaceId: Spaces.space1.id,
+          type: 'alert',
+          id: alertId,
+          provider: 'alerting',
+          actions: ['execute', 'execute-action', 'new-instance', 'resolved-instance'],
+        });
+      });
+
+      // make sure the counts of the # of events per type are as expected
+      const executeEvents = getEventsByAction(events, 'execute');
+      const executeActionEvents = getEventsByAction(events, 'execute-action');
+      const newInstanceEvents = getEventsByAction(events, 'new-instance');
+      const resolvedInstanceEvents = getEventsByAction(events, 'resolved-instance');
+
+      expect(executeEvents.length >= 4).to.be(true);
+      expect(executeActionEvents.length).to.be(2);
+      expect(newInstanceEvents.length).to.be(1);
+      expect(resolvedInstanceEvents.length).to.be(1);
+
+      // make sure the events are in the right temporal order
+      const executeTimes = getTimestamps(executeEvents);
+      const executeActionTimes = getTimestamps(executeActionEvents);
+      const newInstanceTimes = getTimestamps(newInstanceEvents);
+      const resolvedInstanceTimes = getTimestamps(resolvedInstanceEvents);
+
+      expect(executeTimes[0] < newInstanceTimes[0]).to.be(true);
+      expect(executeTimes[1] <= newInstanceTimes[0]).to.be(true);
+      expect(executeTimes[2] > newInstanceTimes[0]).to.be(true);
+      expect(executeTimes[1] <= executeActionTimes[0]).to.be(true);
+      expect(executeTimes[2] > executeActionTimes[0]).to.be(true);
+      expect(resolvedInstanceTimes[0] > newInstanceTimes[0]).to.be(true);
+
+      // validate each event
+      for (const event of events) {
+        switch (event?.event?.action) {
+          case 'execute':
+            validateEvent(event, {
+              spaceId: Spaces.space1.id,
+              savedObjects: [{ type: 'alert', id: alertId, rel: 'primary' }],
+              outcome: 'success',
+              message: `alert executed: test.patternFiring:${alertId}: 'abc'`,
+            });
+            break;
+          case 'execute-action':
+            validateEvent(event, {
+              spaceId: Spaces.space1.id,
+              savedObjects: [
+                { type: 'alert', id: alertId, rel: 'primary' },
+                { type: 'action', id: createdAction.id },
+              ],
+              message: `alert: test.patternFiring:${alertId}: 'abc' instanceId: 'instance' scheduled actionGroup: 'default' action: test.noop:${createdAction.id}`,
+            });
+            break;
+          case 'new-instance':
+            validateEvent(event, {
+              spaceId: Spaces.space1.id,
+              savedObjects: [{ type: 'alert', id: alertId, rel: 'primary' }],
+              message: `test.patternFiring:${alertId}: 'abc' created new instance: 'instance'`,
+            });
+            break;
+          case 'resolved-instance':
+            validateEvent(event, {
+              spaceId: Spaces.space1.id,
+              savedObjects: [{ type: 'alert', id: alertId, rel: 'primary' }],
+              message: `test.patternFiring:${alertId}: 'abc' resolved instance: 'instance'`,
+            });
+            break;
+          // this will get triggered as we add new event actions
+          default:
+            throw new Error(`unexpected event action "${event?.event?.action}"`);
+        }
+      }
+    });
+
+    it('should generate events for execution errors', async () => {
+      const response = await supertest
+        .post(`${getUrlPrefix(Spaces.space1.id)}/api/alerts/alert`)
+        .set('kbn-xsrf', 'foo')
+        .send(
+          getTestAlertData({
+            alertTypeId: 'test.throw',
+            schedule: { interval: '1s' },
+            throttle: null,
+          })
+        );
+
+      expect(response.status).to.eql(200);
+      const alertId = response.body.id;
+      objectRemover.add(Spaces.space1.id, alertId, 'alert', 'alerts');
+
+      const events = await retry.try(async () => {
+        return await getEventLog({
+          getService,
+          spaceId: Spaces.space1.id,
+          type: 'alert',
+          id: alertId,
+          provider: 'alerting',
+          actions: ['execute'],
+        });
+      });
+
+      const event = events[0];
+      expect(event).to.be.ok();
+
+      validateEvent(event, {
+        spaceId: Spaces.space1.id,
+        savedObjects: [{ type: 'alert', id: alertId, rel: 'primary' }],
+        outcome: 'failure',
+        message: `alert execution failure: test.throw:${alertId}: 'abc'`,
+        errorMessage: 'this alert is intended to fail',
+      });
+    });
+  });
+
+  interface SavedObject {
+    type: string;
+    id: string;
+    rel?: string;
+  }
+
+  interface ValidateEventLogParams {
+    spaceId: string;
+    savedObjects: SavedObject[];
+    outcome?: string;
+    message: string;
+    errorMessage?: string;
+  }
+
+  function validateEvent(event: IValidatedEvent, params: ValidateEventLogParams): void {
+    const { spaceId, savedObjects, outcome, message, errorMessage } = params;
+
+    const duration = event?.event?.duration;
+    const eventStart = Date.parse(event?.event?.start || 'undefined');
+    const eventEnd = Date.parse(event?.event?.end || 'undefined');
+    const dateNow = Date.now();
+
+    if (duration !== undefined) {
+      expect(typeof duration).to.be('number');
+      expect(eventStart).to.be.ok();
+      expect(eventEnd).to.be.ok();
+
+      const durationDiff = Math.abs(
+        Math.round(duration! / NANOS_IN_MILLIS) - (eventEnd - eventStart)
+      );
+
+      // account for rounding errors
+      expect(durationDiff < 1).to.equal(true);
+      expect(eventStart <= eventEnd).to.equal(true);
+      expect(eventEnd <= dateNow).to.equal(true);
+    }
+
+    expect(event?.event?.outcome).to.equal(outcome);
+
+    for (const savedObject of savedObjects) {
+      expect(
+        isSavedObjectInEvent(event, spaceId, savedObject.type, savedObject.id, savedObject.rel)
+      ).to.be(true);
+    }
+
+    expect(event?.message).to.eql(message);
+
+    if (errorMessage) {
+      expect(event?.error?.message).to.eql(errorMessage);
+    }
+  }
+}
+
+function getEventsByAction(events: IValidatedEvent[], action: string) {
+  return events.filter((event) => event?.event?.action === action);
+}
+
+function getTimestamps(events: IValidatedEvent[]) {
+  return events.map((event) => event?.['@timestamp'] ?? 'missing timestamp');
+}
+
+function isSavedObjectInEvent(
+  event: IValidatedEvent,
+  namespace: string,
+  type: string,
+  id: string,
+  rel?: string
+): boolean {
+  const savedObjects = event?.kibana?.saved_objects ?? [];
+
+  for (const savedObject of savedObjects) {
+    if (
+      savedObject.namespace === namespace &&
+      savedObject.type === type &&
+      savedObject.id === id &&
+      savedObject.rel === rel
+    ) {
+      return true;
+    }
+  }
+
+  return false;
+}
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/index.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/index.ts
index 2fc35ddaa3c61..0970738b630c4 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/index.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/index.ts
@@ -17,6 +17,7 @@ export default function alertingTests({ loadTestFile }: FtrProviderContext) {
     loadTestFile(require.resolve('./get'));
     loadTestFile(require.resolve('./get_alert_state'));
     loadTestFile(require.resolve('./list_alert_types'));
+    loadTestFile(require.resolve('./event_log'));
     loadTestFile(require.resolve('./mute_all'));
     loadTestFile(require.resolve('./mute_instance'));
     loadTestFile(require.resolve('./unmute_all'));
@@ -26,6 +27,8 @@ export default function alertingTests({ loadTestFile }: FtrProviderContext) {
     loadTestFile(require.resolve('./alerts_space1'));
     loadTestFile(require.resolve('./alerts_default_space'));
     loadTestFile(require.resolve('./builtin_alert_types'));
+
+    // note that this test will destroy existing spaces
     loadTestFile(require.resolve('./migrations'));
   });
 }
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/index.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/index.ts
index 17f602d3d94f7..281096f8a3592 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/index.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/index.ts
@@ -27,7 +27,7 @@ export default function alertingApiIntegrationTests({
       }
     });
 
-    after(() => esArchiver.unload('empty_kibana'));
+    after(async () => await esArchiver.unload('empty_kibana'));
 
     loadTestFile(require.resolve('./actions'));
     loadTestFile(require.resolve('./alerting'));
diff --git a/x-pack/test/api_integration/apis/fleet/index.js b/x-pack/test/api_integration/apis/fleet/index.js
index ec80b9aed4be0..df81b826132a9 100644
--- a/x-pack/test/api_integration/apis/fleet/index.js
+++ b/x-pack/test/api_integration/apis/fleet/index.js
@@ -5,9 +5,7 @@
  */
 
 export default function loadTests({ loadTestFile }) {
-  // Temporarily skipped to promote snapshot
-  // Re-enabled in https://github.com/elastic/kibana/pull/71727
-  describe.skip('Fleet Endpoints', () => {
+  describe('Fleet Endpoints', () => {
     loadTestFile(require.resolve('./setup'));
     loadTestFile(require.resolve('./delete_agent'));
     loadTestFile(require.resolve('./list_agent'));
diff --git a/x-pack/test/api_integration/apis/fleet/setup.ts b/x-pack/test/api_integration/apis/fleet/setup.ts
index 4fcf39886e202..82e494b0ab28c 100644
--- a/x-pack/test/api_integration/apis/fleet/setup.ts
+++ b/x-pack/test/api_integration/apis/fleet/setup.ts
@@ -11,7 +11,8 @@ export default function ({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
   const es = getService('es');
 
-  describe('fleet_setup', () => {
+  // FLAKY: https://github.com/elastic/kibana/issues/72053
+  describe.skip('fleet_setup', () => {
     beforeEach(async () => {
       try {
         await es.security.deleteUser({
diff --git a/x-pack/test/api_integration/apis/management/index_management/data_streams.ts b/x-pack/test/api_integration/apis/management/index_management/data_streams.ts
index 9f5c2a3de07bf..f8ddca374209b 100644
--- a/x-pack/test/api_integration/apis/management/index_management/data_streams.ts
+++ b/x-pack/test/api_integration/apis/management/index_management/data_streams.ts
@@ -51,8 +51,7 @@ export default function ({ getService }: FtrProviderContext) {
     await deleteComposableIndexTemplate(name);
   };
 
-  // Temporarily skipping tests until ES snapshot is updated
-  describe.skip('Data streams', function () {
+  describe('Data streams', function () {
     describe('Get', () => {
       const testDataStreamName = 'test-data-stream';
 
diff --git a/x-pack/test/detection_engine_api_integration/basic/tests/add_prepackaged_rules.ts b/x-pack/test/detection_engine_api_integration/basic/tests/add_prepackaged_rules.ts
index 242f906d0d197..3340ac49b2d2d 100644
--- a/x-pack/test/detection_engine_api_integration/basic/tests/add_prepackaged_rules.ts
+++ b/x-pack/test/detection_engine_api_integration/basic/tests/add_prepackaged_rules.ts
@@ -20,7 +20,8 @@ export default ({ getService }: FtrProviderContext): void => {
   const supertest = getService('supertest');
   const es = getService('es');
 
-  describe('add_prepackaged_rules', () => {
+  // FLAKY: https://github.com/elastic/kibana/issues/71867
+  describe.skip('add_prepackaged_rules', () => {
     describe('validation errors', () => {
       it('should give an error that the index must exist first if it does not exist before adding prepackaged rules', async () => {
         const { body } = await supertest
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/add_prepackaged_rules.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/add_prepackaged_rules.ts
index 5e0ce0b824323..7671b1bd49744 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/add_prepackaged_rules.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/add_prepackaged_rules.ts
@@ -20,7 +20,7 @@ export default ({ getService }: FtrProviderContext): void => {
   const supertest = getService('supertest');
   const es = getService('es');
 
-  // https://github.com/elastic/kibana/issues/71814
+  // FLAKY: https://github.com/elastic/kibana/issues/71814
   describe.skip('add_prepackaged_rules', () => {
     describe('validation errors', () => {
       it('should give an error that the index must exist first if it does not exist before adding prepackaged rules', async () => {
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_rules.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_rules.ts
index 73d39b600cf11..c763be1c2c3ec 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_rules.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_rules.ts
@@ -31,8 +31,7 @@ export default ({ getService }: FtrProviderContext) => {
   const supertest = getService('supertest');
   const es = getService('es');
 
-  // Preventing ES promotion: https://github.com/elastic/kibana/issues/71555
-  describe.skip('create_rules', () => {
+  describe('create_rules', () => {
     describe('validation errors', () => {
       it('should give an error that the index must exist first if it does not exist before creating a rule', async () => {
         const { body } = await supertest
diff --git a/x-pack/test/functional/apps/dashboard_mode/dashboard_empty_screen.js b/x-pack/test/functional/apps/dashboard_mode/dashboard_empty_screen.js
index ece326eabf869..c8a8f9653c11b 100644
--- a/x-pack/test/functional/apps/dashboard_mode/dashboard_empty_screen.js
+++ b/x-pack/test/functional/apps/dashboard_mode/dashboard_empty_screen.js
@@ -36,22 +36,19 @@ export default function ({ getPageObjects, getService }) {
       await PageObjects.visualize.clickLensWidget();
       await PageObjects.lens.goToTimeRange();
       await PageObjects.lens.configureDimension({
-        dimension:
-          '[data-test-subj="lnsXY_xDimensionPanel"] [data-test-subj="lns-empty-dimension"]',
+        dimension: 'lnsXY_xDimensionPanel > lns-empty-dimension',
         operation: 'date_histogram',
         field: '@timestamp',
       });
 
       await PageObjects.lens.configureDimension({
-        dimension:
-          '[data-test-subj="lnsXY_yDimensionPanel"] [data-test-subj="lns-empty-dimension"]',
+        dimension: 'lnsXY_yDimensionPanel > lns-empty-dimension',
         operation: 'avg',
         field: 'bytes',
       });
 
       await PageObjects.lens.configureDimension({
-        dimension:
-          '[data-test-subj="lnsXY_splitDimensionPanel"] [data-test-subj="lns-empty-dimension"]',
+        dimension: 'lnsXY_splitDimensionPanel > lns-empty-dimension',
         operation: 'terms',
         field: 'ip',
       });
diff --git a/x-pack/test/functional/apps/lens/smokescreen.ts b/x-pack/test/functional/apps/lens/smokescreen.ts
index 97cdd081705a4..8bb5faf2469d7 100644
--- a/x-pack/test/functional/apps/lens/smokescreen.ts
+++ b/x-pack/test/functional/apps/lens/smokescreen.ts
@@ -111,9 +111,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await PageObjects.lens.clickVisualizeListItemTitle('Artistpreviouslyknownaslens');
       await PageObjects.lens.goToTimeRange();
       await assertExpectedMetric();
-      await PageObjects.lens.switchToVisualization('lnsChartSwitchPopover_lnsDatatable');
+      await PageObjects.lens.switchToVisualization('lnsDatatable');
       await assertExpectedTable();
-      await PageObjects.lens.switchToVisualization('lnsChartSwitchPopover_lnsMetric');
+      await PageObjects.lens.switchToVisualization('lnsMetric');
       await assertExpectedMetric();
     });
 
@@ -123,33 +123,29 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       await PageObjects.lens.goToTimeRange();
 
       await PageObjects.lens.configureDimension({
-        dimension:
-          '[data-test-subj="lnsXY_xDimensionPanel"] [data-test-subj="lns-empty-dimension"]',
+        dimension: 'lnsXY_xDimensionPanel > lns-empty-dimension',
         operation: 'date_histogram',
         field: '@timestamp',
       });
 
       await PageObjects.lens.configureDimension({
-        dimension:
-          '[data-test-subj="lnsXY_yDimensionPanel"] [data-test-subj="lns-empty-dimension"]',
+        dimension: 'lnsXY_yDimensionPanel > lns-empty-dimension',
         operation: 'avg',
         field: 'bytes',
       });
 
       await PageObjects.lens.configureDimension({
-        dimension:
-          '[data-test-subj="lnsXY_splitDimensionPanel"] [data-test-subj="lns-empty-dimension"]',
+        dimension: 'lnsXY_splitDimensionPanel > lns-empty-dimension',
         operation: 'terms',
         field: '@message.raw',
       });
 
-      await PageObjects.lens.switchToVisualization('lnsChartSwitchPopover_lnsDatatable');
+      await PageObjects.lens.switchToVisualization('lnsDatatable');
       await PageObjects.lens.removeDimension('lnsDatatable_column');
-      await PageObjects.lens.switchToVisualization('lnsChartSwitchPopover_bar_stacked');
+      await PageObjects.lens.switchToVisualization('bar_stacked');
 
       await PageObjects.lens.configureDimension({
-        dimension:
-          '[data-test-subj="lnsXY_splitDimensionPanel"] [data-test-subj="lns-empty-dimension"]',
+        dimension: 'lnsXY_splitDimensionPanel > lns-empty-dimension',
         operation: 'terms',
         field: 'ip',
       });
diff --git a/x-pack/test/functional/apps/management/create_index_pattern_wizard.js b/x-pack/test/functional/apps/management/create_index_pattern_wizard.js
new file mode 100644
index 0000000000000..187124f9edc12
--- /dev/null
+++ b/x-pack/test/functional/apps/management/create_index_pattern_wizard.js
@@ -0,0 +1,54 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export default function ({ getService, getPageObjects }) {
+  const kibanaServer = getService('kibanaServer');
+  const es = getService('legacyEs');
+  const PageObjects = getPageObjects(['settings', 'common']);
+
+  describe('"Create Index Pattern" wizard', function () {
+    before(async function () {
+      // delete .kibana index and then wait for Kibana to re-create it
+      await kibanaServer.uiSettings.replace({});
+      await PageObjects.settings.navigateTo();
+      await PageObjects.settings.clickKibanaIndexPatterns();
+    });
+
+    describe('data streams', () => {
+      it('can be an index pattern', async () => {
+        await es.transport.request({
+          path: '/_index_template/generic-logs',
+          method: 'PUT',
+          body: {
+            index_patterns: ['logs-*', 'test_data_stream'],
+            template: {
+              mappings: {
+                properties: {
+                  '@timestamp': {
+                    type: 'date',
+                  },
+                },
+              },
+            },
+            data_stream: {},
+          },
+        });
+
+        await es.transport.request({
+          path: '/_data_stream/test_data_stream',
+          method: 'PUT',
+        });
+
+        await PageObjects.settings.createIndexPattern('test_data_stream', false);
+
+        await es.transport.request({
+          path: '/_data_stream/test_data_stream',
+          method: 'DELETE',
+        });
+      });
+    });
+  });
+}
diff --git a/x-pack/plugins/ml/public/application/components/ml_in_memory_table/index.ts b/x-pack/test/functional/apps/management/index.js
similarity index 56%
rename from x-pack/plugins/ml/public/application/components/ml_in_memory_table/index.ts
rename to x-pack/test/functional/apps/management/index.js
index bbd793696e005..19c68a2da9d9b 100644
--- a/x-pack/plugins/ml/public/application/components/ml_in_memory_table/index.ts
+++ b/x-pack/test/functional/apps/management/index.js
@@ -4,5 +4,10 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export { ProgressBar, mlInMemoryTableFactory } from './ml_in_memory_table';
-export * from './types';
+export default function ({ loadTestFile }) {
+  describe('management', function () {
+    this.tags(['ciGroup2']);
+
+    loadTestFile(require.resolve('./create_index_pattern_wizard'));
+  });
+}
diff --git a/x-pack/test/functional/apps/ml/anomaly_detection/advanced_job.ts b/x-pack/test/functional/apps/ml/anomaly_detection/advanced_job.ts
index 497078c4fd273..b574c67daf7a4 100644
--- a/x-pack/test/functional/apps/ml/anomaly_detection/advanced_job.ts
+++ b/x-pack/test/functional/apps/ml/anomaly_detection/advanced_job.ts
@@ -261,7 +261,7 @@ export default function ({ getService }: FtrProviderContext) {
         modelSizeStats: {
           result_type: 'model_size_stats',
           model_bytes_exceeded: '0.0 B',
-          total_by_field_count: '994',
+          // not checking total_by_field_count as the number of categories might change
           total_over_field_count: '0',
           total_partition_field_count: '2',
           bucket_allocation_failures_count: '0',
@@ -517,44 +517,18 @@ export default function ({ getService }: FtrProviderContext) {
             id: testData.jobId,
             description: testData.jobDescription,
             jobGroups: [...new Set(testData.jobGroups)].sort(),
-            recordCount: testData.expected.row.recordCount,
-            memoryStatus: testData.expected.row.memoryStatus,
-            jobState: testData.expected.row.jobState,
-            datafeedState: testData.expected.row.datafeedState,
-            latestTimestamp: testData.expected.row.latestTimestamp,
+            ...testData.expected.row,
           });
 
           await ml.jobTable.assertJobRowDetailsCounts(
             testData.jobId,
             {
               job_id: testData.jobId,
-              processed_record_count: testData.expected.counts.processed_record_count,
-              processed_field_count: testData.expected.counts.processed_field_count,
-              input_bytes: testData.expected.counts.input_bytes,
-              input_field_count: testData.expected.counts.input_field_count,
-              invalid_date_count: testData.expected.counts.invalid_date_count,
-              missing_field_count: testData.expected.counts.missing_field_count,
-              out_of_order_timestamp_count: testData.expected.counts.out_of_order_timestamp_count,
-              empty_bucket_count: testData.expected.counts.empty_bucket_count,
-              sparse_bucket_count: testData.expected.counts.sparse_bucket_count,
-              bucket_count: testData.expected.counts.bucket_count,
-              earliest_record_timestamp: testData.expected.counts.earliest_record_timestamp,
-              latest_record_timestamp: testData.expected.counts.latest_record_timestamp,
-              input_record_count: testData.expected.counts.input_record_count,
-              latest_bucket_timestamp: testData.expected.counts.latest_bucket_timestamp,
+              ...testData.expected.counts,
             },
             {
               job_id: testData.jobId,
-              result_type: testData.expected.modelSizeStats.result_type,
-              model_bytes_exceeded: testData.expected.modelSizeStats.model_bytes_exceeded,
-              total_by_field_count: testData.expected.modelSizeStats.total_by_field_count,
-              total_over_field_count: testData.expected.modelSizeStats.total_over_field_count,
-              total_partition_field_count:
-                testData.expected.modelSizeStats.total_partition_field_count,
-              bucket_allocation_failures_count:
-                testData.expected.modelSizeStats.bucket_allocation_failures_count,
-              memory_status: testData.expected.modelSizeStats.memory_status,
-              timestamp: testData.expected.modelSizeStats.timestamp,
+              ...testData.expected.modelSizeStats,
             }
           );
         });
@@ -780,44 +754,18 @@ export default function ({ getService }: FtrProviderContext) {
             id: testData.jobIdClone,
             description: testData.jobDescription,
             jobGroups: [...new Set(testData.jobGroupsClone)].sort(),
-            recordCount: testData.expected.row.recordCount,
-            memoryStatus: testData.expected.row.memoryStatus,
-            jobState: testData.expected.row.jobState,
-            datafeedState: testData.expected.row.datafeedState,
-            latestTimestamp: testData.expected.row.latestTimestamp,
+            ...testData.expected.row,
           });
 
           await ml.jobTable.assertJobRowDetailsCounts(
             testData.jobIdClone,
             {
               job_id: testData.jobIdClone,
-              processed_record_count: testData.expected.counts.processed_record_count,
-              processed_field_count: testData.expected.counts.processed_field_count,
-              input_bytes: testData.expected.counts.input_bytes,
-              input_field_count: testData.expected.counts.input_field_count,
-              invalid_date_count: testData.expected.counts.invalid_date_count,
-              missing_field_count: testData.expected.counts.missing_field_count,
-              out_of_order_timestamp_count: testData.expected.counts.out_of_order_timestamp_count,
-              empty_bucket_count: testData.expected.counts.empty_bucket_count,
-              sparse_bucket_count: testData.expected.counts.sparse_bucket_count,
-              bucket_count: testData.expected.counts.bucket_count,
-              earliest_record_timestamp: testData.expected.counts.earliest_record_timestamp,
-              latest_record_timestamp: testData.expected.counts.latest_record_timestamp,
-              input_record_count: testData.expected.counts.input_record_count,
-              latest_bucket_timestamp: testData.expected.counts.latest_bucket_timestamp,
+              ...testData.expected.counts,
             },
             {
               job_id: testData.jobIdClone,
-              result_type: testData.expected.modelSizeStats.result_type,
-              model_bytes_exceeded: testData.expected.modelSizeStats.model_bytes_exceeded,
-              total_by_field_count: testData.expected.modelSizeStats.total_by_field_count,
-              total_over_field_count: testData.expected.modelSizeStats.total_over_field_count,
-              total_partition_field_count:
-                testData.expected.modelSizeStats.total_partition_field_count,
-              bucket_allocation_failures_count:
-                testData.expected.modelSizeStats.bucket_allocation_failures_count,
-              memory_status: testData.expected.modelSizeStats.memory_status,
-              timestamp: testData.expected.modelSizeStats.timestamp,
+              ...testData.expected.modelSizeStats,
             }
           );
         });
diff --git a/x-pack/test/functional/apps/ml/anomaly_detection/categorization_job.ts b/x-pack/test/functional/apps/ml/anomaly_detection/categorization_job.ts
index 3461fe72c1556..0f8aad36ed372 100644
--- a/x-pack/test/functional/apps/ml/anomaly_detection/categorization_job.ts
+++ b/x-pack/test/functional/apps/ml/anomaly_detection/categorization_job.ts
@@ -64,7 +64,7 @@ export default function ({ getService }: FtrProviderContext) {
       job_id: expectedJobId,
       result_type: 'model_size_stats',
       model_bytes_exceeded: '0.0 B',
-      total_by_field_count: '30',
+      // not checking total_by_field_count as the number of categories might change
       total_over_field_count: '0',
       total_partition_field_count: '2',
       bucket_allocation_failures_count: '0',
diff --git a/x-pack/test/functional/apps/ml/anomaly_detection/date_nanos_job.ts b/x-pack/test/functional/apps/ml/anomaly_detection/date_nanos_job.ts
index 2cc393c3d986d..da56d96d3d59e 100644
--- a/x-pack/test/functional/apps/ml/anomaly_detection/date_nanos_job.ts
+++ b/x-pack/test/functional/apps/ml/anomaly_detection/date_nanos_job.ts
@@ -391,44 +391,18 @@ export default function ({ getService }: FtrProviderContext) {
             id: testData.jobId,
             description: testData.jobDescription,
             jobGroups: [...new Set(testData.jobGroups)].sort(),
-            recordCount: testData.expected.row.recordCount,
-            memoryStatus: testData.expected.row.memoryStatus,
-            jobState: testData.expected.row.jobState,
-            datafeedState: testData.expected.row.datafeedState,
-            latestTimestamp: testData.expected.row.latestTimestamp,
+            ...testData.expected.row,
           });
 
           await ml.jobTable.assertJobRowDetailsCounts(
             testData.jobId,
             {
               job_id: testData.jobId,
-              processed_record_count: testData.expected.counts.processed_record_count,
-              processed_field_count: testData.expected.counts.processed_field_count,
-              input_bytes: testData.expected.counts.input_bytes,
-              input_field_count: testData.expected.counts.input_field_count,
-              invalid_date_count: testData.expected.counts.invalid_date_count,
-              missing_field_count: testData.expected.counts.missing_field_count,
-              out_of_order_timestamp_count: testData.expected.counts.out_of_order_timestamp_count,
-              empty_bucket_count: testData.expected.counts.empty_bucket_count,
-              sparse_bucket_count: testData.expected.counts.sparse_bucket_count,
-              bucket_count: testData.expected.counts.bucket_count,
-              earliest_record_timestamp: testData.expected.counts.earliest_record_timestamp,
-              latest_record_timestamp: testData.expected.counts.latest_record_timestamp,
-              input_record_count: testData.expected.counts.input_record_count,
-              latest_bucket_timestamp: testData.expected.counts.latest_bucket_timestamp,
+              ...testData.expected.counts,
             },
             {
               job_id: testData.jobId,
-              result_type: testData.expected.modelSizeStats.result_type,
-              model_bytes_exceeded: testData.expected.modelSizeStats.model_bytes_exceeded,
-              total_by_field_count: testData.expected.modelSizeStats.total_by_field_count,
-              total_over_field_count: testData.expected.modelSizeStats.total_over_field_count,
-              total_partition_field_count:
-                testData.expected.modelSizeStats.total_partition_field_count,
-              bucket_allocation_failures_count:
-                testData.expected.modelSizeStats.bucket_allocation_failures_count,
-              memory_status: testData.expected.modelSizeStats.memory_status,
-              timestamp: testData.expected.modelSizeStats.timestamp,
+              ...testData.expected.modelSizeStats,
             }
           );
         });
diff --git a/x-pack/test/functional/apps/ml/anomaly_detection/saved_search_job.ts b/x-pack/test/functional/apps/ml/anomaly_detection/saved_search_job.ts
index 75f0f2682c198..c1276c158eb64 100644
--- a/x-pack/test/functional/apps/ml/anomaly_detection/saved_search_job.ts
+++ b/x-pack/test/functional/apps/ml/anomaly_detection/saved_search_job.ts
@@ -429,44 +429,18 @@ export default function ({ getService }: FtrProviderContext) {
             id: testData.jobId,
             description: testData.jobDescription,
             jobGroups: [...new Set(testData.jobGroups)].sort(),
-            recordCount: testData.expected.row.recordCount,
-            memoryStatus: testData.expected.row.memoryStatus,
-            jobState: testData.expected.row.jobState,
-            datafeedState: testData.expected.row.datafeedState,
-            latestTimestamp: testData.expected.row.latestTimestamp,
+            ...testData.expected.row,
           });
 
           await ml.jobTable.assertJobRowDetailsCounts(
             testData.jobId,
             {
               job_id: testData.jobId,
-              processed_record_count: testData.expected.counts.processed_record_count,
-              processed_field_count: testData.expected.counts.processed_field_count,
-              input_bytes: testData.expected.counts.input_bytes,
-              input_field_count: testData.expected.counts.input_field_count,
-              invalid_date_count: testData.expected.counts.invalid_date_count,
-              missing_field_count: testData.expected.counts.missing_field_count,
-              out_of_order_timestamp_count: testData.expected.counts.out_of_order_timestamp_count,
-              empty_bucket_count: testData.expected.counts.empty_bucket_count,
-              sparse_bucket_count: testData.expected.counts.sparse_bucket_count,
-              bucket_count: testData.expected.counts.bucket_count,
-              earliest_record_timestamp: testData.expected.counts.earliest_record_timestamp,
-              latest_record_timestamp: testData.expected.counts.latest_record_timestamp,
-              input_record_count: testData.expected.counts.input_record_count,
-              latest_bucket_timestamp: testData.expected.counts.latest_bucket_timestamp,
+              ...testData.expected.counts,
             },
             {
               job_id: testData.jobId,
-              result_type: testData.expected.modelSizeStats.result_type,
-              model_bytes_exceeded: testData.expected.modelSizeStats.model_bytes_exceeded,
-              total_by_field_count: testData.expected.modelSizeStats.total_by_field_count,
-              total_over_field_count: testData.expected.modelSizeStats.total_over_field_count,
-              total_partition_field_count:
-                testData.expected.modelSizeStats.total_partition_field_count,
-              bucket_allocation_failures_count:
-                testData.expected.modelSizeStats.bucket_allocation_failures_count,
-              memory_status: testData.expected.modelSizeStats.memory_status,
-              timestamp: testData.expected.modelSizeStats.timestamp,
+              ...testData.expected.modelSizeStats,
             }
           );
         });
diff --git a/x-pack/test/functional/apps/monitoring/cluster/overview.js b/x-pack/test/functional/apps/monitoring/cluster/overview.js
index 94996d6ab40ab..0e608e9a055fa 100644
--- a/x-pack/test/functional/apps/monitoring/cluster/overview.js
+++ b/x-pack/test/functional/apps/monitoring/cluster/overview.js
@@ -10,8 +10,7 @@ import { getLifecycleMethods } from '../_get_lifecycle_methods';
 export default function ({ getService, getPageObjects }) {
   const overview = getService('monitoringClusterOverview');
 
-  // https://github.com/elastic/kibana/issues/71796
-  describe.skip('Cluster overview', () => {
+  describe('Cluster overview', () => {
     describe('for Green cluster with Gold license', () => {
       const { setup, tearDown } = getLifecycleMethods(getService, getPageObjects);
 
diff --git a/x-pack/test/functional/config.js b/x-pack/test/functional/config.js
index ad65f82d6dfe1..5c13e430ae2ca 100644
--- a/x-pack/test/functional/config.js
+++ b/x-pack/test/functional/config.js
@@ -57,6 +57,7 @@ export default async function ({ readConfigFile }) {
       resolve(__dirname, './apps/remote_clusters'),
       resolve(__dirname, './apps/transform'),
       resolve(__dirname, './apps/reporting_management'),
+      resolve(__dirname, './apps/management'),
 
       // This license_management file must be last because it is destructive.
       resolve(__dirname, './apps/license_management'),
diff --git a/x-pack/test/functional/page_objects/lens_page.ts b/x-pack/test/functional/page_objects/lens_page.ts
index ce621d4471d0f..4252c400ff1cd 100644
--- a/x-pack/test/functional/page_objects/lens_page.ts
+++ b/x-pack/test/functional/page_objects/lens_page.ts
@@ -74,16 +74,6 @@ export function LensPageProvider({ getService, getPageObjects }: FtrProviderCont
       return this.assertExpectedText(selector, (value) => value === expectedText);
     },
 
-    /**
-     * Uses the Lens visualization switcher to switch visualizations.
-     *
-     * @param dataTestSubj - the data-test-subj of the visualization to switch to
-     */
-    async switchToVisualization(dataTestSubj: string) {
-      await testSubjects.click('lnsChartSwitchPopover');
-      await testSubjects.click(dataTestSubj);
-    },
-
     /**
      * Clicks a visualize list item's title (in the visualize app).
      *
@@ -101,12 +91,12 @@ export function LensPageProvider({ getService, getPageObjects }: FtrProviderCont
      * @param opts.field - the desired field for the dimension
      */
     async configureDimension(opts: { dimension: string; operation: string; field: string }) {
-      await find.clickByCssSelector(opts.dimension);
+      await retry.try(async () => {
+        await testSubjects.click(opts.dimension);
+        await testSubjects.exists(`lns-indexPatternDimension-${opts.operation}`);
+      });
 
-      await find.clickByCssSelector(
-        `[data-test-subj="lns-indexPatternDimensionIncompatible-${opts.operation}"],
-          [data-test-subj="lns-indexPatternDimension-${opts.operation}"]`
-      );
+      await testSubjects.click(`lns-indexPatternDimension-${opts.operation}`);
 
       const target = await testSubjects.find('indexPattern-dimension-field');
       await comboBox.openOptionsList(target);
@@ -117,9 +107,7 @@ export function LensPageProvider({ getService, getPageObjects }: FtrProviderCont
      * Removes the dimension matching a specific test subject
      */
     async removeDimension(dimensionTestSubj: string) {
-      await find.clickByCssSelector(
-        `[data-test-subj="${dimensionTestSubj}"] [data-test-subj="indexPattern-dimensionPopover-remove"]`
-      );
+      await testSubjects.click(`${dimensionTestSubj} > indexPattern-dimensionPopover-remove`);
     },
 
     /**
@@ -158,5 +146,26 @@ export function LensPageProvider({ getService, getPageObjects }: FtrProviderCont
     getTitle() {
       return testSubjects.getVisibleText('lns_ChartTitle');
     },
+
+    /**
+     * Uses the Lens visualization switcher to switch visualizations.
+     *
+     * @param subVisualizationId - the ID of the sub-visualization to switch to, such as
+     * lnsDatatable or bar_stacked
+     */
+    async switchToVisualization(subVisualizationId: string) {
+      await this.openChartSwitchPopover();
+      await testSubjects.click(`lnsChartSwitchPopover_${subVisualizationId}`);
+    },
+
+    async openChartSwitchPopover() {
+      if (await testSubjects.exists('visTypeTitle')) {
+        return;
+      }
+      await retry.try(async () => {
+        await testSubjects.click('lnsChartSwitchPopover');
+        await testSubjects.existOrFail('visTypeTitle');
+      });
+    },
   });
 }
diff --git a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/details.ts b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/details.ts
index 4c33a709d9bf9..d86d272c1da8c 100644
--- a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/details.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/details.ts
@@ -19,8 +19,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
   const retry = getService('retry');
   const find = getService('find');
 
-  // Failing ES Promotion: https://github.com/elastic/kibana/issues/71559
-  describe.skip('Alert Details', function () {
+  describe('Alert Details', function () {
     describe('Header', function () {
       const testRunUuid = uuid.v4();
       before(async () => {
diff --git a/x-pack/test/ingest_manager_api_integration/apis/epm/install.ts b/x-pack/test/ingest_manager_api_integration/apis/epm/install.ts
index f2ca98ca39a0b..b6807b2fd3414 100644
--- a/x-pack/test/ingest_manager_api_integration/apis/epm/install.ts
+++ b/x-pack/test/ingest_manager_api_integration/apis/epm/install.ts
@@ -21,8 +21,7 @@ export default function ({ getService }: FtrProviderContext) {
   const mappingsPackage = 'overrides-0.1.0';
   const server = dockerServers.get('registry');
 
-  // Temporarily skipped to promote snapshot
-  // Re-enabled in https://github.com/elastic/kibana/pull/71727
+  // FLAKY: https://github.com/elastic/kibana/issues/71939
   describe.skip('installs packages that include settings and mappings overrides', async () => {
     after(async () => {
       if (server.enabled) {
diff --git a/x-pack/test/plugin_api_integration/plugins/event_log/server/plugin.ts b/x-pack/test/plugin_api_integration/plugins/event_log/server/plugin.ts
index 2ef932d19e9ee..4fb0511db2194 100644
--- a/x-pack/test/plugin_api_integration/plugins/event_log/server/plugin.ts
+++ b/x-pack/test/plugin_api_integration/plugins/event_log/server/plugin.ts
@@ -44,7 +44,7 @@ export class EventLogFixturePlugin
     core.savedObjects.registerType({
       name: 'event_log_test',
       hidden: false,
-      namespaceType: 'agnostic',
+      namespaceType: 'single',
       mappings: {
         properties: {},
       },
diff --git a/x-pack/test/plugin_api_integration/test_suites/event_log/public_api_integration.ts b/x-pack/test/plugin_api_integration/test_suites/event_log/public_api_integration.ts
index b6eacf2427643..eea18863e3be8 100644
--- a/x-pack/test/plugin_api_integration/test_suites/event_log/public_api_integration.ts
+++ b/x-pack/test/plugin_api_integration/test_suites/event_log/public_api_integration.ts
@@ -18,137 +18,162 @@ export default function ({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
   const log = getService('log');
   const retry = getService('retry');
+  const spacesService = getService('spaces');
+  const esArchiver = getService('esArchiver');
 
   describe('Event Log public API', () => {
-    it('should allow querying for events by Saved Object', async () => {
-      const id = uuid.v4();
+    before(async () => {
+      await spacesService.create({
+        id: 'namespace-a',
+        name: 'Space A',
+        disabledFeatures: [],
+      });
+    });
 
-      const expectedEvents = [fakeEvent(id), fakeEvent(id)];
+    after(async () => {
+      await esArchiver.unload('empty_kibana');
+    });
 
-      await logTestEvent(id, expectedEvents[0]);
-      await logTestEvent(id, expectedEvents[1]);
+    for (const namespace of [undefined, 'namespace-a']) {
+      const namespaceName = namespace === undefined ? 'default' : namespace;
 
-      await retry.try(async () => {
-        const {
-          body: { data, total },
-        } = await findEvents(id, {});
+      describe(`namespace: ${namespaceName}`, () => {
+        it('should allow querying for events by Saved Object', async () => {
+          const id = uuid.v4();
 
-        expect(data.length).to.be(2);
-        expect(total).to.be(2);
+          const expectedEvents = [fakeEvent(namespace, id), fakeEvent(namespace, id)];
 
-        assertEventsFromApiMatchCreatedEvents(data, expectedEvents);
-      });
-    });
+          await logTestEvent(namespace, id, expectedEvents[0]);
+          await logTestEvent(namespace, id, expectedEvents[1]);
 
-    it('should support pagination for events', async () => {
-      const id = uuid.v4();
+          await retry.try(async () => {
+            const {
+              body: { data, total },
+            } = await findEvents(namespace, id, {});
 
-      const expectedEvents = await logFakeEvents(id, 6);
+            expect(data.length).to.be(2);
+            expect(total).to.be(2);
 
-      await retry.try(async () => {
-        const {
-          body: { data: foundEvents },
-        } = await findEvents(id, {});
+            assertEventsFromApiMatchCreatedEvents(data, expectedEvents);
+          });
+        });
 
-        expect(foundEvents.length).to.be(6);
-      });
+        it('should support pagination for events', async () => {
+          const id = uuid.v4();
 
-      const [expectedFirstPage, expectedSecondPage] = chunk(expectedEvents, 3);
+          const expectedEvents = await logFakeEvents(namespace, id, 6);
 
-      const {
-        body: { data: firstPage },
-      } = await findEvents(id, { per_page: 3 });
+          await retry.try(async () => {
+            const {
+              body: { data: foundEvents },
+            } = await findEvents(namespace, id, {});
 
-      expect(firstPage.length).to.be(3);
-      assertEventsFromApiMatchCreatedEvents(firstPage, expectedFirstPage);
+            expect(foundEvents.length).to.be(6);
+          });
 
-      const {
-        body: { data: secondPage },
-      } = await findEvents(id, { per_page: 3, page: 2 });
+          const [expectedFirstPage, expectedSecondPage] = chunk(expectedEvents, 3);
 
-      expect(secondPage.length).to.be(3);
-      assertEventsFromApiMatchCreatedEvents(secondPage, expectedSecondPage);
-    });
+          const {
+            body: { data: firstPage },
+          } = await findEvents(namespace, id, { per_page: 3 });
 
-    it('should support sorting by event end', async () => {
-      const id = uuid.v4();
+          expect(firstPage.length).to.be(3);
+          assertEventsFromApiMatchCreatedEvents(firstPage, expectedFirstPage);
 
-      const expectedEvents = await logFakeEvents(id, 6);
+          const {
+            body: { data: secondPage },
+          } = await findEvents(namespace, id, { per_page: 3, page: 2 });
 
-      await retry.try(async () => {
-        const {
-          body: { data: foundEvents },
-        } = await findEvents(id, { sort_field: 'event.end', sort_order: 'desc' });
+          expect(secondPage.length).to.be(3);
+          assertEventsFromApiMatchCreatedEvents(secondPage, expectedSecondPage);
+        });
 
-        expect(foundEvents.length).to.be(expectedEvents.length);
-        assertEventsFromApiMatchCreatedEvents(foundEvents, expectedEvents.reverse());
-      });
-    });
+        it('should support sorting by event end', async () => {
+          const id = uuid.v4();
 
-    it('should support date ranges for events', async () => {
-      const id = uuid.v4();
+          const expectedEvents = await logFakeEvents(namespace, id, 6);
 
-      // write a document that shouldn't be found in the inclusive date range search
-      const firstEvent = fakeEvent(id);
-      await logTestEvent(id, firstEvent);
+          await retry.try(async () => {
+            const {
+              body: { data: foundEvents },
+            } = await findEvents(namespace, id, { sort_field: 'event.end', sort_order: 'desc' });
 
-      // wait a second, get the start time for the date range search
-      await delay(1000);
-      const start = new Date().toISOString();
+            expect(foundEvents.length).to.be(expectedEvents.length);
+            assertEventsFromApiMatchCreatedEvents(foundEvents, expectedEvents.reverse());
+          });
+        });
 
-      // write the documents that we should be found in the date range searches
-      const expectedEvents = await logFakeEvents(id, 6);
+        it('should support date ranges for events', async () => {
+          const id = uuid.v4();
 
-      // get the end time for the date range search
-      const end = new Date().toISOString();
+          // write a document that shouldn't be found in the inclusive date range search
+          const firstEvent = fakeEvent(namespace, id);
+          await logTestEvent(namespace, id, firstEvent);
 
-      // write a document that shouldn't be found in the inclusive date range search
-      await delay(1000);
-      const lastEvent = fakeEvent(id);
-      await logTestEvent(id, lastEvent);
+          // wait a second, get the start time for the date range search
+          await delay(1000);
+          const start = new Date().toISOString();
 
-      await retry.try(async () => {
-        const {
-          body: { data: foundEvents, total },
-        } = await findEvents(id, {});
+          // write the documents that we should be found in the date range searches
+          const expectedEvents = await logFakeEvents(namespace, id, 6);
 
-        expect(foundEvents.length).to.be(8);
-        expect(total).to.be(8);
-      });
+          // get the end time for the date range search
+          const end = new Date().toISOString();
 
-      const {
-        body: { data: eventsWithinRange },
-      } = await findEvents(id, { start, end });
+          // write a document that shouldn't be found in the inclusive date range search
+          await delay(1000);
+          const lastEvent = fakeEvent(namespace, id);
+          await logTestEvent(namespace, id, lastEvent);
 
-      expect(eventsWithinRange.length).to.be(expectedEvents.length);
-      assertEventsFromApiMatchCreatedEvents(eventsWithinRange, expectedEvents);
+          await retry.try(async () => {
+            const {
+              body: { data: foundEvents, total },
+            } = await findEvents(namespace, id, {});
 
-      const {
-        body: { data: eventsFrom },
-      } = await findEvents(id, { start });
+            expect(foundEvents.length).to.be(8);
+            expect(total).to.be(8);
+          });
 
-      expect(eventsFrom.length).to.be(expectedEvents.length + 1);
-      assertEventsFromApiMatchCreatedEvents(eventsFrom, [...expectedEvents, lastEvent]);
+          const {
+            body: { data: eventsWithinRange },
+          } = await findEvents(namespace, id, { start, end });
 
-      const {
-        body: { data: eventsUntil },
-      } = await findEvents(id, { end });
+          expect(eventsWithinRange.length).to.be(expectedEvents.length);
+          assertEventsFromApiMatchCreatedEvents(eventsWithinRange, expectedEvents);
 
-      expect(eventsUntil.length).to.be(expectedEvents.length + 1);
-      assertEventsFromApiMatchCreatedEvents(eventsUntil, [firstEvent, ...expectedEvents]);
-    });
+          const {
+            body: { data: eventsFrom },
+          } = await findEvents(namespace, id, { start });
+
+          expect(eventsFrom.length).to.be(expectedEvents.length + 1);
+          assertEventsFromApiMatchCreatedEvents(eventsFrom, [...expectedEvents, lastEvent]);
+
+          const {
+            body: { data: eventsUntil },
+          } = await findEvents(namespace, id, { end });
+
+          expect(eventsUntil.length).to.be(expectedEvents.length + 1);
+          assertEventsFromApiMatchCreatedEvents(eventsUntil, [firstEvent, ...expectedEvents]);
+        });
+      });
+    }
   });
 
-  async function findEvents(id: string, query: Record<string, any> = {}) {
-    const uri = `/api/event_log/event_log_test/${id}/_find${
+  async function findEvents(
+    namespace: string | undefined,
+    id: string,
+    query: Record<string, any> = {}
+  ) {
+    const urlPrefix = urlPrefixFromNamespace(namespace);
+    const url = `${urlPrefix}/api/event_log/event_log_test/${id}/_find${
       isEmpty(query)
         ? ''
         : `?${Object.entries(query)
             .map(([key, val]) => `${key}=${val}`)
             .join('&')}`
     }`;
-    log.debug(`calling ${uri}`);
-    return await supertest.get(uri).set('kbn-xsrf', 'foo').expect(200);
+    log.debug(`Finding Events for Saved Object with ${url}`);
+    return await supertest.get(url).set('kbn-xsrf', 'foo').expect(200);
   }
 
   function assertEventsFromApiMatchCreatedEvents(
@@ -169,16 +194,27 @@ export default function ({ getService }: FtrProviderContext) {
     }
   }
 
-  async function logTestEvent(id: string, event: IEvent) {
-    log.debug(`Logging Event for Saved Object ${id}`);
-    return await supertest
-      .post(`/api/log_event_fixture/${id}/_log`)
-      .set('kbn-xsrf', 'foo')
-      .send(event)
-      .expect(200);
+  async function logTestEvent(namespace: string | undefined, id: string, event: IEvent) {
+    const urlPrefix = urlPrefixFromNamespace(namespace);
+    const url = `${urlPrefix}/api/log_event_fixture/${id}/_log`;
+    log.debug(`Logging Event for Saved Object with ${url} - ${JSON.stringify(event)}`);
+    return await supertest.post(url).set('kbn-xsrf', 'foo').send(event).expect(200);
   }
 
-  function fakeEvent(id: string, overrides: Partial<IEvent> = {}): IEvent {
+  function fakeEvent(
+    namespace: string | undefined,
+    id: string,
+    overrides: Partial<IEvent> = {}
+  ): IEvent {
+    const savedObject: any = {
+      rel: 'primary',
+      type: 'event_log_test',
+      id,
+    };
+    if (namespace !== undefined) {
+      savedObject.namespace = namespace;
+    }
+
     return merge(
       {
         event: {
@@ -186,14 +222,7 @@ export default function ({ getService }: FtrProviderContext) {
           action: 'test',
         },
         kibana: {
-          saved_objects: [
-            {
-              rel: 'primary',
-              namespace: 'default',
-              type: 'event_log_test',
-              id,
-            },
-          ],
+          saved_objects: [savedObject],
         },
         message: `test ${moment().toISOString()}`,
       },
@@ -201,13 +230,22 @@ export default function ({ getService }: FtrProviderContext) {
     );
   }
 
-  async function logFakeEvents(savedObjectId: string, eventsToLog: number): Promise<IEvent[]> {
+  async function logFakeEvents(
+    namespace: string | undefined,
+    savedObjectId: string,
+    eventsToLog: number
+  ): Promise<IEvent[]> {
     const expectedEvents: IEvent[] = [];
     for (let index = 0; index < eventsToLog; index++) {
-      const event = fakeEvent(savedObjectId);
-      await logTestEvent(savedObjectId, event);
+      const event = fakeEvent(namespace, savedObjectId);
+      await logTestEvent(namespace, savedObjectId, event);
       expectedEvents.push(event);
     }
     return expectedEvents;
   }
 }
+
+function urlPrefixFromNamespace(namespace: string | undefined): string {
+  if (namespace === undefined) return '';
+  return `/s/${namespace}`;
+}
diff --git a/x-pack/test/plugin_api_integration/test_suites/task_manager/task_manager_integration.js b/x-pack/test/plugin_api_integration/test_suites/task_manager/task_manager_integration.js
index 6d8121f8bf45b..165e79fb311ea 100644
--- a/x-pack/test/plugin_api_integration/test_suites/task_manager/task_manager_integration.js
+++ b/x-pack/test/plugin_api_integration/test_suites/task_manager/task_manager_integration.js
@@ -28,7 +28,8 @@ export default function ({ getService }) {
   const testHistoryIndex = '.kibana_task_manager_test_result';
   const supertest = supertestAsPromised(url.format(config.get('servers.kibana')));
 
-  describe('scheduling and running tasks', () => {
+  // FLAKY: https://github.com/elastic/kibana/issues/71390
+  describe.skip('scheduling and running tasks', () => {
     beforeEach(
       async () => await supertest.delete('/api/sample_tasks').set('kbn-xsrf', 'xxx').expect(200)
     );
diff --git a/x-pack/test/security_solution_endpoint/apps/endpoint/policy_details.ts b/x-pack/test/security_solution_endpoint/apps/endpoint/policy_details.ts
index 0c9a86449506b..cf76f297d83be 100644
--- a/x-pack/test/security_solution_endpoint/apps/endpoint/policy_details.ts
+++ b/x-pack/test/security_solution_endpoint/apps/endpoint/policy_details.ts
@@ -19,9 +19,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
   const testSubjects = getService('testSubjects');
   const policyTestResources = getService('policyTestResources');
 
-  // Temporarily skipped to promote snapshot
-  // Re-enabled in https://github.com/elastic/kibana/pull/71727
-  describe.skip('When on the Endpoint Policy Details Page', function () {
+  describe('When on the Endpoint Policy Details Page', function () {
     this.tags(['ciGroup7']);
 
     describe('with an invalid policy id', () => {
diff --git a/x-pack/test/security_solution_endpoint/apps/endpoint/policy_list.ts b/x-pack/test/security_solution_endpoint/apps/endpoint/policy_list.ts
index 5b4a5cca108f9..b91f0647487ff 100644
--- a/x-pack/test/security_solution_endpoint/apps/endpoint/policy_list.ts
+++ b/x-pack/test/security_solution_endpoint/apps/endpoint/policy_list.ts
@@ -19,8 +19,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
   const policyTestResources = getService('policyTestResources');
   const RELATIVE_DATE_FORMAT = /\d (?:seconds|minutes) ago/i;
 
-  // Temporarily skipped to promote snapshot
-  // Re-enabled in https://github.com/elastic/kibana/pull/71727
+  // FLAKY: https://github.com/elastic/kibana/issues/71951
   describe.skip('When on the Endpoint Policy List', function () {
     this.tags(['ciGroup7']);
     before(async () => {
diff --git a/yarn.lock b/yarn.lock
index 8e04560bd303e..a5066b51f3198 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -16274,7 +16274,7 @@ graceful-fs@^4.2.0:
   resolved "https://registry.yarnpkg.com/graceful-fs/-/graceful-fs-4.2.2.tgz#6f0952605d0140c1cfdb138ed005775b92d67b02"
   integrity sha512-IItsdsea19BoLC7ELy13q1iJFNmd7ofZH5+X/pJr90/nRoPEX0DJo1dHDbgtYWOhJhcCgMDTOw84RZ72q6lB+Q==
 
-graceful-fs@^4.2.4:
+graceful-fs@^4.2.3, graceful-fs@^4.2.4:
   version "4.2.4"
   resolved "https://registry.yarnpkg.com/graceful-fs/-/graceful-fs-4.2.4.tgz#2256bde14d3632958c465ebc96dc467ca07a29fb"
   integrity sha512-WjKPNJF79dtJAVniUlGGWHYGz2jWxT6VhN/4m1NdkbZ2nOsEF+cI1Edgql5zCRhs/VsQYRvrXctxktVXZUkixw==
@@ -18026,6 +18026,11 @@ insight@0.10.1:
     tough-cookie "^2.0.0"
     uuid "^3.0.0"
 
+install-artifact-from-github@^1.0.2:
+  version "1.0.2"
+  resolved "https://registry.yarnpkg.com/install-artifact-from-github/-/install-artifact-from-github-1.0.2.tgz#e1e478dd29880b9112ecd684a84029603e234a9d"
+  integrity sha512-yuMFBSVIP3vD0SDBGUqeIpgOAIlFx8eQFknQObpkYEM5gsl9hy6R9Ms3aV+Vw9MMyYsoPMeex0XDnfgY7uzc+Q==
+
 internal-ip@^4.3.0:
   version "4.3.0"
   resolved "https://registry.yarnpkg.com/internal-ip/-/internal-ip-4.3.0.tgz#845452baad9d2ca3b69c635a137acb9a0dad0907"
@@ -22708,22 +22713,21 @@ node-gyp@^3.8.0:
     tar "^2.0.0"
     which "1"
 
-node-gyp@^6.1.0:
-  version "6.1.0"
-  resolved "https://registry.yarnpkg.com/node-gyp/-/node-gyp-6.1.0.tgz#64e31c61a4695ad304c1d5b82cf6b7c79cc79f3f"
-  integrity sha512-h4A2zDlOujeeaaTx06r4Vy+8MZ1679lU+wbCKDS4ZtvY2A37DESo37oejIw0mtmR3+rvNwts5B6Kpt1KrNYdNw==
+node-gyp@^7.0.0:
+  version "7.0.0"
+  resolved "https://registry.yarnpkg.com/node-gyp/-/node-gyp-7.0.0.tgz#2e88425ce84e9b1a4433958ed55d74c70fffb6be"
+  integrity sha512-ZW34qA3CJSPKDz2SJBHKRvyNQN0yWO5EGKKksJc+jElu9VA468gwJTyTArC1iOXU7rN3Wtfg/CMt/dBAOFIjvg==
   dependencies:
     env-paths "^2.2.0"
     glob "^7.1.4"
-    graceful-fs "^4.2.2"
-    mkdirp "^0.5.1"
-    nopt "^4.0.1"
+    graceful-fs "^4.2.3"
+    nopt "^4.0.3"
     npmlog "^4.1.2"
-    request "^2.88.0"
+    request "^2.88.2"
     rimraf "^2.6.3"
-    semver "^5.7.1"
-    tar "^4.4.12"
-    which "^1.3.1"
+    semver "^7.3.2"
+    tar "^6.0.1"
+    which "^2.0.2"
 
 node-int64@^0.4.0:
   version "0.4.0"
@@ -22945,7 +22949,7 @@ nopt@^2.2.0:
   dependencies:
     abbrev "1"
 
-nopt@^4.0.1:
+nopt@^4.0.1, nopt@^4.0.3:
   version "4.0.3"
   resolved "https://registry.yarnpkg.com/nopt/-/nopt-4.0.3.tgz#a375cad9d02fd921278d954c2254d5aa57e15e48"
   integrity sha512-CvaGwVMztSMJLOeXPrez7fyfObdZqNUK1cPAEzLHrTybIua9pMdmmPR5YwtfNftIOMv3DPUhFaxsZMNTQO20Kg==
@@ -25557,13 +25561,14 @@ re-resizable@^6.1.1:
   dependencies:
     fast-memoize "^2.5.1"
 
-re2@1.14.0:
-  version "1.14.0"
-  resolved "https://registry.yarnpkg.com/re2/-/re2-1.14.0.tgz#727076590acfe868cf04e115a3a3f6c373ddd63b"
-  integrity sha512-TYogJmzni8zNVaw4gNOVORRTUaggLZwnMhJoTD0POKeACEoCxTWa9BAYehRnh3S1JUXIMEfcEUa7piiGEn71Zg==
+re2@^1.15.4:
+  version "1.15.4"
+  resolved "https://registry.yarnpkg.com/re2/-/re2-1.15.4.tgz#2ffc3e4894fb60430393459978197648be01a0a9"
+  integrity sha512-7w3K+Daq/JjbX/dz5voMt7B9wlprVBQnMiypyCojAZ99kcAL+3LiJ5uBoX/u47l8eFTVq3Wj+V0pmvU+CT8tOg==
   dependencies:
+    install-artifact-from-github "^1.0.2"
     nan "^2.14.1"
-    node-gyp "^6.1.0"
+    node-gyp "^7.0.0"
 
 react-ace@^5.5.0:
   version "5.10.0"
@@ -27259,6 +27264,32 @@ request@^2.87.0:
     tunnel-agent "^0.6.0"
     uuid "^3.1.0"
 
+request@^2.88.2:
+  version "2.88.2"
+  resolved "https://registry.yarnpkg.com/request/-/request-2.88.2.tgz#d73c918731cb5a87da047e207234146f664d12b3"
+  integrity sha512-MsvtOrfG9ZcrOwAW+Qi+F6HbD0CWXEh9ou77uOb7FM2WPhwT7smM833PzanhJLsgXjN89Ir6V2PczXNnMpwKhw==
+  dependencies:
+    aws-sign2 "~0.7.0"
+    aws4 "^1.8.0"
+    caseless "~0.12.0"
+    combined-stream "~1.0.6"
+    extend "~3.0.2"
+    forever-agent "~0.6.1"
+    form-data "~2.3.2"
+    har-validator "~5.1.3"
+    http-signature "~1.2.0"
+    is-typedarray "~1.0.0"
+    isstream "~0.1.2"
+    json-stringify-safe "~5.0.1"
+    mime-types "~2.1.19"
+    oauth-sign "~0.9.0"
+    performance-now "^2.1.0"
+    qs "~6.5.2"
+    safe-buffer "^5.1.2"
+    tough-cookie "~2.5.0"
+    tunnel-agent "^0.6.0"
+    uuid "^3.3.2"
+
 require-ancestors@^1.0.0:
   version "1.0.0"
   resolved "https://registry.yarnpkg.com/require-ancestors/-/require-ancestors-1.0.0.tgz#807831f8f8081fb12863da81ddb15c8f2a73a004"
@@ -30043,7 +30074,7 @@ tar-stream@^2.1.0:
     inherits "^2.0.3"
     readable-stream "^3.1.1"
 
-tar@4.4.13, tar@^4, tar@^4.4.12:
+tar@4.4.13, tar@^4:
   version "4.4.13"
   resolved "https://registry.yarnpkg.com/tar/-/tar-4.4.13.tgz#43b364bc52888d555298637b10d60790254ab525"
   integrity sha512-w2VwSrBoHa5BsSyH+KxEqeQBAllHhccyMFVHtGtdMpF4W7IRWfZjFiQceJPChOeTsSDVUpER2T8FA93pr0L+QA==
@@ -30078,7 +30109,7 @@ tar@^2.0.0:
     fstream "^1.0.12"
     inherits "2"
 
-tar@^6.0.2:
+tar@^6.0.1, tar@^6.0.2:
   version "6.0.2"
   resolved "https://registry.yarnpkg.com/tar/-/tar-6.0.2.tgz#5df17813468a6264ff14f766886c622b84ae2f39"
   integrity sha512-Glo3jkRtPcvpDlAs/0+hozav78yoXKFr+c4wgw62NNMO3oo4AaJdCo21Uu7lcwr55h39W2XD1LMERc64wtbItg==