From 717e40c4447977aeac1f4e316b400ee22d1a56d5 Mon Sep 17 00:00:00 2001
From: Maja Grubic <maja.grubic@elastic.co>
Date: Tue, 10 Dec 2019 15:05:05 +0000
Subject: [PATCH 01/24] Move DashboardEmptyScreen inside DashboardViewport
 (#51939)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Prototyping adding Visualization to Dashboard

* i18n fixes

* Remvoing dashboard empty screen directive

* Updating test for empty dashboard screen

* Removing unused state variable

* Adding a test for DashboardViewPort

* i18n & minor fixes

* Fixing fullscreen mode view

* Fixing failing functional test (hopefully)

* Minor style fix

* Fixing EUI text, rendering empty screen OR the panels

* Fixing empty screen in fullscreen mode

* Update snapshot

* Trying to render empty screen from Angular controller

* refactor: 💡 don't pass renderEmpty through inputs

And make sure isEmptyState is not stale.

* Fixing tests after Vadim's commit

* Removing unnecessary isEmptyStateProps

* Skipping failing test

* Removing unnecessary en.json file

* Re-adding emptyState, reintroducing functional test

* Fixing ja-JP file

* Undoing my thing to the functional test
---
 .../dashboard_empty_screen.test.tsx.snap      | 364 +++++++++++++-----
 .../__tests__/dashboard_empty_screen.test.tsx |  10 +-
 .../public/dashboard/_dashboard_app.scss      |   6 +-
 .../kibana/public/dashboard/application.ts    |   1 -
 .../public/dashboard/dashboard_app.html       |  18 -
 .../dashboard/dashboard_app_controller.tsx    |  49 ++-
 .../dashboard/dashboard_empty_screen.tsx      |  73 ++--
 .../dashboard_empty_screen_directive.ts       |  30 --
 .../public/dashboard/top_nav/top_nav_ids.ts   |   1 +
 .../public/embeddable/dashboard_container.tsx |   4 +-
 .../embeddable/grid/_dashboard_grid.scss      |   2 +-
 .../viewport/dashboard_viewport.test.tsx      |  51 +++
 .../viewport/dashboard_viewport.tsx           |  59 ++-
 .../public/lib/containers/container.ts        |   1 +
 .../public/lib/embeddables/i_embeddable.ts    |   2 +-
 .../apps/dashboard/full_screen_mode.js        |   1 -
 .../public/does_inherit_time_range.ts         |   4 +
 .../translations/translations/ja-JP.json      |   2 +-
 18 files changed, 461 insertions(+), 217 deletions(-)
 delete mode 100644 src/legacy/core_plugins/kibana/public/dashboard/dashboard_empty_screen_directive.ts

diff --git a/src/legacy/core_plugins/kibana/public/dashboard/__tests__/__snapshots__/dashboard_empty_screen.test.tsx.snap b/src/legacy/core_plugins/kibana/public/dashboard/__tests__/__snapshots__/dashboard_empty_screen.test.tsx.snap
index 07e4173d5323f..8410040a0100d 100644
--- a/src/legacy/core_plugins/kibana/public/dashboard/__tests__/__snapshots__/dashboard_empty_screen.test.tsx.snap
+++ b/src/legacy/core_plugins/kibana/public/dashboard/__tests__/__snapshots__/dashboard_empty_screen.test.tsx.snap
@@ -193,78 +193,160 @@ exports[`DashboardEmptyScreen renders correctly with visualize paragraph 1`] = `
       textComponent={Symbol(react.fragment)}
     >
       <PseudoLocaleWrapper>
-        <EuiIcon
-          color="subdued"
-          size="xxl"
-          type="dashboardApp"
+        <EuiPage
+          className="dshStartScreen"
+          restrictWidth="36em"
         >
-          <EuiIconEmpty
-            className="euiIcon euiIcon--xxLarge euiIcon--subdued euiIcon--app euiIcon-isLoading"
-            focusable="false"
-            style={null}
-          >
-            <svg
-              className="euiIcon euiIcon--xxLarge euiIcon--subdued euiIcon--app euiIcon-isLoading"
-              focusable="false"
-              height={16}
-              style={null}
-              viewBox="0 0 16 16"
-              width={16}
-              xmlns="http://www.w3.org/2000/svg"
-            />
-          </EuiIconEmpty>
-        </EuiIcon>
-        <h2>
-          This dashboard is empty. Let’s fill it up!
-        </h2>
-        <p>
-          <span>
-            Click the 
-            <EuiLink
-              aria-label="Add visualization"
-              data-test-subj="emptyDashboardAddPanelButton"
-              onClick={[MockFunction]}
-            >
-              <button
-                aria-label="Add visualization"
-                className="euiLink euiLink--primary"
-                data-test-subj="emptyDashboardAddPanelButton"
-                onClick={[MockFunction]}
-                type="button"
-              >
-                Add
-              </button>
-            </EuiLink>
-             button in the menu bar above to add a visualization to the dashboard.
-          </span>
-        </p>
-        <p
-          className="linkToVisualizeParagraph"
-        >
-          <FormattedMessage
-            defaultMessage="If you haven't set up any visualizations yet, {visualizeAppLink} to create your first visualization"
-            id="kbn.dashboard.addVisualizationDescription3"
-            values={
+          <div
+            className="euiPage euiPage--restrictWidth-custom dshStartScreen"
+            style={
               Object {
-                "visualizeAppLink": <a
-                  className="euiLink"
-                  href="#/visualize"
-                >
-                  visit the Visualize app
-                </a>,
+                "maxWidth": "36em",
               }
             }
           >
-            If you haven't set up any visualizations yet, 
-            <a
-              className="euiLink"
-              href="#/visualize"
+            <EuiPageBody
+              component="main"
+              restrictWidth={false}
             >
-              visit the Visualize app
-            </a>
-             to create your first visualization
-          </FormattedMessage>
-        </p>
+              <main
+                className="euiPageBody"
+              >
+                <EuiPageContent
+                  horizontalPosition="center"
+                  panelPaddingSize="l"
+                  verticalPosition="center"
+                >
+                  <EuiPanel
+                    className="euiPageContent euiPageContent--verticalCenter euiPageContent--horizontalCenter"
+                    paddingSize="l"
+                  >
+                    <div
+                      className="euiPanel euiPanel--paddingLarge euiPageContent euiPageContent--verticalCenter euiPageContent--horizontalCenter"
+                    >
+                      <EuiIcon
+                        color="subdued"
+                        size="xxl"
+                        type="dashboardApp"
+                      >
+                        <EuiIconEmpty
+                          className="euiIcon euiIcon--xxLarge euiIcon--subdued euiIcon--app euiIcon-isLoading"
+                          focusable="false"
+                          style={null}
+                        >
+                          <svg
+                            className="euiIcon euiIcon--xxLarge euiIcon--subdued euiIcon--app euiIcon-isLoading"
+                            focusable="false"
+                            height={16}
+                            style={null}
+                            viewBox="0 0 16 16"
+                            width={16}
+                            xmlns="http://www.w3.org/2000/svg"
+                          />
+                        </EuiIconEmpty>
+                      </EuiIcon>
+                      <EuiSpacer
+                        size="s"
+                      >
+                        <div
+                          className="euiSpacer euiSpacer--s"
+                        />
+                      </EuiSpacer>
+                      <EuiText
+                        grow={true}
+                      >
+                        <div
+                          className="euiText euiText--medium"
+                        >
+                          <h2
+                            key="0.5"
+                          >
+                            This dashboard is empty. Let’s fill it up!
+                          </h2>
+                        </div>
+                      </EuiText>
+                      <EuiSpacer
+                        size="m"
+                      >
+                        <div
+                          className="euiSpacer euiSpacer--m"
+                        />
+                      </EuiSpacer>
+                      <EuiText
+                        size="m"
+                      >
+                        <div
+                          className="euiText euiText--medium"
+                        >
+                          <p>
+                            Click the 
+                            <EuiLink
+                              aria-label="Add visualization"
+                              data-test-subj="emptyDashboardAddPanelButton"
+                              onClick={[MockFunction]}
+                            >
+                              <button
+                                aria-label="Add visualization"
+                                className="euiLink euiLink--primary"
+                                data-test-subj="emptyDashboardAddPanelButton"
+                                onClick={[MockFunction]}
+                                type="button"
+                              >
+                                Add
+                              </button>
+                            </EuiLink>
+                             button in the menu bar above to add a visualization to the dashboard.
+                          </p>
+                        </div>
+                      </EuiText>
+                      <EuiSpacer
+                        size="m"
+                      >
+                        <div
+                          className="euiSpacer euiSpacer--m"
+                        />
+                      </EuiSpacer>
+                      <EuiText
+                        data-test-subj="linkToVisualizeParagraph"
+                      >
+                        <div
+                          className="euiText euiText--medium"
+                          data-test-subj="linkToVisualizeParagraph"
+                        >
+                          <p>
+                            <FormattedMessage
+                              defaultMessage="If you haven't set up any visualizations yet, {visualizeAppLink} to create your first visualization"
+                              id="kbn.dashboard.addVisualizationDescription3"
+                              values={
+                                Object {
+                                  "visualizeAppLink": <a
+                                    className="euiLink"
+                                    href="#/visualize"
+                                  >
+                                    visit the Visualize app
+                                  </a>,
+                                }
+                              }
+                            >
+                              If you haven't set up any visualizations yet, 
+                              <a
+                                className="euiLink"
+                                href="#/visualize"
+                              >
+                                visit the Visualize app
+                              </a>
+                               to create your first visualization
+                            </FormattedMessage>
+                          </p>
+                        </div>
+                      </EuiText>
+                    </div>
+                  </EuiPanel>
+                </EuiPageContent>
+              </main>
+            </EuiPageBody>
+          </div>
+        </EuiPage>
       </PseudoLocaleWrapper>
     </IntlProvider>
   </I18nProvider>
@@ -464,51 +546,119 @@ exports[`DashboardEmptyScreen renders correctly without visualize paragraph 1`]
       textComponent={Symbol(react.fragment)}
     >
       <PseudoLocaleWrapper>
-        <EuiIcon
-          color="subdued"
-          size="xxl"
-          type="dashboardApp"
+        <EuiPage
+          className="dshStartScreen"
+          restrictWidth="36em"
         >
-          <EuiIconEmpty
-            className="euiIcon euiIcon--xxLarge euiIcon--subdued euiIcon--app euiIcon-isLoading"
-            focusable="false"
-            style={null}
+          <div
+            className="euiPage euiPage--restrictWidth-custom dshStartScreen"
+            style={
+              Object {
+                "maxWidth": "36em",
+              }
+            }
           >
-            <svg
-              className="euiIcon euiIcon--xxLarge euiIcon--subdued euiIcon--app euiIcon-isLoading"
-              focusable="false"
-              height={16}
-              style={null}
-              viewBox="0 0 16 16"
-              width={16}
-              xmlns="http://www.w3.org/2000/svg"
-            />
-          </EuiIconEmpty>
-        </EuiIcon>
-        <h2>
-          This dashboard is empty. Let’s fill it up!
-        </h2>
-        <p>
-          <span>
-            Click the 
-            <EuiLink
-              aria-label="Edit dashboard"
-              data-test-subj=""
-              onClick={[MockFunction]}
+            <EuiPageBody
+              component="main"
+              restrictWidth={false}
             >
-              <button
-                aria-label="Edit dashboard"
-                className="euiLink euiLink--primary"
-                data-test-subj=""
-                onClick={[MockFunction]}
-                type="button"
+              <main
+                className="euiPageBody"
               >
-                Edit
-              </button>
-            </EuiLink>
-             button in the menu bar above to start working on your new dashboard.
-          </span>
-        </p>
+                <EuiPageContent
+                  horizontalPosition="center"
+                  panelPaddingSize="l"
+                  verticalPosition="center"
+                >
+                  <EuiPanel
+                    className="euiPageContent euiPageContent--verticalCenter euiPageContent--horizontalCenter"
+                    paddingSize="l"
+                  >
+                    <div
+                      className="euiPanel euiPanel--paddingLarge euiPageContent euiPageContent--verticalCenter euiPageContent--horizontalCenter"
+                    >
+                      <EuiIcon
+                        color="subdued"
+                        size="xxl"
+                        type="dashboardApp"
+                      >
+                        <EuiIconEmpty
+                          className="euiIcon euiIcon--xxLarge euiIcon--subdued euiIcon--app euiIcon-isLoading"
+                          focusable="false"
+                          style={null}
+                        >
+                          <svg
+                            className="euiIcon euiIcon--xxLarge euiIcon--subdued euiIcon--app euiIcon-isLoading"
+                            focusable="false"
+                            height={16}
+                            style={null}
+                            viewBox="0 0 16 16"
+                            width={16}
+                            xmlns="http://www.w3.org/2000/svg"
+                          />
+                        </EuiIconEmpty>
+                      </EuiIcon>
+                      <EuiSpacer
+                        size="s"
+                      >
+                        <div
+                          className="euiSpacer euiSpacer--s"
+                        />
+                      </EuiSpacer>
+                      <EuiText
+                        grow={true}
+                      >
+                        <div
+                          className="euiText euiText--medium"
+                        >
+                          <h2
+                            key="0.5"
+                          >
+                            This dashboard is empty. Let’s fill it up!
+                          </h2>
+                        </div>
+                      </EuiText>
+                      <EuiSpacer
+                        size="m"
+                      >
+                        <div
+                          className="euiSpacer euiSpacer--m"
+                        />
+                      </EuiSpacer>
+                      <EuiText
+                        size="m"
+                      >
+                        <div
+                          className="euiText euiText--medium"
+                        >
+                          <p>
+                            Click the 
+                            <EuiLink
+                              aria-label="Edit dashboard"
+                              data-test-subj=""
+                              onClick={[MockFunction]}
+                            >
+                              <button
+                                aria-label="Edit dashboard"
+                                className="euiLink euiLink--primary"
+                                data-test-subj=""
+                                onClick={[MockFunction]}
+                                type="button"
+                              >
+                                Edit
+                              </button>
+                            </EuiLink>
+                             button in the menu bar above to start working on your new dashboard.
+                          </p>
+                        </div>
+                      </EuiText>
+                    </div>
+                  </EuiPanel>
+                </EuiPageContent>
+              </main>
+            </EuiPageBody>
+          </div>
+        </EuiPage>
       </PseudoLocaleWrapper>
     </IntlProvider>
   </I18nProvider>
diff --git a/src/legacy/core_plugins/kibana/public/dashboard/__tests__/dashboard_empty_screen.test.tsx b/src/legacy/core_plugins/kibana/public/dashboard/__tests__/dashboard_empty_screen.test.tsx
index a4604d17ddecd..69bdcf59bb227 100644
--- a/src/legacy/core_plugins/kibana/public/dashboard/__tests__/dashboard_empty_screen.test.tsx
+++ b/src/legacy/core_plugins/kibana/public/dashboard/__tests__/dashboard_empty_screen.test.tsx
@@ -18,7 +18,9 @@
  */
 import React from 'react';
 import { mountWithIntl } from 'test_utils/enzyme_helpers';
-import { DashboardEmptyScreen, Props } from '../dashboard_empty_screen';
+import { DashboardEmptyScreen, DashboardEmptyScreenProps } from '../dashboard_empty_screen';
+// @ts-ignore
+import { findTestSubject } from '@elastic/eui/lib/test';
 
 describe('DashboardEmptyScreen', () => {
   const defaultProps = {
@@ -26,7 +28,7 @@ describe('DashboardEmptyScreen', () => {
     onLinkClick: jest.fn(),
   };
 
-  function mountComponent(props?: Props) {
+  function mountComponent(props?: DashboardEmptyScreenProps) {
     const compProps = props || defaultProps;
     const comp = mountWithIntl(<DashboardEmptyScreen {...compProps} />);
     return comp;
@@ -35,14 +37,14 @@ describe('DashboardEmptyScreen', () => {
   test('renders correctly with visualize paragraph', () => {
     const component = mountComponent();
     expect(component).toMatchSnapshot();
-    const paragraph = component.find('.linkToVisualizeParagraph');
+    const paragraph = findTestSubject(component, 'linkToVisualizeParagraph');
     expect(paragraph.length).toBe(1);
   });
 
   test('renders correctly without visualize paragraph', () => {
     const component = mountComponent({ ...defaultProps, ...{ showLinkToVisualize: false } });
     expect(component).toMatchSnapshot();
-    const paragraph = component.find('.linkToVisualizeParagraph');
+    const paragraph = findTestSubject(component, 'linkToVisualizeParagraph');
     expect(paragraph.length).toBe(0);
   });
 });
diff --git a/src/legacy/core_plugins/kibana/public/dashboard/_dashboard_app.scss b/src/legacy/core_plugins/kibana/public/dashboard/_dashboard_app.scss
index 14c35759d70a9..d9eadf6c0e37d 100644
--- a/src/legacy/core_plugins/kibana/public/dashboard/_dashboard_app.scss
+++ b/src/legacy/core_plugins/kibana/public/dashboard/_dashboard_app.scss
@@ -6,9 +6,5 @@
 
 .dshStartScreen {
   text-align: center;
-  padding: $euiSize;
-
-  > * {
-    max-width: 36em !important;
-  }
+  padding: $euiSizeS;
 }
diff --git a/src/legacy/core_plugins/kibana/public/dashboard/application.ts b/src/legacy/core_plugins/kibana/public/dashboard/application.ts
index b58325a77e61e..ef1bcab589c4a 100644
--- a/src/legacy/core_plugins/kibana/public/dashboard/application.ts
+++ b/src/legacy/core_plugins/kibana/public/dashboard/application.ts
@@ -131,7 +131,6 @@ function createLocalAngularModule(core: AppMountContext['core'], navigation: Nav
     'app/dashboard/State',
     'app/dashboard/ConfirmModal',
     'app/dashboard/icon',
-    'app/dashboard/emptyScreen',
   ]);
   return dashboardAngularModule;
 }
diff --git a/src/legacy/core_plugins/kibana/public/dashboard/dashboard_app.html b/src/legacy/core_plugins/kibana/public/dashboard/dashboard_app.html
index c7fd8600b73bb..3cf8932958b6d 100644
--- a/src/legacy/core_plugins/kibana/public/dashboard/dashboard_app.html
+++ b/src/legacy/core_plugins/kibana/public/dashboard/dashboard_app.html
@@ -48,24 +48,6 @@
   >
   </kbn-top-nav>
 
-  <div ng-show="getShouldShowEditHelp() || getShouldShowViewHelp()" class="dshStartScreen">
-    <div class="euiPanel euiPanel--paddingLarge euiPageContent euiPageContent--horizontalCenter">
-      <br><br>
-      <div ng-show="getShouldShowEditHelp()" class="euiText">
-        <dashboard-empty-screen on-link-click="showAddPanel"
-                                show-link-to-visualize="true"
-        />
-      </div>
-
-      <div ng-show="getShouldShowViewHelp()" class="euiText">
-        <dashboard-empty-screen show-link-to-visualize="false"
-                                on-link-click="enterEditMode"
-        />
-      </div>
-
-    </div>
-  </div>
-
   <h1 class="euiScreenReaderOnly">{{screenTitle}}</h1>
   <div id="dashboardViewport"></div>
 
diff --git a/src/legacy/core_plugins/kibana/public/dashboard/dashboard_app_controller.tsx b/src/legacy/core_plugins/kibana/public/dashboard/dashboard_app_controller.tsx
index 7eac251a532c7..3b336ebfc11fe 100644
--- a/src/legacy/core_plugins/kibana/public/dashboard/dashboard_app_controller.tsx
+++ b/src/legacy/core_plugins/kibana/public/dashboard/dashboard_app_controller.tsx
@@ -21,9 +21,10 @@ import _ from 'lodash';
 import { i18n } from '@kbn/i18n';
 import React from 'react';
 import angular from 'angular';
-import { uniq } from 'lodash';
+import { uniq, noop } from 'lodash';
 
 import { Subscription } from 'rxjs';
+import { DashboardEmptyScreen, DashboardEmptyScreenProps } from './dashboard_empty_screen';
 
 import {
   subscribeWithScope,
@@ -41,8 +42,6 @@ import {
 import { FilterStateManager, IndexPattern } from '../../../data/public';
 import { Query, SavedQuery, IndexPatternsContract } from '../../../../../plugins/data/public';
 
-import './dashboard_empty_screen_directive';
-
 import {
   DashboardContainer,
   DASHBOARD_CONTAINER_TYPE,
@@ -143,6 +142,16 @@ export class DashboardAppController {
     }
     $scope.showSaveQuery = dashboardCapabilities.saveQuery as boolean;
 
+    $scope.getShouldShowEditHelp = () =>
+      !dashboardStateManager.getPanels().length &&
+      dashboardStateManager.getIsEditMode() &&
+      !dashboardConfig.getHideWriteControls();
+
+    $scope.getShouldShowViewHelp = () =>
+      !dashboardStateManager.getPanels().length &&
+      dashboardStateManager.getIsViewMode() &&
+      !dashboardConfig.getHideWriteControls();
+
     const updateIndexPatterns = (container?: DashboardContainer) => {
       if (!container || isErrorEmbeddable(container)) {
         return;
@@ -171,6 +180,17 @@ export class DashboardAppController {
       }
     };
 
+    const getEmptyScreenProps = (shouldShowEditHelp: boolean): DashboardEmptyScreenProps => {
+      const emptyScreenProps: DashboardEmptyScreenProps = {
+        onLinkClick: shouldShowEditHelp ? $scope.showAddPanel : $scope.enterEditMode,
+        showLinkToVisualize: shouldShowEditHelp,
+      };
+      if (shouldShowEditHelp) {
+        emptyScreenProps.onVisualizeClick = noop;
+      }
+      return emptyScreenProps;
+    };
+
     const getDashboardInput = (): DashboardContainerInput => {
       const embeddablesMap: {
         [key: string]: DashboardPanelState;
@@ -182,6 +202,8 @@ export class DashboardAppController {
       if (dashboardContainer && !isErrorEmbeddable(dashboardContainer)) {
         expandedPanelId = dashboardContainer.getInput().expandedPanelId;
       }
+      const shouldShowEditHelp = $scope.getShouldShowEditHelp();
+      const shouldShowViewHelp = $scope.getShouldShowViewHelp();
       return {
         id: dashboardStateManager.savedDashboard.id || '',
         filters: queryFilter.getFilters(),
@@ -194,6 +216,7 @@ export class DashboardAppController {
         viewMode: dashboardStateManager.getViewMode(),
         panels: embeddablesMap,
         isFullScreenMode: dashboardStateManager.getFullScreenMode(),
+        isEmptyState: shouldShowEditHelp || shouldShowViewHelp,
         useMargins: dashboardStateManager.getUseMargins(),
         lastReloadRequestTime,
         title: dashboardStateManager.getTitle(),
@@ -234,6 +257,15 @@ export class DashboardAppController {
         if (!isErrorEmbeddable(container)) {
           dashboardContainer = container;
 
+          dashboardContainer.renderEmpty = () => {
+            const shouldShowEditHelp = $scope.getShouldShowEditHelp();
+            const shouldShowViewHelp = $scope.getShouldShowViewHelp();
+            const isEmptyState = shouldShowEditHelp || shouldShowViewHelp;
+            return isEmptyState ? (
+              <DashboardEmptyScreen {...getEmptyScreenProps(shouldShowEditHelp)} />
+            ) : null;
+          };
+
           updateIndexPatterns(dashboardContainer);
 
           outputSubscription = dashboardContainer.getOutput$().subscribe(() => {
@@ -334,15 +366,6 @@ export class DashboardAppController {
     updateBreadcrumbs();
     dashboardStateManager.registerChangeListener(updateBreadcrumbs);
 
-    $scope.getShouldShowEditHelp = () =>
-      !dashboardStateManager.getPanels().length &&
-      dashboardStateManager.getIsEditMode() &&
-      !dashboardConfig.getHideWriteControls();
-    $scope.getShouldShowViewHelp = () =>
-      !dashboardStateManager.getPanels().length &&
-      dashboardStateManager.getIsViewMode() &&
-      !dashboardConfig.getHideWriteControls();
-
     const getChangesFromAppStateForContainerState = () => {
       const appStateDashboardInput = getDashboardInput();
       if (!dashboardContainer || isErrorEmbeddable(dashboardContainer)) {
@@ -729,6 +752,8 @@ export class DashboardAppController {
       }
     };
 
+    navActions[TopNavIds.VISUALIZE] = async () => {};
+
     navActions[TopNavIds.OPTIONS] = anchorElement => {
       showOptionsPopover({
         anchorElement,
diff --git a/src/legacy/core_plugins/kibana/public/dashboard/dashboard_empty_screen.tsx b/src/legacy/core_plugins/kibana/public/dashboard/dashboard_empty_screen.tsx
index d5a4e6e6a325d..234228ba4166a 100644
--- a/src/legacy/core_plugins/kibana/public/dashboard/dashboard_empty_screen.tsx
+++ b/src/legacy/core_plugins/kibana/public/dashboard/dashboard_empty_screen.tsx
@@ -18,29 +18,43 @@
  */
 import React from 'react';
 import { I18nProvider, FormattedMessage } from '@kbn/i18n/react';
-import { EuiIcon, EuiLink } from '@elastic/eui';
+import {
+  EuiIcon,
+  EuiLink,
+  EuiSpacer,
+  EuiPageContent,
+  EuiPageBody,
+  EuiPage,
+  EuiText,
+} from '@elastic/eui';
 import * as constants from './dashboard_empty_screen_constants';
 
-export interface Props {
+export interface DashboardEmptyScreenProps {
   showLinkToVisualize: boolean;
   onLinkClick: () => void;
+  onVisualizeClick?: () => void;
 }
 
-export function DashboardEmptyScreen({ showLinkToVisualize, onLinkClick }: Props) {
+export function DashboardEmptyScreen({
+  showLinkToVisualize,
+  onLinkClick,
+}: DashboardEmptyScreenProps) {
   const linkToVisualizeParagraph = (
-    <p className="linkToVisualizeParagraph">
-      <FormattedMessage
-        id="kbn.dashboard.addVisualizationDescription3"
-        defaultMessage="If you haven't set up any visualizations yet, {visualizeAppLink} to create your first visualization"
-        values={{
-          visualizeAppLink: (
-            <a className="euiLink" href="#/visualize">
-              {constants.visualizeAppLinkTest}
-            </a>
-          ),
-        }}
-      />
-    </p>
+    <EuiText data-test-subj="linkToVisualizeParagraph">
+      <p>
+        <FormattedMessage
+          id="kbn.dashboard.addVisualizationDescription3"
+          defaultMessage="If you haven't set up any visualizations yet, {visualizeAppLink} to create your first visualization"
+          values={{
+            visualizeAppLink: (
+              <a className="euiLink" href="#/visualize">
+                {constants.visualizeAppLinkTest}
+              </a>
+            ),
+          }}
+        />
+      </p>
+    </EuiText>
   );
   const paragraph = (
     description1: string,
@@ -50,15 +64,15 @@ export function DashboardEmptyScreen({ showLinkToVisualize, onLinkClick }: Props
     dataTestSubj?: string
   ) => {
     return (
-      <p>
-        <span>
+      <EuiText size="m">
+        <p>
           {description1}
           <EuiLink onClick={onLinkClick} aria-label={ariaLabel} data-test-subj={dataTestSubj || ''}>
             {linkText}
           </EuiLink>
           {description2}
-        </span>
-      </p>
+        </p>
+      </EuiText>
     );
   };
   const addVisualizationParagraph = (
@@ -70,6 +84,7 @@ export function DashboardEmptyScreen({ showLinkToVisualize, onLinkClick }: Props
         constants.addVisualizationLinkAriaLabel,
         'emptyDashboardAddPanelButton'
       )}
+      <EuiSpacer size="m" />
       {linkToVisualizeParagraph}
     </React.Fragment>
   );
@@ -81,11 +96,19 @@ export function DashboardEmptyScreen({ showLinkToVisualize, onLinkClick }: Props
   );
   return (
     <I18nProvider>
-      <React.Fragment>
-        <EuiIcon type="dashboardApp" size="xxl" color="subdued" />
-        <h2>{constants.fillDashboardTitle}</h2>
-        {showLinkToVisualize ? addVisualizationParagraph : enterEditModeParagraph}
-      </React.Fragment>
+      <EuiPage className="dshStartScreen" restrictWidth={'36em'}>
+        <EuiPageBody>
+          <EuiPageContent verticalPosition="center" horizontalPosition="center">
+            <EuiIcon type="dashboardApp" size="xxl" color="subdued" />
+            <EuiSpacer size="s" />
+            <EuiText grow={true}>
+              <h2 key={0.5}>{constants.fillDashboardTitle}</h2>
+            </EuiText>
+            <EuiSpacer size="m" />
+            {showLinkToVisualize ? addVisualizationParagraph : enterEditModeParagraph}
+          </EuiPageContent>
+        </EuiPageBody>
+      </EuiPage>
     </I18nProvider>
   );
 }
diff --git a/src/legacy/core_plugins/kibana/public/dashboard/dashboard_empty_screen_directive.ts b/src/legacy/core_plugins/kibana/public/dashboard/dashboard_empty_screen_directive.ts
deleted file mode 100644
index 5ebefd817ca4a..0000000000000
--- a/src/legacy/core_plugins/kibana/public/dashboard/dashboard_empty_screen_directive.ts
+++ /dev/null
@@ -1,30 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-// @ts-ignore
-import angular from 'angular';
-import { DashboardEmptyScreen } from './dashboard_empty_screen';
-
-angular
-  .module('app/dashboard/emptyScreen', ['react'])
-  .directive('dashboardEmptyScreen', function(reactDirective: any) {
-    return reactDirective(DashboardEmptyScreen, [
-      ['showLinkToVisualize', { watchDepth: 'value' }],
-      ['onLinkClick', { watchDepth: 'reference' }],
-    ]);
-  });
diff --git a/src/legacy/core_plugins/kibana/public/dashboard/top_nav/top_nav_ids.ts b/src/legacy/core_plugins/kibana/public/dashboard/top_nav/top_nav_ids.ts
index 9df86f2ca3cce..c67d6891c18e7 100644
--- a/src/legacy/core_plugins/kibana/public/dashboard/top_nav/top_nav_ids.ts
+++ b/src/legacy/core_plugins/kibana/public/dashboard/top_nav/top_nav_ids.ts
@@ -26,4 +26,5 @@ export const TopNavIds = {
   ENTER_EDIT_MODE: 'enterEditMode',
   CLONE: 'clone',
   FULL_SCREEN: 'fullScreenMode',
+  VISUALIZE: 'visualize',
 };
diff --git a/src/plugins/dashboard_embeddable_container/public/embeddable/dashboard_container.tsx b/src/plugins/dashboard_embeddable_container/public/embeddable/dashboard_container.tsx
index 684aa93779bc1..021a1a9d1e64a 100644
--- a/src/plugins/dashboard_embeddable_container/public/embeddable/dashboard_container.tsx
+++ b/src/plugins/dashboard_embeddable_container/public/embeddable/dashboard_container.tsx
@@ -90,6 +90,8 @@ export type DashboardReactContext = KibanaReactContext<DashboardContainerOptions
 export class DashboardContainer extends Container<InheritedChildInput, DashboardContainerInput> {
   public readonly type = DASHBOARD_CONTAINER_TYPE;
 
+  public renderEmpty?: undefined | (() => React.ReactNode);
+
   constructor(
     initialInput: DashboardContainerInput,
     private readonly options: DashboardContainerOptions,
@@ -124,7 +126,7 @@ export class DashboardContainer extends Container<InheritedChildInput, Dashboard
     ReactDOM.render(
       <I18nProvider>
         <KibanaContextProvider services={this.options}>
-          <DashboardViewport container={this} />
+          <DashboardViewport renderEmpty={this.renderEmpty} container={this} />
         </KibanaContextProvider>
       </I18nProvider>,
       dom
diff --git a/src/plugins/dashboard_embeddable_container/public/embeddable/grid/_dashboard_grid.scss b/src/plugins/dashboard_embeddable_container/public/embeddable/grid/_dashboard_grid.scss
index 24b813ec58964..0bd356522c7fa 100644
--- a/src/plugins/dashboard_embeddable_container/public/embeddable/grid/_dashboard_grid.scss
+++ b/src/plugins/dashboard_embeddable_container/public/embeddable/grid/_dashboard_grid.scss
@@ -34,7 +34,7 @@
  .dshLayout-isMaximizedPanel {
   height: 100% !important; /* 1. */
   width: 100%;
-  position: absolute;
+  position: absolute !important;
 }
 
 /**
diff --git a/src/plugins/dashboard_embeddable_container/public/embeddable/viewport/dashboard_viewport.test.tsx b/src/plugins/dashboard_embeddable_container/public/embeddable/viewport/dashboard_viewport.test.tsx
index a2f7b8dc28fb0..e3d9b8552f060 100644
--- a/src/plugins/dashboard_embeddable_container/public/embeddable/viewport/dashboard_viewport.test.tsx
+++ b/src/plugins/dashboard_embeddable_container/public/embeddable/viewport/dashboard_viewport.test.tsx
@@ -121,6 +121,24 @@ test('renders DashboardViewport with no visualizations', () => {
   component.unmount();
 });
 
+test('renders DashboardEmptyScreen', () => {
+  const renderEmptyScreen = jest.fn();
+  const { props, options } = getProps({ renderEmpty: renderEmptyScreen });
+  props.container.updateInput({ isEmptyState: true });
+  const component = mount(
+    <I18nProvider>
+      <KibanaContextProvider services={options}>
+        <DashboardViewport {...props} />
+      </KibanaContextProvider>
+    </I18nProvider>
+  );
+  const dashboardEmptyScreenDiv = component.find('.dshDashboardEmptyScreen');
+  expect(dashboardEmptyScreenDiv.length).toBe(1);
+  expect(renderEmptyScreen).toHaveBeenCalled();
+
+  component.unmount();
+});
+
 test('renders exit full screen button when in full screen mode', async () => {
   const { props, options } = getProps();
   props.container.updateInput({ isFullScreenMode: true });
@@ -153,6 +171,39 @@ test('renders exit full screen button when in full screen mode', async () => {
   component.unmount();
 });
 
+test('renders exit full screen button when in full screen mode and empty screen', async () => {
+  const renderEmptyScreen = jest.fn();
+  renderEmptyScreen.mockReturnValue(React.createElement('div'));
+  const { props, options } = getProps({ renderEmpty: renderEmptyScreen });
+  props.container.updateInput({ isEmptyState: true, isFullScreenMode: true });
+  const component = mount(
+    <I18nProvider>
+      <KibanaContextProvider services={options}>
+        <DashboardViewport {...props} />
+      </KibanaContextProvider>
+    </I18nProvider>
+  );
+  expect(
+    (component
+      .find('.dshDashboardEmptyScreen')
+      .childAt(0)
+      .type() as any).name
+  ).toBe('ExitFullScreenButton');
+
+  props.container.updateInput({ isFullScreenMode: false });
+  component.update();
+  await nextTick();
+
+  expect(
+    (component
+      .find('.dshDashboardEmptyScreen')
+      .childAt(0)
+      .type() as any).name
+  ).not.toBe('ExitFullScreenButton');
+
+  component.unmount();
+});
+
 test('DashboardViewport unmount unsubscribes', async done => {
   const { props, options } = getProps();
   const component = mount(
diff --git a/src/plugins/dashboard_embeddable_container/public/embeddable/viewport/dashboard_viewport.tsx b/src/plugins/dashboard_embeddable_container/public/embeddable/viewport/dashboard_viewport.tsx
index 13407e5e33725..e7fd379898dd1 100644
--- a/src/plugins/dashboard_embeddable_container/public/embeddable/viewport/dashboard_viewport.tsx
+++ b/src/plugins/dashboard_embeddable_container/public/embeddable/viewport/dashboard_viewport.tsx
@@ -26,6 +26,7 @@ import { context } from '../../../../kibana_react/public';
 
 export interface DashboardViewportProps {
   container: DashboardContainer;
+  renderEmpty?: () => React.ReactNode;
 }
 
 interface State {
@@ -34,6 +35,7 @@ interface State {
   title: string;
   description?: string;
   panels: { [key: string]: PanelState };
+  isEmptyState?: boolean;
 }
 
 export class DashboardViewport extends React.Component<DashboardViewportProps, State> {
@@ -44,26 +46,40 @@ export class DashboardViewport extends React.Component<DashboardViewportProps, S
   private mounted: boolean = false;
   constructor(props: DashboardViewportProps) {
     super(props);
-    const { isFullScreenMode, panels, useMargins, title } = this.props.container.getInput();
+    const {
+      isFullScreenMode,
+      panels,
+      useMargins,
+      title,
+      isEmptyState,
+    } = this.props.container.getInput();
 
     this.state = {
       isFullScreenMode,
       panels,
       useMargins,
       title,
+      isEmptyState,
     };
   }
 
   public componentDidMount() {
     this.mounted = true;
     this.subscription = this.props.container.getInput$().subscribe(() => {
-      const { isFullScreenMode, useMargins, title, description } = this.props.container.getInput();
+      const {
+        isFullScreenMode,
+        useMargins,
+        title,
+        description,
+        isEmptyState,
+      } = this.props.container.getInput();
       if (this.mounted) {
         this.setState({
           isFullScreenMode,
           description,
           useMargins,
           title,
+          isEmptyState,
         });
       }
     });
@@ -82,19 +98,33 @@ export class DashboardViewport extends React.Component<DashboardViewportProps, S
     });
   };
 
-  public render() {
+  private renderEmptyScreen() {
+    const { renderEmpty } = this.props;
+    const { isFullScreenMode } = this.state;
+    return (
+      <div className="dshDashboardEmptyScreen">
+        {isFullScreenMode && (
+          <this.context.services.ExitFullScreenButton
+            onExitFullScreenMode={this.onExitFullScreenMode}
+          />
+        )}
+        {renderEmpty && renderEmpty()}
+      </div>
+    );
+  }
+
+  private renderContainerScreen() {
     const { container } = this.props;
+    const { isFullScreenMode, panels, title, description, useMargins } = this.state;
     return (
       <div
-        data-shared-items-count={Object.values(this.state.panels).length}
+        data-shared-items-count={Object.values(panels).length}
         data-shared-items-container
-        data-title={this.state.title}
-        data-description={this.state.description}
-        className={
-          this.state.useMargins ? 'dshDashboardViewport-withMargins' : 'dshDashboardViewport'
-        }
+        data-title={title}
+        data-description={description}
+        className={useMargins ? 'dshDashboardViewport-withMargins' : 'dshDashboardViewport'}
       >
-        {this.state.isFullScreenMode && (
+        {isFullScreenMode && (
           <this.context.services.ExitFullScreenButton
             onExitFullScreenMode={this.onExitFullScreenMode}
           />
@@ -103,4 +133,13 @@ export class DashboardViewport extends React.Component<DashboardViewportProps, S
       </div>
     );
   }
+
+  public render() {
+    return (
+      <React.Fragment>
+        {this.state.isEmptyState ? this.renderEmptyScreen() : null}
+        {this.renderContainerScreen()}
+      </React.Fragment>
+    );
+  }
 }
diff --git a/src/plugins/embeddable/public/lib/containers/container.ts b/src/plugins/embeddable/public/lib/containers/container.ts
index bce16747ed48e..71e7cca3552bb 100644
--- a/src/plugins/embeddable/public/lib/containers/container.ts
+++ b/src/plugins/embeddable/public/lib/containers/container.ts
@@ -240,6 +240,7 @@ export abstract class Container<
         ...this.input.panels,
         [panelState.explicitInput.id]: panelState,
       },
+      isEmptyState: false,
     } as Partial<TContainerInput>);
 
     return await this.untilEmbeddableLoaded<TEmbeddable>(panelState.explicitInput.id);
diff --git a/src/plugins/embeddable/public/lib/embeddables/i_embeddable.ts b/src/plugins/embeddable/public/lib/embeddables/i_embeddable.ts
index 33cb146a056cb..0197582778940 100644
--- a/src/plugins/embeddable/public/lib/embeddables/i_embeddable.ts
+++ b/src/plugins/embeddable/public/lib/embeddables/i_embeddable.ts
@@ -28,7 +28,7 @@ export interface EmbeddableInput {
   id: string;
   lastReloadRequestTime?: number;
   hidePanelTitles?: boolean;
-
+  isEmptyState?: boolean;
   /**
    * List of action IDs that this embeddable should not render.
    */
diff --git a/test/functional/apps/dashboard/full_screen_mode.js b/test/functional/apps/dashboard/full_screen_mode.js
index e18fd47b39b16..bf549ec21a6d3 100644
--- a/test/functional/apps/dashboard/full_screen_mode.js
+++ b/test/functional/apps/dashboard/full_screen_mode.js
@@ -78,7 +78,6 @@ export default function ({ getService, getPageObjects }) {
       const logoButton = await PageObjects.dashboard.getExitFullScreenLogoButton();
       await logoButton.moveMouseTo();
       await PageObjects.dashboard.clickExitFullScreenTextButton();
-
       await retry.try(async () => {
         const isChromeVisible = await PageObjects.common.isChromeVisible();
         expect(isChromeVisible).to.be(true);
diff --git a/x-pack/plugins/advanced_ui_actions/public/does_inherit_time_range.ts b/x-pack/plugins/advanced_ui_actions/public/does_inherit_time_range.ts
index 4cfe581b7eac5..d1568a5ab96ce 100644
--- a/x-pack/plugins/advanced_ui_actions/public/does_inherit_time_range.ts
+++ b/x-pack/plugins/advanced_ui_actions/public/does_inherit_time_range.ts
@@ -17,6 +17,10 @@ export function doesInheritTimeRange(embeddable: Embeddable<TimeRangeInput>) {
   // Note: this logic might not work in a container nested world... the explicit input
   // may be on the root... or any of the interim parents.
 
+  // if it's a dashboard emptys screen, there will be no embeddable
+  if (!parent.getInput().panels[embeddable.id]) {
+    return false;
+  }
   // If there is no explicit input defined on the parent then this embeddable inherits the
   // time range from whatever the time range of the parent is.
   return parent.getInput().panels[embeddable.id].explicitInput.timeRange === undefined;
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index d51332c65aa54..55147c7863d1f 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -12736,4 +12736,4 @@
     "xpack.licensing.welcomeBanner.licenseIsExpiredDescription.updateYourLicenseLinkText": "ライセンスを更新",
     "xpack.licensing.welcomeBanner.licenseIsExpiredTitle": "ご使用の {licenseType} ライセンスは期限切れです"
   }
-}
+}
\ No newline at end of file

From 5217dfd731726aa0c3ce39436b7a5018ff2aa466 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Juan=20=C3=81lvarez?= <juan.alvarez@elastic.co>
Date: Tue, 10 Dec 2019 16:11:58 +0100
Subject: [PATCH 02/24] update apm index pattern (#52629)

---
 .../core_plugins/kibana/server/tutorials/apm/index_pattern.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/legacy/core_plugins/kibana/server/tutorials/apm/index_pattern.json b/src/legacy/core_plugins/kibana/server/tutorials/apm/index_pattern.json
index 69a165c09c2f9..9001613623ccb 100644
--- a/src/legacy/core_plugins/kibana/server/tutorials/apm/index_pattern.json
+++ b/src/legacy/core_plugins/kibana/server/tutorials/apm/index_pattern.json
@@ -1,7 +1,7 @@
 {
   "attributes": {
     "fieldFormatMap": "{\"client.bytes\":{\"id\":\"bytes\"},\"client.nat.port\":{\"id\":\"string\"},\"client.port\":{\"id\":\"string\"},\"destination.bytes\":{\"id\":\"bytes\"},\"destination.nat.port\":{\"id\":\"string\"},\"destination.port\":{\"id\":\"string\"},\"event.duration\":{\"id\":\"duration\",\"params\":{\"inputFormat\":\"nanoseconds\",\"outputFormat\":\"asMilliseconds\",\"outputPrecision\":1}},\"event.sequence\":{\"id\":\"string\"},\"event.severity\":{\"id\":\"string\"},\"http.request.body.bytes\":{\"id\":\"bytes\"},\"http.request.bytes\":{\"id\":\"bytes\"},\"http.response.body.bytes\":{\"id\":\"bytes\"},\"http.response.bytes\":{\"id\":\"bytes\"},\"http.response.status_code\":{\"id\":\"string\"},\"log.syslog.facility.code\":{\"id\":\"string\"},\"log.syslog.priority\":{\"id\":\"string\"},\"network.bytes\":{\"id\":\"bytes\"},\"package.size\":{\"id\":\"string\"},\"process.pgid\":{\"id\":\"string\"},\"process.pid\":{\"id\":\"string\"},\"process.ppid\":{\"id\":\"string\"},\"process.thread.id\":{\"id\":\"string\"},\"server.bytes\":{\"id\":\"bytes\"},\"server.nat.port\":{\"id\":\"string\"},\"server.port\":{\"id\":\"string\"},\"source.bytes\":{\"id\":\"bytes\"},\"source.nat.port\":{\"id\":\"string\"},\"source.port\":{\"id\":\"string\"},\"system.cpu.total.norm.pct\":{\"id\":\"percent\"},\"system.memory.actual.free\":{\"id\":\"bytes\"},\"system.memory.total\":{\"id\":\"bytes\"},\"system.process.cpu.total.norm.pct\":{\"id\":\"percent\"},\"system.process.memory.rss.bytes\":{\"id\":\"bytes\"},\"system.process.memory.size\":{\"id\":\"bytes\"},\"url.port\":{\"id\":\"string\"},\"view spans\":{\"id\":\"url\",\"params\":{\"labelTemplate\":\"View Spans\"}}}",
-    "fields": "[{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"@timestamp\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"labels\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"message\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tags\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"agent.ephemeral_id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"agent.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"agent.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"agent.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"agent.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"as.number\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"as.organization.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.address\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.as.number\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.as.organization.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.geo.city_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.geo.continent_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.geo.country_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.geo.country_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.geo.location\",\"scripted\":false,\"searchable\":true,\"type\":\"geo_point\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.geo.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.geo.region_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.geo.region_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.mac\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.nat.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.nat.port\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.packets\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.port\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.registered_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.top_level_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.email\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.full_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.group.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.group.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.group.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.hash\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.account.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.availability_zone\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.instance.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.instance.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.machine.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.provider\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.region\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"container.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"container.image.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"container.image.tag\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"container.labels\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"container.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"container.runtime\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.address\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.as.number\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.as.organization.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.geo.city_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.geo.continent_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.geo.country_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.geo.country_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.geo.location\",\"scripted\":false,\"searchable\":true,\"type\":\"geo_point\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.geo.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.geo.region_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.geo.region_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.mac\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.nat.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.nat.port\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.packets\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.port\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.registered_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.top_level_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.email\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.full_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.group.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.group.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.group.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.hash\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.answers\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.answers.class\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.answers.data\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.answers.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.answers.ttl\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.answers.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.header_flags\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.op_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.question.class\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.question.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.question.registered_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.question.subdomain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.question.top_level_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.question.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.resolved_ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.response_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"ecs.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":4,\"doc_values\":true,\"indexed\":true,\"name\":\"error.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.message\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.stack_trace\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.action\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.category\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.created\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.dataset\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.duration\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.end\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.hash\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.kind\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.module\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.original\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.outcome\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.provider\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.risk_score\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.risk_score_norm\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.sequence\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.severity\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.start\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.timezone\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.accessed\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.created\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.ctime\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.device\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.directory\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.extension\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.gid\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.group\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.hash.md5\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.hash.sha1\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.hash.sha256\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.hash.sha512\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.inode\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.mode\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.mtime\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.owner\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.path\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.size\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.target_path\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.uid\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"geo.city_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"geo.continent_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"geo.country_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"geo.country_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"geo.location\",\"scripted\":false,\"searchable\":true,\"type\":\"geo_point\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"geo.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"geo.region_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"geo.region_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"group.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"group.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"group.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"hash.md5\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"hash.sha1\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"hash.sha256\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"hash.sha512\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.architecture\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.geo.city_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.geo.continent_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.geo.country_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.geo.country_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.geo.location\",\"scripted\":false,\"searchable\":true,\"type\":\"geo_point\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.geo.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.geo.region_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.geo.region_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.hostname\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.mac\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.os.family\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.os.full\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.os.kernel\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.os.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.os.platform\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.os.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.uptime\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.email\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.full_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.group.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.group.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.group.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.hash\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.request.body.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.request.body.content\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.request.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.request.method\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.request.referrer\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.response.body.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.response.body.content\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.response.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.response.status_code\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.level\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.logger\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.origin.file.line\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.origin.file.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.origin.function\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.original\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.syslog\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.syslog.facility.code\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.syslog.facility.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.syslog.priority\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.syslog.severity.code\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.syslog.severity.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.application\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.community_id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.direction\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.forwarded_ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.iana_number\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.packets\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.protocol\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.transport\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.geo.city_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.geo.continent_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.geo.country_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.geo.country_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.geo.location\",\"scripted\":false,\"searchable\":true,\"type\":\"geo_point\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.geo.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.geo.region_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.geo.region_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.hostname\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.mac\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.os.family\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.os.full\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.os.kernel\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.os.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.os.platform\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.os.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.product\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.serial_number\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.vendor\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"organization.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"organization.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"os.family\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"os.full\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"os.kernel\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"os.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"os.platform\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"os.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.architecture\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.checksum\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.description\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.install_scope\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.installed\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.license\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.path\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.size\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.args\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.executable\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.hash.md5\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.hash.sha1\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.hash.sha256\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.hash.sha512\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.pgid\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.pid\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.ppid\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.start\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.thread.id\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.thread.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.title\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.uptime\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.working_directory\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"related.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.address\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.as.number\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.as.organization.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.geo.city_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.geo.continent_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.geo.country_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.geo.country_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.geo.location\",\"scripted\":false,\"searchable\":true,\"type\":\"geo_point\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.geo.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.geo.region_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.geo.region_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.mac\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.nat.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.nat.port\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.packets\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.port\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.registered_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.top_level_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.email\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.full_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.group.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.group.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.group.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.hash\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.ephemeral_id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.node.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.state\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.address\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.as.number\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.as.organization.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.geo.city_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.geo.continent_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.geo.country_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.geo.country_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.geo.location\",\"scripted\":false,\"searchable\":true,\"type\":\"geo_point\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.geo.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.geo.region_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.geo.region_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.mac\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.nat.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.nat.port\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.packets\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.port\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.registered_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.top_level_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.email\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.full_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.group.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.group.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.group.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.hash\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"threat.framework\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"threat.tactic.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"threat.tactic.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"threat.tactic.reference\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"threat.technique.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"threat.technique.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"threat.technique.reference\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tracing.trace.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tracing.transaction.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.extension\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.fragment\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.full\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.original\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.password\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.path\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.port\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.query\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.registered_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.scheme\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.top_level_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.username\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.email\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.full_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.group.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.group.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.group.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.hash\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.device.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.original\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.os.family\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.os.full\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.os.kernel\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.os.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.os.platform\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.os.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"agent.hostname\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"fields\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"timeseries.instance\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.project.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.image.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"docker.container.labels\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.containerized\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.os.build\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.os.codename\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.pod.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.pod.uid\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.namespace\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.node.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.labels.*\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.annotations.*\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.replicaset.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.deployment.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.statefulset.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.container.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.container.image\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"processor.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"processor.event\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"timestamp.us\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":false,\"enabled\":false,\"indexed\":false,\"name\":\"http.request.headers\",\"scripted\":false,\"searchable\":false},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.response.finished\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":false,\"enabled\":false,\"indexed\":false,\"name\":\"http.response.headers\",\"scripted\":false,\"searchable\":false},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.environment\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.language.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.language.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.runtime.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.runtime.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.framework.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.framework.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.sampled\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.duration.count\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.duration.sum.us\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.self_time.count\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.self_time.sum.us\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.breakdown.count\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"span.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"span.subtype\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"span.self_time.count\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"span.self_time.sum.us\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"trace.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"parent.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.listening\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.version_major\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.original.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"experimental\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":2,\"doc_values\":true,\"indexed\":true,\"name\":\"error.culprit\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.grouping_key\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.exception.code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":2,\"doc_values\":true,\"indexed\":true,\"name\":\"error.exception.message\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.exception.module\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":4,\"doc_values\":true,\"indexed\":true,\"name\":\"error.exception.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":2,\"doc_values\":true,\"indexed\":true,\"name\":\"error.exception.handled\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.log.level\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.log.logger_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":2,\"doc_values\":true,\"indexed\":true,\"name\":\"error.log.message\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.log.param_message\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"system.cpu.total.norm.pct\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"system.memory.total\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"system.memory.actual.free\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"system.process.cpu.total.norm.pct\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"system.process.memory.size\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"system.process.memory.rss.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"sourcemap.service.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"sourcemap.service.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"sourcemap.bundle_filepath\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"view spans\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"span.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"span.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"span.action\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"span.start.us\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"span.duration.us\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"span.sync\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"span.db.link\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.duration.us\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.result\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.marks\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.marks.*.*\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.span_count.dropped\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":false,\"indexed\":false,\"name\":\"_id\",\"scripted\":false,\"searchable\":false,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":false,\"indexed\":false,\"name\":\"_type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":false,\"indexed\":false,\"name\":\"_index\",\"scripted\":false,\"searchable\":false,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":false,\"indexed\":false,\"name\":\"_score\",\"scripted\":false,\"searchable\":false,\"type\":\"number\"}]",
+    "fields": "[{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"@timestamp\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"labels\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"message\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tags\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"agent.ephemeral_id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"agent.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"agent.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"agent.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"agent.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"as.number\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"as.organization.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.address\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.as.number\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.as.organization.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.geo.city_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.geo.continent_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.geo.country_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.geo.country_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.geo.location\",\"scripted\":false,\"searchable\":true,\"type\":\"geo_point\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.geo.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.geo.region_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.geo.region_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.mac\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.nat.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.nat.port\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.packets\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.port\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.registered_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.top_level_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.email\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.full_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.group.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.group.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.group.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.hash\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"client.user.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.account.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.availability_zone\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.instance.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.instance.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.machine.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.provider\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.region\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"container.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"container.image.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"container.image.tag\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"container.labels\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"container.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"container.runtime\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.address\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.as.number\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.as.organization.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.geo.city_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.geo.continent_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.geo.country_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.geo.country_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.geo.location\",\"scripted\":false,\"searchable\":true,\"type\":\"geo_point\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.geo.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.geo.region_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.geo.region_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.mac\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.nat.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.nat.port\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.packets\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.port\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.registered_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.top_level_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.email\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.full_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.group.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.group.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.group.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.hash\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"destination.user.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.answers\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.answers.class\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.answers.data\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.answers.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.answers.ttl\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.answers.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.header_flags\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.op_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.question.class\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.question.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.question.registered_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.question.subdomain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.question.top_level_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.question.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.resolved_ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.response_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"dns.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"ecs.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":4,\"doc_values\":true,\"indexed\":true,\"name\":\"error.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.message\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.stack_trace\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.action\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.category\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.created\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.dataset\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.duration\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.end\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.hash\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.kind\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.module\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.original\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.outcome\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.provider\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.risk_score\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.risk_score_norm\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.sequence\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.severity\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.start\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.timezone\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"event.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.accessed\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.created\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.ctime\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.device\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.directory\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.extension\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.gid\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.group\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.hash.md5\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.hash.sha1\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.hash.sha256\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.hash.sha512\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.inode\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.mode\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.mtime\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.owner\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.path\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.size\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.target_path\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"file.uid\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"geo.city_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"geo.continent_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"geo.country_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"geo.country_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"geo.location\",\"scripted\":false,\"searchable\":true,\"type\":\"geo_point\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"geo.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"geo.region_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"geo.region_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"group.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"group.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"group.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"hash.md5\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"hash.sha1\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"hash.sha256\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"hash.sha512\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.architecture\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.geo.city_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.geo.continent_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.geo.country_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.geo.country_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.geo.location\",\"scripted\":false,\"searchable\":true,\"type\":\"geo_point\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.geo.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.geo.region_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.geo.region_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.hostname\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.mac\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.os.family\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.os.full\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.os.kernel\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.os.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.os.platform\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.os.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.uptime\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.email\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.full_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.group.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.group.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.group.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.hash\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.user.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.request.body.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.request.body.content\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.request.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.request.method\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.request.referrer\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.response.body.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.response.body.content\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.response.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.response.status_code\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.level\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.logger\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.origin.file.line\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.origin.file.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.origin.function\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.original\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.syslog\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.syslog.facility.code\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.syslog.facility.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.syslog.priority\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.syslog.severity.code\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"log.syslog.severity.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.application\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.community_id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.direction\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.forwarded_ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.iana_number\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.packets\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.protocol\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.transport\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"network.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.geo.city_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.geo.continent_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.geo.country_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.geo.country_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.geo.location\",\"scripted\":false,\"searchable\":true,\"type\":\"geo_point\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.geo.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.geo.region_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.geo.region_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.hostname\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.mac\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.os.family\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.os.full\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.os.kernel\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.os.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.os.platform\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.os.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.product\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.serial_number\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.vendor\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"organization.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"organization.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"os.family\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"os.full\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"os.kernel\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"os.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"os.platform\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"os.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.architecture\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.checksum\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.description\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.install_scope\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.installed\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.license\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.path\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.size\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"package.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.args\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.executable\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.hash.md5\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.hash.sha1\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.hash.sha256\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.hash.sha512\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.pgid\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.pid\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.ppid\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.start\",\"scripted\":false,\"searchable\":true,\"type\":\"date\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.thread.id\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.thread.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.title\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.uptime\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"process.working_directory\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"related.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.address\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.as.number\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.as.organization.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.geo.city_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.geo.continent_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.geo.country_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.geo.country_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.geo.location\",\"scripted\":false,\"searchable\":true,\"type\":\"geo_point\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.geo.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.geo.region_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.geo.region_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.mac\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.nat.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.nat.port\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.packets\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.port\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.registered_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.top_level_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.email\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.full_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.group.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.group.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.group.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.hash\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"server.user.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.ephemeral_id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.node.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.state\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.address\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.as.number\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.as.organization.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.geo.city_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.geo.continent_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.geo.country_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.geo.country_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.geo.location\",\"scripted\":false,\"searchable\":true,\"type\":\"geo_point\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.geo.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.geo.region_iso_code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.geo.region_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.mac\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.nat.ip\",\"scripted\":false,\"searchable\":true,\"type\":\"ip\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.nat.port\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.packets\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.port\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.registered_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.top_level_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.email\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.full_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.group.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.group.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.group.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.hash\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"source.user.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"threat.framework\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"threat.tactic.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"threat.tactic.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"threat.tactic.reference\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"threat.technique.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"threat.technique.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"threat.technique.reference\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tracing.trace.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"tracing.transaction.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.extension\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.fragment\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.full\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.original\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.password\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.path\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.port\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.query\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.registered_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.scheme\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.top_level_domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"url.username\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.email\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.full_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.group.domain\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.group.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.group.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.hash\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.device.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.original\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.os.family\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.os.full\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.os.kernel\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.os.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.os.platform\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.os.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"agent.hostname\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"fields\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"timeseries.instance\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.project.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"cloud.image.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"docker.container.labels\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.containerized\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.os.build\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"host.os.codename\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.pod.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.pod.uid\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.namespace\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.node.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.labels.*\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.annotations.*\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.replicaset.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.deployment.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.statefulset.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.container.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"kubernetes.container.image\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"processor.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"processor.event\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"timestamp.us\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":false,\"enabled\":false,\"indexed\":false,\"name\":\"http.request.headers\",\"scripted\":false,\"searchable\":false},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"http.response.finished\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":false,\"enabled\":false,\"indexed\":false,\"name\":\"http.response.headers\",\"scripted\":false,\"searchable\":false},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.environment\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.language.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.language.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.runtime.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.runtime.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.framework.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"service.framework.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.sampled\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.name.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.duration.count\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.duration.sum.us\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.self_time.count\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.self_time.sum.us\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.breakdown.count\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"span.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"span.subtype\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"span.self_time.count\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"span.self_time.sum.us\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"trace.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"parent.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.listening\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"observer.version_major\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"user_agent.original.text\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"experimental\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":2,\"doc_values\":true,\"indexed\":true,\"name\":\"error.culprit\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.grouping_key\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.exception.code\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":2,\"doc_values\":true,\"indexed\":true,\"name\":\"error.exception.message\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.exception.module\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":4,\"doc_values\":true,\"indexed\":true,\"name\":\"error.exception.type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":2,\"doc_values\":true,\"indexed\":true,\"name\":\"error.exception.handled\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.log.level\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.log.logger_name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":2,\"doc_values\":true,\"indexed\":true,\"name\":\"error.log.message\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"error.log.param_message\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"system.cpu.total.norm.pct\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"system.memory.total\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"system.memory.actual.free\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"system.process.cpu.total.norm.pct\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"system.process.memory.size\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"system.process.memory.rss.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.cpu.ns\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.samples.count\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.alloc_objects.count\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.alloc_space.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.inuse_objects.count\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.inuse_space.bytes\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.duration\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.top.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.top.function\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.top.filename\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.top.line\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.stack.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.stack.function\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.stack.filename\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"profile.stack.line\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"sourcemap.service.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"sourcemap.service.version\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"sourcemap.bundle_filepath\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"view spans\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"span.id\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"span.name\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"span.action\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"span.start.us\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":1,\"doc_values\":true,\"indexed\":true,\"name\":\"span.duration.us\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"span.sync\",\"scripted\":false,\"searchable\":true,\"type\":\"boolean\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"span.db.link\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.duration.us\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.result\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.marks\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.marks.*.*\",\"scripted\":false,\"searchable\":true},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":true,\"indexed\":true,\"name\":\"transaction.span_count.dropped\",\"scripted\":false,\"searchable\":true,\"type\":\"number\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":false,\"indexed\":false,\"name\":\"_id\",\"scripted\":false,\"searchable\":false,\"type\":\"string\"},{\"aggregatable\":true,\"analyzed\":false,\"count\":0,\"doc_values\":false,\"indexed\":false,\"name\":\"_type\",\"scripted\":false,\"searchable\":true,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":false,\"indexed\":false,\"name\":\"_index\",\"scripted\":false,\"searchable\":false,\"type\":\"string\"},{\"aggregatable\":false,\"analyzed\":false,\"count\":0,\"doc_values\":false,\"indexed\":false,\"name\":\"_score\",\"scripted\":false,\"searchable\":false,\"type\":\"number\"}]",
     "sourceFilters": "[{\"value\":\"sourcemap.sourcemap\"}]",
     "timeFieldName": "@timestamp"
   },

From 6ea07cbb9cfa01bc428da29c2d2beedb73594f8a Mon Sep 17 00:00:00 2001
From: Frank Hassanabad <frank.hassanabad@elastic.co>
Date: Tue, 10 Dec 2019 08:43:04 -0700
Subject: [PATCH 03/24] [SIEM][Detection Engine] Renaming and moving of folders
 and files (#52587)

## Summary

* Creates several folders
* Moves schema into smaller files
* Moves `utils.ts` in smaller files
* Splits apart the types to not be in one giant file but rather cascade bottom up

### Checklist

Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR.

~~- [ ] This was checked for cross-browser compatibility, [including a check against IE11](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility)~~

~~- [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)~~

~~- [ ] [Documentation](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#writing-documentation) was added for features that require explanation or tutorials~~

- [x] [Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios

~~- [ ] This was checked for [keyboard-only and screenreader accessibility](https://developer.mozilla.org/en-US/docs/Learn/Tools_and_testing/Cross_browser_testing/Accessibility#Accessibility_testing_checklist)~~

### For maintainers

~~- [ ] This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~~

- [x] This includes a feature addition or change that requires a release note and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)
---
 .../plugins/siem/server/kibana.index.ts       |   16 +-
 .../lib/detection_engine/alerts/types.ts      |  264 --
 .../lib/detection_engine/alerts/utils.test.ts | 1107 ---------
 .../lib/detection_engine/alerts/utils.ts      |  408 ----
 .../routes/__mocks__/request_responses.ts     |    4 +-
 .../{ => rules}/create_rules_route.test.ts    |    6 +-
 .../routes/{ => rules}/create_rules_route.ts  |   17 +-
 .../{ => rules}/delete_rules_route.test.ts    |    6 +-
 .../routes/{ => rules}/delete_rules_route.ts  |   13 +-
 .../{ => rules}/find_rules_route.test.ts      |    6 +-
 .../routes/{ => rules}/find_rules_route.ts    |   13 +-
 .../{ => rules}/read_rules_route.test.ts      |    6 +-
 .../routes/{ => rules}/read_rules_route.ts    |   13 +-
 .../detection_engine/routes/rules/types.ts    |   11 +
 .../{ => rules}/update_rules_route.test.ts    |    6 +-
 .../routes/{ => rules}/update_rules_route.ts  |   13 +-
 .../routes/rules/utils.test.ts                |  496 ++++
 .../detection_engine/routes/rules/utils.ts    |   76 +
 .../detection_engine/routes/schemas.test.ts   | 2133 -----------------
 .../lib/detection_engine/routes/schemas.ts    |  162 --
 .../schemas/create_rules_schema.test.ts       | 1047 ++++++++
 .../routes/schemas/create_rules_schema.ts     |   67 +
 .../routes/schemas/find_rules_schema.test.ts  |  136 ++
 .../routes/schemas/find_rules_schema.ts       |   24 +
 .../routes/schemas/query_rules_schema.test.ts |   32 +
 .../routes/schemas/query_rules_schema.ts      |   16 +
 .../routes/schemas/schemas.ts                 |   79 +
 .../schemas/set_signal_status_schema.test.ts  |   66 +
 .../schemas/set_signal_status_schema.ts       |   17 +
 .../schemas/update_rules_schema.test.ts       |  869 +++++++
 .../routes/schemas/update_rules_schema.ts     |   63 +
 .../signals/open_close_signals_route.ts       |    4 +-
 .../lib/detection_engine/routes/utils.test.ts |  488 +---
 .../lib/detection_engine/routes/utils.ts      |   68 -
 .../{alerts => rules}/create_rules.ts         |    0
 .../{alerts => rules}/delete_rules.ts         |    0
 .../{alerts => rules}/find_rules.test.ts      |    0
 .../{alerts => rules}/find_rules.ts           |    0
 .../{alerts => rules}/read_rules.test.ts      |    0
 .../{alerts => rules}/read_rules.ts           |    0
 .../lib/detection_engine/rules/types.ts       |  102 +
 .../{alerts => rules}/update_rules.test.ts    |    0
 .../{alerts => rules}/update_rules.ts         |    0
 .../__mocks__/es_results.ts                   |   19 +-
 .../signals/build_bulk_body.test.ts           |  284 +++
 .../signals/build_bulk_body.ts                |   56 +
 .../signals/build_event_type_signal.test.ts   |   47 +
 .../signals/build_event_type_signal.ts        |   15 +
 .../build_events_query.test.ts                |    0
 .../{alerts => signals}/build_events_query.ts |    0
 .../signals/build_rule.test.ts                |  156 ++
 .../detection_engine/signals/build_rule.ts    |   59 +
 .../signals/build_signal.test.ts              |  111 +
 .../detection_engine/signals/build_signal.ts  |   26 +
 .../{alerts => signals}/get_filter.test.ts    |    2 +-
 .../{alerts => signals}/get_filter.ts         |    2 +-
 .../get_input_output_index.test.ts            |    0
 .../get_input_output_index.ts                 |    0
 .../signals/search_after_bulk_create.test.ts  |  286 +++
 .../signals/search_after_bulk_create.ts       |  135 ++
 .../signal_rule_alert_type.ts}                |   10 +-
 .../signals/single_bulk_create.test.ts        |  230 ++
 .../signals/single_bulk_create.ts             |  106 +
 .../signals/single_search_after.test.ts       |   73 +
 .../signals/single_search_after.ts            |   52 +
 .../lib/detection_engine/signals/types.ts     |  123 +
 .../lib/detection_engine/signals/utils.ts     |   16 +
 .../siem/server/lib/detection_engine/types.ts |   67 +
 .../legacy/plugins/siem/server/lib/types.ts   |   20 -
 69 files changed, 5029 insertions(+), 4720 deletions(-)
 delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/types.ts
 delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/utils.test.ts
 delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/utils.ts
 rename x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/{ => rules}/create_rules_route.test.ts (96%)
 rename x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/{ => rules}/create_rules_route.ts (85%)
 rename x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/{ => rules}/delete_rules_route.test.ts (96%)
 rename x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/{ => rules}/delete_rules_route.ts (78%)
 rename x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/{ => rules}/find_rules_route.test.ts (94%)
 rename x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/{ => rules}/find_rules_route.ts (78%)
 rename x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/{ => rules}/read_rules_route.test.ts (94%)
 rename x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/{ => rules}/read_rules_route.ts (78%)
 create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/types.ts
 rename x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/{ => rules}/update_rules_route.test.ts (97%)
 rename x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/{ => rules}/update_rules_route.ts (84%)
 create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/utils.test.ts
 create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/utils.ts
 delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas.test.ts
 delete mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas.ts
 create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/create_rules_schema.test.ts
 create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/create_rules_schema.ts
 create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/find_rules_schema.test.ts
 create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/find_rules_schema.ts
 create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/query_rules_schema.test.ts
 create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/query_rules_schema.ts
 create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/schemas.ts
 create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/set_signal_status_schema.test.ts
 create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/set_signal_status_schema.ts
 create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/update_rules_schema.test.ts
 create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/update_rules_schema.ts
 rename x-pack/legacy/plugins/siem/server/lib/detection_engine/{alerts => rules}/create_rules.ts (100%)
 rename x-pack/legacy/plugins/siem/server/lib/detection_engine/{alerts => rules}/delete_rules.ts (100%)
 rename x-pack/legacy/plugins/siem/server/lib/detection_engine/{alerts => rules}/find_rules.test.ts (100%)
 rename x-pack/legacy/plugins/siem/server/lib/detection_engine/{alerts => rules}/find_rules.ts (100%)
 rename x-pack/legacy/plugins/siem/server/lib/detection_engine/{alerts => rules}/read_rules.test.ts (100%)
 rename x-pack/legacy/plugins/siem/server/lib/detection_engine/{alerts => rules}/read_rules.ts (100%)
 create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/types.ts
 rename x-pack/legacy/plugins/siem/server/lib/detection_engine/{alerts => rules}/update_rules.test.ts (100%)
 rename x-pack/legacy/plugins/siem/server/lib/detection_engine/{alerts => rules}/update_rules.ts (100%)
 rename x-pack/legacy/plugins/siem/server/lib/detection_engine/{alerts => signals}/__mocks__/es_results.ts (94%)
 create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_bulk_body.test.ts
 create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_bulk_body.ts
 create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_event_type_signal.test.ts
 create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_event_type_signal.ts
 rename x-pack/legacy/plugins/siem/server/lib/detection_engine/{alerts => signals}/build_events_query.test.ts (100%)
 rename x-pack/legacy/plugins/siem/server/lib/detection_engine/{alerts => signals}/build_events_query.ts (100%)
 create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_rule.test.ts
 create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_rule.ts
 create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_signal.test.ts
 create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_signal.ts
 rename x-pack/legacy/plugins/siem/server/lib/detection_engine/{alerts => signals}/get_filter.test.ts (99%)
 rename x-pack/legacy/plugins/siem/server/lib/detection_engine/{alerts => signals}/get_filter.ts (98%)
 rename x-pack/legacy/plugins/siem/server/lib/detection_engine/{alerts => signals}/get_input_output_index.test.ts (100%)
 rename x-pack/legacy/plugins/siem/server/lib/detection_engine/{alerts => signals}/get_input_output_index.ts (100%)
 create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/search_after_bulk_create.test.ts
 create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/search_after_bulk_create.ts
 rename x-pack/legacy/plugins/siem/server/lib/detection_engine/{alerts/rules_alert_type.ts => signals/signal_rule_alert_type.ts} (96%)
 create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/single_bulk_create.test.ts
 create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/single_bulk_create.ts
 create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/single_search_after.test.ts
 create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/single_search_after.ts
 create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/types.ts
 create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/utils.ts
 create mode 100644 x-pack/legacy/plugins/siem/server/lib/detection_engine/types.ts

diff --git a/x-pack/legacy/plugins/siem/server/kibana.index.ts b/x-pack/legacy/plugins/siem/server/kibana.index.ts
index bb0958b32fa19..f56e6b3c3f550 100644
--- a/x-pack/legacy/plugins/siem/server/kibana.index.ts
+++ b/x-pack/legacy/plugins/siem/server/kibana.index.ts
@@ -6,18 +6,18 @@
 
 import { PluginInitializerContext } from 'src/core/server';
 
-import { rulesAlertType } from './lib/detection_engine/alerts/rules_alert_type';
-import { isAlertExecutor } from './lib/detection_engine/alerts/types';
-import { createRulesRoute } from './lib/detection_engine/routes/create_rules_route';
+import { signalRulesAlertType } from './lib/detection_engine/signals/signal_rule_alert_type';
+import { createRulesRoute } from './lib/detection_engine/routes/rules/create_rules_route';
 import { createIndexRoute } from './lib/detection_engine/routes/index/create_index_route';
 import { readIndexRoute } from './lib/detection_engine/routes/index/read_index_route';
-import { readRulesRoute } from './lib/detection_engine/routes/read_rules_route';
-import { findRulesRoute } from './lib/detection_engine/routes/find_rules_route';
-import { deleteRulesRoute } from './lib/detection_engine/routes/delete_rules_route';
-import { updateRulesRoute } from './lib/detection_engine/routes/update_rules_route';
+import { readRulesRoute } from './lib/detection_engine/routes/rules/read_rules_route';
+import { findRulesRoute } from './lib/detection_engine/routes/rules/find_rules_route';
+import { deleteRulesRoute } from './lib/detection_engine/routes/rules/delete_rules_route';
+import { updateRulesRoute } from './lib/detection_engine/routes/rules/update_rules_route';
 import { setSignalsStatusRoute } from './lib/detection_engine/routes/signals/open_close_signals_route';
 import { ServerFacade } from './types';
 import { deleteIndexRoute } from './lib/detection_engine/routes/index/delete_index_route';
+import { isAlertExecutor } from './lib/detection_engine/signals/types';
 
 const APP_ID = 'siem';
 
@@ -26,7 +26,7 @@ export const initServerWithKibana = (context: PluginInitializerContext, __legacy
   const version = context.env.packageInfo.version;
 
   if (__legacy.plugins.alerting != null) {
-    const type = rulesAlertType({ logger, version });
+    const type = signalRulesAlertType({ logger, version });
     if (isAlertExecutor(type)) {
       __legacy.plugins.alerting.setup.registerType(type);
     }
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/types.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/types.ts
deleted file mode 100644
index c9d265ebffacd..0000000000000
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/types.ts
+++ /dev/null
@@ -1,264 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { get } from 'lodash/fp';
-
-import { SIGNALS_ID } from '../../../../common/constants';
-import {
-  Alert,
-  AlertType,
-  State,
-  AlertExecutorOptions,
-} from '../../../../../alerting/server/types';
-import { AlertsClient } from '../../../../../alerting/server/alerts_client';
-import { ActionsClient } from '../../../../../actions/server/actions_client';
-import { RequestFacade } from '../../../types';
-import { SearchResponse } from '../../types';
-import { esFilters } from '../../../../../../../../src/plugins/data/server';
-
-export type PartialFilter = Partial<esFilters.Filter>;
-
-export interface IMitreAttack {
-  id: string;
-  name: string;
-  reference: string;
-}
-export interface ThreatParams {
-  framework: string;
-  tactic: IMitreAttack;
-  techniques: IMitreAttack[];
-}
-export interface RuleAlertParams {
-  description: string;
-  enabled: boolean;
-  falsePositives: string[];
-  filters: PartialFilter[] | undefined | null;
-  from: string;
-  immutable: boolean;
-  index: string[];
-  interval: string;
-  ruleId: string | undefined | null;
-  language: string | undefined | null;
-  maxSignals: number;
-  riskScore: number;
-  outputIndex: string;
-  name: string;
-  query: string | undefined | null;
-  references: string[];
-  savedId: string | undefined | null;
-  meta: Record<string, {}> | undefined | null;
-  severity: string;
-  tags: string[];
-  to: string;
-  threats: ThreatParams[] | undefined | null;
-  type: 'query' | 'saved_query';
-}
-
-export type RuleAlertParamsRest = Omit<
-  RuleAlertParams,
-  'ruleId' | 'falsePositives' | 'maxSignals' | 'savedId' | 'riskScore' | 'outputIndex'
-> & {
-  rule_id: RuleAlertParams['ruleId'];
-  false_positives: RuleAlertParams['falsePositives'];
-  saved_id: RuleAlertParams['savedId'];
-  max_signals: RuleAlertParams['maxSignals'];
-  risk_score: RuleAlertParams['riskScore'];
-  output_index: RuleAlertParams['outputIndex'];
-};
-
-export interface SignalsParams {
-  signalIds: string[] | undefined | null;
-  query: object | undefined | null;
-  status: 'open' | 'closed';
-}
-
-export type SignalsRestParams = Omit<SignalsParams, 'signalIds'> & {
-  signal_ids: SignalsParams['signalIds'];
-};
-
-export type OutputRuleAlertRest = RuleAlertParamsRest & {
-  id: string;
-  created_by: string | undefined | null;
-  updated_by: string | undefined | null;
-};
-
-export type UpdateRuleAlertParamsRest = Partial<RuleAlertParamsRest> & {
-  id: string | undefined;
-  rule_id: RuleAlertParams['ruleId'] | undefined;
-};
-
-export interface FindParamsRest {
-  per_page: number;
-  page: number;
-  sort_field: string;
-  sort_order: 'asc' | 'desc';
-  fields: string[];
-  filter: string;
-}
-
-export interface Clients {
-  alertsClient: AlertsClient;
-  actionsClient: ActionsClient;
-}
-
-export type RuleParams = RuleAlertParams & Clients;
-
-export type UpdateRuleParams = Partial<RuleAlertParams> & {
-  id: string | undefined | null;
-} & Clients;
-
-export type DeleteRuleParams = Clients & {
-  id: string | undefined;
-  ruleId: string | undefined | null;
-};
-
-export interface FindRulesRequest extends Omit<RequestFacade, 'query'> {
-  query: {
-    per_page: number;
-    page: number;
-    search?: string;
-    sort_field?: string;
-    filter?: string;
-    fields?: string[];
-    sort_order?: 'asc' | 'desc';
-  };
-}
-
-export interface FindRuleParams {
-  alertsClient: AlertsClient;
-  perPage?: number;
-  page?: number;
-  sortField?: string;
-  filter?: string;
-  fields?: string[];
-  sortOrder?: 'asc' | 'desc';
-}
-
-export interface ReadRuleParams {
-  alertsClient: AlertsClient;
-  id?: string | undefined | null;
-  ruleId?: string | undefined | null;
-}
-
-export interface ReadRuleByRuleId {
-  alertsClient: AlertsClient;
-  ruleId: string;
-}
-
-export type RuleTypeParams = Omit<RuleAlertParams, 'name' | 'enabled' | 'interval' | 'tags'>;
-
-export type RuleAlertType = Alert & {
-  id: string;
-  params: RuleTypeParams;
-};
-
-export interface RulesRequest extends RequestFacade {
-  payload: RuleAlertParamsRest;
-}
-
-export interface SignalsRequest extends RequestFacade {
-  payload: SignalsRestParams;
-}
-
-export interface UpdateRulesRequest extends RequestFacade {
-  payload: UpdateRuleAlertParamsRest;
-}
-
-export type RuleExecutorOptions = Omit<AlertExecutorOptions, 'params'> & {
-  params: RuleAlertParams & {
-    scrollSize: number;
-    scrollLock: string;
-  };
-};
-
-export type SearchTypes =
-  | string
-  | string[]
-  | number
-  | number[]
-  | boolean
-  | boolean[]
-  | object
-  | object[];
-
-export interface SignalSource {
-  [key: string]: SearchTypes;
-  '@timestamp': string;
-}
-
-export interface BulkResponse {
-  took: number;
-  errors: boolean;
-  items: [
-    {
-      create: {
-        _index: string;
-        _type?: string;
-        _id: string;
-        _version: number;
-        result?: string;
-        _shards?: {
-          total: number;
-          successful: number;
-          failed: number;
-        };
-        _seq_no?: number;
-        _primary_term?: number;
-        status: number;
-        error?: {
-          type: string;
-          reason: string;
-          index_uuid?: string;
-          shard: string;
-          index: string;
-        };
-      };
-    }
-  ];
-}
-
-export interface MGetResponse {
-  docs: GetResponse[];
-}
-export interface GetResponse {
-  _index: string;
-  _type: string;
-  _id: string;
-  _version: number;
-  _seq_no: number;
-  _primary_term: number;
-  found: boolean;
-  _source: SearchTypes;
-}
-
-export type SignalSearchResponse = SearchResponse<SignalSource>;
-export type SignalSourceHit = SignalSearchResponse['hits']['hits'][0];
-
-export type QueryRequest = Omit<RequestFacade, 'query'> & {
-  query: { id: string | undefined; rule_id: string | undefined };
-};
-
-// This returns true because by default a RuleAlertTypeDefinition is an AlertType
-// since we are only increasing the strictness of params.
-export const isAlertExecutor = (obj: RuleAlertTypeDefinition): obj is AlertType => {
-  return true;
-};
-
-export type RuleAlertTypeDefinition = Omit<AlertType, 'executor'> & {
-  executor: ({ services, params, state }: RuleExecutorOptions) => Promise<State | void>;
-};
-
-export const isAlertTypes = (obj: unknown[]): obj is RuleAlertType[] => {
-  return obj.every(rule => isAlertType(rule));
-};
-
-export const isAlertType = (obj: unknown): obj is RuleAlertType => {
-  return get('alertTypeId', obj) === SIGNALS_ID;
-};
-
-export const isAlertTypeArray = (objArray: unknown[]): objArray is RuleAlertType[] => {
-  return objArray.length === 0 || isAlertType(objArray[0]);
-};
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/utils.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/utils.test.ts
deleted file mode 100644
index 41052ab4bbb15..0000000000000
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/utils.test.ts
+++ /dev/null
@@ -1,1107 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import uuid from 'uuid';
-import { savedObjectsClientMock } from 'src/core/server/mocks';
-
-import { Logger } from '../../../../../../../../src/core/server';
-import {
-  buildBulkBody,
-  generateId,
-  singleBulkCreate,
-  singleSearchAfter,
-  searchAfterAndBulkCreate,
-  buildEventTypeSignal,
-  buildSignal,
-  buildRule,
-} from './utils';
-import {
-  sampleDocNoSortId,
-  sampleRuleAlertParams,
-  sampleDocSearchResultsNoSortId,
-  sampleDocSearchResultsNoSortIdNoHits,
-  sampleDocSearchResultsNoSortIdNoVersion,
-  sampleDocSearchResultsWithSortId,
-  sampleEmptyDocSearchResults,
-  repeatedSearchResultsWithSortId,
-  sampleBulkCreateDuplicateResult,
-  sampleRuleGuid,
-  sampleRule,
-  sampleIdGuid,
-} from './__mocks__/es_results';
-import { DEFAULT_SIGNALS_INDEX } from '../../../../common/constants';
-import { OutputRuleAlertRest } from './types';
-import { Signal } from '../../types';
-
-const mockLogger: Logger = {
-  log: jest.fn(),
-  trace: jest.fn(),
-  debug: jest.fn(),
-  info: jest.fn(),
-  warn: jest.fn(),
-  error: jest.fn(),
-  fatal: jest.fn(),
-};
-
-const mockService = {
-  callCluster: jest.fn(),
-  alertInstanceFactory: jest.fn(),
-  savedObjectsClient: savedObjectsClientMock.create(),
-};
-
-describe('utils', () => {
-  beforeEach(() => {
-    jest.clearAllMocks();
-  });
-  describe('buildBulkBody', () => {
-    test('if bulk body builds well-defined body', () => {
-      const sampleParams = sampleRuleAlertParams();
-      const fakeSignalSourceHit = buildBulkBody({
-        doc: sampleDocNoSortId(),
-        ruleParams: sampleParams,
-        id: sampleRuleGuid,
-        name: 'rule-name',
-        createdBy: 'elastic',
-        updatedBy: 'elastic',
-        interval: '5m',
-        enabled: true,
-        tags: ['some fake tag 1', 'some fake tag 2'],
-      });
-      // Timestamp will potentially always be different so remove it for the test
-      delete fakeSignalSourceHit['@timestamp'];
-      expect(fakeSignalSourceHit).toEqual({
-        someKey: 'someValue',
-        event: {
-          kind: 'signal',
-        },
-        signal: {
-          parent: {
-            id: sampleIdGuid,
-            type: 'event',
-            index: 'myFakeSignalIndex',
-            depth: 1,
-          },
-          original_time: 'someTimeStamp',
-          status: 'open',
-          rule: {
-            id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
-            rule_id: 'rule-1',
-            false_positives: [],
-            max_signals: 10000,
-            risk_score: 50,
-            output_index: '.siem-signals',
-            description: 'Detecting root and admin users',
-            from: 'now-6m',
-            immutable: false,
-            index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
-            interval: '5m',
-            language: 'kuery',
-            name: 'rule-name',
-            query: 'user.name: root or user.name: admin',
-            references: ['http://google.com'],
-            severity: 'high',
-            tags: ['some fake tag 1', 'some fake tag 2'],
-            type: 'query',
-            to: 'now',
-            enabled: true,
-            created_by: 'elastic',
-            updated_by: 'elastic',
-          },
-        },
-      });
-    });
-
-    test('if bulk body builds original_event if it exists on the event to begin with', () => {
-      const sampleParams = sampleRuleAlertParams();
-      const doc = sampleDocNoSortId();
-      doc._source.event = {
-        action: 'socket_opened',
-        module: 'system',
-        dataset: 'socket',
-        kind: 'event',
-      };
-      const fakeSignalSourceHit = buildBulkBody({
-        doc,
-        ruleParams: sampleParams,
-        id: sampleRuleGuid,
-        name: 'rule-name',
-        createdBy: 'elastic',
-        updatedBy: 'elastic',
-        interval: '5m',
-        enabled: true,
-        tags: ['some fake tag 1', 'some fake tag 2'],
-      });
-      // Timestamp will potentially always be different so remove it for the test
-      delete fakeSignalSourceHit['@timestamp'];
-      expect(fakeSignalSourceHit).toEqual({
-        someKey: 'someValue',
-        event: {
-          action: 'socket_opened',
-          dataset: 'socket',
-          kind: 'signal',
-          module: 'system',
-        },
-        signal: {
-          original_event: {
-            action: 'socket_opened',
-            dataset: 'socket',
-            kind: 'event',
-            module: 'system',
-          },
-          parent: {
-            id: sampleIdGuid,
-            type: 'event',
-            index: 'myFakeSignalIndex',
-            depth: 1,
-          },
-          original_time: 'someTimeStamp',
-          status: 'open',
-          rule: {
-            id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
-            rule_id: 'rule-1',
-            false_positives: [],
-            max_signals: 10000,
-            risk_score: 50,
-            output_index: '.siem-signals',
-            description: 'Detecting root and admin users',
-            from: 'now-6m',
-            immutable: false,
-            index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
-            interval: '5m',
-            language: 'kuery',
-            name: 'rule-name',
-            query: 'user.name: root or user.name: admin',
-            references: ['http://google.com'],
-            severity: 'high',
-            tags: ['some fake tag 1', 'some fake tag 2'],
-            type: 'query',
-            to: 'now',
-            enabled: true,
-            created_by: 'elastic',
-            updated_by: 'elastic',
-          },
-        },
-      });
-    });
-
-    test('if bulk body builds original_event if it exists on the event to begin with but no kind information', () => {
-      const sampleParams = sampleRuleAlertParams();
-      const doc = sampleDocNoSortId();
-      doc._source.event = {
-        action: 'socket_opened',
-        module: 'system',
-        dataset: 'socket',
-      };
-      const fakeSignalSourceHit = buildBulkBody({
-        doc,
-        ruleParams: sampleParams,
-        id: sampleRuleGuid,
-        name: 'rule-name',
-        createdBy: 'elastic',
-        updatedBy: 'elastic',
-        interval: '5m',
-        enabled: true,
-        tags: ['some fake tag 1', 'some fake tag 2'],
-      });
-      // Timestamp will potentially always be different so remove it for the test
-      delete fakeSignalSourceHit['@timestamp'];
-      expect(fakeSignalSourceHit).toEqual({
-        someKey: 'someValue',
-        event: {
-          action: 'socket_opened',
-          dataset: 'socket',
-          kind: 'signal',
-          module: 'system',
-        },
-        signal: {
-          original_event: {
-            action: 'socket_opened',
-            dataset: 'socket',
-            module: 'system',
-          },
-          parent: {
-            id: sampleIdGuid,
-            type: 'event',
-            index: 'myFakeSignalIndex',
-            depth: 1,
-          },
-          original_time: 'someTimeStamp',
-          status: 'open',
-          rule: {
-            id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
-            rule_id: 'rule-1',
-            false_positives: [],
-            max_signals: 10000,
-            risk_score: 50,
-            output_index: '.siem-signals',
-            description: 'Detecting root and admin users',
-            from: 'now-6m',
-            immutable: false,
-            index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
-            interval: '5m',
-            language: 'kuery',
-            name: 'rule-name',
-            query: 'user.name: root or user.name: admin',
-            references: ['http://google.com'],
-            severity: 'high',
-            tags: ['some fake tag 1', 'some fake tag 2'],
-            type: 'query',
-            to: 'now',
-            enabled: true,
-            created_by: 'elastic',
-            updated_by: 'elastic',
-          },
-        },
-      });
-    });
-
-    test('if bulk body builds original_event if it exists on the event to begin with with only kind information', () => {
-      const sampleParams = sampleRuleAlertParams();
-      const doc = sampleDocNoSortId();
-      doc._source.event = {
-        kind: 'event',
-      };
-      const fakeSignalSourceHit = buildBulkBody({
-        doc,
-        ruleParams: sampleParams,
-        id: sampleRuleGuid,
-        name: 'rule-name',
-        createdBy: 'elastic',
-        updatedBy: 'elastic',
-        interval: '5m',
-        enabled: true,
-        tags: ['some fake tag 1', 'some fake tag 2'],
-      });
-      // Timestamp will potentially always be different so remove it for the test
-      delete fakeSignalSourceHit['@timestamp'];
-      expect(fakeSignalSourceHit).toEqual({
-        someKey: 'someValue',
-        event: {
-          kind: 'signal',
-        },
-        signal: {
-          original_event: {
-            kind: 'event',
-          },
-          parent: {
-            id: sampleIdGuid,
-            type: 'event',
-            index: 'myFakeSignalIndex',
-            depth: 1,
-          },
-          original_time: 'someTimeStamp',
-          status: 'open',
-          rule: {
-            id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
-            rule_id: 'rule-1',
-            false_positives: [],
-            max_signals: 10000,
-            risk_score: 50,
-            output_index: '.siem-signals',
-            description: 'Detecting root and admin users',
-            from: 'now-6m',
-            immutable: false,
-            index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
-            interval: '5m',
-            language: 'kuery',
-            name: 'rule-name',
-            query: 'user.name: root or user.name: admin',
-            references: ['http://google.com'],
-            severity: 'high',
-            tags: ['some fake tag 1', 'some fake tag 2'],
-            type: 'query',
-            to: 'now',
-            enabled: true,
-            created_by: 'elastic',
-            updated_by: 'elastic',
-          },
-        },
-      });
-    });
-  });
-  describe('singleBulkCreate', () => {
-    describe('create signal id gereateId', () => {
-      test('two docs with same index, id, and version should have same id', () => {
-        const findex = 'myfakeindex';
-        const fid = 'somefakeid';
-        const version = '1';
-        const ruleId = 'rule-1';
-        // 'myfakeindexsomefakeid1rule-1'
-        const generatedHash = '342404d620be4344d6d90dd0461d1d1848aec457944d5c5f40cc0cbfedb36679';
-        const firstHash = generateId(findex, fid, version, ruleId);
-        const secondHash = generateId(findex, fid, version, ruleId);
-        expect(firstHash).toEqual(generatedHash);
-        expect(secondHash).toEqual(generatedHash);
-        expect(Buffer.byteLength(firstHash, 'utf8')).toBeLessThan(512); // 512 bytes is maximum size of _id field
-        expect(Buffer.byteLength(secondHash, 'utf8')).toBeLessThan(512);
-      });
-      test('two docs with different index, id, and version should have different id', () => {
-        const findex = 'myfakeindex';
-        const findex2 = 'mysecondfakeindex';
-        const fid = 'somefakeid';
-        const version = '1';
-        const ruleId = 'rule-1';
-        // 'myfakeindexsomefakeid1rule-1'
-        const firstGeneratedHash =
-          '342404d620be4344d6d90dd0461d1d1848aec457944d5c5f40cc0cbfedb36679';
-        // 'mysecondfakeindexsomefakeid1rule-1'
-        const secondGeneratedHash =
-          'a852941273f805ffe9006e574601acc8ae1148d6c0b3f7f8c4785cba8f6b768a';
-        const firstHash = generateId(findex, fid, version, ruleId);
-        const secondHash = generateId(findex2, fid, version, ruleId);
-        expect(firstHash).toEqual(firstGeneratedHash);
-        expect(secondHash).toEqual(secondGeneratedHash);
-        expect(Buffer.byteLength(firstHash, 'utf8')).toBeLessThan(512); // 512 bytes is maximum size of _id field
-        expect(Buffer.byteLength(secondHash, 'utf8')).toBeLessThan(512);
-        expect(firstHash).not.toEqual(secondHash);
-      });
-      test('two docs with same index, different id, and same version should have different id', () => {
-        const findex = 'myfakeindex';
-        const fid = 'somefakeid';
-        const fid2 = 'somefakeid2';
-        const version = '1';
-        const ruleId = 'rule-1';
-        // 'myfakeindexsomefakeid1rule-1'
-        const firstGeneratedHash =
-          '342404d620be4344d6d90dd0461d1d1848aec457944d5c5f40cc0cbfedb36679';
-        // 'myfakeindexsomefakeid21rule-1'
-        const secondGeneratedHash =
-          '7d33faea18159fd010c4b79890620e8b12cdc88ec1d370149d0e5552ce860255';
-        const firstHash = generateId(findex, fid, version, ruleId);
-        const secondHash = generateId(findex, fid2, version, ruleId);
-        expect(firstHash).toEqual(firstGeneratedHash);
-        expect(secondHash).toEqual(secondGeneratedHash);
-        expect(Buffer.byteLength(firstHash, 'utf8')).toBeLessThan(512); // 512 bytes is maximum size of _id field
-        expect(Buffer.byteLength(secondHash, 'utf8')).toBeLessThan(512);
-        expect(firstHash).not.toEqual(secondHash);
-      });
-      test('two docs with same index, same id, and different version should have different id', () => {
-        const findex = 'myfakeindex';
-        const fid = 'somefakeid';
-        const version = '1';
-        const version2 = '2';
-        const ruleId = 'rule-1';
-        // 'myfakeindexsomefakeid1rule-1'
-        const firstGeneratedHash =
-          '342404d620be4344d6d90dd0461d1d1848aec457944d5c5f40cc0cbfedb36679';
-        // myfakeindexsomefakeid2rule-1'
-        const secondGeneratedHash =
-          'f016f3071fa9df9221d2fb2ba92389d4d388a4347c6ec7a4012c01cb1c640a40';
-        const firstHash = generateId(findex, fid, version, ruleId);
-        const secondHash = generateId(findex, fid, version2, ruleId);
-        expect(firstHash).toEqual(firstGeneratedHash);
-        expect(secondHash).toEqual(secondGeneratedHash);
-        expect(Buffer.byteLength(firstHash, 'utf8')).toBeLessThan(512); // 512 bytes is maximum size of _id field
-        expect(Buffer.byteLength(secondHash, 'utf8')).toBeLessThan(512);
-        expect(firstHash).not.toEqual(secondHash);
-      });
-      test('Ensure generated id is less than 512 bytes, even for really really long strings', () => {
-        const longIndexName =
-          'myfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindex';
-        const fid = 'somefakeid';
-        const version = '1';
-        const ruleId = 'rule-1';
-        const firstHash = generateId(longIndexName, fid, version, ruleId);
-        expect(Buffer.byteLength(firstHash, 'utf8')).toBeLessThan(512); // 512 bytes is maximum size of _id field
-      });
-      test('two docs with same index, same id, same version number, and different rule ids should have different id', () => {
-        const findex = 'myfakeindex';
-        const fid = 'somefakeid';
-        const version = '1';
-        const ruleId = 'rule-1';
-        const ruleId2 = 'rule-2';
-        // 'myfakeindexsomefakeid1rule-1'
-        const firstGeneratedHash =
-          '342404d620be4344d6d90dd0461d1d1848aec457944d5c5f40cc0cbfedb36679';
-        // myfakeindexsomefakeid1rule-2'
-        const secondGeneratedHash =
-          '1eb04f997086f8b3b143d4d9b18ac178c4a7423f71a5dad9ba8b9e92603c6863';
-        const firstHash = generateId(findex, fid, version, ruleId);
-        const secondHash = generateId(findex, fid, version, ruleId2);
-        expect(firstHash).toEqual(firstGeneratedHash);
-        expect(secondHash).toEqual(secondGeneratedHash);
-        expect(Buffer.byteLength(firstHash, 'utf8')).toBeLessThan(512); // 512 bytes is maximum size of _id field
-        expect(Buffer.byteLength(secondHash, 'utf8')).toBeLessThan(512);
-        expect(firstHash).not.toEqual(secondHash);
-      });
-    });
-    test('create successful bulk create', async () => {
-      const sampleParams = sampleRuleAlertParams();
-      const sampleSearchResult = sampleDocSearchResultsNoSortId;
-      mockService.callCluster.mockReturnValueOnce({
-        took: 100,
-        errors: false,
-        items: [
-          {
-            fakeItemValue: 'fakeItemKey',
-          },
-        ],
-      });
-      const successfulsingleBulkCreate = await singleBulkCreate({
-        someResult: sampleSearchResult(),
-        ruleParams: sampleParams,
-        services: mockService,
-        logger: mockLogger,
-        id: sampleRuleGuid,
-        signalsIndex: DEFAULT_SIGNALS_INDEX,
-        name: 'rule-name',
-        createdBy: 'elastic',
-        updatedBy: 'elastic',
-        interval: '5m',
-        enabled: true,
-        tags: ['some fake tag 1', 'some fake tag 2'],
-      });
-      expect(successfulsingleBulkCreate).toEqual(true);
-    });
-    test('create successful bulk create with docs with no versioning', async () => {
-      const sampleParams = sampleRuleAlertParams();
-      const sampleSearchResult = sampleDocSearchResultsNoSortIdNoVersion;
-      mockService.callCluster.mockReturnValueOnce({
-        took: 100,
-        errors: false,
-        items: [
-          {
-            fakeItemValue: 'fakeItemKey',
-          },
-        ],
-      });
-      const successfulsingleBulkCreate = await singleBulkCreate({
-        someResult: sampleSearchResult(),
-        ruleParams: sampleParams,
-        services: mockService,
-        logger: mockLogger,
-        id: sampleRuleGuid,
-        signalsIndex: DEFAULT_SIGNALS_INDEX,
-        name: 'rule-name',
-        createdBy: 'elastic',
-        updatedBy: 'elastic',
-        interval: '5m',
-        enabled: true,
-        tags: ['some fake tag 1', 'some fake tag 2'],
-      });
-      expect(successfulsingleBulkCreate).toEqual(true);
-    });
-    test('create unsuccessful bulk create due to empty search results', async () => {
-      const sampleParams = sampleRuleAlertParams();
-      const sampleSearchResult = sampleEmptyDocSearchResults;
-      mockService.callCluster.mockReturnValue(false);
-      const successfulsingleBulkCreate = await singleBulkCreate({
-        someResult: sampleSearchResult,
-        ruleParams: sampleParams,
-        services: mockService,
-        logger: mockLogger,
-        id: sampleRuleGuid,
-        signalsIndex: DEFAULT_SIGNALS_INDEX,
-        name: 'rule-name',
-        createdBy: 'elastic',
-        updatedBy: 'elastic',
-        interval: '5m',
-        enabled: true,
-        tags: ['some fake tag 1', 'some fake tag 2'],
-      });
-      expect(successfulsingleBulkCreate).toEqual(true);
-    });
-    test('create successful bulk create when bulk create has errors', async () => {
-      const sampleParams = sampleRuleAlertParams();
-      const sampleSearchResult = sampleDocSearchResultsNoSortId;
-      mockService.callCluster.mockReturnValue(sampleBulkCreateDuplicateResult);
-      const successfulsingleBulkCreate = await singleBulkCreate({
-        someResult: sampleSearchResult(),
-        ruleParams: sampleParams,
-        services: mockService,
-        logger: mockLogger,
-        id: sampleRuleGuid,
-        signalsIndex: DEFAULT_SIGNALS_INDEX,
-        name: 'rule-name',
-        createdBy: 'elastic',
-        updatedBy: 'elastic',
-        interval: '5m',
-        enabled: true,
-        tags: ['some fake tag 1', 'some fake tag 2'],
-      });
-      expect(mockLogger.error).toHaveBeenCalled();
-      expect(successfulsingleBulkCreate).toEqual(true);
-    });
-  });
-  describe('singleSearchAfter', () => {
-    test('if singleSearchAfter works without a given sort id', async () => {
-      let searchAfterSortId;
-      const sampleParams = sampleRuleAlertParams();
-      mockService.callCluster.mockReturnValue(sampleDocSearchResultsNoSortId);
-      await expect(
-        singleSearchAfter({
-          searchAfterSortId,
-          ruleParams: sampleParams,
-          services: mockService,
-          logger: mockLogger,
-          pageSize: 1,
-          filter: undefined,
-        })
-      ).rejects.toThrow('Attempted to search after with empty sort id');
-    });
-    test('if singleSearchAfter works with a given sort id', async () => {
-      const searchAfterSortId = '1234567891111';
-      const sampleParams = sampleRuleAlertParams();
-      mockService.callCluster.mockReturnValue(sampleDocSearchResultsWithSortId);
-      const searchAfterResult = await singleSearchAfter({
-        searchAfterSortId,
-        ruleParams: sampleParams,
-        services: mockService,
-        logger: mockLogger,
-        pageSize: 1,
-        filter: undefined,
-      });
-      expect(searchAfterResult).toEqual(sampleDocSearchResultsWithSortId);
-    });
-    test('if singleSearchAfter throws error', async () => {
-      const searchAfterSortId = '1234567891111';
-      const sampleParams = sampleRuleAlertParams();
-      mockService.callCluster.mockImplementation(async () => {
-        throw Error('Fake Error');
-      });
-      await expect(
-        singleSearchAfter({
-          searchAfterSortId,
-          ruleParams: sampleParams,
-          services: mockService,
-          logger: mockLogger,
-          pageSize: 1,
-          filter: undefined,
-        })
-      ).rejects.toThrow('Fake Error');
-    });
-  });
-  describe('searchAfterAndBulkCreate', () => {
-    test('if successful with empty search results', async () => {
-      const sampleParams = sampleRuleAlertParams();
-      const result = await searchAfterAndBulkCreate({
-        someResult: sampleEmptyDocSearchResults,
-        ruleParams: sampleParams,
-        services: mockService,
-        logger: mockLogger,
-        id: sampleRuleGuid,
-        signalsIndex: DEFAULT_SIGNALS_INDEX,
-        name: 'rule-name',
-        createdBy: 'elastic',
-        updatedBy: 'elastic',
-        interval: '5m',
-        enabled: true,
-        pageSize: 1,
-        filter: undefined,
-        tags: ['some fake tag 1', 'some fake tag 2'],
-      });
-      expect(mockService.callCluster).toHaveBeenCalledTimes(0);
-      expect(result).toEqual(true);
-    });
-    test('if successful iteration of while loop with maxDocs', async () => {
-      const sampleParams = sampleRuleAlertParams(30);
-      const someGuids = Array.from({ length: 13 }).map(x => uuid.v4());
-      mockService.callCluster
-        .mockReturnValueOnce({
-          took: 100,
-          errors: false,
-          items: [
-            {
-              fakeItemValue: 'fakeItemKey',
-            },
-          ],
-        })
-        .mockReturnValueOnce(repeatedSearchResultsWithSortId(3, 1, someGuids.slice(0, 3)))
-        .mockReturnValueOnce({
-          took: 100,
-          errors: false,
-          items: [
-            {
-              fakeItemValue: 'fakeItemKey',
-            },
-          ],
-        })
-        .mockReturnValueOnce(repeatedSearchResultsWithSortId(3, 1, someGuids.slice(3, 6)))
-        .mockReturnValueOnce({
-          took: 100,
-          errors: false,
-          items: [
-            {
-              fakeItemValue: 'fakeItemKey',
-            },
-          ],
-        });
-      const result = await searchAfterAndBulkCreate({
-        someResult: repeatedSearchResultsWithSortId(3, 1, someGuids.slice(6, 9)),
-        ruleParams: sampleParams,
-        services: mockService,
-        logger: mockLogger,
-        id: sampleRuleGuid,
-        signalsIndex: DEFAULT_SIGNALS_INDEX,
-        name: 'rule-name',
-        createdBy: 'elastic',
-        updatedBy: 'elastic',
-        interval: '5m',
-        enabled: true,
-        pageSize: 1,
-        filter: undefined,
-        tags: ['some fake tag 1', 'some fake tag 2'],
-      });
-      expect(mockService.callCluster).toHaveBeenCalledTimes(5);
-      expect(result).toEqual(true);
-    });
-    test('if unsuccessful first bulk create', async () => {
-      const someGuids = Array.from({ length: 4 }).map(x => uuid.v4());
-      const sampleParams = sampleRuleAlertParams(10);
-      mockService.callCluster.mockReturnValue(sampleBulkCreateDuplicateResult);
-      const result = await searchAfterAndBulkCreate({
-        someResult: repeatedSearchResultsWithSortId(4, 1, someGuids),
-        ruleParams: sampleParams,
-        services: mockService,
-        logger: mockLogger,
-        id: sampleRuleGuid,
-        signalsIndex: DEFAULT_SIGNALS_INDEX,
-        name: 'rule-name',
-        createdBy: 'elastic',
-        updatedBy: 'elastic',
-        interval: '5m',
-        enabled: true,
-        pageSize: 1,
-        filter: undefined,
-        tags: ['some fake tag 1', 'some fake tag 2'],
-      });
-      expect(mockLogger.error).toHaveBeenCalled();
-      expect(result).toEqual(false);
-    });
-    test('if unsuccessful iteration of searchAfterAndBulkCreate due to empty sort ids', async () => {
-      const sampleParams = sampleRuleAlertParams();
-      mockService.callCluster.mockReturnValueOnce({
-        took: 100,
-        errors: false,
-        items: [
-          {
-            fakeItemValue: 'fakeItemKey',
-          },
-        ],
-      });
-      const result = await searchAfterAndBulkCreate({
-        someResult: sampleDocSearchResultsNoSortId(),
-        ruleParams: sampleParams,
-        services: mockService,
-        logger: mockLogger,
-        id: sampleRuleGuid,
-        signalsIndex: DEFAULT_SIGNALS_INDEX,
-        name: 'rule-name',
-        createdBy: 'elastic',
-        updatedBy: 'elastic',
-        interval: '5m',
-        enabled: true,
-        pageSize: 1,
-        filter: undefined,
-        tags: ['some fake tag 1', 'some fake tag 2'],
-      });
-      expect(mockLogger.error).toHaveBeenCalled();
-      expect(result).toEqual(false);
-    });
-    test('if unsuccessful iteration of searchAfterAndBulkCreate due to empty sort ids and 0 total hits', async () => {
-      const sampleParams = sampleRuleAlertParams();
-      mockService.callCluster.mockReturnValueOnce({
-        took: 100,
-        errors: false,
-        items: [
-          {
-            fakeItemValue: 'fakeItemKey',
-          },
-        ],
-      });
-      const result = await searchAfterAndBulkCreate({
-        someResult: sampleDocSearchResultsNoSortIdNoHits(),
-        ruleParams: sampleParams,
-        services: mockService,
-        logger: mockLogger,
-        id: sampleRuleGuid,
-        signalsIndex: DEFAULT_SIGNALS_INDEX,
-        name: 'rule-name',
-        createdBy: 'elastic',
-        updatedBy: 'elastic',
-        interval: '5m',
-        enabled: true,
-        pageSize: 1,
-        filter: undefined,
-        tags: ['some fake tag 1', 'some fake tag 2'],
-      });
-      expect(result).toEqual(true);
-    });
-    test('if successful iteration of while loop with maxDocs and search after returns results with no sort ids', async () => {
-      const sampleParams = sampleRuleAlertParams(10);
-      const someGuids = Array.from({ length: 4 }).map(x => uuid.v4());
-      mockService.callCluster
-        .mockReturnValueOnce({
-          took: 100,
-          errors: false,
-          items: [
-            {
-              fakeItemValue: 'fakeItemKey',
-            },
-          ],
-        })
-        .mockReturnValueOnce(sampleDocSearchResultsNoSortId());
-      const result = await searchAfterAndBulkCreate({
-        someResult: repeatedSearchResultsWithSortId(4, 1, someGuids),
-        ruleParams: sampleParams,
-        services: mockService,
-        logger: mockLogger,
-        id: sampleRuleGuid,
-        signalsIndex: DEFAULT_SIGNALS_INDEX,
-        name: 'rule-name',
-        createdBy: 'elastic',
-        updatedBy: 'elastic',
-        interval: '5m',
-        enabled: true,
-        pageSize: 1,
-        filter: undefined,
-        tags: ['some fake tag 1', 'some fake tag 2'],
-      });
-      expect(result).toEqual(true);
-    });
-    test('if successful iteration of while loop with maxDocs and search after returns empty results with no sort ids', async () => {
-      const sampleParams = sampleRuleAlertParams(10);
-      const someGuids = Array.from({ length: 4 }).map(x => uuid.v4());
-      mockService.callCluster
-        .mockReturnValueOnce({
-          took: 100,
-          errors: false,
-          items: [
-            {
-              fakeItemValue: 'fakeItemKey',
-            },
-          ],
-        })
-        .mockReturnValueOnce(sampleEmptyDocSearchResults);
-      const result = await searchAfterAndBulkCreate({
-        someResult: repeatedSearchResultsWithSortId(4, 1, someGuids),
-        ruleParams: sampleParams,
-        services: mockService,
-        logger: mockLogger,
-        id: sampleRuleGuid,
-        signalsIndex: DEFAULT_SIGNALS_INDEX,
-        name: 'rule-name',
-        createdBy: 'elastic',
-        updatedBy: 'elastic',
-        interval: '5m',
-        enabled: true,
-        pageSize: 1,
-        filter: undefined,
-        tags: ['some fake tag 1', 'some fake tag 2'],
-      });
-      expect(result).toEqual(true);
-    });
-    test('if returns false when singleSearchAfter throws an exception', async () => {
-      const sampleParams = sampleRuleAlertParams(10);
-      const someGuids = Array.from({ length: 4 }).map(x => uuid.v4());
-      mockService.callCluster
-        .mockReturnValueOnce({
-          took: 100,
-          errors: false,
-          items: [
-            {
-              fakeItemValue: 'fakeItemKey',
-            },
-          ],
-        })
-        .mockImplementation(() => {
-          throw Error('Fake Error');
-        });
-      const result = await searchAfterAndBulkCreate({
-        someResult: repeatedSearchResultsWithSortId(4, 1, someGuids),
-        ruleParams: sampleParams,
-        services: mockService,
-        logger: mockLogger,
-        id: sampleRuleGuid,
-        signalsIndex: DEFAULT_SIGNALS_INDEX,
-        name: 'rule-name',
-        createdBy: 'elastic',
-        updatedBy: 'elastic',
-        interval: '5m',
-        enabled: true,
-        pageSize: 1,
-        filter: undefined,
-        tags: ['some fake tag 1', 'some fake tag 2'],
-      });
-      expect(result).toEqual(false);
-    });
-  });
-
-  describe('buildEventTypeSignal', () => {
-    test('it returns the event appended of kind signal if it does not exist', () => {
-      const doc = sampleDocNoSortId();
-      delete doc._source.event;
-      const eventType = buildEventTypeSignal(doc);
-      const expected: object = { kind: 'signal' };
-      expect(eventType).toEqual(expected);
-    });
-
-    test('it returns the event appended of kind signal if it is an empty object', () => {
-      const doc = sampleDocNoSortId();
-      doc._source.event = {};
-      const eventType = buildEventTypeSignal(doc);
-      const expected: object = { kind: 'signal' };
-      expect(eventType).toEqual(expected);
-    });
-
-    test('it returns the event with kind signal and other properties if they exist', () => {
-      const doc = sampleDocNoSortId();
-      doc._source.event = {
-        action: 'socket_opened',
-        module: 'system',
-        dataset: 'socket',
-      };
-      const eventType = buildEventTypeSignal(doc);
-      const expected: object = {
-        action: 'socket_opened',
-        module: 'system',
-        dataset: 'socket',
-        kind: 'signal',
-      };
-      expect(eventType).toEqual(expected);
-    });
-  });
-
-  describe('buildSignal', () => {
-    test('it builds a signal as expected without original_event if event does not exist', () => {
-      const doc = sampleDocNoSortId('d5e8eb51-a6a0-456d-8a15-4b79bfec3d71');
-      delete doc._source.event;
-      const rule: Partial<OutputRuleAlertRest> = sampleRule();
-      const signal = buildSignal(doc, rule);
-      const expected: Signal = {
-        parent: {
-          id: 'd5e8eb51-a6a0-456d-8a15-4b79bfec3d71',
-          type: 'event',
-          index: 'myFakeSignalIndex',
-          depth: 1,
-        },
-        original_time: 'someTimeStamp',
-        status: 'open',
-        rule: {
-          created_by: 'elastic',
-          description: 'Detecting root and admin users',
-          enabled: true,
-          false_positives: [],
-          from: 'now-6m',
-          id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
-          immutable: false,
-          index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
-          interval: '5m',
-          risk_score: 50,
-          rule_id: 'rule-1',
-          language: 'kuery',
-          max_signals: 100,
-          name: 'Detect Root/Admin Users',
-          output_index: '.siem-signals',
-          query: 'user.name: root or user.name: admin',
-          references: ['http://www.example.com', 'https://ww.example.com'],
-          severity: 'high',
-          updated_by: 'elastic',
-          tags: ['some fake tag 1', 'some fake tag 2'],
-          to: 'now',
-          type: 'query',
-        },
-      };
-      expect(signal).toEqual(expected);
-    });
-
-    test('it builds a signal as expected with original_event if is present', () => {
-      const doc = sampleDocNoSortId('d5e8eb51-a6a0-456d-8a15-4b79bfec3d71');
-      doc._source.event = {
-        action: 'socket_opened',
-        dataset: 'socket',
-        kind: 'event',
-        module: 'system',
-      };
-      const rule: Partial<OutputRuleAlertRest> = sampleRule();
-      const signal = buildSignal(doc, rule);
-      const expected: Signal = {
-        parent: {
-          id: 'd5e8eb51-a6a0-456d-8a15-4b79bfec3d71',
-          type: 'event',
-          index: 'myFakeSignalIndex',
-          depth: 1,
-        },
-        original_time: 'someTimeStamp',
-        original_event: {
-          action: 'socket_opened',
-          dataset: 'socket',
-          kind: 'event',
-          module: 'system',
-        },
-        status: 'open',
-        rule: {
-          created_by: 'elastic',
-          description: 'Detecting root and admin users',
-          enabled: true,
-          false_positives: [],
-          from: 'now-6m',
-          id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
-          immutable: false,
-          index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
-          interval: '5m',
-          risk_score: 50,
-          rule_id: 'rule-1',
-          language: 'kuery',
-          max_signals: 100,
-          name: 'Detect Root/Admin Users',
-          output_index: '.siem-signals',
-          query: 'user.name: root or user.name: admin',
-          references: ['http://www.example.com', 'https://ww.example.com'],
-          severity: 'high',
-          updated_by: 'elastic',
-          tags: ['some fake tag 1', 'some fake tag 2'],
-          to: 'now',
-          type: 'query',
-        },
-      };
-      expect(signal).toEqual(expected);
-    });
-  });
-
-  describe('buildRule', () => {
-    test('it builds a rule as expected with filters present', () => {
-      const ruleParams = sampleRuleAlertParams();
-      ruleParams.filters = [
-        {
-          query: 'host.name: Rebecca',
-        },
-        {
-          query: 'host.name: Evan',
-        },
-        {
-          query: 'host.name: Braden',
-        },
-      ];
-      const rule = buildRule({
-        ruleParams,
-        name: 'some-name',
-        id: sampleRuleGuid,
-        enabled: false,
-        createdBy: 'elastic',
-        updatedBy: 'elastic',
-        interval: 'some interval',
-        tags: ['some fake tag 1', 'some fake tag 2'],
-      });
-      const expected: Partial<OutputRuleAlertRest> = {
-        created_by: 'elastic',
-        description: 'Detecting root and admin users',
-        enabled: false,
-        false_positives: [],
-        from: 'now-6m',
-        id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
-        immutable: false,
-        index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
-        interval: 'some interval',
-        language: 'kuery',
-        max_signals: 10000,
-        name: 'some-name',
-        output_index: '.siem-signals',
-        query: 'user.name: root or user.name: admin',
-        references: ['http://google.com'],
-        risk_score: 50,
-        rule_id: 'rule-1',
-        severity: 'high',
-        tags: ['some fake tag 1', 'some fake tag 2'],
-        to: 'now',
-        type: 'query',
-        updated_by: 'elastic',
-        filters: [
-          {
-            query: 'host.name: Rebecca',
-          },
-          {
-            query: 'host.name: Evan',
-          },
-          {
-            query: 'host.name: Braden',
-          },
-        ],
-      };
-      expect(rule).toEqual(expected);
-    });
-
-    test('it omits a null value such as if enabled is null if is present', () => {
-      const ruleParams = sampleRuleAlertParams();
-      ruleParams.filters = undefined;
-      const rule = buildRule({
-        ruleParams,
-        name: 'some-name',
-        id: sampleRuleGuid,
-        enabled: true,
-        createdBy: 'elastic',
-        updatedBy: 'elastic',
-        interval: 'some interval',
-        tags: ['some fake tag 1', 'some fake tag 2'],
-      });
-      const expected: Partial<OutputRuleAlertRest> = {
-        created_by: 'elastic',
-        description: 'Detecting root and admin users',
-        enabled: true,
-        false_positives: [],
-        from: 'now-6m',
-        id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
-        immutable: false,
-        index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
-        interval: 'some interval',
-        language: 'kuery',
-        max_signals: 10000,
-        name: 'some-name',
-        output_index: '.siem-signals',
-        query: 'user.name: root or user.name: admin',
-        references: ['http://google.com'],
-        risk_score: 50,
-        rule_id: 'rule-1',
-        severity: 'high',
-        tags: ['some fake tag 1', 'some fake tag 2'],
-        to: 'now',
-        type: 'query',
-        updated_by: 'elastic',
-      };
-      expect(rule).toEqual(expected);
-    });
-
-    test('it omits a null value such as if filters is undefined if is present', () => {
-      const ruleParams = sampleRuleAlertParams();
-      ruleParams.filters = undefined;
-      const rule = buildRule({
-        ruleParams,
-        name: 'some-name',
-        id: sampleRuleGuid,
-        enabled: true,
-        createdBy: 'elastic',
-        updatedBy: 'elastic',
-        interval: 'some interval',
-        tags: ['some fake tag 1', 'some fake tag 2'],
-      });
-      const expected: Partial<OutputRuleAlertRest> = {
-        created_by: 'elastic',
-        description: 'Detecting root and admin users',
-        enabled: true,
-        false_positives: [],
-        from: 'now-6m',
-        id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
-        immutable: false,
-        index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
-        interval: 'some interval',
-        language: 'kuery',
-        max_signals: 10000,
-        name: 'some-name',
-        output_index: '.siem-signals',
-        query: 'user.name: root or user.name: admin',
-        references: ['http://google.com'],
-        risk_score: 50,
-        rule_id: 'rule-1',
-        severity: 'high',
-        tags: ['some fake tag 1', 'some fake tag 2'],
-        to: 'now',
-        type: 'query',
-        updated_by: 'elastic',
-      };
-      expect(rule).toEqual(expected);
-    });
-  });
-});
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/utils.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/utils.ts
deleted file mode 100644
index 1787aa3a3081b..0000000000000
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/utils.ts
+++ /dev/null
@@ -1,408 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-import { createHash } from 'crypto';
-import { performance } from 'perf_hooks';
-import { pickBy } from 'lodash/fp';
-import { SignalHit, Signal } from '../../types';
-import { Logger } from '../../../../../../../../src/core/server';
-import { AlertServices } from '../../../../../alerting/server/types';
-import {
-  SignalSourceHit,
-  SignalSearchResponse,
-  BulkResponse,
-  RuleTypeParams,
-  OutputRuleAlertRest,
-} from './types';
-import { buildEventsSearchQuery } from './build_events_query';
-
-interface BuildRuleParams {
-  ruleParams: RuleTypeParams;
-  name: string;
-  id: string;
-  enabled: boolean;
-  createdBy: string;
-  updatedBy: string;
-  interval: string;
-  tags: string[];
-}
-
-export const buildRule = ({
-  ruleParams,
-  name,
-  id,
-  enabled,
-  createdBy,
-  updatedBy,
-  interval,
-  tags,
-}: BuildRuleParams): Partial<OutputRuleAlertRest> => {
-  return pickBy<OutputRuleAlertRest>((value: unknown) => value != null, {
-    id,
-    rule_id: ruleParams.ruleId,
-    false_positives: ruleParams.falsePositives,
-    saved_id: ruleParams.savedId,
-    meta: ruleParams.meta,
-    max_signals: ruleParams.maxSignals,
-    risk_score: ruleParams.riskScore,
-    output_index: ruleParams.outputIndex,
-    description: ruleParams.description,
-    from: ruleParams.from,
-    immutable: ruleParams.immutable,
-    index: ruleParams.index,
-    interval,
-    language: ruleParams.language,
-    name,
-    query: ruleParams.query,
-    references: ruleParams.references,
-    severity: ruleParams.severity,
-    tags,
-    type: ruleParams.type,
-    to: ruleParams.to,
-    enabled,
-    filters: ruleParams.filters,
-    created_by: createdBy,
-    updated_by: updatedBy,
-    threats: ruleParams.threats,
-  });
-};
-
-export const buildSignal = (doc: SignalSourceHit, rule: Partial<OutputRuleAlertRest>): Signal => {
-  const signal: Signal = {
-    parent: {
-      id: doc._id,
-      type: 'event',
-      index: doc._index,
-      depth: 1,
-    },
-    original_time: doc._source['@timestamp'],
-    status: 'open',
-    rule,
-  };
-  if (doc._source.event != null) {
-    return { ...signal, original_event: doc._source.event };
-  }
-  return signal;
-};
-
-interface BuildBulkBodyParams {
-  doc: SignalSourceHit;
-  ruleParams: RuleTypeParams;
-  id: string;
-  name: string;
-  createdBy: string;
-  updatedBy: string;
-  interval: string;
-  enabled: boolean;
-  tags: string[];
-}
-
-export const buildEventTypeSignal = (doc: SignalSourceHit): object => {
-  if (doc._source.event != null && doc._source.event instanceof Object) {
-    return { ...doc._source.event, kind: 'signal' };
-  } else {
-    return { kind: 'signal' };
-  }
-};
-
-// format search_after result for signals index.
-export const buildBulkBody = ({
-  doc,
-  ruleParams,
-  id,
-  name,
-  createdBy,
-  updatedBy,
-  interval,
-  enabled,
-  tags,
-}: BuildBulkBodyParams): SignalHit => {
-  const rule = buildRule({
-    ruleParams,
-    id,
-    name,
-    enabled,
-    createdBy,
-    updatedBy,
-    interval,
-    tags,
-  });
-  const signal = buildSignal(doc, rule);
-  const event = buildEventTypeSignal(doc);
-  const signalHit: SignalHit = {
-    ...doc._source,
-    '@timestamp': new Date().toISOString(),
-    event,
-    signal,
-  };
-  return signalHit;
-};
-
-interface SingleBulkCreateParams {
-  someResult: SignalSearchResponse;
-  ruleParams: RuleTypeParams;
-  services: AlertServices;
-  logger: Logger;
-  id: string;
-  signalsIndex: string;
-  name: string;
-  createdBy: string;
-  updatedBy: string;
-  interval: string;
-  enabled: boolean;
-  tags: string[];
-}
-
-export const generateId = (
-  docIndex: string,
-  docId: string,
-  version: string,
-  ruleId: string
-): string =>
-  createHash('sha256')
-    .update(docIndex.concat(docId, version, ruleId))
-    .digest('hex');
-
-// Bulk Index documents.
-export const singleBulkCreate = async ({
-  someResult,
-  ruleParams,
-  services,
-  logger,
-  id,
-  signalsIndex,
-  name,
-  createdBy,
-  updatedBy,
-  interval,
-  enabled,
-  tags,
-}: SingleBulkCreateParams): Promise<boolean> => {
-  if (someResult.hits.hits.length === 0) {
-    return true;
-  }
-  // index documents after creating an ID based on the
-  // source documents' originating index, and the original
-  // document _id. This will allow two documents from two
-  // different indexes with the same ID to be
-  // indexed, and prevents us from creating any updates
-  // to the documents once inserted into the signals index,
-  // while preventing duplicates from being added to the
-  // signals index if rules are re-run over the same time
-  // span. Also allow for versioning.
-  const bulkBody = someResult.hits.hits.flatMap(doc => [
-    {
-      create: {
-        _index: signalsIndex,
-        _id: generateId(
-          doc._index,
-          doc._id,
-          doc._version ? doc._version.toString() : '',
-          ruleParams.ruleId ?? ''
-        ),
-      },
-    },
-    buildBulkBody({ doc, ruleParams, id, name, createdBy, updatedBy, interval, enabled, tags }),
-  ]);
-  const time1 = performance.now();
-  const firstResult: BulkResponse = await services.callCluster('bulk', {
-    index: signalsIndex,
-    refresh: false,
-    body: bulkBody,
-  });
-  const time2 = performance.now();
-  logger.debug(
-    `individual bulk process time took: ${Number(time2 - time1).toFixed(2)} milliseconds`
-  );
-  logger.debug(`took property says bulk took: ${firstResult.took} milliseconds`);
-  if (firstResult.errors) {
-    // go through the response status errors and see what
-    // types of errors they are, count them up, and log them.
-    const errorCountMap = firstResult.items.reduce((acc: { [key: string]: number }, item) => {
-      if (item.create.error) {
-        const responseStatusKey = item.create.status.toString();
-        acc[responseStatusKey] = acc[responseStatusKey] ? acc[responseStatusKey] + 1 : 1;
-      }
-      return acc;
-    }, {});
-    /*
-     the logging output below should look like
-     {'409': 55}
-     which is read as "there were 55 counts of 409 errors returned from bulk create"
-    */
-    logger.error(
-      `[-] bulkResponse had errors with response statuses:counts of...\n${JSON.stringify(
-        errorCountMap,
-        null,
-        2
-      )}`
-    );
-  }
-  return true;
-};
-
-interface SingleSearchAfterParams {
-  searchAfterSortId: string | undefined;
-  ruleParams: RuleTypeParams;
-  services: AlertServices;
-  logger: Logger;
-  pageSize: number;
-  filter: unknown;
-}
-
-// utilize search_after for paging results into bulk.
-export const singleSearchAfter = async ({
-  searchAfterSortId,
-  ruleParams,
-  services,
-  filter,
-  logger,
-  pageSize,
-}: SingleSearchAfterParams): Promise<SignalSearchResponse> => {
-  if (searchAfterSortId == null) {
-    throw Error('Attempted to search after with empty sort id');
-  }
-  try {
-    const searchAfterQuery = buildEventsSearchQuery({
-      index: ruleParams.index,
-      from: ruleParams.from,
-      to: ruleParams.to,
-      filter,
-      size: pageSize,
-      searchAfterSortId,
-    });
-    const nextSearchAfterResult: SignalSearchResponse = await services.callCluster(
-      'search',
-      searchAfterQuery
-    );
-    return nextSearchAfterResult;
-  } catch (exc) {
-    logger.error(`[-] nextSearchAfter threw an error ${exc}`);
-    throw exc;
-  }
-};
-
-interface SearchAfterAndBulkCreateParams {
-  someResult: SignalSearchResponse;
-  ruleParams: RuleTypeParams;
-  services: AlertServices;
-  logger: Logger;
-  id: string;
-  signalsIndex: string;
-  name: string;
-  createdBy: string;
-  updatedBy: string;
-  interval: string;
-  enabled: boolean;
-  pageSize: number;
-  filter: unknown;
-  tags: string[];
-}
-
-// search_after through documents and re-index using bulk endpoint.
-export const searchAfterAndBulkCreate = async ({
-  someResult,
-  ruleParams,
-  services,
-  logger,
-  id,
-  signalsIndex,
-  filter,
-  name,
-  createdBy,
-  updatedBy,
-  interval,
-  enabled,
-  pageSize,
-  tags,
-}: SearchAfterAndBulkCreateParams): Promise<boolean> => {
-  if (someResult.hits.hits.length === 0) {
-    return true;
-  }
-
-  logger.debug('[+] starting bulk insertion');
-  await singleBulkCreate({
-    someResult,
-    ruleParams,
-    services,
-    logger,
-    id,
-    signalsIndex,
-    name,
-    createdBy,
-    updatedBy,
-    interval,
-    enabled,
-    tags,
-  });
-  const totalHits =
-    typeof someResult.hits.total === 'number' ? someResult.hits.total : someResult.hits.total.value;
-  // maxTotalHitsSize represents the total number of docs to
-  // query for, no matter the size of each individual page of search results.
-  // If the total number of hits for the overall search result is greater than
-  // maxSignals, default to requesting a total of maxSignals, otherwise use the
-  // totalHits in the response from the searchAfter query.
-  const maxTotalHitsSize = totalHits >= ruleParams.maxSignals ? ruleParams.maxSignals : totalHits;
-
-  // number of docs in the current search result
-  let hitsSize = someResult.hits.hits.length;
-  logger.debug(`first size: ${hitsSize}`);
-  let sortIds = someResult.hits.hits[0].sort;
-  if (sortIds == null && totalHits > 0) {
-    logger.error('sortIds was empty on first search but expected more');
-    return false;
-  } else if (sortIds == null && totalHits === 0) {
-    return true;
-  }
-  let sortId;
-  if (sortIds != null) {
-    sortId = sortIds[0];
-  }
-  while (hitsSize < maxTotalHitsSize && hitsSize !== 0) {
-    try {
-      logger.debug(`sortIds: ${sortIds}`);
-      const searchAfterResult: SignalSearchResponse = await singleSearchAfter({
-        searchAfterSortId: sortId,
-        ruleParams,
-        services,
-        logger,
-        filter,
-        pageSize, // maximum number of docs to receive per search result.
-      });
-      if (searchAfterResult.hits.hits.length === 0) {
-        return true;
-      }
-      hitsSize += searchAfterResult.hits.hits.length;
-      logger.debug(`size adjusted: ${hitsSize}`);
-      sortIds = searchAfterResult.hits.hits[0].sort;
-      if (sortIds == null) {
-        logger.debug('sortIds was empty on search');
-        return true; // no more search results
-      }
-      sortId = sortIds[0];
-      logger.debug('next bulk index');
-      await singleBulkCreate({
-        someResult: searchAfterResult,
-        ruleParams,
-        services,
-        logger,
-        id,
-        signalsIndex,
-        name,
-        createdBy,
-        updatedBy,
-        interval,
-        enabled,
-        tags,
-      });
-      logger.debug('finished next bulk index');
-    } catch (exc) {
-      logger.error(`[-] search_after and bulk threw an error ${exc}`);
-      return false;
-    }
-  }
-  logger.debug(`[+] completed bulk index of ${maxTotalHitsSize}`);
-  return true;
-};
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/__mocks__/request_responses.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/__mocks__/request_responses.ts
index cd8b716221b9b..978434859ef95 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/__mocks__/request_responses.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/__mocks__/request_responses.ts
@@ -6,11 +6,13 @@
 
 import { ServerInjectOptions } from 'hapi';
 import { ActionResult } from '../../../../../../actions/server/types';
-import { RuleAlertParamsRest, RuleAlertType, SignalsRestParams } from '../../alerts/types';
+import { SignalsRestParams } from '../../signals/types';
 import {
   DETECTION_ENGINE_RULES_URL,
   DETECTION_ENGINE_SIGNALS_STATUS_URL,
 } from '../../../../../common/constants';
+import { RuleAlertType } from '../../rules/types';
+import { RuleAlertParamsRest } from '../../types';
 
 // The Omit of filter is because of a Hapi Server Typing issue that I am unclear
 // where it comes from. I would hope to remove the "filter" as an omit at some point
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/create_rules_route.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/create_rules_route.test.ts
similarity index 96%
rename from x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/create_rules_route.test.ts
rename to x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/create_rules_route.test.ts
index b271af2db1e7d..094449a5f61ac 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/create_rules_route.test.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/create_rules_route.test.ts
@@ -9,7 +9,7 @@ import {
   createMockServerWithoutActionClientDecoration,
   createMockServerWithoutAlertClientDecoration,
   createMockServerWithoutActionOrAlertClientDecoration,
-} from './__mocks__/_mock_server';
+} from '../__mocks__/_mock_server';
 import { createRulesRoute } from './create_rules_route';
 import { ServerInjectOptions } from 'hapi';
 import {
@@ -18,8 +18,8 @@ import {
   createActionResult,
   getCreateRequest,
   typicalPayload,
-} from './__mocks__/request_responses';
-import { DETECTION_ENGINE_RULES_URL } from '../../../../common/constants';
+} from '../__mocks__/request_responses';
+import { DETECTION_ENGINE_RULES_URL } from '../../../../../common/constants';
 
 describe('create_rules', () => {
   let { server, alertsClient, actionsClient, elasticsearch } = createMockServer();
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/create_rules_route.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/create_rules_route.ts
similarity index 85%
rename from x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/create_rules_route.ts
rename to x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/create_rules_route.ts
index a137d54250189..0dc213e9e2173 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/create_rules_route.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/create_rules_route.ts
@@ -8,14 +8,15 @@ import Hapi from 'hapi';
 import { isFunction } from 'lodash/fp';
 import Boom from 'boom';
 import uuid from 'uuid';
-import { DETECTION_ENGINE_RULES_URL } from '../../../../common/constants';
-import { createRules } from '../alerts/create_rules';
-import { RulesRequest } from '../alerts/types';
-import { createRulesSchema } from './schemas';
-import { ServerFacade } from '../../../types';
-import { readRules } from '../alerts/read_rules';
-import { transformOrError, transformError, getIndex, callWithRequestFactory } from './utils';
-import { getIndexExists } from '../index/get_index_exists';
+import { DETECTION_ENGINE_RULES_URL } from '../../../../../common/constants';
+import { createRules } from '../../rules/create_rules';
+import { RulesRequest } from '../../rules/types';
+import { createRulesSchema } from '../schemas/create_rules_schema';
+import { ServerFacade } from '../../../../types';
+import { readRules } from '../../rules/read_rules';
+import { transformOrError } from './utils';
+import { getIndexExists } from '../../index/get_index_exists';
+import { callWithRequestFactory, getIndex, transformError } from '../utils';
 
 export const createCreateRulesRoute = (server: ServerFacade): Hapi.ServerRoute => {
   return {
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/delete_rules_route.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/delete_rules_route.test.ts
similarity index 96%
rename from x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/delete_rules_route.test.ts
rename to x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/delete_rules_route.test.ts
index 0808051964dc1..cacafcf741e6a 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/delete_rules_route.test.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/delete_rules_route.test.ts
@@ -9,7 +9,7 @@ import {
   createMockServerWithoutActionClientDecoration,
   createMockServerWithoutAlertClientDecoration,
   createMockServerWithoutActionOrAlertClientDecoration,
-} from './__mocks__/_mock_server';
+} from '../__mocks__/_mock_server';
 
 import { deleteRulesRoute } from './delete_rules_route';
 import { ServerInjectOptions } from 'hapi';
@@ -19,8 +19,8 @@ import {
   getDeleteRequest,
   getFindResultWithSingleHit,
   getDeleteRequestById,
-} from './__mocks__/request_responses';
-import { DETECTION_ENGINE_RULES_URL } from '../../../../common/constants';
+} from '../__mocks__/request_responses';
+import { DETECTION_ENGINE_RULES_URL } from '../../../../../common/constants';
 
 describe('delete_rules', () => {
   let { server, alertsClient } = createMockServer();
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/delete_rules_route.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/delete_rules_route.ts
similarity index 78%
rename from x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/delete_rules_route.ts
rename to x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/delete_rules_route.ts
index fe8b139f11c01..c2b2e2fdbbaef 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/delete_rules_route.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/delete_rules_route.ts
@@ -7,12 +7,13 @@
 import Hapi from 'hapi';
 import { isFunction } from 'lodash/fp';
 
-import { DETECTION_ENGINE_RULES_URL } from '../../../../common/constants';
-import { deleteRules } from '../alerts/delete_rules';
-import { ServerFacade } from '../../../types';
-import { queryRulesSchema } from './schemas';
-import { QueryRequest } from '../alerts/types';
-import { getIdError, transformOrError, transformError } from './utils';
+import { DETECTION_ENGINE_RULES_URL } from '../../../../../common/constants';
+import { deleteRules } from '../../rules/delete_rules';
+import { ServerFacade } from '../../../../types';
+import { queryRulesSchema } from '../schemas/query_rules_schema';
+import { getIdError, transformOrError } from './utils';
+import { transformError } from '../utils';
+import { QueryRequest } from './types';
 
 export const createDeleteRulesRoute: Hapi.ServerRoute = {
   method: 'DELETE',
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/find_rules_route.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/find_rules_route.test.ts
similarity index 94%
rename from x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/find_rules_route.test.ts
rename to x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/find_rules_route.test.ts
index dae40f05155dc..38937c13d302c 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/find_rules_route.test.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/find_rules_route.test.ts
@@ -9,12 +9,12 @@ import {
   createMockServerWithoutActionClientDecoration,
   createMockServerWithoutAlertClientDecoration,
   createMockServerWithoutActionOrAlertClientDecoration,
-} from './__mocks__/_mock_server';
+} from '../__mocks__/_mock_server';
 
 import { findRulesRoute } from './find_rules_route';
 import { ServerInjectOptions } from 'hapi';
-import { getFindResult, getResult, getFindRequest } from './__mocks__/request_responses';
-import { DETECTION_ENGINE_RULES_URL } from '../../../../common/constants';
+import { getFindResult, getResult, getFindRequest } from '../__mocks__/request_responses';
+import { DETECTION_ENGINE_RULES_URL } from '../../../../../common/constants';
 
 describe('find_rules', () => {
   let { server, alertsClient, actionsClient } = createMockServer();
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/find_rules_route.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/find_rules_route.ts
similarity index 78%
rename from x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/find_rules_route.ts
rename to x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/find_rules_route.ts
index 137dd9352699e..6e89ddb19017d 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/find_rules_route.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/find_rules_route.ts
@@ -6,12 +6,13 @@
 
 import Hapi from 'hapi';
 import { isFunction } from 'lodash/fp';
-import { DETECTION_ENGINE_RULES_URL } from '../../../../common/constants';
-import { findRules } from '../alerts/find_rules';
-import { FindRulesRequest } from '../alerts/types';
-import { findRulesSchema } from './schemas';
-import { ServerFacade } from '../../../types';
-import { transformFindAlertsOrError, transformError } from './utils';
+import { DETECTION_ENGINE_RULES_URL } from '../../../../../common/constants';
+import { findRules } from '../../rules/find_rules';
+import { FindRulesRequest } from '../../rules/types';
+import { findRulesSchema } from '../schemas/find_rules_schema';
+import { ServerFacade } from '../../../../types';
+import { transformFindAlertsOrError } from './utils';
+import { transformError } from '../utils';
 
 export const createFindRulesRoute: Hapi.ServerRoute = {
   method: 'GET',
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/read_rules_route.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/read_rules_route.test.ts
similarity index 94%
rename from x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/read_rules_route.test.ts
rename to x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/read_rules_route.test.ts
index 47ecf62f41be9..0d77583573c13 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/read_rules_route.test.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/read_rules_route.test.ts
@@ -9,7 +9,7 @@ import {
   createMockServerWithoutActionClientDecoration,
   createMockServerWithoutAlertClientDecoration,
   createMockServerWithoutActionOrAlertClientDecoration,
-} from './__mocks__/_mock_server';
+} from '../__mocks__/_mock_server';
 
 import { readRulesRoute } from './read_rules_route';
 import { ServerInjectOptions } from 'hapi';
@@ -18,8 +18,8 @@ import {
   getResult,
   getReadRequest,
   getFindResultWithSingleHit,
-} from './__mocks__/request_responses';
-import { DETECTION_ENGINE_RULES_URL } from '../../../../common/constants';
+} from '../__mocks__/request_responses';
+import { DETECTION_ENGINE_RULES_URL } from '../../../../../common/constants';
 
 describe('read_signals', () => {
   let { server, alertsClient } = createMockServer();
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/read_rules_route.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/read_rules_route.ts
similarity index 78%
rename from x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/read_rules_route.ts
rename to x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/read_rules_route.ts
index a7bda40fdc523..a842e68b6b7fe 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/read_rules_route.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/read_rules_route.ts
@@ -6,13 +6,14 @@
 
 import Hapi from 'hapi';
 import { isFunction } from 'lodash/fp';
-import { DETECTION_ENGINE_RULES_URL } from '../../../../common/constants';
-import { getIdError, transformOrError, transformError } from './utils';
+import { DETECTION_ENGINE_RULES_URL } from '../../../../../common/constants';
+import { getIdError, transformOrError } from './utils';
+import { transformError } from '../utils';
 
-import { readRules } from '../alerts/read_rules';
-import { ServerFacade } from '../../../types';
-import { queryRulesSchema } from './schemas';
-import { QueryRequest } from '../alerts/types';
+import { readRules } from '../../rules/read_rules';
+import { ServerFacade } from '../../../../types';
+import { queryRulesSchema } from '../schemas/query_rules_schema';
+import { QueryRequest } from './types';
 
 export const createReadRulesRoute: Hapi.ServerRoute = {
   method: 'GET',
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/types.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/types.ts
new file mode 100644
index 0000000000000..f6878c9edc9b8
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/types.ts
@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { RequestFacade } from '../../../../types';
+
+export type QueryRequest = Omit<RequestFacade, 'query'> & {
+  query: { id: string | undefined; rule_id: string | undefined };
+};
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/update_rules_route.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/update_rules_route.test.ts
similarity index 97%
rename from x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/update_rules_route.test.ts
rename to x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/update_rules_route.test.ts
index dfa1275a6b26b..3cf5c07655d92 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/update_rules_route.test.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/update_rules_route.test.ts
@@ -9,7 +9,7 @@ import {
   createMockServerWithoutActionClientDecoration,
   createMockServerWithoutAlertClientDecoration,
   createMockServerWithoutActionOrAlertClientDecoration,
-} from './__mocks__/_mock_server';
+} from '../__mocks__/_mock_server';
 
 import { updateRulesRoute } from './update_rules_route';
 import { ServerInjectOptions } from 'hapi';
@@ -20,8 +20,8 @@ import {
   getUpdateRequest,
   typicalPayload,
   getFindResultWithSingleHit,
-} from './__mocks__/request_responses';
-import { DETECTION_ENGINE_RULES_URL } from '../../../../common/constants';
+} from '../__mocks__/request_responses';
+import { DETECTION_ENGINE_RULES_URL } from '../../../../../common/constants';
 
 describe('update_rules', () => {
   let { server, alertsClient, actionsClient } = createMockServer();
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/update_rules_route.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/update_rules_route.ts
similarity index 84%
rename from x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/update_rules_route.ts
rename to x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/update_rules_route.ts
index 943c41fd6dea6..2e7b48afbb5d9 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/update_rules_route.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/update_rules_route.ts
@@ -6,12 +6,13 @@
 
 import Hapi from 'hapi';
 import { isFunction } from 'lodash/fp';
-import { DETECTION_ENGINE_RULES_URL } from '../../../../common/constants';
-import { updateRules } from '../alerts/update_rules';
-import { UpdateRulesRequest } from '../alerts/types';
-import { updateRulesSchema } from './schemas';
-import { ServerFacade } from '../../../types';
-import { getIdError, transformOrError, transformError } from './utils';
+import { DETECTION_ENGINE_RULES_URL } from '../../../../../common/constants';
+import { updateRules } from '../../rules/update_rules';
+import { UpdateRulesRequest } from '../../rules/types';
+import { updateRulesSchema } from '../schemas/update_rules_schema';
+import { ServerFacade } from '../../../../types';
+import { getIdError, transformOrError } from './utils';
+import { transformError } from '../utils';
 
 export const createUpdateRulesRoute: Hapi.ServerRoute = {
   method: 'PUT',
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/utils.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/utils.test.ts
new file mode 100644
index 0000000000000..d4e129f543ccf
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/utils.test.ts
@@ -0,0 +1,496 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import Boom from 'boom';
+
+import {
+  transformAlertToRule,
+  getIdError,
+  transformFindAlertsOrError,
+  transformOrError,
+} from './utils';
+import { getResult } from '../__mocks__/request_responses';
+
+describe('utils', () => {
+  describe('transformAlertToRule', () => {
+    test('should work with a full data set', () => {
+      const fullRule = getResult();
+      const rule = transformAlertToRule(fullRule);
+      expect(rule).toEqual({
+        created_by: 'elastic',
+        description: 'Detecting root and admin users',
+        enabled: true,
+        false_positives: [],
+        from: 'now-6m',
+        id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
+        immutable: false,
+        index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
+        interval: '5m',
+        risk_score: 50,
+        rule_id: 'rule-1',
+        language: 'kuery',
+        max_signals: 100,
+        name: 'Detect Root/Admin Users',
+        output_index: '.siem-signals',
+        query: 'user.name: root or user.name: admin',
+        references: ['http://www.example.com', 'https://ww.example.com'],
+        severity: 'high',
+        updated_by: 'elastic',
+        tags: [],
+        threats: [
+          {
+            framework: 'MITRE ATT&CK',
+            tactic: {
+              id: 'TA0040',
+              name: 'impact',
+              reference: 'https://attack.mitre.org/tactics/TA0040/',
+            },
+            techniques: [
+              {
+                id: 'T1499',
+                name: 'endpoint denial of service',
+                reference: 'https://attack.mitre.org/techniques/T1499/',
+              },
+            ],
+          },
+        ],
+        to: 'now',
+        type: 'query',
+      });
+    });
+
+    test('should work with a partial data set missing data', () => {
+      const fullRule = getResult();
+      const { from, language, ...omitData } = transformAlertToRule(fullRule);
+      expect(omitData).toEqual({
+        created_by: 'elastic',
+        description: 'Detecting root and admin users',
+        enabled: true,
+        false_positives: [],
+        id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
+        immutable: false,
+        index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
+        output_index: '.siem-signals',
+        interval: '5m',
+        risk_score: 50,
+        rule_id: 'rule-1',
+        max_signals: 100,
+        name: 'Detect Root/Admin Users',
+        query: 'user.name: root or user.name: admin',
+        references: ['http://www.example.com', 'https://ww.example.com'],
+        severity: 'high',
+        updated_by: 'elastic',
+        tags: [],
+        threats: [
+          {
+            framework: 'MITRE ATT&CK',
+            tactic: {
+              id: 'TA0040',
+              name: 'impact',
+              reference: 'https://attack.mitre.org/tactics/TA0040/',
+            },
+            techniques: [
+              {
+                id: 'T1499',
+                name: 'endpoint denial of service',
+                reference: 'https://attack.mitre.org/techniques/T1499/',
+              },
+            ],
+          },
+        ],
+        to: 'now',
+        type: 'query',
+      });
+    });
+
+    test('should omit query if query is null', () => {
+      const fullRule = getResult();
+      fullRule.params.query = null;
+      const rule = transformAlertToRule(fullRule);
+      expect(rule).toEqual({
+        created_by: 'elastic',
+        description: 'Detecting root and admin users',
+        enabled: true,
+        false_positives: [],
+        from: 'now-6m',
+        id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
+        immutable: false,
+        index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
+        output_index: '.siem-signals',
+        interval: '5m',
+        risk_score: 50,
+        rule_id: 'rule-1',
+        language: 'kuery',
+        max_signals: 100,
+        name: 'Detect Root/Admin Users',
+        references: ['http://www.example.com', 'https://ww.example.com'],
+        severity: 'high',
+        updated_by: 'elastic',
+        tags: [],
+        threats: [
+          {
+            framework: 'MITRE ATT&CK',
+            tactic: {
+              id: 'TA0040',
+              name: 'impact',
+              reference: 'https://attack.mitre.org/tactics/TA0040/',
+            },
+            techniques: [
+              {
+                id: 'T1499',
+                name: 'endpoint denial of service',
+                reference: 'https://attack.mitre.org/techniques/T1499/',
+              },
+            ],
+          },
+        ],
+        to: 'now',
+        type: 'query',
+      });
+    });
+
+    test('should omit query if query is undefined', () => {
+      const fullRule = getResult();
+      fullRule.params.query = undefined;
+      const rule = transformAlertToRule(fullRule);
+      expect(rule).toEqual({
+        created_by: 'elastic',
+        description: 'Detecting root and admin users',
+        enabled: true,
+        false_positives: [],
+        from: 'now-6m',
+        id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
+        immutable: false,
+        index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
+        output_index: '.siem-signals',
+        interval: '5m',
+        rule_id: 'rule-1',
+        risk_score: 50,
+        language: 'kuery',
+        max_signals: 100,
+        name: 'Detect Root/Admin Users',
+        references: ['http://www.example.com', 'https://ww.example.com'],
+        severity: 'high',
+        updated_by: 'elastic',
+        tags: [],
+        threats: [
+          {
+            framework: 'MITRE ATT&CK',
+            tactic: {
+              id: 'TA0040',
+              name: 'impact',
+              reference: 'https://attack.mitre.org/tactics/TA0040/',
+            },
+            techniques: [
+              {
+                id: 'T1499',
+                name: 'endpoint denial of service',
+                reference: 'https://attack.mitre.org/techniques/T1499/',
+              },
+            ],
+          },
+        ],
+        to: 'now',
+        type: 'query',
+      });
+    });
+
+    test('should omit a mix of undefined, null, and missing fields', () => {
+      const fullRule = getResult();
+      fullRule.params.query = undefined;
+      fullRule.params.language = null;
+      const { from, enabled, ...omitData } = transformAlertToRule(fullRule);
+      expect(omitData).toEqual({
+        created_by: 'elastic',
+        description: 'Detecting root and admin users',
+        false_positives: [],
+        id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
+        immutable: false,
+        output_index: '.siem-signals',
+        index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
+        interval: '5m',
+        rule_id: 'rule-1',
+        risk_score: 50,
+        max_signals: 100,
+        name: 'Detect Root/Admin Users',
+        references: ['http://www.example.com', 'https://ww.example.com'],
+        severity: 'high',
+        updated_by: 'elastic',
+        tags: [],
+        threats: [
+          {
+            framework: 'MITRE ATT&CK',
+            tactic: {
+              id: 'TA0040',
+              name: 'impact',
+              reference: 'https://attack.mitre.org/tactics/TA0040/',
+            },
+            techniques: [
+              {
+                id: 'T1499',
+                name: 'endpoint denial of service',
+                reference: 'https://attack.mitre.org/techniques/T1499/',
+              },
+            ],
+          },
+        ],
+        to: 'now',
+        type: 'query',
+      });
+    });
+
+    test('should return enabled is equal to false', () => {
+      const fullRule = getResult();
+      fullRule.enabled = false;
+      const ruleWithEnabledFalse = transformAlertToRule(fullRule);
+      expect(ruleWithEnabledFalse).toEqual({
+        created_by: 'elastic',
+        description: 'Detecting root and admin users',
+        enabled: false,
+        from: 'now-6m',
+        false_positives: [],
+        id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
+        immutable: false,
+        output_index: '.siem-signals',
+        index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
+        interval: '5m',
+        language: 'kuery',
+        risk_score: 50,
+        rule_id: 'rule-1',
+        max_signals: 100,
+        name: 'Detect Root/Admin Users',
+        query: 'user.name: root or user.name: admin',
+        references: ['http://www.example.com', 'https://ww.example.com'],
+        severity: 'high',
+        updated_by: 'elastic',
+        tags: [],
+        threats: [
+          {
+            framework: 'MITRE ATT&CK',
+            tactic: {
+              id: 'TA0040',
+              name: 'impact',
+              reference: 'https://attack.mitre.org/tactics/TA0040/',
+            },
+            techniques: [
+              {
+                id: 'T1499',
+                name: 'endpoint denial of service',
+                reference: 'https://attack.mitre.org/techniques/T1499/',
+              },
+            ],
+          },
+        ],
+        to: 'now',
+        type: 'query',
+      });
+    });
+
+    test('should return immutable is equal to false', () => {
+      const fullRule = getResult();
+      fullRule.params.immutable = false;
+      const ruleWithEnabledFalse = transformAlertToRule(fullRule);
+      expect(ruleWithEnabledFalse).toEqual({
+        created_by: 'elastic',
+        description: 'Detecting root and admin users',
+        enabled: true,
+        from: 'now-6m',
+        false_positives: [],
+        id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
+        immutable: false,
+        output_index: '.siem-signals',
+        index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
+        interval: '5m',
+        language: 'kuery',
+        risk_score: 50,
+        rule_id: 'rule-1',
+        max_signals: 100,
+        name: 'Detect Root/Admin Users',
+        query: 'user.name: root or user.name: admin',
+        references: ['http://www.example.com', 'https://ww.example.com'],
+        severity: 'high',
+        updated_by: 'elastic',
+        tags: [],
+        threats: [
+          {
+            framework: 'MITRE ATT&CK',
+            tactic: {
+              id: 'TA0040',
+              name: 'impact',
+              reference: 'https://attack.mitre.org/tactics/TA0040/',
+            },
+            techniques: [
+              {
+                id: 'T1499',
+                name: 'endpoint denial of service',
+                reference: 'https://attack.mitre.org/techniques/T1499/',
+              },
+            ],
+          },
+        ],
+        to: 'now',
+        type: 'query',
+      });
+    });
+  });
+
+  describe('getIdError', () => {
+    test('outputs message about id not being found if only id is defined and ruleId is undefined', () => {
+      const boom = getIdError({ id: '123', ruleId: undefined });
+      expect(boom.message).toEqual('id: "123" not found');
+    });
+
+    test('outputs message about id not being found if only id is defined and ruleId is null', () => {
+      const boom = getIdError({ id: '123', ruleId: null });
+      expect(boom.message).toEqual('id: "123" not found');
+    });
+
+    test('outputs message about ruleId not being found if only ruleId is defined and id is undefined', () => {
+      const boom = getIdError({ id: undefined, ruleId: 'rule-id-123' });
+      expect(boom.message).toEqual('rule_id: "rule-id-123" not found');
+    });
+
+    test('outputs message about ruleId not being found if only ruleId is defined and id is null', () => {
+      const boom = getIdError({ id: null, ruleId: 'rule-id-123' });
+      expect(boom.message).toEqual('rule_id: "rule-id-123" not found');
+    });
+
+    test('outputs message about both being not defined when both are undefined', () => {
+      const boom = getIdError({ id: undefined, ruleId: undefined });
+      expect(boom.message).toEqual('id or rule_id should have been defined');
+    });
+
+    test('outputs message about both being not defined when both are null', () => {
+      const boom = getIdError({ id: null, ruleId: null });
+      expect(boom.message).toEqual('id or rule_id should have been defined');
+    });
+
+    test('outputs message about both being not defined when id is null and ruleId is undefined', () => {
+      const boom = getIdError({ id: null, ruleId: undefined });
+      expect(boom.message).toEqual('id or rule_id should have been defined');
+    });
+
+    test('outputs message about both being not defined when id is undefined and ruleId is null', () => {
+      const boom = getIdError({ id: undefined, ruleId: null });
+      expect(boom.message).toEqual('id or rule_id should have been defined');
+    });
+  });
+
+  describe('transformFindAlertsOrError', () => {
+    test('outputs empty data set when data set is empty correct', () => {
+      const output = transformFindAlertsOrError({ data: [] });
+      expect(output).toEqual({ data: [] });
+    });
+
+    test('outputs 200 if the data is of type siem alert', () => {
+      const output = transformFindAlertsOrError({
+        data: [getResult()],
+      });
+      expect(output).toEqual({
+        data: [
+          {
+            created_by: 'elastic',
+            description: 'Detecting root and admin users',
+            enabled: true,
+            false_positives: [],
+            from: 'now-6m',
+            id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
+            immutable: false,
+            output_index: '.siem-signals',
+            index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
+            interval: '5m',
+            risk_score: 50,
+            rule_id: 'rule-1',
+            language: 'kuery',
+            max_signals: 100,
+            name: 'Detect Root/Admin Users',
+            query: 'user.name: root or user.name: admin',
+            references: ['http://www.example.com', 'https://ww.example.com'],
+            severity: 'high',
+            updated_by: 'elastic',
+            tags: [],
+            to: 'now',
+            type: 'query',
+            threats: [
+              {
+                framework: 'MITRE ATT&CK',
+                tactic: {
+                  id: 'TA0040',
+                  name: 'impact',
+                  reference: 'https://attack.mitre.org/tactics/TA0040/',
+                },
+                techniques: [
+                  {
+                    id: 'T1499',
+                    name: 'endpoint denial of service',
+                    reference: 'https://attack.mitre.org/techniques/T1499/',
+                  },
+                ],
+              },
+            ],
+          },
+        ],
+      });
+    });
+
+    test('returns 500 if the data is not of type siem alert', () => {
+      const output = transformFindAlertsOrError({ data: [{ random: 1 }] });
+      expect((output as Boom).message).toEqual('Internal error transforming');
+    });
+  });
+
+  describe('transformOrError', () => {
+    test('outputs 200 if the data is of type siem alert', () => {
+      const output = transformOrError(getResult());
+      expect(output).toEqual({
+        created_by: 'elastic',
+        description: 'Detecting root and admin users',
+        enabled: true,
+        false_positives: [],
+        from: 'now-6m',
+        id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
+        immutable: false,
+        output_index: '.siem-signals',
+        index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
+        interval: '5m',
+        rule_id: 'rule-1',
+        risk_score: 50,
+        language: 'kuery',
+        max_signals: 100,
+        name: 'Detect Root/Admin Users',
+        query: 'user.name: root or user.name: admin',
+        references: ['http://www.example.com', 'https://ww.example.com'],
+        severity: 'high',
+        updated_by: 'elastic',
+        tags: [],
+        to: 'now',
+        type: 'query',
+        threats: [
+          {
+            framework: 'MITRE ATT&CK',
+            tactic: {
+              id: 'TA0040',
+              name: 'impact',
+              reference: 'https://attack.mitre.org/tactics/TA0040/',
+            },
+            techniques: [
+              {
+                id: 'T1499',
+                name: 'endpoint denial of service',
+                reference: 'https://attack.mitre.org/techniques/T1499/',
+              },
+            ],
+          },
+        ],
+      });
+    });
+
+    test('returns 500 if the data is not of type siem alert', () => {
+      const output = transformOrError({ data: [{ random: 1 }] });
+      expect((output as Boom).message).toEqual('Internal error transforming');
+    });
+  });
+});
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/utils.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/utils.ts
new file mode 100644
index 0000000000000..c9ae3abdfdc6b
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/utils.ts
@@ -0,0 +1,76 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import Boom from 'boom';
+import { pickBy } from 'lodash/fp';
+import { RuleAlertType, isAlertType, isAlertTypes } from '../../rules/types';
+import { OutputRuleAlertRest } from '../../types';
+
+export const getIdError = ({
+  id,
+  ruleId,
+}: {
+  id: string | undefined | null;
+  ruleId: string | undefined | null;
+}) => {
+  if (id != null) {
+    return new Boom(`id: "${id}" not found`, { statusCode: 404 });
+  } else if (ruleId != null) {
+    return new Boom(`rule_id: "${ruleId}" not found`, { statusCode: 404 });
+  } else {
+    return new Boom(`id or rule_id should have been defined`, { statusCode: 404 });
+  }
+};
+
+// Transforms the data but will remove any null or undefined it encounters and not include
+// those on the export
+export const transformAlertToRule = (alert: RuleAlertType): Partial<OutputRuleAlertRest> => {
+  return pickBy<OutputRuleAlertRest>((value: unknown) => value != null, {
+    created_by: alert.createdBy,
+    description: alert.params.description,
+    enabled: alert.enabled,
+    false_positives: alert.params.falsePositives,
+    filters: alert.params.filters,
+    from: alert.params.from,
+    id: alert.id,
+    immutable: alert.params.immutable,
+    index: alert.params.index,
+    interval: alert.interval,
+    rule_id: alert.params.ruleId,
+    language: alert.params.language,
+    output_index: alert.params.outputIndex,
+    max_signals: alert.params.maxSignals,
+    risk_score: alert.params.riskScore,
+    name: alert.name,
+    query: alert.params.query,
+    references: alert.params.references,
+    saved_id: alert.params.savedId,
+    meta: alert.params.meta,
+    severity: alert.params.severity,
+    updated_by: alert.updatedBy,
+    tags: alert.tags,
+    to: alert.params.to,
+    type: alert.params.type,
+    threats: alert.params.threats,
+  });
+};
+
+export const transformFindAlertsOrError = (findResults: { data: unknown[] }): unknown | Boom => {
+  if (isAlertTypes(findResults.data)) {
+    findResults.data = findResults.data.map(alert => transformAlertToRule(alert));
+    return findResults;
+  } else {
+    return new Boom('Internal error transforming', { statusCode: 500 });
+  }
+};
+
+export const transformOrError = (alert: unknown): Partial<OutputRuleAlertRest> | Boom => {
+  if (isAlertType(alert)) {
+    return transformAlertToRule(alert);
+  } else {
+    return new Boom('Internal error transforming', { statusCode: 500 });
+  }
+};
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas.test.ts
deleted file mode 100644
index f5147bc5a8f8b..0000000000000
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas.test.ts
+++ /dev/null
@@ -1,2133 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import {
-  createRulesSchema,
-  updateRulesSchema,
-  findRulesSchema,
-  queryRulesSchema,
-  setSignalsStatusSchema,
-} from './schemas';
-import {
-  RuleAlertParamsRest,
-  FindParamsRest,
-  UpdateRuleAlertParamsRest,
-  ThreatParams,
-  SignalsRestParams,
-} from '../alerts/types';
-
-describe('schemas', () => {
-  describe('create rules schema', () => {
-    test('empty objects do not validate', () => {
-      expect(createRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({}).error).toBeTruthy();
-    });
-
-    test('made up values do not validate', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest & { madeUp: string }>>({
-          madeUp: 'hi',
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('[rule_id] does not validate', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('[rule_id, description] does not validate', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          description: 'some description',
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('[rule_id, description, from] does not validate', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('[rule_id, description, from, to] does not validate', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('[rule_id, description, from, to, name] does not validate', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          name: 'some-name',
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('[rule_id, description, from, to, name, severity] does not validate', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          name: 'some-name',
-          severity: 'severity',
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('[rule_id, description, from, to, name, severity, type] does not validate', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          name: 'some-name',
-          severity: 'severity',
-          type: 'query',
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('[rule_id, description, from, to, name, severity, type, interval] does not validate', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('[rule_id, description, from, to, name, severity, type, interval, index] does not validate', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          name: 'some-name',
-          severity: 'severity',
-          type: 'query',
-          interval: '5m',
-          index: ['index-1'],
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('[rule_id, description, from, to, name, severity, type, query, index, interval] does validate', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          risk_score: 50,
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          name: 'some-name',
-          severity: 'severity',
-          type: 'query',
-          query: 'some query',
-          index: ['index-1'],
-          interval: '5m',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('[rule_id, description, from, to, index, name, severity, interval, type, query, language] does not validate', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          query: 'some query',
-          language: 'kuery',
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('[rule_id, description, from, to, index, name, severity, interval, type, query, language, risk_score] does validate', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          risk_score: 50,
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          query: 'some query',
-          language: 'kuery',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('[rule_id, description, from, to, index, name, severity, interval, type, query, language, risk_score, output_index] does validate', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          output_index: '.siem-signals',
-          risk_score: 50,
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          query: 'some query',
-          language: 'kuery',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('[rule_id, description, from, to, index, name, severity, interval, type, filter, risk_score] does validate', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          risk_score: 50,
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('[rule_id, description, from, to, index, name, severity, interval, type, filter, risk_score, output_index] does validate', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          output_index: '.siem-signals',
-          risk_score: 50,
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-        }).error
-      ).toBeFalsy();
-    });
-    test('You can send in an empty array to threats', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          output_index: '.siem-signals',
-          risk_score: 50,
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          references: ['index-1'],
-          query: 'some query',
-          language: 'kuery',
-          max_signals: 1,
-          threats: [],
-        }).error
-      ).toBeFalsy();
-    });
-    test('[rule_id, description, from, to, index, name, severity, interval, type, filter, risk_score, output_index, threats] does validate', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          output_index: '.siem-signals',
-          risk_score: 50,
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          threats: [
-            {
-              framework: 'someFramework',
-              tactic: {
-                id: 'fakeId',
-                name: 'fakeName',
-                reference: 'fakeRef',
-              },
-              techniques: [
-                {
-                  id: 'techniqueId',
-                  name: 'techniqueName',
-                  reference: 'techniqueRef',
-                },
-              ],
-            },
-          ],
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('allows references to be sent as valid', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          output_index: '.siem-signals',
-          risk_score: 50,
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          references: ['index-1'],
-          query: 'some query',
-          language: 'kuery',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('defaults references to an array', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          output_index: '.siem-signals',
-          risk_score: 50,
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          query: 'some-query',
-          language: 'kuery',
-        }).value.references
-      ).toEqual([]);
-    });
-
-    test('references cannot be numbers', () => {
-      expect(
-        createRulesSchema.validate<
-          Partial<Omit<RuleAlertParamsRest, 'references'>> & { references: number[] }
-        >({
-          rule_id: 'rule-1',
-          output_index: '.siem-signals',
-          risk_score: 50,
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          query: 'some-query',
-          language: 'kuery',
-          references: [5],
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('indexes cannot be numbers', () => {
-      expect(
-        createRulesSchema.validate<
-          Partial<Omit<RuleAlertParamsRest, 'index'>> & { index: number[] }
-        >({
-          rule_id: 'rule-1',
-          output_index: '.siem-signals',
-          risk_score: 50,
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: [5],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          query: 'some-query',
-          language: 'kuery',
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('defaults interval to 5 min', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          output_index: '.siem-signals',
-          risk_score: 50,
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          type: 'query',
-        }).value.interval
-      ).toEqual('5m');
-    });
-
-    test('defaults max signals to 100', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          output_index: '.siem-signals',
-          risk_score: 50,
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-        }).value.max_signals
-      ).toEqual(100);
-    });
-
-    test('saved_id is required when type is saved_query and will not validate without out', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          output_index: '.siem-signals',
-          risk_score: 50,
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'saved_query',
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('saved_id is required when type is saved_query and validates with it', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          risk_score: 50,
-          output_index: '.siem-signals',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'saved_query',
-          saved_id: 'some id',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('saved_query type can have filters with it', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          output_index: '.siem-signals',
-          risk_score: 50,
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'saved_query',
-          saved_id: 'some id',
-          filters: [],
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('filters cannot be a string', () => {
-      expect(
-        createRulesSchema.validate<
-          Partial<Omit<RuleAlertParamsRest, 'filters'> & { filters: string }>
-        >({
-          rule_id: 'rule-1',
-          output_index: '.siem-signals',
-          risk_score: 50,
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'saved_query',
-          saved_id: 'some id',
-          filters: 'some string',
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('language validates with kuery', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          output_index: '.siem-signals',
-          risk_score: 50,
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          references: ['index-1'],
-          query: 'some query',
-          language: 'kuery',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('language validates with lucene', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          risk_score: 50,
-          output_index: '.siem-signals',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          references: ['index-1'],
-          query: 'some query',
-          language: 'lucene',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('language does not validate with something made up', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          output_index: '.siem-signals',
-          risk_score: 50,
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          references: ['index-1'],
-          query: 'some query',
-          language: 'something-made-up',
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('max_signals cannot be negative', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          output_index: '.siem-signals',
-          risk_score: 50,
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          references: ['index-1'],
-          query: 'some query',
-          language: 'kuery',
-          max_signals: -1,
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('max_signals cannot be zero', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          output_index: '.siem-signals',
-          risk_score: 50,
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          references: ['index-1'],
-          query: 'some query',
-          language: 'kuery',
-          max_signals: 0,
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('max_signals can be 1', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          output_index: '.siem-signals',
-          risk_score: 50,
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          references: ['index-1'],
-          query: 'some query',
-          language: 'kuery',
-          max_signals: 1,
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('You can optionally send in an array of tags', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          output_index: '.siem-signals',
-          risk_score: 50,
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          references: ['index-1'],
-          query: 'some query',
-          language: 'kuery',
-          max_signals: 1,
-          tags: ['tag_1', 'tag_2'],
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('You cannot send in an array of tags that are numbers', () => {
-      expect(
-        createRulesSchema.validate<Partial<Omit<RuleAlertParamsRest, 'tags'>> & { tags: number[] }>(
-          {
-            rule_id: 'rule-1',
-            output_index: '.siem-signals',
-            risk_score: 50,
-            description: 'some description',
-            from: 'now-5m',
-            to: 'now',
-            index: ['index-1'],
-            name: 'some-name',
-            severity: 'severity',
-            interval: '5m',
-            type: 'query',
-            references: ['index-1'],
-            query: 'some query',
-            language: 'kuery',
-            max_signals: 1,
-            tags: [0, 1, 2],
-          }
-        ).error
-      ).toBeTruthy();
-    });
-
-    test('You cannot send in an array of threats that are missing "framework"', () => {
-      expect(
-        createRulesSchema.validate<
-          Partial<Omit<RuleAlertParamsRest, 'threats'>> & {
-            threats: Array<Partial<Omit<ThreatParams, 'framework'>>>;
-          }
-        >({
-          rule_id: 'rule-1',
-          output_index: '.siem-signals',
-          risk_score: 50,
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          references: ['index-1'],
-          query: 'some query',
-          language: 'kuery',
-          max_signals: 1,
-          threats: [
-            {
-              tactic: {
-                id: 'fakeId',
-                name: 'fakeName',
-                reference: 'fakeRef',
-              },
-              techniques: [
-                {
-                  id: 'techniqueId',
-                  name: 'techniqueName',
-                  reference: 'techniqueRef',
-                },
-              ],
-            },
-          ],
-        }).error
-      ).toBeTruthy();
-    });
-    test('You cannot send in an array of threats that are missing "tactic"', () => {
-      expect(
-        createRulesSchema.validate<
-          Partial<Omit<RuleAlertParamsRest, 'threats'>> & {
-            threats: Array<Partial<Omit<ThreatParams, 'tactic'>>>;
-          }
-        >({
-          rule_id: 'rule-1',
-          output_index: '.siem-signals',
-          risk_score: 50,
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          references: ['index-1'],
-          query: 'some query',
-          language: 'kuery',
-          max_signals: 1,
-          threats: [
-            {
-              framework: 'fake',
-              techniques: [
-                {
-                  id: 'techniqueId',
-                  name: 'techniqueName',
-                  reference: 'techniqueRef',
-                },
-              ],
-            },
-          ],
-        }).error
-      ).toBeTruthy();
-    });
-    test('You cannot send in an array of threats that are missing "techniques"', () => {
-      expect(
-        createRulesSchema.validate<
-          Partial<Omit<RuleAlertParamsRest, 'threats'>> & {
-            threats: Array<Partial<Omit<ThreatParams, 'technique'>>>;
-          }
-        >({
-          rule_id: 'rule-1',
-          output_index: '.siem-signals',
-          risk_score: 50,
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          references: ['index-1'],
-          query: 'some query',
-          language: 'kuery',
-          max_signals: 1,
-          threats: [
-            {
-              framework: 'fake',
-              tactic: {
-                id: 'fakeId',
-                name: 'fakeName',
-                reference: 'fakeRef',
-              },
-            },
-          ],
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('You can optionally send in an array of false positives', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          output_index: '.siem-signals',
-          risk_score: 50,
-          description: 'some description',
-          false_positives: ['false_1', 'false_2'],
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          references: ['index-1'],
-          query: 'some query',
-          language: 'kuery',
-          max_signals: 1,
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('You cannot send in an array of false positives that are numbers', () => {
-      expect(
-        createRulesSchema.validate<
-          Partial<Omit<RuleAlertParamsRest, 'false_positives'>> & { false_positives: number[] }
-        >({
-          rule_id: 'rule-1',
-          output_index: '.siem-signals',
-          risk_score: 50,
-          description: 'some description',
-          false_positives: [5, 4],
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          references: ['index-1'],
-          query: 'some query',
-          language: 'kuery',
-          max_signals: 1,
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('You can optionally set the immutable to be true', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          output_index: '.siem-signals',
-          risk_score: 50,
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          immutable: true,
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          references: ['index-1'],
-          query: 'some query',
-          language: 'kuery',
-          max_signals: 1,
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('You cannot set the immutable to be a number', () => {
-      expect(
-        createRulesSchema.validate<
-          Partial<Omit<RuleAlertParamsRest, 'immutable'>> & { immutable: number }
-        >({
-          rule_id: 'rule-1',
-          output_index: '.siem-signals',
-          risk_score: 50,
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          immutable: 5,
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          references: ['index-1'],
-          query: 'some query',
-          language: 'kuery',
-          max_signals: 1,
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('You cannot set the risk_score to 101', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          output_index: '.siem-signals',
-          risk_score: 101,
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          immutable: true,
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          references: ['index-1'],
-          query: 'some query',
-          language: 'kuery',
-          max_signals: 1,
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('You cannot set the risk_score to -1', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          output_index: '.siem-signals',
-          risk_score: -1,
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          immutable: true,
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          references: ['index-1'],
-          query: 'some query',
-          language: 'kuery',
-          max_signals: 1,
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('You can set the risk_score to 0', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          output_index: '.siem-signals',
-          risk_score: 0,
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          immutable: true,
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          references: ['index-1'],
-          query: 'some query',
-          language: 'kuery',
-          max_signals: 1,
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('You can set the risk_score to 100', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          output_index: '.siem-signals',
-          risk_score: 100,
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          immutable: true,
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          references: ['index-1'],
-          query: 'some query',
-          language: 'kuery',
-          max_signals: 1,
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('You can set meta to any object you want', () => {
-      expect(
-        createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          output_index: '.siem-signals',
-          risk_score: 50,
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          immutable: true,
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          references: ['index-1'],
-          query: 'some query',
-          language: 'kuery',
-          max_signals: 1,
-          meta: {
-            somethingMadeUp: { somethingElse: true },
-          },
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('You cannot create meta as a string', () => {
-      expect(
-        createRulesSchema.validate<Partial<Omit<RuleAlertParamsRest, 'meta'> & { meta: string }>>({
-          rule_id: 'rule-1',
-          output_index: '.siem-signals',
-          risk_score: 50,
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          immutable: true,
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          references: ['index-1'],
-          query: 'some query',
-          language: 'kuery',
-          max_signals: 1,
-          meta: 'should not work',
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('You can omit the query string when filters are present', () => {
-      expect(
-        createRulesSchema.validate<Partial<Omit<RuleAlertParamsRest, 'meta'> & { meta: string }>>({
-          rule_id: 'rule-1',
-          output_index: '.siem-signals',
-          risk_score: 50,
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          immutable: true,
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          references: ['index-1'],
-          language: 'kuery',
-          filters: [],
-          max_signals: 1,
-        }).error
-      ).toBeFalsy();
-    });
-  });
-
-  describe('update rules schema', () => {
-    test('empty objects do not validate as they require at least id or rule_id', () => {
-      expect(updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({}).error).toBeTruthy();
-    });
-
-    test('made up values do not validate', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest & { madeUp: string }>>({
-          madeUp: 'hi',
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('[id] does validate', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          id: 'rule-1',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('[rule_id] does validate', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('[id and rule_id] does not validate', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          id: 'id-1',
-          rule_id: 'rule-1',
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('[rule_id, description] does validate', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          description: 'some description',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('[id, description] does validate', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          id: 'rule-1',
-          description: 'some description',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('[id, risk_score] does validate', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          id: 'rule-1',
-          risk_score: 10,
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('[rule_id, description, from] does validate', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('[id, description, from] does validate', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('[rule_id, description, from, to] does validate', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('[id, description, from, to] does validate', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('[rule_id, description, from, to, name] does validate', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          name: 'some-name',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('[id, description, from, to, name] does validate', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          name: 'some-name',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('[rule_id, description, from, to, name, severity] does validate', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          name: 'some-name',
-          severity: 'severity',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('[id, description, from, to, name, severity] does validate', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          name: 'some-name',
-          severity: 'severity',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('[rule_id, description, from, to, name, severity, type] does validate', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          name: 'some-name',
-          severity: 'severity',
-          type: 'query',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('[id, description, from, to, name, severity, type] does validate', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          name: 'some-name',
-          severity: 'severity',
-          type: 'query',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('[rule_id, description, from, to, name, severity, type, interval] does validate', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('[id, description, from, to, name, severity, type, interval] does validate', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('[rule_id, description, from, to, index, name, severity, interval, type] does validate', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('[id, description, from, to, index, name, severity, interval, type] does validate', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('[rule_id, description, from, to, index, name, severity, interval, type, query] does validate', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          query: 'some query',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('[id, description, from, to, index, name, severity, interval, type, query] does validate', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          query: 'some query',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('[rule_id, description, from, to, index, name, severity, interval, type, query, language] does validate', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          query: 'some query',
-          language: 'kuery',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('[id, description, from, to, index, name, severity, interval, type, query, language] does validate', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          query: 'some query',
-          language: 'kuery',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('[rule_id, description, from, to, index, name, severity, type, filter] does validate', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          rule_id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('[id, description, from, to, index, name, severity, type, filter] does validate', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('allows references to be sent as a valid value to update with', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          references: ['index-1'],
-          query: 'some query',
-          language: 'kuery',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('does not default references to an array', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          query: 'some-query',
-          language: 'kuery',
-        }).value.references
-      ).toEqual(undefined);
-    });
-
-    test('does not default interval', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          type: 'query',
-        }).value.interval
-      ).toEqual(undefined);
-    });
-
-    test('does not default max signal', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-        }).value.max_signals
-      ).toEqual(undefined);
-    });
-
-    test('references cannot be numbers', () => {
-      expect(
-        updateRulesSchema.validate<
-          Partial<Omit<UpdateRuleAlertParamsRest, 'references'>> & { references: number[] }
-        >({
-          id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          query: 'some-query',
-          language: 'kuery',
-          references: [5],
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('indexes cannot be numbers', () => {
-      expect(
-        updateRulesSchema.validate<
-          Partial<Omit<UpdateRuleAlertParamsRest, 'index'>> & { index: number[] }
-        >({
-          id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: [5],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          query: 'some-query',
-          language: 'kuery',
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('saved_id is not required when type is saved_query and will validate without it', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'saved_query',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('saved_id validates with saved_query', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'saved_query',
-          saved_id: 'some id',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('saved_query type can have filters with it', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'saved_query',
-          saved_id: 'some id',
-          filters: [],
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('language validates with kuery', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          references: ['index-1'],
-          query: 'some query',
-          language: 'kuery',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('language validates with lucene', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          references: ['index-1'],
-          query: 'some query',
-          language: 'lucene',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('language does not validate with something made up', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          references: ['index-1'],
-          query: 'some query',
-          language: 'something-made-up',
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('max_signals cannot be negative', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          references: ['index-1'],
-          query: 'some query',
-          language: 'kuery',
-          max_signals: -1,
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('max_signals cannot be zero', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          references: ['index-1'],
-          query: 'some query',
-          language: 'kuery',
-          max_signals: 0,
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('max_signals can be 1', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          references: ['index-1'],
-          query: 'some query',
-          language: 'kuery',
-          max_signals: 1,
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('meta can be updated', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          id: 'rule-1',
-          meta: { whateverYouWant: 'anything_at_all' },
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('You update meta as a string', () => {
-      expect(
-        updateRulesSchema.validate<
-          Partial<Omit<UpdateRuleAlertParamsRest, 'meta'> & { meta: string }>
-        >({
-          id: 'rule-1',
-          meta: 'should not work',
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('filters cannot be a string', () => {
-      expect(
-        updateRulesSchema.validate<
-          Partial<Omit<UpdateRuleAlertParamsRest, 'filters'> & { filters: string }>
-        >({
-          rule_id: 'rule-1',
-          type: 'query',
-          filters: 'some string',
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('threats is not defaulted to empty array on update', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          references: ['index-1'],
-          query: 'some query',
-          language: 'kuery',
-          max_signals: 1,
-        }).value.threats
-      ).toBe(undefined);
-    });
-
-    test('threats is not defaulted to undefined on update with empty array', () => {
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          references: ['index-1'],
-          query: 'some query',
-          language: 'kuery',
-          max_signals: 1,
-          threats: [],
-        }).value.threats
-      ).toMatchObject([]);
-    });
-    test('threats is valid when updated with all sub-objects', () => {
-      const expected: ThreatParams[] = [
-        {
-          framework: 'fake',
-          tactic: {
-            id: 'fakeId',
-            name: 'fakeName',
-            reference: 'fakeRef',
-          },
-          techniques: [
-            {
-              id: 'techniqueId',
-              name: 'techniqueName',
-              reference: 'techniqueRef',
-            },
-          ],
-        },
-      ];
-      expect(
-        updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
-          id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          references: ['index-1'],
-          query: 'some query',
-          language: 'kuery',
-          max_signals: 1,
-          threats: [
-            {
-              framework: 'fake',
-              tactic: {
-                id: 'fakeId',
-                name: 'fakeName',
-                reference: 'fakeRef',
-              },
-              techniques: [
-                {
-                  id: 'techniqueId',
-                  name: 'techniqueName',
-                  reference: 'techniqueRef',
-                },
-              ],
-            },
-          ],
-        }).value.threats
-      ).toMatchObject(expected);
-    });
-    test('threats is invalid when updated with missing property framework', () => {
-      expect(
-        updateRulesSchema.validate<
-          Partial<Omit<UpdateRuleAlertParamsRest, 'threats'>> & {
-            threats: Array<Partial<Omit<ThreatParams, 'framework'>>>;
-          }
-        >({
-          id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          references: ['index-1'],
-          query: 'some query',
-          language: 'kuery',
-          max_signals: 1,
-          threats: [
-            {
-              tactic: {
-                id: 'fakeId',
-                name: 'fakeName',
-                reference: 'fakeRef',
-              },
-              techniques: [
-                {
-                  id: 'techniqueId',
-                  name: 'techniqueName',
-                  reference: 'techniqueRef',
-                },
-              ],
-            },
-          ],
-        }).error
-      ).toBeTruthy();
-    });
-    test('threats is invalid when updated with missing tactic sub-object', () => {
-      expect(
-        updateRulesSchema.validate<
-          Partial<Omit<UpdateRuleAlertParamsRest, 'threats'>> & {
-            threats: Array<Partial<Omit<ThreatParams, 'tactic'>>>;
-          }
-        >({
-          id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          references: ['index-1'],
-          query: 'some query',
-          language: 'kuery',
-          max_signals: 1,
-          threats: [
-            {
-              framework: 'fake',
-              techniques: [
-                {
-                  id: 'techniqueId',
-                  name: 'techniqueName',
-                  reference: 'techniqueRef',
-                },
-              ],
-            },
-          ],
-        }).error
-      ).toBeTruthy();
-    });
-    test('threats is invalid when updated with missing techniques', () => {
-      expect(
-        updateRulesSchema.validate<
-          Partial<Omit<UpdateRuleAlertParamsRest, 'threats'>> & {
-            threats: Array<Partial<Omit<ThreatParams, 'techniques'>>>;
-          }
-        >({
-          id: 'rule-1',
-          description: 'some description',
-          from: 'now-5m',
-          to: 'now',
-          index: ['index-1'],
-          name: 'some-name',
-          severity: 'severity',
-          interval: '5m',
-          type: 'query',
-          references: ['index-1'],
-          query: 'some query',
-          language: 'kuery',
-          max_signals: 1,
-          threats: [
-            {
-              framework: 'fake',
-              tactic: {
-                id: 'techniqueId',
-                name: 'techniqueName',
-                reference: 'techniqueRef',
-              },
-            },
-          ],
-        }).error
-      ).toBeTruthy();
-    });
-  });
-
-  describe('find rules schema', () => {
-    test('empty objects do validate', () => {
-      expect(findRulesSchema.validate<Partial<FindParamsRest>>({}).error).toBeFalsy();
-    });
-
-    test('all values validate', () => {
-      expect(
-        findRulesSchema.validate<Partial<FindParamsRest>>({
-          per_page: 5,
-          page: 1,
-          sort_field: 'some field',
-          fields: ['field 1', 'field 2'],
-          filter: 'some filter',
-          sort_order: 'asc',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('made up parameters do not validate', () => {
-      expect(
-        findRulesSchema.validate<Partial<FindParamsRest & { madeUp: string }>>({
-          madeUp: 'hi',
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('per_page validates', () => {
-      expect(
-        findRulesSchema.validate<Partial<FindParamsRest>>({ per_page: 5 }).error
-      ).toBeFalsy();
-    });
-
-    test('page validates', () => {
-      expect(
-        findRulesSchema.validate<Partial<FindParamsRest>>({ page: 5 }).error
-      ).toBeFalsy();
-    });
-
-    test('sort_field validates', () => {
-      expect(
-        findRulesSchema.validate<Partial<FindParamsRest>>({ sort_field: 'some value' }).error
-      ).toBeFalsy();
-    });
-
-    test('fields validates with a string', () => {
-      expect(
-        findRulesSchema.validate<Partial<FindParamsRest>>({ fields: ['some value'] }).error
-      ).toBeFalsy();
-    });
-
-    test('fields validates with multiple strings', () => {
-      expect(
-        findRulesSchema.validate<Partial<FindParamsRest>>({
-          fields: ['some value 1', 'some value 2'],
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('fields does not validate with a number', () => {
-      expect(
-        findRulesSchema.validate<Partial<Omit<FindParamsRest, 'fields'>> & { fields: number[] }>({
-          fields: [5],
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('per page has a default of 20', () => {
-      expect(findRulesSchema.validate<Partial<FindParamsRest>>({}).value.per_page).toEqual(20);
-    });
-
-    test('page has a default of 1', () => {
-      expect(findRulesSchema.validate<Partial<FindParamsRest>>({}).value.page).toEqual(1);
-    });
-
-    test('filter works with a string', () => {
-      expect(
-        findRulesSchema.validate<Partial<FindParamsRest>>({
-          filter: 'some value 1',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('filter does not work with a number', () => {
-      expect(
-        findRulesSchema.validate<Partial<Omit<FindParamsRest, 'filter'>> & { filter: number }>({
-          filter: 5,
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('sort_order requires sort_field to work', () => {
-      expect(
-        findRulesSchema.validate<Partial<FindParamsRest>>({
-          sort_order: 'asc',
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('sort_order and sort_field validate together', () => {
-      expect(
-        findRulesSchema.validate<Partial<FindParamsRest>>({
-          sort_order: 'asc',
-          sort_field: 'some field',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('sort_order validates with desc and sort_field', () => {
-      expect(
-        findRulesSchema.validate<Partial<FindParamsRest>>({
-          sort_order: 'desc',
-          sort_field: 'some field',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('sort_order does not validate with a string other than asc and desc', () => {
-      expect(
-        findRulesSchema.validate<
-          Partial<Omit<FindParamsRest, 'sort_order'>> & { sort_order: string }
-        >({
-          sort_order: 'some other string',
-          sort_field: 'some field',
-        }).error
-      ).toBeTruthy();
-    });
-  });
-
-  describe('queryRulesSchema', () => {
-    test('empty objects do not validate', () => {
-      expect(queryRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({}).error).toBeTruthy();
-    });
-
-    test('both rule_id and id being supplied dot not validate', () => {
-      expect(
-        queryRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({ rule_id: '1', id: '1' })
-          .error
-      ).toBeTruthy();
-    });
-
-    test('only id validates', () => {
-      expect(
-        queryRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({ id: '1' }).error
-      ).toBeFalsy();
-    });
-
-    test('only rule_id validates', () => {
-      expect(
-        queryRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({ rule_id: '1' }).error
-      ).toBeFalsy();
-    });
-  });
-
-  describe('set signal status schema', () => {
-    test('signal_ids and status is valid', () => {
-      expect(
-        setSignalsStatusSchema.validate<Partial<SignalsRestParams>>({
-          signal_ids: ['somefakeid'],
-          status: 'open',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('query and status is valid', () => {
-      expect(
-        setSignalsStatusSchema.validate<Partial<SignalsRestParams>>({
-          query: {},
-          status: 'open',
-        }).error
-      ).toBeFalsy();
-    });
-
-    test('signal_ids and missing status is invalid', () => {
-      expect(
-        setSignalsStatusSchema.validate<Partial<SignalsRestParams>>({
-          signal_ids: ['somefakeid'],
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('query and missing status is invalid', () => {
-      expect(
-        setSignalsStatusSchema.validate<Partial<SignalsRestParams>>({
-          query: {},
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('status is present but query or signal_ids is missing is invalid', () => {
-      expect(
-        setSignalsStatusSchema.validate<Partial<SignalsRestParams>>({
-          status: 'closed',
-        }).error
-      ).toBeTruthy();
-    });
-
-    test('signal_ids is present but status has wrong value', () => {
-      expect(
-        setSignalsStatusSchema.validate<
-          Partial<
-            Omit<SignalsRestParams, 'status'> & {
-              status: string;
-            }
-          >
-        >({
-          status: 'fakeVal',
-        }).error
-      ).toBeTruthy();
-    });
-  });
-});
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas.ts
deleted file mode 100644
index 6ed6fdd2577d8..0000000000000
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas.ts
+++ /dev/null
@@ -1,162 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import Joi from 'joi';
-import { DEFAULT_MAX_SIGNALS } from '../../../../common/constants';
-
-/* eslint-disable @typescript-eslint/camelcase */
-const description = Joi.string();
-const enabled = Joi.boolean();
-const false_positives = Joi.array().items(Joi.string());
-const filters = Joi.array();
-const from = Joi.string();
-const immutable = Joi.boolean();
-const rule_id = Joi.string();
-const id = Joi.string();
-const index = Joi.array()
-  .items(Joi.string())
-  .single();
-const interval = Joi.string();
-const query = Joi.string();
-const language = Joi.string().valid('kuery', 'lucene');
-const output_index = Joi.string();
-const saved_id = Joi.string();
-const meta = Joi.object();
-const max_signals = Joi.number().greater(0);
-const name = Joi.string();
-const risk_score = Joi.number()
-  .greater(-1)
-  .less(101);
-const severity = Joi.string();
-const status = Joi.string().valid('open', 'closed');
-const to = Joi.string();
-const type = Joi.string().valid('query', 'saved_query');
-const queryFilter = Joi.string();
-const references = Joi.array()
-  .items(Joi.string())
-  .single();
-const per_page = Joi.number()
-  .min(0)
-  .default(20);
-const page = Joi.number()
-  .min(1)
-  .default(1);
-const signal_ids = Joi.array().items(Joi.string());
-const signal_status_query = Joi.object();
-const sort_field = Joi.string();
-const sort_order = Joi.string().valid('asc', 'desc');
-const tags = Joi.array().items(Joi.string());
-const fields = Joi.array()
-  .items(Joi.string())
-  .single();
-const threat_framework = Joi.string();
-const threat_tactic_id = Joi.string();
-const threat_tactic_name = Joi.string();
-const threat_tactic_reference = Joi.string();
-const threat_tactic = Joi.object({
-  id: threat_tactic_id.required(),
-  name: threat_tactic_name.required(),
-  reference: threat_tactic_reference.required(),
-});
-const threat_technique_id = Joi.string();
-const threat_technique_name = Joi.string();
-const threat_technique_reference = Joi.string();
-const threat_technique = Joi.object({
-  id: threat_technique_id.required(),
-  name: threat_technique_name.required(),
-  reference: threat_technique_reference.required(),
-});
-const threat_techniques = Joi.array().items(threat_technique.required());
-
-const threats = Joi.array().items(
-  Joi.object({
-    framework: threat_framework.required(),
-    tactic: threat_tactic.required(),
-    techniques: threat_techniques.required(),
-  })
-);
-/* eslint-enable @typescript-eslint/camelcase */
-
-export const createRulesSchema = Joi.object({
-  description: description.required(),
-  enabled: enabled.default(true),
-  false_positives: false_positives.default([]),
-  filters,
-  from: from.required(),
-  rule_id,
-  immutable: immutable.default(false),
-  index,
-  interval: interval.default('5m'),
-  query: query.allow('').default(''),
-  language: language.default('kuery'),
-  output_index,
-  saved_id: saved_id.when('type', {
-    is: 'saved_query',
-    then: Joi.required(),
-    otherwise: Joi.forbidden(),
-  }),
-  meta,
-  risk_score: risk_score.required(),
-  max_signals: max_signals.default(DEFAULT_MAX_SIGNALS),
-  name: name.required(),
-  severity: severity.required(),
-  tags: tags.default([]),
-  to: to.required(),
-  type: type.required(),
-  threats: threats.default([]),
-  references: references.default([]),
-});
-
-export const updateRulesSchema = Joi.object({
-  description,
-  enabled,
-  false_positives,
-  filters,
-  from,
-  rule_id,
-  id,
-  immutable,
-  index,
-  interval,
-  query: query.allow(''),
-  language,
-  output_index,
-  saved_id,
-  meta,
-  risk_score,
-  max_signals,
-  name,
-  severity,
-  tags,
-  to,
-  type,
-  threats,
-  references,
-}).xor('id', 'rule_id');
-
-export const queryRulesSchema = Joi.object({
-  rule_id,
-  id,
-}).xor('id', 'rule_id');
-
-export const findRulesSchema = Joi.object({
-  fields,
-  filter: queryFilter,
-  per_page,
-  page,
-  sort_field: Joi.when(Joi.ref('sort_order'), {
-    is: Joi.exist(),
-    then: sort_field.required(),
-    otherwise: sort_field.optional(),
-  }),
-  sort_order,
-});
-
-export const setSignalsStatusSchema = Joi.object({
-  signal_ids,
-  query: signal_status_query,
-  status: status.required(),
-}).xor('signal_ids', 'query');
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/create_rules_schema.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/create_rules_schema.test.ts
new file mode 100644
index 0000000000000..4efea69db1f41
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/create_rules_schema.test.ts
@@ -0,0 +1,1047 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { createRulesSchema } from './create_rules_schema';
+import { UpdateRuleAlertParamsRest } from '../../rules/types';
+import { ThreatParams, RuleAlertParamsRest } from '../../types';
+
+describe('create rules schema', () => {
+  test('empty objects do not validate', () => {
+    expect(createRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({}).error).toBeTruthy();
+  });
+
+  test('made up values do not validate', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest & { madeUp: string }>>({
+        madeUp: 'hi',
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('[rule_id] does not validate', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('[rule_id, description] does not validate', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        description: 'some description',
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('[rule_id, description, from] does not validate', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('[rule_id, description, from, to] does not validate', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('[rule_id, description, from, to, name] does not validate', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        name: 'some-name',
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('[rule_id, description, from, to, name, severity] does not validate', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        name: 'some-name',
+        severity: 'severity',
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('[rule_id, description, from, to, name, severity, type] does not validate', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        name: 'some-name',
+        severity: 'severity',
+        type: 'query',
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('[rule_id, description, from, to, name, severity, type, interval] does not validate', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('[rule_id, description, from, to, name, severity, type, interval, index] does not validate', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        name: 'some-name',
+        severity: 'severity',
+        type: 'query',
+        interval: '5m',
+        index: ['index-1'],
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('[rule_id, description, from, to, name, severity, type, query, index, interval] does validate', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        risk_score: 50,
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        name: 'some-name',
+        severity: 'severity',
+        type: 'query',
+        query: 'some query',
+        index: ['index-1'],
+        interval: '5m',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('[rule_id, description, from, to, index, name, severity, interval, type, query, language] does not validate', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        query: 'some query',
+        language: 'kuery',
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('[rule_id, description, from, to, index, name, severity, interval, type, query, language, risk_score] does validate', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        risk_score: 50,
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        query: 'some query',
+        language: 'kuery',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('[rule_id, description, from, to, index, name, severity, interval, type, query, language, risk_score, output_index] does validate', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        output_index: '.siem-signals',
+        risk_score: 50,
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        query: 'some query',
+        language: 'kuery',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('[rule_id, description, from, to, index, name, severity, interval, type, filter, risk_score] does validate', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        risk_score: 50,
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('[rule_id, description, from, to, index, name, severity, interval, type, filter, risk_score, output_index] does validate', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        output_index: '.siem-signals',
+        risk_score: 50,
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+      }).error
+    ).toBeFalsy();
+  });
+  test('You can send in an empty array to threats', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        output_index: '.siem-signals',
+        risk_score: 50,
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        references: ['index-1'],
+        query: 'some query',
+        language: 'kuery',
+        max_signals: 1,
+        threats: [],
+      }).error
+    ).toBeFalsy();
+  });
+  test('[rule_id, description, from, to, index, name, severity, interval, type, filter, risk_score, output_index, threats] does validate', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        output_index: '.siem-signals',
+        risk_score: 50,
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        threats: [
+          {
+            framework: 'someFramework',
+            tactic: {
+              id: 'fakeId',
+              name: 'fakeName',
+              reference: 'fakeRef',
+            },
+            techniques: [
+              {
+                id: 'techniqueId',
+                name: 'techniqueName',
+                reference: 'techniqueRef',
+              },
+            ],
+          },
+        ],
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('allows references to be sent as valid', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        output_index: '.siem-signals',
+        risk_score: 50,
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        references: ['index-1'],
+        query: 'some query',
+        language: 'kuery',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('defaults references to an array', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        output_index: '.siem-signals',
+        risk_score: 50,
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        query: 'some-query',
+        language: 'kuery',
+      }).value.references
+    ).toEqual([]);
+  });
+
+  test('references cannot be numbers', () => {
+    expect(
+      createRulesSchema.validate<
+        Partial<Omit<RuleAlertParamsRest, 'references'>> & { references: number[] }
+      >({
+        rule_id: 'rule-1',
+        output_index: '.siem-signals',
+        risk_score: 50,
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        query: 'some-query',
+        language: 'kuery',
+        references: [5],
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('indexes cannot be numbers', () => {
+    expect(
+      createRulesSchema.validate<Partial<Omit<RuleAlertParamsRest, 'index'>> & { index: number[] }>(
+        {
+          rule_id: 'rule-1',
+          output_index: '.siem-signals',
+          risk_score: 50,
+          description: 'some description',
+          from: 'now-5m',
+          to: 'now',
+          index: [5],
+          name: 'some-name',
+          severity: 'severity',
+          interval: '5m',
+          type: 'query',
+          query: 'some-query',
+          language: 'kuery',
+        }
+      ).error
+    ).toBeTruthy();
+  });
+
+  test('defaults interval to 5 min', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        output_index: '.siem-signals',
+        risk_score: 50,
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        type: 'query',
+      }).value.interval
+    ).toEqual('5m');
+  });
+
+  test('defaults max signals to 100', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        output_index: '.siem-signals',
+        risk_score: 50,
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+      }).value.max_signals
+    ).toEqual(100);
+  });
+
+  test('saved_id is required when type is saved_query and will not validate without out', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        output_index: '.siem-signals',
+        risk_score: 50,
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'saved_query',
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('saved_id is required when type is saved_query and validates with it', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        risk_score: 50,
+        output_index: '.siem-signals',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'saved_query',
+        saved_id: 'some id',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('saved_query type can have filters with it', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        output_index: '.siem-signals',
+        risk_score: 50,
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'saved_query',
+        saved_id: 'some id',
+        filters: [],
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('filters cannot be a string', () => {
+    expect(
+      createRulesSchema.validate<
+        Partial<Omit<RuleAlertParamsRest, 'filters'> & { filters: string }>
+      >({
+        rule_id: 'rule-1',
+        output_index: '.siem-signals',
+        risk_score: 50,
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'saved_query',
+        saved_id: 'some id',
+        filters: 'some string',
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('language validates with kuery', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        output_index: '.siem-signals',
+        risk_score: 50,
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        references: ['index-1'],
+        query: 'some query',
+        language: 'kuery',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('language validates with lucene', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        risk_score: 50,
+        output_index: '.siem-signals',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        references: ['index-1'],
+        query: 'some query',
+        language: 'lucene',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('language does not validate with something made up', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        output_index: '.siem-signals',
+        risk_score: 50,
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        references: ['index-1'],
+        query: 'some query',
+        language: 'something-made-up',
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('max_signals cannot be negative', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        output_index: '.siem-signals',
+        risk_score: 50,
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        references: ['index-1'],
+        query: 'some query',
+        language: 'kuery',
+        max_signals: -1,
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('max_signals cannot be zero', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        output_index: '.siem-signals',
+        risk_score: 50,
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        references: ['index-1'],
+        query: 'some query',
+        language: 'kuery',
+        max_signals: 0,
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('max_signals can be 1', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        output_index: '.siem-signals',
+        risk_score: 50,
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        references: ['index-1'],
+        query: 'some query',
+        language: 'kuery',
+        max_signals: 1,
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('You can optionally send in an array of tags', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        output_index: '.siem-signals',
+        risk_score: 50,
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        references: ['index-1'],
+        query: 'some query',
+        language: 'kuery',
+        max_signals: 1,
+        tags: ['tag_1', 'tag_2'],
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('You cannot send in an array of tags that are numbers', () => {
+    expect(
+      createRulesSchema.validate<Partial<Omit<RuleAlertParamsRest, 'tags'>> & { tags: number[] }>({
+        rule_id: 'rule-1',
+        output_index: '.siem-signals',
+        risk_score: 50,
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        references: ['index-1'],
+        query: 'some query',
+        language: 'kuery',
+        max_signals: 1,
+        tags: [0, 1, 2],
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('You cannot send in an array of threats that are missing "framework"', () => {
+    expect(
+      createRulesSchema.validate<
+        Partial<Omit<RuleAlertParamsRest, 'threats'>> & {
+          threats: Array<Partial<Omit<ThreatParams, 'framework'>>>;
+        }
+      >({
+        rule_id: 'rule-1',
+        output_index: '.siem-signals',
+        risk_score: 50,
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        references: ['index-1'],
+        query: 'some query',
+        language: 'kuery',
+        max_signals: 1,
+        threats: [
+          {
+            tactic: {
+              id: 'fakeId',
+              name: 'fakeName',
+              reference: 'fakeRef',
+            },
+            techniques: [
+              {
+                id: 'techniqueId',
+                name: 'techniqueName',
+                reference: 'techniqueRef',
+              },
+            ],
+          },
+        ],
+      }).error
+    ).toBeTruthy();
+  });
+  test('You cannot send in an array of threats that are missing "tactic"', () => {
+    expect(
+      createRulesSchema.validate<
+        Partial<Omit<RuleAlertParamsRest, 'threats'>> & {
+          threats: Array<Partial<Omit<ThreatParams, 'tactic'>>>;
+        }
+      >({
+        rule_id: 'rule-1',
+        output_index: '.siem-signals',
+        risk_score: 50,
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        references: ['index-1'],
+        query: 'some query',
+        language: 'kuery',
+        max_signals: 1,
+        threats: [
+          {
+            framework: 'fake',
+            techniques: [
+              {
+                id: 'techniqueId',
+                name: 'techniqueName',
+                reference: 'techniqueRef',
+              },
+            ],
+          },
+        ],
+      }).error
+    ).toBeTruthy();
+  });
+  test('You cannot send in an array of threats that are missing "techniques"', () => {
+    expect(
+      createRulesSchema.validate<
+        Partial<Omit<RuleAlertParamsRest, 'threats'>> & {
+          threats: Array<Partial<Omit<ThreatParams, 'technique'>>>;
+        }
+      >({
+        rule_id: 'rule-1',
+        output_index: '.siem-signals',
+        risk_score: 50,
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        references: ['index-1'],
+        query: 'some query',
+        language: 'kuery',
+        max_signals: 1,
+        threats: [
+          {
+            framework: 'fake',
+            tactic: {
+              id: 'fakeId',
+              name: 'fakeName',
+              reference: 'fakeRef',
+            },
+          },
+        ],
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('You can optionally send in an array of false positives', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        output_index: '.siem-signals',
+        risk_score: 50,
+        description: 'some description',
+        false_positives: ['false_1', 'false_2'],
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        references: ['index-1'],
+        query: 'some query',
+        language: 'kuery',
+        max_signals: 1,
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('You cannot send in an array of false positives that are numbers', () => {
+    expect(
+      createRulesSchema.validate<
+        Partial<Omit<RuleAlertParamsRest, 'false_positives'>> & { false_positives: number[] }
+      >({
+        rule_id: 'rule-1',
+        output_index: '.siem-signals',
+        risk_score: 50,
+        description: 'some description',
+        false_positives: [5, 4],
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        references: ['index-1'],
+        query: 'some query',
+        language: 'kuery',
+        max_signals: 1,
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('You can optionally set the immutable to be true', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        output_index: '.siem-signals',
+        risk_score: 50,
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        immutable: true,
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        references: ['index-1'],
+        query: 'some query',
+        language: 'kuery',
+        max_signals: 1,
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('You cannot set the immutable to be a number', () => {
+    expect(
+      createRulesSchema.validate<
+        Partial<Omit<RuleAlertParamsRest, 'immutable'>> & { immutable: number }
+      >({
+        rule_id: 'rule-1',
+        output_index: '.siem-signals',
+        risk_score: 50,
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        immutable: 5,
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        references: ['index-1'],
+        query: 'some query',
+        language: 'kuery',
+        max_signals: 1,
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('You cannot set the risk_score to 101', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        output_index: '.siem-signals',
+        risk_score: 101,
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        immutable: true,
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        references: ['index-1'],
+        query: 'some query',
+        language: 'kuery',
+        max_signals: 1,
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('You cannot set the risk_score to -1', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        output_index: '.siem-signals',
+        risk_score: -1,
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        immutable: true,
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        references: ['index-1'],
+        query: 'some query',
+        language: 'kuery',
+        max_signals: 1,
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('You can set the risk_score to 0', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        output_index: '.siem-signals',
+        risk_score: 0,
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        immutable: true,
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        references: ['index-1'],
+        query: 'some query',
+        language: 'kuery',
+        max_signals: 1,
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('You can set the risk_score to 100', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        output_index: '.siem-signals',
+        risk_score: 100,
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        immutable: true,
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        references: ['index-1'],
+        query: 'some query',
+        language: 'kuery',
+        max_signals: 1,
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('You can set meta to any object you want', () => {
+    expect(
+      createRulesSchema.validate<Partial<RuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        output_index: '.siem-signals',
+        risk_score: 50,
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        immutable: true,
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        references: ['index-1'],
+        query: 'some query',
+        language: 'kuery',
+        max_signals: 1,
+        meta: {
+          somethingMadeUp: { somethingElse: true },
+        },
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('You cannot create meta as a string', () => {
+    expect(
+      createRulesSchema.validate<Partial<Omit<RuleAlertParamsRest, 'meta'> & { meta: string }>>({
+        rule_id: 'rule-1',
+        output_index: '.siem-signals',
+        risk_score: 50,
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        immutable: true,
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        references: ['index-1'],
+        query: 'some query',
+        language: 'kuery',
+        max_signals: 1,
+        meta: 'should not work',
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('You can omit the query string when filters are present', () => {
+    expect(
+      createRulesSchema.validate<Partial<Omit<RuleAlertParamsRest, 'meta'> & { meta: string }>>({
+        rule_id: 'rule-1',
+        output_index: '.siem-signals',
+        risk_score: 50,
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        immutable: true,
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        references: ['index-1'],
+        language: 'kuery',
+        filters: [],
+        max_signals: 1,
+      }).error
+    ).toBeFalsy();
+  });
+});
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/create_rules_schema.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/create_rules_schema.ts
new file mode 100644
index 0000000000000..ccda7256d2eeb
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/create_rules_schema.ts
@@ -0,0 +1,67 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import Joi from 'joi';
+
+/* eslint-disable @typescript-eslint/camelcase */
+import {
+  enabled,
+  description,
+  false_positives,
+  filters,
+  from,
+  immutable,
+  index,
+  rule_id,
+  interval,
+  query,
+  language,
+  output_index,
+  saved_id,
+  meta,
+  risk_score,
+  max_signals,
+  name,
+  severity,
+  tags,
+  to,
+  type,
+  threats,
+  references,
+} from './schemas';
+/* eslint-enable @typescript-eslint/camelcase */
+
+import { DEFAULT_MAX_SIGNALS } from '../../../../../common/constants';
+
+export const createRulesSchema = Joi.object({
+  description: description.required(),
+  enabled: enabled.default(true),
+  false_positives: false_positives.default([]),
+  filters,
+  from: from.required(),
+  rule_id,
+  immutable: immutable.default(false),
+  index,
+  interval: interval.default('5m'),
+  query: query.allow('').default(''),
+  language: language.default('kuery'),
+  output_index,
+  saved_id: saved_id.when('type', {
+    is: 'saved_query',
+    then: Joi.required(),
+    otherwise: Joi.forbidden(),
+  }),
+  meta,
+  risk_score: risk_score.required(),
+  max_signals: max_signals.default(DEFAULT_MAX_SIGNALS),
+  name: name.required(),
+  severity: severity.required(),
+  tags: tags.default([]),
+  to: to.required(),
+  type: type.required(),
+  threats: threats.default([]),
+  references: references.default([]),
+});
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/find_rules_schema.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/find_rules_schema.test.ts
new file mode 100644
index 0000000000000..14b3bdb298739
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/find_rules_schema.test.ts
@@ -0,0 +1,136 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { findRulesSchema } from './find_rules_schema';
+import { FindParamsRest } from '../../rules/types';
+
+describe('find rules schema', () => {
+  test('empty objects do validate', () => {
+    expect(findRulesSchema.validate<Partial<FindParamsRest>>({}).error).toBeFalsy();
+  });
+
+  test('all values validate', () => {
+    expect(
+      findRulesSchema.validate<Partial<FindParamsRest>>({
+        per_page: 5,
+        page: 1,
+        sort_field: 'some field',
+        fields: ['field 1', 'field 2'],
+        filter: 'some filter',
+        sort_order: 'asc',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('made up parameters do not validate', () => {
+    expect(
+      findRulesSchema.validate<Partial<FindParamsRest & { madeUp: string }>>({
+        madeUp: 'hi',
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('per_page validates', () => {
+    expect(
+      findRulesSchema.validate<Partial<FindParamsRest>>({ per_page: 5 }).error
+    ).toBeFalsy();
+  });
+
+  test('page validates', () => {
+    expect(
+      findRulesSchema.validate<Partial<FindParamsRest>>({ page: 5 }).error
+    ).toBeFalsy();
+  });
+
+  test('sort_field validates', () => {
+    expect(
+      findRulesSchema.validate<Partial<FindParamsRest>>({ sort_field: 'some value' }).error
+    ).toBeFalsy();
+  });
+
+  test('fields validates with a string', () => {
+    expect(
+      findRulesSchema.validate<Partial<FindParamsRest>>({ fields: ['some value'] }).error
+    ).toBeFalsy();
+  });
+
+  test('fields validates with multiple strings', () => {
+    expect(
+      findRulesSchema.validate<Partial<FindParamsRest>>({
+        fields: ['some value 1', 'some value 2'],
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('fields does not validate with a number', () => {
+    expect(
+      findRulesSchema.validate<Partial<Omit<FindParamsRest, 'fields'>> & { fields: number[] }>({
+        fields: [5],
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('per page has a default of 20', () => {
+    expect(findRulesSchema.validate<Partial<FindParamsRest>>({}).value.per_page).toEqual(20);
+  });
+
+  test('page has a default of 1', () => {
+    expect(findRulesSchema.validate<Partial<FindParamsRest>>({}).value.page).toEqual(1);
+  });
+
+  test('filter works with a string', () => {
+    expect(
+      findRulesSchema.validate<Partial<FindParamsRest>>({
+        filter: 'some value 1',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('filter does not work with a number', () => {
+    expect(
+      findRulesSchema.validate<Partial<Omit<FindParamsRest, 'filter'>> & { filter: number }>({
+        filter: 5,
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('sort_order requires sort_field to work', () => {
+    expect(
+      findRulesSchema.validate<Partial<FindParamsRest>>({
+        sort_order: 'asc',
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('sort_order and sort_field validate together', () => {
+    expect(
+      findRulesSchema.validate<Partial<FindParamsRest>>({
+        sort_order: 'asc',
+        sort_field: 'some field',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('sort_order validates with desc and sort_field', () => {
+    expect(
+      findRulesSchema.validate<Partial<FindParamsRest>>({
+        sort_order: 'desc',
+        sort_field: 'some field',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('sort_order does not validate with a string other than asc and desc', () => {
+    expect(
+      findRulesSchema.validate<
+        Partial<Omit<FindParamsRest, 'sort_order'>> & { sort_order: string }
+      >({
+        sort_order: 'some other string',
+        sort_field: 'some field',
+      }).error
+    ).toBeTruthy();
+  });
+});
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/find_rules_schema.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/find_rules_schema.ts
new file mode 100644
index 0000000000000..3cc5b9ca44530
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/find_rules_schema.ts
@@ -0,0 +1,24 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import Joi from 'joi';
+
+/* eslint-disable @typescript-eslint/camelcase */
+import { queryFilter, fields, per_page, page, sort_field, sort_order } from './schemas';
+/* eslint-enable @typescript-eslint/camelcase */
+
+export const findRulesSchema = Joi.object({
+  fields,
+  filter: queryFilter,
+  per_page,
+  page,
+  sort_field: Joi.when(Joi.ref('sort_order'), {
+    is: Joi.exist(),
+    then: sort_field.required(),
+    otherwise: sort_field.optional(),
+  }),
+  sort_order,
+});
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/query_rules_schema.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/query_rules_schema.test.ts
new file mode 100644
index 0000000000000..6c4e96abd2b98
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/query_rules_schema.test.ts
@@ -0,0 +1,32 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { queryRulesSchema } from './query_rules_schema';
+import { UpdateRuleAlertParamsRest } from '../../rules/types';
+
+describe('queryRulesSchema', () => {
+  test('empty objects do not validate', () => {
+    expect(queryRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({}).error).toBeTruthy();
+  });
+
+  test('both rule_id and id being supplied dot not validate', () => {
+    expect(
+      queryRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({ rule_id: '1', id: '1' }).error
+    ).toBeTruthy();
+  });
+
+  test('only id validates', () => {
+    expect(
+      queryRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({ id: '1' }).error
+    ).toBeFalsy();
+  });
+
+  test('only rule_id validates', () => {
+    expect(
+      queryRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({ rule_id: '1' }).error
+    ).toBeFalsy();
+  });
+});
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/query_rules_schema.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/query_rules_schema.ts
new file mode 100644
index 0000000000000..86a731699d1ea
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/query_rules_schema.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import Joi from 'joi';
+
+/* eslint-disable @typescript-eslint/camelcase */
+import { rule_id, id } from './schemas';
+/* eslint-enable @typescript-eslint/camelcase */
+
+export const queryRulesSchema = Joi.object({
+  rule_id,
+  id,
+}).xor('id', 'rule_id');
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/schemas.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/schemas.ts
new file mode 100644
index 0000000000000..5ab8ea3b8af3e
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/schemas.ts
@@ -0,0 +1,79 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import Joi from 'joi';
+
+/* eslint-disable @typescript-eslint/camelcase */
+export const description = Joi.string();
+export const enabled = Joi.boolean();
+export const false_positives = Joi.array().items(Joi.string());
+export const filters = Joi.array();
+export const from = Joi.string();
+export const immutable = Joi.boolean();
+export const rule_id = Joi.string();
+export const id = Joi.string();
+export const index = Joi.array()
+  .items(Joi.string())
+  .single();
+export const interval = Joi.string();
+export const query = Joi.string();
+export const language = Joi.string().valid('kuery', 'lucene');
+export const output_index = Joi.string();
+export const saved_id = Joi.string();
+export const meta = Joi.object();
+export const max_signals = Joi.number().greater(0);
+export const name = Joi.string();
+export const risk_score = Joi.number()
+  .greater(-1)
+  .less(101);
+export const severity = Joi.string();
+export const status = Joi.string().valid('open', 'closed');
+export const to = Joi.string();
+export const type = Joi.string().valid('query', 'saved_query');
+export const queryFilter = Joi.string();
+export const references = Joi.array()
+  .items(Joi.string())
+  .single();
+export const per_page = Joi.number()
+  .min(0)
+  .default(20);
+export const page = Joi.number()
+  .min(1)
+  .default(1);
+export const signal_ids = Joi.array().items(Joi.string());
+export const signal_status_query = Joi.object();
+export const sort_field = Joi.string();
+export const sort_order = Joi.string().valid('asc', 'desc');
+export const tags = Joi.array().items(Joi.string());
+export const fields = Joi.array()
+  .items(Joi.string())
+  .single();
+export const threat_framework = Joi.string();
+export const threat_tactic_id = Joi.string();
+export const threat_tactic_name = Joi.string();
+export const threat_tactic_reference = Joi.string();
+export const threat_tactic = Joi.object({
+  id: threat_tactic_id.required(),
+  name: threat_tactic_name.required(),
+  reference: threat_tactic_reference.required(),
+});
+export const threat_technique_id = Joi.string();
+export const threat_technique_name = Joi.string();
+export const threat_technique_reference = Joi.string();
+export const threat_technique = Joi.object({
+  id: threat_technique_id.required(),
+  name: threat_technique_name.required(),
+  reference: threat_technique_reference.required(),
+});
+export const threat_techniques = Joi.array().items(threat_technique.required());
+
+export const threats = Joi.array().items(
+  Joi.object({
+    framework: threat_framework.required(),
+    tactic: threat_tactic.required(),
+    techniques: threat_techniques.required(),
+  })
+);
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/set_signal_status_schema.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/set_signal_status_schema.test.ts
new file mode 100644
index 0000000000000..b586b4666bfee
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/set_signal_status_schema.test.ts
@@ -0,0 +1,66 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { setSignalsStatusSchema } from './set_signal_status_schema';
+import { SignalsRestParams } from '../../signals/types';
+
+describe('set signal status schema', () => {
+  test('signal_ids and status is valid', () => {
+    expect(
+      setSignalsStatusSchema.validate<Partial<SignalsRestParams>>({
+        signal_ids: ['somefakeid'],
+        status: 'open',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('query and status is valid', () => {
+    expect(
+      setSignalsStatusSchema.validate<Partial<SignalsRestParams>>({
+        query: {},
+        status: 'open',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('signal_ids and missing status is invalid', () => {
+    expect(
+      setSignalsStatusSchema.validate<Partial<SignalsRestParams>>({
+        signal_ids: ['somefakeid'],
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('query and missing status is invalid', () => {
+    expect(
+      setSignalsStatusSchema.validate<Partial<SignalsRestParams>>({
+        query: {},
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('status is present but query or signal_ids is missing is invalid', () => {
+    expect(
+      setSignalsStatusSchema.validate<Partial<SignalsRestParams>>({
+        status: 'closed',
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('signal_ids is present but status has wrong value', () => {
+    expect(
+      setSignalsStatusSchema.validate<
+        Partial<
+          Omit<SignalsRestParams, 'status'> & {
+            status: string;
+          }
+        >
+      >({
+        status: 'fakeVal',
+      }).error
+    ).toBeTruthy();
+  });
+});
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/set_signal_status_schema.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/set_signal_status_schema.ts
new file mode 100644
index 0000000000000..c8a06619287df
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/set_signal_status_schema.ts
@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import Joi from 'joi';
+
+/* eslint-disable @typescript-eslint/camelcase */
+import { signal_ids, signal_status_query, status } from './schemas';
+/* eslint-enable @typescript-eslint/camelcase */
+
+export const setSignalsStatusSchema = Joi.object({
+  signal_ids,
+  query: signal_status_query,
+  status: status.required(),
+}).xor('signal_ids', 'query');
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/update_rules_schema.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/update_rules_schema.test.ts
new file mode 100644
index 0000000000000..606a30309b2ab
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/update_rules_schema.test.ts
@@ -0,0 +1,869 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { updateRulesSchema } from './update_rules_schema';
+import { UpdateRuleAlertParamsRest } from '../../rules/types';
+import { ThreatParams } from '../../types';
+
+describe('update rules schema', () => {
+  test('empty objects do not validate as they require at least id or rule_id', () => {
+    expect(updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({}).error).toBeTruthy();
+  });
+
+  test('made up values do not validate', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest & { madeUp: string }>>({
+        madeUp: 'hi',
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('[id] does validate', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        id: 'rule-1',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('[rule_id] does validate', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('[id and rule_id] does not validate', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        id: 'id-1',
+        rule_id: 'rule-1',
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('[rule_id, description] does validate', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        description: 'some description',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('[id, description] does validate', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        id: 'rule-1',
+        description: 'some description',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('[id, risk_score] does validate', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        id: 'rule-1',
+        risk_score: 10,
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('[rule_id, description, from] does validate', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('[id, description, from] does validate', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('[rule_id, description, from, to] does validate', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('[id, description, from, to] does validate', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('[rule_id, description, from, to, name] does validate', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        name: 'some-name',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('[id, description, from, to, name] does validate', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        name: 'some-name',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('[rule_id, description, from, to, name, severity] does validate', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        name: 'some-name',
+        severity: 'severity',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('[id, description, from, to, name, severity] does validate', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        name: 'some-name',
+        severity: 'severity',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('[rule_id, description, from, to, name, severity, type] does validate', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        name: 'some-name',
+        severity: 'severity',
+        type: 'query',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('[id, description, from, to, name, severity, type] does validate', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        name: 'some-name',
+        severity: 'severity',
+        type: 'query',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('[rule_id, description, from, to, name, severity, type, interval] does validate', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('[id, description, from, to, name, severity, type, interval] does validate', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('[rule_id, description, from, to, index, name, severity, interval, type] does validate', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('[id, description, from, to, index, name, severity, interval, type] does validate', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('[rule_id, description, from, to, index, name, severity, interval, type, query] does validate', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        query: 'some query',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('[id, description, from, to, index, name, severity, interval, type, query] does validate', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        query: 'some query',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('[rule_id, description, from, to, index, name, severity, interval, type, query, language] does validate', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        query: 'some query',
+        language: 'kuery',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('[id, description, from, to, index, name, severity, interval, type, query, language] does validate', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        query: 'some query',
+        language: 'kuery',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('[rule_id, description, from, to, index, name, severity, type, filter] does validate', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        rule_id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('[id, description, from, to, index, name, severity, type, filter] does validate', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('allows references to be sent as a valid value to update with', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        references: ['index-1'],
+        query: 'some query',
+        language: 'kuery',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('does not default references to an array', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        query: 'some-query',
+        language: 'kuery',
+      }).value.references
+    ).toEqual(undefined);
+  });
+
+  test('does not default interval', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        type: 'query',
+      }).value.interval
+    ).toEqual(undefined);
+  });
+
+  test('does not default max signal', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+      }).value.max_signals
+    ).toEqual(undefined);
+  });
+
+  test('references cannot be numbers', () => {
+    expect(
+      updateRulesSchema.validate<
+        Partial<Omit<UpdateRuleAlertParamsRest, 'references'>> & { references: number[] }
+      >({
+        id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        query: 'some-query',
+        language: 'kuery',
+        references: [5],
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('indexes cannot be numbers', () => {
+    expect(
+      updateRulesSchema.validate<
+        Partial<Omit<UpdateRuleAlertParamsRest, 'index'>> & { index: number[] }
+      >({
+        id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: [5],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        query: 'some-query',
+        language: 'kuery',
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('saved_id is not required when type is saved_query and will validate without it', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'saved_query',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('saved_id validates with saved_query', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'saved_query',
+        saved_id: 'some id',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('saved_query type can have filters with it', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'saved_query',
+        saved_id: 'some id',
+        filters: [],
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('language validates with kuery', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        references: ['index-1'],
+        query: 'some query',
+        language: 'kuery',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('language validates with lucene', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        references: ['index-1'],
+        query: 'some query',
+        language: 'lucene',
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('language does not validate with something made up', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        references: ['index-1'],
+        query: 'some query',
+        language: 'something-made-up',
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('max_signals cannot be negative', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        references: ['index-1'],
+        query: 'some query',
+        language: 'kuery',
+        max_signals: -1,
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('max_signals cannot be zero', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        references: ['index-1'],
+        query: 'some query',
+        language: 'kuery',
+        max_signals: 0,
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('max_signals can be 1', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        references: ['index-1'],
+        query: 'some query',
+        language: 'kuery',
+        max_signals: 1,
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('meta can be updated', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        id: 'rule-1',
+        meta: { whateverYouWant: 'anything_at_all' },
+      }).error
+    ).toBeFalsy();
+  });
+
+  test('You update meta as a string', () => {
+    expect(
+      updateRulesSchema.validate<
+        Partial<Omit<UpdateRuleAlertParamsRest, 'meta'> & { meta: string }>
+      >({
+        id: 'rule-1',
+        meta: 'should not work',
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('filters cannot be a string', () => {
+    expect(
+      updateRulesSchema.validate<
+        Partial<Omit<UpdateRuleAlertParamsRest, 'filters'> & { filters: string }>
+      >({
+        rule_id: 'rule-1',
+        type: 'query',
+        filters: 'some string',
+      }).error
+    ).toBeTruthy();
+  });
+
+  test('threats is not defaulted to empty array on update', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        references: ['index-1'],
+        query: 'some query',
+        language: 'kuery',
+        max_signals: 1,
+      }).value.threats
+    ).toBe(undefined);
+  });
+
+  test('threats is not defaulted to undefined on update with empty array', () => {
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        references: ['index-1'],
+        query: 'some query',
+        language: 'kuery',
+        max_signals: 1,
+        threats: [],
+      }).value.threats
+    ).toMatchObject([]);
+  });
+  test('threats is valid when updated with all sub-objects', () => {
+    const expected: ThreatParams[] = [
+      {
+        framework: 'fake',
+        tactic: {
+          id: 'fakeId',
+          name: 'fakeName',
+          reference: 'fakeRef',
+        },
+        techniques: [
+          {
+            id: 'techniqueId',
+            name: 'techniqueName',
+            reference: 'techniqueRef',
+          },
+        ],
+      },
+    ];
+    expect(
+      updateRulesSchema.validate<Partial<UpdateRuleAlertParamsRest>>({
+        id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        references: ['index-1'],
+        query: 'some query',
+        language: 'kuery',
+        max_signals: 1,
+        threats: [
+          {
+            framework: 'fake',
+            tactic: {
+              id: 'fakeId',
+              name: 'fakeName',
+              reference: 'fakeRef',
+            },
+            techniques: [
+              {
+                id: 'techniqueId',
+                name: 'techniqueName',
+                reference: 'techniqueRef',
+              },
+            ],
+          },
+        ],
+      }).value.threats
+    ).toMatchObject(expected);
+  });
+  test('threats is invalid when updated with missing property framework', () => {
+    expect(
+      updateRulesSchema.validate<
+        Partial<Omit<UpdateRuleAlertParamsRest, 'threats'>> & {
+          threats: Array<Partial<Omit<ThreatParams, 'framework'>>>;
+        }
+      >({
+        id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        references: ['index-1'],
+        query: 'some query',
+        language: 'kuery',
+        max_signals: 1,
+        threats: [
+          {
+            tactic: {
+              id: 'fakeId',
+              name: 'fakeName',
+              reference: 'fakeRef',
+            },
+            techniques: [
+              {
+                id: 'techniqueId',
+                name: 'techniqueName',
+                reference: 'techniqueRef',
+              },
+            ],
+          },
+        ],
+      }).error
+    ).toBeTruthy();
+  });
+  test('threats is invalid when updated with missing tactic sub-object', () => {
+    expect(
+      updateRulesSchema.validate<
+        Partial<Omit<UpdateRuleAlertParamsRest, 'threats'>> & {
+          threats: Array<Partial<Omit<ThreatParams, 'tactic'>>>;
+        }
+      >({
+        id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        references: ['index-1'],
+        query: 'some query',
+        language: 'kuery',
+        max_signals: 1,
+        threats: [
+          {
+            framework: 'fake',
+            techniques: [
+              {
+                id: 'techniqueId',
+                name: 'techniqueName',
+                reference: 'techniqueRef',
+              },
+            ],
+          },
+        ],
+      }).error
+    ).toBeTruthy();
+  });
+  test('threats is invalid when updated with missing techniques', () => {
+    expect(
+      updateRulesSchema.validate<
+        Partial<Omit<UpdateRuleAlertParamsRest, 'threats'>> & {
+          threats: Array<Partial<Omit<ThreatParams, 'techniques'>>>;
+        }
+      >({
+        id: 'rule-1',
+        description: 'some description',
+        from: 'now-5m',
+        to: 'now',
+        index: ['index-1'],
+        name: 'some-name',
+        severity: 'severity',
+        interval: '5m',
+        type: 'query',
+        references: ['index-1'],
+        query: 'some query',
+        language: 'kuery',
+        max_signals: 1,
+        threats: [
+          {
+            framework: 'fake',
+            tactic: {
+              id: 'techniqueId',
+              name: 'techniqueName',
+              reference: 'techniqueRef',
+            },
+          },
+        ],
+      }).error
+    ).toBeTruthy();
+  });
+});
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/update_rules_schema.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/update_rules_schema.ts
new file mode 100644
index 0000000000000..244d8d1f5cc77
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/update_rules_schema.ts
@@ -0,0 +1,63 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import Joi from 'joi';
+
+/* eslint-disable @typescript-eslint/camelcase */
+import {
+  enabled,
+  description,
+  false_positives,
+  filters,
+  from,
+  immutable,
+  index,
+  rule_id,
+  interval,
+  query,
+  language,
+  output_index,
+  saved_id,
+  meta,
+  risk_score,
+  max_signals,
+  name,
+  severity,
+  tags,
+  to,
+  type,
+  threats,
+  references,
+  id,
+} from './schemas';
+/* eslint-enable @typescript-eslint/camelcase */
+
+export const updateRulesSchema = Joi.object({
+  description,
+  enabled,
+  false_positives,
+  filters,
+  from,
+  rule_id,
+  id,
+  immutable,
+  index,
+  interval,
+  query: query.allow(''),
+  language,
+  output_index,
+  saved_id,
+  meta,
+  risk_score,
+  max_signals,
+  name,
+  severity,
+  tags,
+  to,
+  type,
+  threats,
+  references,
+}).xor('id', 'rule_id');
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/signals/open_close_signals_route.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/signals/open_close_signals_route.ts
index 99af43ce51a12..b342cc5cd14ef 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/signals/open_close_signals_route.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/signals/open_close_signals_route.ts
@@ -6,8 +6,8 @@
 
 import Hapi from 'hapi';
 import { DETECTION_ENGINE_SIGNALS_STATUS_URL } from '../../../../../common/constants';
-import { SignalsRequest } from '../../alerts/types';
-import { setSignalsStatusSchema } from '../schemas';
+import { SignalsRequest } from '../../signals/types';
+import { setSignalsStatusSchema } from '../schemas/set_signal_status_schema';
 import { ServerFacade } from '../../../../types';
 import { transformError, getIndex } from '../utils';
 
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/utils.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/utils.test.ts
index 4663ea357f259..8ca5c24d88100 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/utils.test.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/utils.test.ts
@@ -6,495 +6,9 @@
 
 import Boom from 'boom';
 
-import {
-  transformAlertToRule,
-  getIdError,
-  transformFindAlertsOrError,
-  transformOrError,
-  transformError,
-} from './utils';
-import { getResult } from './__mocks__/request_responses';
+import { transformError } from './utils';
 
 describe('utils', () => {
-  describe('transformAlertToRule', () => {
-    test('should work with a full data set', () => {
-      const fullRule = getResult();
-      const rule = transformAlertToRule(fullRule);
-      expect(rule).toEqual({
-        created_by: 'elastic',
-        description: 'Detecting root and admin users',
-        enabled: true,
-        false_positives: [],
-        from: 'now-6m',
-        id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
-        immutable: false,
-        index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
-        interval: '5m',
-        risk_score: 50,
-        rule_id: 'rule-1',
-        language: 'kuery',
-        max_signals: 100,
-        name: 'Detect Root/Admin Users',
-        output_index: '.siem-signals',
-        query: 'user.name: root or user.name: admin',
-        references: ['http://www.example.com', 'https://ww.example.com'],
-        severity: 'high',
-        updated_by: 'elastic',
-        tags: [],
-        threats: [
-          {
-            framework: 'MITRE ATT&CK',
-            tactic: {
-              id: 'TA0040',
-              name: 'impact',
-              reference: 'https://attack.mitre.org/tactics/TA0040/',
-            },
-            techniques: [
-              {
-                id: 'T1499',
-                name: 'endpoint denial of service',
-                reference: 'https://attack.mitre.org/techniques/T1499/',
-              },
-            ],
-          },
-        ],
-        to: 'now',
-        type: 'query',
-      });
-    });
-
-    test('should work with a partial data set missing data', () => {
-      const fullRule = getResult();
-      const { from, language, ...omitData } = transformAlertToRule(fullRule);
-      expect(omitData).toEqual({
-        created_by: 'elastic',
-        description: 'Detecting root and admin users',
-        enabled: true,
-        false_positives: [],
-        id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
-        immutable: false,
-        index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
-        output_index: '.siem-signals',
-        interval: '5m',
-        risk_score: 50,
-        rule_id: 'rule-1',
-        max_signals: 100,
-        name: 'Detect Root/Admin Users',
-        query: 'user.name: root or user.name: admin',
-        references: ['http://www.example.com', 'https://ww.example.com'],
-        severity: 'high',
-        updated_by: 'elastic',
-        tags: [],
-        threats: [
-          {
-            framework: 'MITRE ATT&CK',
-            tactic: {
-              id: 'TA0040',
-              name: 'impact',
-              reference: 'https://attack.mitre.org/tactics/TA0040/',
-            },
-            techniques: [
-              {
-                id: 'T1499',
-                name: 'endpoint denial of service',
-                reference: 'https://attack.mitre.org/techniques/T1499/',
-              },
-            ],
-          },
-        ],
-        to: 'now',
-        type: 'query',
-      });
-    });
-
-    test('should omit query if query is null', () => {
-      const fullRule = getResult();
-      fullRule.params.query = null;
-      const rule = transformAlertToRule(fullRule);
-      expect(rule).toEqual({
-        created_by: 'elastic',
-        description: 'Detecting root and admin users',
-        enabled: true,
-        false_positives: [],
-        from: 'now-6m',
-        id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
-        immutable: false,
-        index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
-        output_index: '.siem-signals',
-        interval: '5m',
-        risk_score: 50,
-        rule_id: 'rule-1',
-        language: 'kuery',
-        max_signals: 100,
-        name: 'Detect Root/Admin Users',
-        references: ['http://www.example.com', 'https://ww.example.com'],
-        severity: 'high',
-        updated_by: 'elastic',
-        tags: [],
-        threats: [
-          {
-            framework: 'MITRE ATT&CK',
-            tactic: {
-              id: 'TA0040',
-              name: 'impact',
-              reference: 'https://attack.mitre.org/tactics/TA0040/',
-            },
-            techniques: [
-              {
-                id: 'T1499',
-                name: 'endpoint denial of service',
-                reference: 'https://attack.mitre.org/techniques/T1499/',
-              },
-            ],
-          },
-        ],
-        to: 'now',
-        type: 'query',
-      });
-    });
-
-    test('should omit query if query is undefined', () => {
-      const fullRule = getResult();
-      fullRule.params.query = undefined;
-      const rule = transformAlertToRule(fullRule);
-      expect(rule).toEqual({
-        created_by: 'elastic',
-        description: 'Detecting root and admin users',
-        enabled: true,
-        false_positives: [],
-        from: 'now-6m',
-        id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
-        immutable: false,
-        index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
-        output_index: '.siem-signals',
-        interval: '5m',
-        rule_id: 'rule-1',
-        risk_score: 50,
-        language: 'kuery',
-        max_signals: 100,
-        name: 'Detect Root/Admin Users',
-        references: ['http://www.example.com', 'https://ww.example.com'],
-        severity: 'high',
-        updated_by: 'elastic',
-        tags: [],
-        threats: [
-          {
-            framework: 'MITRE ATT&CK',
-            tactic: {
-              id: 'TA0040',
-              name: 'impact',
-              reference: 'https://attack.mitre.org/tactics/TA0040/',
-            },
-            techniques: [
-              {
-                id: 'T1499',
-                name: 'endpoint denial of service',
-                reference: 'https://attack.mitre.org/techniques/T1499/',
-              },
-            ],
-          },
-        ],
-        to: 'now',
-        type: 'query',
-      });
-    });
-
-    test('should omit a mix of undefined, null, and missing fields', () => {
-      const fullRule = getResult();
-      fullRule.params.query = undefined;
-      fullRule.params.language = null;
-      const { from, enabled, ...omitData } = transformAlertToRule(fullRule);
-      expect(omitData).toEqual({
-        created_by: 'elastic',
-        description: 'Detecting root and admin users',
-        false_positives: [],
-        id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
-        immutable: false,
-        output_index: '.siem-signals',
-        index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
-        interval: '5m',
-        rule_id: 'rule-1',
-        risk_score: 50,
-        max_signals: 100,
-        name: 'Detect Root/Admin Users',
-        references: ['http://www.example.com', 'https://ww.example.com'],
-        severity: 'high',
-        updated_by: 'elastic',
-        tags: [],
-        threats: [
-          {
-            framework: 'MITRE ATT&CK',
-            tactic: {
-              id: 'TA0040',
-              name: 'impact',
-              reference: 'https://attack.mitre.org/tactics/TA0040/',
-            },
-            techniques: [
-              {
-                id: 'T1499',
-                name: 'endpoint denial of service',
-                reference: 'https://attack.mitre.org/techniques/T1499/',
-              },
-            ],
-          },
-        ],
-        to: 'now',
-        type: 'query',
-      });
-    });
-
-    test('should return enabled is equal to false', () => {
-      const fullRule = getResult();
-      fullRule.enabled = false;
-      const ruleWithEnabledFalse = transformAlertToRule(fullRule);
-      expect(ruleWithEnabledFalse).toEqual({
-        created_by: 'elastic',
-        description: 'Detecting root and admin users',
-        enabled: false,
-        from: 'now-6m',
-        false_positives: [],
-        id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
-        immutable: false,
-        output_index: '.siem-signals',
-        index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
-        interval: '5m',
-        language: 'kuery',
-        risk_score: 50,
-        rule_id: 'rule-1',
-        max_signals: 100,
-        name: 'Detect Root/Admin Users',
-        query: 'user.name: root or user.name: admin',
-        references: ['http://www.example.com', 'https://ww.example.com'],
-        severity: 'high',
-        updated_by: 'elastic',
-        tags: [],
-        threats: [
-          {
-            framework: 'MITRE ATT&CK',
-            tactic: {
-              id: 'TA0040',
-              name: 'impact',
-              reference: 'https://attack.mitre.org/tactics/TA0040/',
-            },
-            techniques: [
-              {
-                id: 'T1499',
-                name: 'endpoint denial of service',
-                reference: 'https://attack.mitre.org/techniques/T1499/',
-              },
-            ],
-          },
-        ],
-        to: 'now',
-        type: 'query',
-      });
-    });
-
-    test('should return immutable is equal to false', () => {
-      const fullRule = getResult();
-      fullRule.params.immutable = false;
-      const ruleWithEnabledFalse = transformAlertToRule(fullRule);
-      expect(ruleWithEnabledFalse).toEqual({
-        created_by: 'elastic',
-        description: 'Detecting root and admin users',
-        enabled: true,
-        from: 'now-6m',
-        false_positives: [],
-        id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
-        immutable: false,
-        output_index: '.siem-signals',
-        index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
-        interval: '5m',
-        language: 'kuery',
-        risk_score: 50,
-        rule_id: 'rule-1',
-        max_signals: 100,
-        name: 'Detect Root/Admin Users',
-        query: 'user.name: root or user.name: admin',
-        references: ['http://www.example.com', 'https://ww.example.com'],
-        severity: 'high',
-        updated_by: 'elastic',
-        tags: [],
-        threats: [
-          {
-            framework: 'MITRE ATT&CK',
-            tactic: {
-              id: 'TA0040',
-              name: 'impact',
-              reference: 'https://attack.mitre.org/tactics/TA0040/',
-            },
-            techniques: [
-              {
-                id: 'T1499',
-                name: 'endpoint denial of service',
-                reference: 'https://attack.mitre.org/techniques/T1499/',
-              },
-            ],
-          },
-        ],
-        to: 'now',
-        type: 'query',
-      });
-    });
-  });
-
-  describe('getIdError', () => {
-    test('outputs message about id not being found if only id is defined and ruleId is undefined', () => {
-      const boom = getIdError({ id: '123', ruleId: undefined });
-      expect(boom.message).toEqual('id: "123" not found');
-    });
-
-    test('outputs message about id not being found if only id is defined and ruleId is null', () => {
-      const boom = getIdError({ id: '123', ruleId: null });
-      expect(boom.message).toEqual('id: "123" not found');
-    });
-
-    test('outputs message about ruleId not being found if only ruleId is defined and id is undefined', () => {
-      const boom = getIdError({ id: undefined, ruleId: 'rule-id-123' });
-      expect(boom.message).toEqual('rule_id: "rule-id-123" not found');
-    });
-
-    test('outputs message about ruleId not being found if only ruleId is defined and id is null', () => {
-      const boom = getIdError({ id: null, ruleId: 'rule-id-123' });
-      expect(boom.message).toEqual('rule_id: "rule-id-123" not found');
-    });
-
-    test('outputs message about both being not defined when both are undefined', () => {
-      const boom = getIdError({ id: undefined, ruleId: undefined });
-      expect(boom.message).toEqual('id or rule_id should have been defined');
-    });
-
-    test('outputs message about both being not defined when both are null', () => {
-      const boom = getIdError({ id: null, ruleId: null });
-      expect(boom.message).toEqual('id or rule_id should have been defined');
-    });
-
-    test('outputs message about both being not defined when id is null and ruleId is undefined', () => {
-      const boom = getIdError({ id: null, ruleId: undefined });
-      expect(boom.message).toEqual('id or rule_id should have been defined');
-    });
-
-    test('outputs message about both being not defined when id is undefined and ruleId is null', () => {
-      const boom = getIdError({ id: undefined, ruleId: null });
-      expect(boom.message).toEqual('id or rule_id should have been defined');
-    });
-  });
-
-  describe('transformFindAlertsOrError', () => {
-    test('outputs empty data set when data set is empty correct', () => {
-      const output = transformFindAlertsOrError({ data: [] });
-      expect(output).toEqual({ data: [] });
-    });
-
-    test('outputs 200 if the data is of type siem alert', () => {
-      const output = transformFindAlertsOrError({
-        data: [getResult()],
-      });
-      expect(output).toEqual({
-        data: [
-          {
-            created_by: 'elastic',
-            description: 'Detecting root and admin users',
-            enabled: true,
-            false_positives: [],
-            from: 'now-6m',
-            id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
-            immutable: false,
-            output_index: '.siem-signals',
-            index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
-            interval: '5m',
-            risk_score: 50,
-            rule_id: 'rule-1',
-            language: 'kuery',
-            max_signals: 100,
-            name: 'Detect Root/Admin Users',
-            query: 'user.name: root or user.name: admin',
-            references: ['http://www.example.com', 'https://ww.example.com'],
-            severity: 'high',
-            updated_by: 'elastic',
-            tags: [],
-            to: 'now',
-            type: 'query',
-            threats: [
-              {
-                framework: 'MITRE ATT&CK',
-                tactic: {
-                  id: 'TA0040',
-                  name: 'impact',
-                  reference: 'https://attack.mitre.org/tactics/TA0040/',
-                },
-                techniques: [
-                  {
-                    id: 'T1499',
-                    name: 'endpoint denial of service',
-                    reference: 'https://attack.mitre.org/techniques/T1499/',
-                  },
-                ],
-              },
-            ],
-          },
-        ],
-      });
-    });
-
-    test('returns 500 if the data is not of type siem alert', () => {
-      const output = transformFindAlertsOrError({ data: [{ random: 1 }] });
-      expect((output as Boom).message).toEqual('Internal error transforming');
-    });
-  });
-
-  describe('transformOrError', () => {
-    test('outputs 200 if the data is of type siem alert', () => {
-      const output = transformOrError(getResult());
-      expect(output).toEqual({
-        created_by: 'elastic',
-        description: 'Detecting root and admin users',
-        enabled: true,
-        false_positives: [],
-        from: 'now-6m',
-        id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
-        immutable: false,
-        output_index: '.siem-signals',
-        index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
-        interval: '5m',
-        rule_id: 'rule-1',
-        risk_score: 50,
-        language: 'kuery',
-        max_signals: 100,
-        name: 'Detect Root/Admin Users',
-        query: 'user.name: root or user.name: admin',
-        references: ['http://www.example.com', 'https://ww.example.com'],
-        severity: 'high',
-        updated_by: 'elastic',
-        tags: [],
-        to: 'now',
-        type: 'query',
-        threats: [
-          {
-            framework: 'MITRE ATT&CK',
-            tactic: {
-              id: 'TA0040',
-              name: 'impact',
-              reference: 'https://attack.mitre.org/tactics/TA0040/',
-            },
-            techniques: [
-              {
-                id: 'T1499',
-                name: 'endpoint denial of service',
-                reference: 'https://attack.mitre.org/techniques/T1499/',
-              },
-            ],
-          },
-        ],
-      });
-    });
-
-    test('returns 500 if the data is not of type siem alert', () => {
-      const output = transformOrError({ data: [{ random: 1 }] });
-      expect((output as Boom).message).toEqual('Internal error transforming');
-    });
-  });
-
   describe('transformError', () => {
     test('returns boom if it is a boom object', () => {
       const boom = new Boom('');
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/utils.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/utils.ts
index 6df4174e628b3..aed0ced5cdeb5 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/utils.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/utils.ts
@@ -5,77 +5,9 @@
  */
 
 import Boom from 'boom';
-import { pickBy } from 'lodash/fp';
 import { APP_ID, SIGNALS_INDEX_KEY } from '../../../../common/constants';
-import { RuleAlertType, isAlertType, OutputRuleAlertRest, isAlertTypes } from '../alerts/types';
 import { ServerFacade, RequestFacade } from '../../../types';
 
-export const getIdError = ({
-  id,
-  ruleId,
-}: {
-  id: string | undefined | null;
-  ruleId: string | undefined | null;
-}) => {
-  if (id != null) {
-    return new Boom(`id: "${id}" not found`, { statusCode: 404 });
-  } else if (ruleId != null) {
-    return new Boom(`rule_id: "${ruleId}" not found`, { statusCode: 404 });
-  } else {
-    return new Boom(`id or rule_id should have been defined`, { statusCode: 404 });
-  }
-};
-
-// Transforms the data but will remove any null or undefined it encounters and not include
-// those on the export
-export const transformAlertToRule = (alert: RuleAlertType): Partial<OutputRuleAlertRest> => {
-  return pickBy<OutputRuleAlertRest>((value: unknown) => value != null, {
-    created_by: alert.createdBy,
-    description: alert.params.description,
-    enabled: alert.enabled,
-    false_positives: alert.params.falsePositives,
-    filters: alert.params.filters,
-    from: alert.params.from,
-    id: alert.id,
-    immutable: alert.params.immutable,
-    index: alert.params.index,
-    interval: alert.interval,
-    rule_id: alert.params.ruleId,
-    language: alert.params.language,
-    output_index: alert.params.outputIndex,
-    max_signals: alert.params.maxSignals,
-    risk_score: alert.params.riskScore,
-    name: alert.name,
-    query: alert.params.query,
-    references: alert.params.references,
-    saved_id: alert.params.savedId,
-    meta: alert.params.meta,
-    severity: alert.params.severity,
-    updated_by: alert.updatedBy,
-    tags: alert.tags,
-    to: alert.params.to,
-    type: alert.params.type,
-    threats: alert.params.threats,
-  });
-};
-
-export const transformFindAlertsOrError = (findResults: { data: unknown[] }): unknown | Boom => {
-  if (isAlertTypes(findResults.data)) {
-    findResults.data = findResults.data.map(alert => transformAlertToRule(alert));
-    return findResults;
-  } else {
-    return new Boom('Internal error transforming', { statusCode: 500 });
-  }
-};
-
-export const transformOrError = (alert: unknown): Partial<OutputRuleAlertRest> | Boom => {
-  if (isAlertType(alert)) {
-    return transformAlertToRule(alert);
-  } else {
-    return new Boom('Internal error transforming', { statusCode: 500 });
-  }
-};
-
 export const transformError = (err: Error & { statusCode?: number }) => {
   if (Boom.isBoom(err)) {
     return err;
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/create_rules.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/create_rules.ts
similarity index 100%
rename from x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/create_rules.ts
rename to x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/create_rules.ts
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/delete_rules.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/delete_rules.ts
similarity index 100%
rename from x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/delete_rules.ts
rename to x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/delete_rules.ts
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/find_rules.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/find_rules.test.ts
similarity index 100%
rename from x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/find_rules.test.ts
rename to x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/find_rules.test.ts
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/find_rules.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/find_rules.ts
similarity index 100%
rename from x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/find_rules.ts
rename to x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/find_rules.ts
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/read_rules.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/read_rules.test.ts
similarity index 100%
rename from x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/read_rules.test.ts
rename to x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/read_rules.test.ts
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/read_rules.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/read_rules.ts
similarity index 100%
rename from x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/read_rules.ts
rename to x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/read_rules.ts
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/types.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/types.ts
new file mode 100644
index 0000000000000..5c0fa76b52620
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/types.ts
@@ -0,0 +1,102 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { get } from 'lodash/fp';
+
+import { SIGNALS_ID } from '../../../../common/constants';
+import { AlertsClient } from '../../../../../alerting/server/alerts_client';
+import { ActionsClient } from '../../../../../actions/server/actions_client';
+import { RuleAlertParams, RuleTypeParams, RuleAlertParamsRest } from '../types';
+import { RequestFacade } from '../../../types';
+import { Alert } from '../../../../../alerting/server/types';
+
+export type UpdateRuleAlertParamsRest = Partial<RuleAlertParamsRest> & {
+  id: string | undefined;
+  rule_id: RuleAlertParams['ruleId'] | undefined;
+};
+
+export interface FindParamsRest {
+  per_page: number;
+  page: number;
+  sort_field: string;
+  sort_order: 'asc' | 'desc';
+  fields: string[];
+  filter: string;
+}
+
+export interface UpdateRulesRequest extends RequestFacade {
+  payload: UpdateRuleAlertParamsRest;
+}
+
+export type RuleAlertType = Alert & {
+  id: string;
+  params: RuleTypeParams;
+};
+
+export interface RulesRequest extends RequestFacade {
+  payload: RuleAlertParamsRest;
+}
+
+export interface FindRuleParams {
+  alertsClient: AlertsClient;
+  perPage?: number;
+  page?: number;
+  sortField?: string;
+  filter?: string;
+  fields?: string[];
+  sortOrder?: 'asc' | 'desc';
+}
+
+export interface FindRulesRequest extends Omit<RequestFacade, 'query'> {
+  query: {
+    per_page: number;
+    page: number;
+    search?: string;
+    sort_field?: string;
+    filter?: string;
+    fields?: string[];
+    sort_order?: 'asc' | 'desc';
+  };
+}
+
+export interface Clients {
+  alertsClient: AlertsClient;
+  actionsClient: ActionsClient;
+}
+
+export type UpdateRuleParams = Partial<RuleAlertParams> & {
+  id: string | undefined | null;
+} & Clients;
+
+export type DeleteRuleParams = Clients & {
+  id: string | undefined;
+  ruleId: string | undefined | null;
+};
+
+export type RuleParams = RuleAlertParams & Clients;
+
+export interface ReadRuleParams {
+  alertsClient: AlertsClient;
+  id?: string | undefined | null;
+  ruleId?: string | undefined | null;
+}
+
+export interface ReadRuleByRuleId {
+  alertsClient: AlertsClient;
+  ruleId: string;
+}
+
+export const isAlertTypes = (obj: unknown[]): obj is RuleAlertType[] => {
+  return obj.every(rule => isAlertType(rule));
+};
+
+export const isAlertType = (obj: unknown): obj is RuleAlertType => {
+  return get('alertTypeId', obj) === SIGNALS_ID;
+};
+
+export const isAlertTypeArray = (objArray: unknown[]): objArray is RuleAlertType[] => {
+  return objArray.length === 0 || isAlertType(objArray[0]);
+};
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/update_rules.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/update_rules.test.ts
similarity index 100%
rename from x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/update_rules.test.ts
rename to x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/update_rules.test.ts
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/update_rules.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/update_rules.ts
similarity index 100%
rename from x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/update_rules.ts
rename to x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/update_rules.ts
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/__mocks__/es_results.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/__mocks__/es_results.ts
similarity index 94%
rename from x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/__mocks__/es_results.ts
rename to x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/__mocks__/es_results.ts
index 4c113544e6e21..215d9da6eb7ff 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/__mocks__/es_results.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/__mocks__/es_results.ts
@@ -4,12 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import {
-  SignalSourceHit,
-  SignalSearchResponse,
-  RuleTypeParams,
-  OutputRuleAlertRest,
-} from '../types';
+import { SignalSourceHit, SignalSearchResponse } from '../types';
+import { Logger } from 'kibana/server';
+import { RuleTypeParams, OutputRuleAlertRest } from '../../types';
 
 export const sampleRuleAlertParams = (
   maxSignals?: number | undefined,
@@ -281,3 +278,13 @@ export const sampleRule = (): Partial<OutputRuleAlertRest> => {
     type: 'query',
   };
 };
+
+export const mockLogger: Logger = {
+  log: jest.fn(),
+  trace: jest.fn(),
+  debug: jest.fn(),
+  info: jest.fn(),
+  warn: jest.fn(),
+  error: jest.fn(),
+  fatal: jest.fn(),
+};
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_bulk_body.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_bulk_body.test.ts
new file mode 100644
index 0000000000000..e10158a0b879e
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_bulk_body.test.ts
@@ -0,0 +1,284 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  sampleRuleAlertParams,
+  sampleDocNoSortId,
+  sampleRuleGuid,
+  sampleIdGuid,
+} from './__mocks__/es_results';
+import { buildBulkBody } from './build_bulk_body';
+
+describe('buildBulkBody', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  test('if bulk body builds well-defined body', () => {
+    const sampleParams = sampleRuleAlertParams();
+    const fakeSignalSourceHit = buildBulkBody({
+      doc: sampleDocNoSortId(),
+      ruleParams: sampleParams,
+      id: sampleRuleGuid,
+      name: 'rule-name',
+      createdBy: 'elastic',
+      updatedBy: 'elastic',
+      interval: '5m',
+      enabled: true,
+      tags: ['some fake tag 1', 'some fake tag 2'],
+    });
+    // Timestamp will potentially always be different so remove it for the test
+    delete fakeSignalSourceHit['@timestamp'];
+    expect(fakeSignalSourceHit).toEqual({
+      someKey: 'someValue',
+      event: {
+        kind: 'signal',
+      },
+      signal: {
+        parent: {
+          id: sampleIdGuid,
+          type: 'event',
+          index: 'myFakeSignalIndex',
+          depth: 1,
+        },
+        original_time: 'someTimeStamp',
+        status: 'open',
+        rule: {
+          id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
+          rule_id: 'rule-1',
+          false_positives: [],
+          max_signals: 10000,
+          risk_score: 50,
+          output_index: '.siem-signals',
+          description: 'Detecting root and admin users',
+          from: 'now-6m',
+          immutable: false,
+          index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
+          interval: '5m',
+          language: 'kuery',
+          name: 'rule-name',
+          query: 'user.name: root or user.name: admin',
+          references: ['http://google.com'],
+          severity: 'high',
+          tags: ['some fake tag 1', 'some fake tag 2'],
+          type: 'query',
+          to: 'now',
+          enabled: true,
+          created_by: 'elastic',
+          updated_by: 'elastic',
+        },
+      },
+    });
+  });
+
+  test('if bulk body builds original_event if it exists on the event to begin with', () => {
+    const sampleParams = sampleRuleAlertParams();
+    const doc = sampleDocNoSortId();
+    doc._source.event = {
+      action: 'socket_opened',
+      module: 'system',
+      dataset: 'socket',
+      kind: 'event',
+    };
+    const fakeSignalSourceHit = buildBulkBody({
+      doc,
+      ruleParams: sampleParams,
+      id: sampleRuleGuid,
+      name: 'rule-name',
+      createdBy: 'elastic',
+      updatedBy: 'elastic',
+      interval: '5m',
+      enabled: true,
+      tags: ['some fake tag 1', 'some fake tag 2'],
+    });
+    // Timestamp will potentially always be different so remove it for the test
+    delete fakeSignalSourceHit['@timestamp'];
+    expect(fakeSignalSourceHit).toEqual({
+      someKey: 'someValue',
+      event: {
+        action: 'socket_opened',
+        dataset: 'socket',
+        kind: 'signal',
+        module: 'system',
+      },
+      signal: {
+        original_event: {
+          action: 'socket_opened',
+          dataset: 'socket',
+          kind: 'event',
+          module: 'system',
+        },
+        parent: {
+          id: sampleIdGuid,
+          type: 'event',
+          index: 'myFakeSignalIndex',
+          depth: 1,
+        },
+        original_time: 'someTimeStamp',
+        status: 'open',
+        rule: {
+          id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
+          rule_id: 'rule-1',
+          false_positives: [],
+          max_signals: 10000,
+          risk_score: 50,
+          output_index: '.siem-signals',
+          description: 'Detecting root and admin users',
+          from: 'now-6m',
+          immutable: false,
+          index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
+          interval: '5m',
+          language: 'kuery',
+          name: 'rule-name',
+          query: 'user.name: root or user.name: admin',
+          references: ['http://google.com'],
+          severity: 'high',
+          tags: ['some fake tag 1', 'some fake tag 2'],
+          type: 'query',
+          to: 'now',
+          enabled: true,
+          created_by: 'elastic',
+          updated_by: 'elastic',
+        },
+      },
+    });
+  });
+
+  test('if bulk body builds original_event if it exists on the event to begin with but no kind information', () => {
+    const sampleParams = sampleRuleAlertParams();
+    const doc = sampleDocNoSortId();
+    doc._source.event = {
+      action: 'socket_opened',
+      module: 'system',
+      dataset: 'socket',
+    };
+    const fakeSignalSourceHit = buildBulkBody({
+      doc,
+      ruleParams: sampleParams,
+      id: sampleRuleGuid,
+      name: 'rule-name',
+      createdBy: 'elastic',
+      updatedBy: 'elastic',
+      interval: '5m',
+      enabled: true,
+      tags: ['some fake tag 1', 'some fake tag 2'],
+    });
+    // Timestamp will potentially always be different so remove it for the test
+    delete fakeSignalSourceHit['@timestamp'];
+    expect(fakeSignalSourceHit).toEqual({
+      someKey: 'someValue',
+      event: {
+        action: 'socket_opened',
+        dataset: 'socket',
+        kind: 'signal',
+        module: 'system',
+      },
+      signal: {
+        original_event: {
+          action: 'socket_opened',
+          dataset: 'socket',
+          module: 'system',
+        },
+        parent: {
+          id: sampleIdGuid,
+          type: 'event',
+          index: 'myFakeSignalIndex',
+          depth: 1,
+        },
+        original_time: 'someTimeStamp',
+        status: 'open',
+        rule: {
+          id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
+          rule_id: 'rule-1',
+          false_positives: [],
+          max_signals: 10000,
+          risk_score: 50,
+          output_index: '.siem-signals',
+          description: 'Detecting root and admin users',
+          from: 'now-6m',
+          immutable: false,
+          index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
+          interval: '5m',
+          language: 'kuery',
+          name: 'rule-name',
+          query: 'user.name: root or user.name: admin',
+          references: ['http://google.com'],
+          severity: 'high',
+          tags: ['some fake tag 1', 'some fake tag 2'],
+          type: 'query',
+          to: 'now',
+          enabled: true,
+          created_by: 'elastic',
+          updated_by: 'elastic',
+        },
+      },
+    });
+  });
+
+  test('if bulk body builds original_event if it exists on the event to begin with with only kind information', () => {
+    const sampleParams = sampleRuleAlertParams();
+    const doc = sampleDocNoSortId();
+    doc._source.event = {
+      kind: 'event',
+    };
+    const fakeSignalSourceHit = buildBulkBody({
+      doc,
+      ruleParams: sampleParams,
+      id: sampleRuleGuid,
+      name: 'rule-name',
+      createdBy: 'elastic',
+      updatedBy: 'elastic',
+      interval: '5m',
+      enabled: true,
+      tags: ['some fake tag 1', 'some fake tag 2'],
+    });
+    // Timestamp will potentially always be different so remove it for the test
+    delete fakeSignalSourceHit['@timestamp'];
+    expect(fakeSignalSourceHit).toEqual({
+      someKey: 'someValue',
+      event: {
+        kind: 'signal',
+      },
+      signal: {
+        original_event: {
+          kind: 'event',
+        },
+        parent: {
+          id: sampleIdGuid,
+          type: 'event',
+          index: 'myFakeSignalIndex',
+          depth: 1,
+        },
+        original_time: 'someTimeStamp',
+        status: 'open',
+        rule: {
+          id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
+          rule_id: 'rule-1',
+          false_positives: [],
+          max_signals: 10000,
+          risk_score: 50,
+          output_index: '.siem-signals',
+          description: 'Detecting root and admin users',
+          from: 'now-6m',
+          immutable: false,
+          index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
+          interval: '5m',
+          language: 'kuery',
+          name: 'rule-name',
+          query: 'user.name: root or user.name: admin',
+          references: ['http://google.com'],
+          severity: 'high',
+          tags: ['some fake tag 1', 'some fake tag 2'],
+          type: 'query',
+          to: 'now',
+          enabled: true,
+          created_by: 'elastic',
+          updated_by: 'elastic',
+        },
+      },
+    });
+  });
+});
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_bulk_body.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_bulk_body.ts
new file mode 100644
index 0000000000000..6d9f442515b2a
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_bulk_body.ts
@@ -0,0 +1,56 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { SignalSourceHit, SignalHit } from './types';
+import { buildRule } from './build_rule';
+import { buildSignal } from './build_signal';
+import { buildEventTypeSignal } from './build_event_type_signal';
+import { RuleTypeParams } from '../types';
+
+interface BuildBulkBodyParams {
+  doc: SignalSourceHit;
+  ruleParams: RuleTypeParams;
+  id: string;
+  name: string;
+  createdBy: string;
+  updatedBy: string;
+  interval: string;
+  enabled: boolean;
+  tags: string[];
+}
+
+// format search_after result for signals index.
+export const buildBulkBody = ({
+  doc,
+  ruleParams,
+  id,
+  name,
+  createdBy,
+  updatedBy,
+  interval,
+  enabled,
+  tags,
+}: BuildBulkBodyParams): SignalHit => {
+  const rule = buildRule({
+    ruleParams,
+    id,
+    name,
+    enabled,
+    createdBy,
+    updatedBy,
+    interval,
+    tags,
+  });
+  const signal = buildSignal(doc, rule);
+  const event = buildEventTypeSignal(doc);
+  const signalHit: SignalHit = {
+    ...doc._source,
+    '@timestamp': new Date().toISOString(),
+    event,
+    signal,
+  };
+  return signalHit;
+};
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_event_type_signal.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_event_type_signal.test.ts
new file mode 100644
index 0000000000000..106a049002e05
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_event_type_signal.test.ts
@@ -0,0 +1,47 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { sampleDocNoSortId } from './__mocks__/es_results';
+import { buildEventTypeSignal } from './build_event_type_signal';
+
+describe('buildEventTypeSignal', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  test('it returns the event appended of kind signal if it does not exist', () => {
+    const doc = sampleDocNoSortId();
+    delete doc._source.event;
+    const eventType = buildEventTypeSignal(doc);
+    const expected: object = { kind: 'signal' };
+    expect(eventType).toEqual(expected);
+  });
+
+  test('it returns the event appended of kind signal if it is an empty object', () => {
+    const doc = sampleDocNoSortId();
+    doc._source.event = {};
+    const eventType = buildEventTypeSignal(doc);
+    const expected: object = { kind: 'signal' };
+    expect(eventType).toEqual(expected);
+  });
+
+  test('it returns the event with kind signal and other properties if they exist', () => {
+    const doc = sampleDocNoSortId();
+    doc._source.event = {
+      action: 'socket_opened',
+      module: 'system',
+      dataset: 'socket',
+    };
+    const eventType = buildEventTypeSignal(doc);
+    const expected: object = {
+      action: 'socket_opened',
+      module: 'system',
+      dataset: 'socket',
+      kind: 'signal',
+    };
+    expect(eventType).toEqual(expected);
+  });
+});
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_event_type_signal.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_event_type_signal.ts
new file mode 100644
index 0000000000000..59cdc020c611d
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_event_type_signal.ts
@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { SignalSourceHit } from './types';
+
+export const buildEventTypeSignal = (doc: SignalSourceHit): object => {
+  if (doc._source.event != null && doc._source.event instanceof Object) {
+    return { ...doc._source.event, kind: 'signal' };
+  } else {
+    return { kind: 'signal' };
+  }
+};
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/build_events_query.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_events_query.test.ts
similarity index 100%
rename from x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/build_events_query.test.ts
rename to x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_events_query.test.ts
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/build_events_query.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_events_query.ts
similarity index 100%
rename from x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/build_events_query.ts
rename to x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_events_query.ts
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_rule.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_rule.test.ts
new file mode 100644
index 0000000000000..c12c6fd333f56
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_rule.test.ts
@@ -0,0 +1,156 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { buildRule } from './build_rule';
+import { sampleRuleAlertParams, sampleRuleGuid } from './__mocks__/es_results';
+import { OutputRuleAlertRest } from '../types';
+
+describe('buildRule', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  test('it builds a rule as expected with filters present', () => {
+    const ruleParams = sampleRuleAlertParams();
+    ruleParams.filters = [
+      {
+        query: 'host.name: Rebecca',
+      },
+      {
+        query: 'host.name: Evan',
+      },
+      {
+        query: 'host.name: Braden',
+      },
+    ];
+    const rule = buildRule({
+      ruleParams,
+      name: 'some-name',
+      id: sampleRuleGuid,
+      enabled: false,
+      createdBy: 'elastic',
+      updatedBy: 'elastic',
+      interval: 'some interval',
+      tags: ['some fake tag 1', 'some fake tag 2'],
+    });
+    const expected: Partial<OutputRuleAlertRest> = {
+      created_by: 'elastic',
+      description: 'Detecting root and admin users',
+      enabled: false,
+      false_positives: [],
+      from: 'now-6m',
+      id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
+      immutable: false,
+      index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
+      interval: 'some interval',
+      language: 'kuery',
+      max_signals: 10000,
+      name: 'some-name',
+      output_index: '.siem-signals',
+      query: 'user.name: root or user.name: admin',
+      references: ['http://google.com'],
+      risk_score: 50,
+      rule_id: 'rule-1',
+      severity: 'high',
+      tags: ['some fake tag 1', 'some fake tag 2'],
+      to: 'now',
+      type: 'query',
+      updated_by: 'elastic',
+      filters: [
+        {
+          query: 'host.name: Rebecca',
+        },
+        {
+          query: 'host.name: Evan',
+        },
+        {
+          query: 'host.name: Braden',
+        },
+      ],
+    };
+    expect(rule).toEqual(expected);
+  });
+
+  test('it omits a null value such as if enabled is null if is present', () => {
+    const ruleParams = sampleRuleAlertParams();
+    ruleParams.filters = undefined;
+    const rule = buildRule({
+      ruleParams,
+      name: 'some-name',
+      id: sampleRuleGuid,
+      enabled: true,
+      createdBy: 'elastic',
+      updatedBy: 'elastic',
+      interval: 'some interval',
+      tags: ['some fake tag 1', 'some fake tag 2'],
+    });
+    const expected: Partial<OutputRuleAlertRest> = {
+      created_by: 'elastic',
+      description: 'Detecting root and admin users',
+      enabled: true,
+      false_positives: [],
+      from: 'now-6m',
+      id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
+      immutable: false,
+      index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
+      interval: 'some interval',
+      language: 'kuery',
+      max_signals: 10000,
+      name: 'some-name',
+      output_index: '.siem-signals',
+      query: 'user.name: root or user.name: admin',
+      references: ['http://google.com'],
+      risk_score: 50,
+      rule_id: 'rule-1',
+      severity: 'high',
+      tags: ['some fake tag 1', 'some fake tag 2'],
+      to: 'now',
+      type: 'query',
+      updated_by: 'elastic',
+    };
+    expect(rule).toEqual(expected);
+  });
+
+  test('it omits a null value such as if filters is undefined if is present', () => {
+    const ruleParams = sampleRuleAlertParams();
+    ruleParams.filters = undefined;
+    const rule = buildRule({
+      ruleParams,
+      name: 'some-name',
+      id: sampleRuleGuid,
+      enabled: true,
+      createdBy: 'elastic',
+      updatedBy: 'elastic',
+      interval: 'some interval',
+      tags: ['some fake tag 1', 'some fake tag 2'],
+    });
+    const expected: Partial<OutputRuleAlertRest> = {
+      created_by: 'elastic',
+      description: 'Detecting root and admin users',
+      enabled: true,
+      false_positives: [],
+      from: 'now-6m',
+      id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
+      immutable: false,
+      index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
+      interval: 'some interval',
+      language: 'kuery',
+      max_signals: 10000,
+      name: 'some-name',
+      output_index: '.siem-signals',
+      query: 'user.name: root or user.name: admin',
+      references: ['http://google.com'],
+      risk_score: 50,
+      rule_id: 'rule-1',
+      severity: 'high',
+      tags: ['some fake tag 1', 'some fake tag 2'],
+      to: 'now',
+      type: 'query',
+      updated_by: 'elastic',
+    };
+    expect(rule).toEqual(expected);
+  });
+});
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_rule.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_rule.ts
new file mode 100644
index 0000000000000..64ec989208b6a
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_rule.ts
@@ -0,0 +1,59 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { pickBy } from 'lodash/fp';
+import { RuleTypeParams, OutputRuleAlertRest } from '../types';
+
+interface BuildRuleParams {
+  ruleParams: RuleTypeParams;
+  name: string;
+  id: string;
+  enabled: boolean;
+  createdBy: string;
+  updatedBy: string;
+  interval: string;
+  tags: string[];
+}
+
+export const buildRule = ({
+  ruleParams,
+  name,
+  id,
+  enabled,
+  createdBy,
+  updatedBy,
+  interval,
+  tags,
+}: BuildRuleParams): Partial<OutputRuleAlertRest> => {
+  return pickBy<OutputRuleAlertRest>((value: unknown) => value != null, {
+    id,
+    rule_id: ruleParams.ruleId,
+    false_positives: ruleParams.falsePositives,
+    saved_id: ruleParams.savedId,
+    meta: ruleParams.meta,
+    max_signals: ruleParams.maxSignals,
+    risk_score: ruleParams.riskScore,
+    output_index: ruleParams.outputIndex,
+    description: ruleParams.description,
+    from: ruleParams.from,
+    immutable: ruleParams.immutable,
+    index: ruleParams.index,
+    interval,
+    language: ruleParams.language,
+    name,
+    query: ruleParams.query,
+    references: ruleParams.references,
+    severity: ruleParams.severity,
+    tags,
+    type: ruleParams.type,
+    to: ruleParams.to,
+    enabled,
+    filters: ruleParams.filters,
+    created_by: createdBy,
+    updated_by: updatedBy,
+    threats: ruleParams.threats,
+  });
+};
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_signal.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_signal.test.ts
new file mode 100644
index 0000000000000..1c024d0496743
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_signal.test.ts
@@ -0,0 +1,111 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { sampleDocNoSortId, sampleRule } from './__mocks__/es_results';
+import { buildSignal } from './build_signal';
+import { OutputRuleAlertRest } from '../types';
+import { Signal } from './types';
+
+describe('buildSignal', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  test('it builds a signal as expected without original_event if event does not exist', () => {
+    const doc = sampleDocNoSortId('d5e8eb51-a6a0-456d-8a15-4b79bfec3d71');
+    delete doc._source.event;
+    const rule: Partial<OutputRuleAlertRest> = sampleRule();
+    const signal = buildSignal(doc, rule);
+    const expected: Signal = {
+      parent: {
+        id: 'd5e8eb51-a6a0-456d-8a15-4b79bfec3d71',
+        type: 'event',
+        index: 'myFakeSignalIndex',
+        depth: 1,
+      },
+      original_time: 'someTimeStamp',
+      status: 'open',
+      rule: {
+        created_by: 'elastic',
+        description: 'Detecting root and admin users',
+        enabled: true,
+        false_positives: [],
+        from: 'now-6m',
+        id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
+        immutable: false,
+        index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
+        interval: '5m',
+        risk_score: 50,
+        rule_id: 'rule-1',
+        language: 'kuery',
+        max_signals: 100,
+        name: 'Detect Root/Admin Users',
+        output_index: '.siem-signals',
+        query: 'user.name: root or user.name: admin',
+        references: ['http://www.example.com', 'https://ww.example.com'],
+        severity: 'high',
+        updated_by: 'elastic',
+        tags: ['some fake tag 1', 'some fake tag 2'],
+        to: 'now',
+        type: 'query',
+      },
+    };
+    expect(signal).toEqual(expected);
+  });
+
+  test('it builds a signal as expected with original_event if is present', () => {
+    const doc = sampleDocNoSortId('d5e8eb51-a6a0-456d-8a15-4b79bfec3d71');
+    doc._source.event = {
+      action: 'socket_opened',
+      dataset: 'socket',
+      kind: 'event',
+      module: 'system',
+    };
+    const rule: Partial<OutputRuleAlertRest> = sampleRule();
+    const signal = buildSignal(doc, rule);
+    const expected: Signal = {
+      parent: {
+        id: 'd5e8eb51-a6a0-456d-8a15-4b79bfec3d71',
+        type: 'event',
+        index: 'myFakeSignalIndex',
+        depth: 1,
+      },
+      original_time: 'someTimeStamp',
+      original_event: {
+        action: 'socket_opened',
+        dataset: 'socket',
+        kind: 'event',
+        module: 'system',
+      },
+      status: 'open',
+      rule: {
+        created_by: 'elastic',
+        description: 'Detecting root and admin users',
+        enabled: true,
+        false_positives: [],
+        from: 'now-6m',
+        id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
+        immutable: false,
+        index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
+        interval: '5m',
+        risk_score: 50,
+        rule_id: 'rule-1',
+        language: 'kuery',
+        max_signals: 100,
+        name: 'Detect Root/Admin Users',
+        output_index: '.siem-signals',
+        query: 'user.name: root or user.name: admin',
+        references: ['http://www.example.com', 'https://ww.example.com'],
+        severity: 'high',
+        updated_by: 'elastic',
+        tags: ['some fake tag 1', 'some fake tag 2'],
+        to: 'now',
+        type: 'query',
+      },
+    };
+    expect(signal).toEqual(expected);
+  });
+});
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_signal.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_signal.ts
new file mode 100644
index 0000000000000..4131c843297ea
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_signal.ts
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { SignalSourceHit, Signal } from './types';
+import { OutputRuleAlertRest } from '../types';
+
+export const buildSignal = (doc: SignalSourceHit, rule: Partial<OutputRuleAlertRest>): Signal => {
+  const signal: Signal = {
+    parent: {
+      id: doc._id,
+      type: 'event',
+      index: doc._index,
+      depth: 1,
+    },
+    original_time: doc._source['@timestamp'],
+    status: 'open',
+    rule,
+  };
+  if (doc._source.event != null) {
+    return { ...signal, original_event: doc._source.event };
+  }
+  return signal;
+};
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/get_filter.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/get_filter.test.ts
similarity index 99%
rename from x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/get_filter.test.ts
rename to x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/get_filter.test.ts
index e1d10e2efdefb..43b5ce4b590a3 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/get_filter.test.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/get_filter.test.ts
@@ -7,7 +7,7 @@
 import { getQueryFilter, getFilter } from './get_filter';
 import { savedObjectsClientMock } from 'src/core/server/mocks';
 import { AlertServices } from '../../../../../alerting/server/types';
-import { PartialFilter } from './types';
+import { PartialFilter } from '../types';
 
 describe('get_filter', () => {
   let savedObjectsClient = savedObjectsClientMock.create();
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/get_filter.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/get_filter.ts
similarity index 98%
rename from x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/get_filter.ts
rename to x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/get_filter.ts
index 858f3580f57e8..8a67d0cb5c5b6 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/get_filter.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/get_filter.ts
@@ -5,7 +5,6 @@
  */
 
 import { AlertServices } from '../../../../../alerting/server/types';
-import { RuleAlertParams, PartialFilter } from './types';
 import { assertUnreachable } from '../../../utils/build_query';
 import {
   Query,
@@ -13,6 +12,7 @@ import {
   esFilters,
   IIndexPattern,
 } from '../../../../../../../../src/plugins/data/server';
+import { PartialFilter, RuleAlertParams } from '../types';
 
 export const getQueryFilter = (
   query: string,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/get_input_output_index.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/get_input_output_index.test.ts
similarity index 100%
rename from x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/get_input_output_index.test.ts
rename to x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/get_input_output_index.test.ts
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/get_input_output_index.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/get_input_output_index.ts
similarity index 100%
rename from x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/get_input_output_index.ts
rename to x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/get_input_output_index.ts
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/search_after_bulk_create.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/search_after_bulk_create.test.ts
new file mode 100644
index 0000000000000..ac6f840943f18
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/search_after_bulk_create.test.ts
@@ -0,0 +1,286 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  sampleRuleAlertParams,
+  sampleEmptyDocSearchResults,
+  sampleRuleGuid,
+  mockLogger,
+  repeatedSearchResultsWithSortId,
+  sampleBulkCreateDuplicateResult,
+  sampleDocSearchResultsNoSortId,
+  sampleDocSearchResultsNoSortIdNoHits,
+} from './__mocks__/es_results';
+import { searchAfterAndBulkCreate } from './search_after_bulk_create';
+import { DEFAULT_SIGNALS_INDEX } from '../../../../common/constants';
+import { savedObjectsClientMock } from 'src/core/server/mocks';
+import uuid from 'uuid';
+
+export const mockService = {
+  callCluster: jest.fn(),
+  alertInstanceFactory: jest.fn(),
+  savedObjectsClient: savedObjectsClientMock.create(),
+};
+
+describe('searchAfterAndBulkCreate', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  test('if successful with empty search results', async () => {
+    const sampleParams = sampleRuleAlertParams();
+    const result = await searchAfterAndBulkCreate({
+      someResult: sampleEmptyDocSearchResults,
+      ruleParams: sampleParams,
+      services: mockService,
+      logger: mockLogger,
+      id: sampleRuleGuid,
+      signalsIndex: DEFAULT_SIGNALS_INDEX,
+      name: 'rule-name',
+      createdBy: 'elastic',
+      updatedBy: 'elastic',
+      interval: '5m',
+      enabled: true,
+      pageSize: 1,
+      filter: undefined,
+      tags: ['some fake tag 1', 'some fake tag 2'],
+    });
+    expect(mockService.callCluster).toHaveBeenCalledTimes(0);
+    expect(result).toEqual(true);
+  });
+  test('if successful iteration of while loop with maxDocs', async () => {
+    const sampleParams = sampleRuleAlertParams(30);
+    const someGuids = Array.from({ length: 13 }).map(x => uuid.v4());
+    mockService.callCluster
+      .mockReturnValueOnce({
+        took: 100,
+        errors: false,
+        items: [
+          {
+            fakeItemValue: 'fakeItemKey',
+          },
+        ],
+      })
+      .mockReturnValueOnce(repeatedSearchResultsWithSortId(3, 1, someGuids.slice(0, 3)))
+      .mockReturnValueOnce({
+        took: 100,
+        errors: false,
+        items: [
+          {
+            fakeItemValue: 'fakeItemKey',
+          },
+        ],
+      })
+      .mockReturnValueOnce(repeatedSearchResultsWithSortId(3, 1, someGuids.slice(3, 6)))
+      .mockReturnValueOnce({
+        took: 100,
+        errors: false,
+        items: [
+          {
+            fakeItemValue: 'fakeItemKey',
+          },
+        ],
+      });
+    const result = await searchAfterAndBulkCreate({
+      someResult: repeatedSearchResultsWithSortId(3, 1, someGuids.slice(6, 9)),
+      ruleParams: sampleParams,
+      services: mockService,
+      logger: mockLogger,
+      id: sampleRuleGuid,
+      signalsIndex: DEFAULT_SIGNALS_INDEX,
+      name: 'rule-name',
+      createdBy: 'elastic',
+      updatedBy: 'elastic',
+      interval: '5m',
+      enabled: true,
+      pageSize: 1,
+      filter: undefined,
+      tags: ['some fake tag 1', 'some fake tag 2'],
+    });
+    expect(mockService.callCluster).toHaveBeenCalledTimes(5);
+    expect(result).toEqual(true);
+  });
+  test('if unsuccessful first bulk create', async () => {
+    const someGuids = Array.from({ length: 4 }).map(x => uuid.v4());
+    const sampleParams = sampleRuleAlertParams(10);
+    mockService.callCluster.mockReturnValue(sampleBulkCreateDuplicateResult);
+    const result = await searchAfterAndBulkCreate({
+      someResult: repeatedSearchResultsWithSortId(4, 1, someGuids),
+      ruleParams: sampleParams,
+      services: mockService,
+      logger: mockLogger,
+      id: sampleRuleGuid,
+      signalsIndex: DEFAULT_SIGNALS_INDEX,
+      name: 'rule-name',
+      createdBy: 'elastic',
+      updatedBy: 'elastic',
+      interval: '5m',
+      enabled: true,
+      pageSize: 1,
+      filter: undefined,
+      tags: ['some fake tag 1', 'some fake tag 2'],
+    });
+    expect(mockLogger.error).toHaveBeenCalled();
+    expect(result).toEqual(false);
+  });
+  test('if unsuccessful iteration of searchAfterAndBulkCreate due to empty sort ids', async () => {
+    const sampleParams = sampleRuleAlertParams();
+    mockService.callCluster.mockReturnValueOnce({
+      took: 100,
+      errors: false,
+      items: [
+        {
+          fakeItemValue: 'fakeItemKey',
+        },
+      ],
+    });
+    const result = await searchAfterAndBulkCreate({
+      someResult: sampleDocSearchResultsNoSortId(),
+      ruleParams: sampleParams,
+      services: mockService,
+      logger: mockLogger,
+      id: sampleRuleGuid,
+      signalsIndex: DEFAULT_SIGNALS_INDEX,
+      name: 'rule-name',
+      createdBy: 'elastic',
+      updatedBy: 'elastic',
+      interval: '5m',
+      enabled: true,
+      pageSize: 1,
+      filter: undefined,
+      tags: ['some fake tag 1', 'some fake tag 2'],
+    });
+    expect(mockLogger.error).toHaveBeenCalled();
+    expect(result).toEqual(false);
+  });
+  test('if unsuccessful iteration of searchAfterAndBulkCreate due to empty sort ids and 0 total hits', async () => {
+    const sampleParams = sampleRuleAlertParams();
+    mockService.callCluster.mockReturnValueOnce({
+      took: 100,
+      errors: false,
+      items: [
+        {
+          fakeItemValue: 'fakeItemKey',
+        },
+      ],
+    });
+    const result = await searchAfterAndBulkCreate({
+      someResult: sampleDocSearchResultsNoSortIdNoHits(),
+      ruleParams: sampleParams,
+      services: mockService,
+      logger: mockLogger,
+      id: sampleRuleGuid,
+      signalsIndex: DEFAULT_SIGNALS_INDEX,
+      name: 'rule-name',
+      createdBy: 'elastic',
+      updatedBy: 'elastic',
+      interval: '5m',
+      enabled: true,
+      pageSize: 1,
+      filter: undefined,
+      tags: ['some fake tag 1', 'some fake tag 2'],
+    });
+    expect(result).toEqual(true);
+  });
+  test('if successful iteration of while loop with maxDocs and search after returns results with no sort ids', async () => {
+    const sampleParams = sampleRuleAlertParams(10);
+    const someGuids = Array.from({ length: 4 }).map(x => uuid.v4());
+    mockService.callCluster
+      .mockReturnValueOnce({
+        took: 100,
+        errors: false,
+        items: [
+          {
+            fakeItemValue: 'fakeItemKey',
+          },
+        ],
+      })
+      .mockReturnValueOnce(sampleDocSearchResultsNoSortId());
+    const result = await searchAfterAndBulkCreate({
+      someResult: repeatedSearchResultsWithSortId(4, 1, someGuids),
+      ruleParams: sampleParams,
+      services: mockService,
+      logger: mockLogger,
+      id: sampleRuleGuid,
+      signalsIndex: DEFAULT_SIGNALS_INDEX,
+      name: 'rule-name',
+      createdBy: 'elastic',
+      updatedBy: 'elastic',
+      interval: '5m',
+      enabled: true,
+      pageSize: 1,
+      filter: undefined,
+      tags: ['some fake tag 1', 'some fake tag 2'],
+    });
+    expect(result).toEqual(true);
+  });
+  test('if successful iteration of while loop with maxDocs and search after returns empty results with no sort ids', async () => {
+    const sampleParams = sampleRuleAlertParams(10);
+    const someGuids = Array.from({ length: 4 }).map(x => uuid.v4());
+    mockService.callCluster
+      .mockReturnValueOnce({
+        took: 100,
+        errors: false,
+        items: [
+          {
+            fakeItemValue: 'fakeItemKey',
+          },
+        ],
+      })
+      .mockReturnValueOnce(sampleEmptyDocSearchResults);
+    const result = await searchAfterAndBulkCreate({
+      someResult: repeatedSearchResultsWithSortId(4, 1, someGuids),
+      ruleParams: sampleParams,
+      services: mockService,
+      logger: mockLogger,
+      id: sampleRuleGuid,
+      signalsIndex: DEFAULT_SIGNALS_INDEX,
+      name: 'rule-name',
+      createdBy: 'elastic',
+      updatedBy: 'elastic',
+      interval: '5m',
+      enabled: true,
+      pageSize: 1,
+      filter: undefined,
+      tags: ['some fake tag 1', 'some fake tag 2'],
+    });
+    expect(result).toEqual(true);
+  });
+  test('if returns false when singleSearchAfter throws an exception', async () => {
+    const sampleParams = sampleRuleAlertParams(10);
+    const someGuids = Array.from({ length: 4 }).map(x => uuid.v4());
+    mockService.callCluster
+      .mockReturnValueOnce({
+        took: 100,
+        errors: false,
+        items: [
+          {
+            fakeItemValue: 'fakeItemKey',
+          },
+        ],
+      })
+      .mockImplementation(() => {
+        throw Error('Fake Error');
+      });
+    const result = await searchAfterAndBulkCreate({
+      someResult: repeatedSearchResultsWithSortId(4, 1, someGuids),
+      ruleParams: sampleParams,
+      services: mockService,
+      logger: mockLogger,
+      id: sampleRuleGuid,
+      signalsIndex: DEFAULT_SIGNALS_INDEX,
+      name: 'rule-name',
+      createdBy: 'elastic',
+      updatedBy: 'elastic',
+      interval: '5m',
+      enabled: true,
+      pageSize: 1,
+      filter: undefined,
+      tags: ['some fake tag 1', 'some fake tag 2'],
+    });
+    expect(result).toEqual(false);
+  });
+});
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/search_after_bulk_create.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/search_after_bulk_create.ts
new file mode 100644
index 0000000000000..fb314e62ba943
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/search_after_bulk_create.ts
@@ -0,0 +1,135 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { RuleTypeParams } from '../types';
+import { AlertServices } from '../../../../../alerting/server/types';
+import { Logger } from '../../../../../../../../src/core/server';
+import { singleSearchAfter } from './single_search_after';
+import { singleBulkCreate } from './single_bulk_create';
+import { SignalSearchResponse } from './types';
+
+interface SearchAfterAndBulkCreateParams {
+  someResult: SignalSearchResponse;
+  ruleParams: RuleTypeParams;
+  services: AlertServices;
+  logger: Logger;
+  id: string;
+  signalsIndex: string;
+  name: string;
+  createdBy: string;
+  updatedBy: string;
+  interval: string;
+  enabled: boolean;
+  pageSize: number;
+  filter: unknown;
+  tags: string[];
+}
+
+// search_after through documents and re-index using bulk endpoint.
+export const searchAfterAndBulkCreate = async ({
+  someResult,
+  ruleParams,
+  services,
+  logger,
+  id,
+  signalsIndex,
+  filter,
+  name,
+  createdBy,
+  updatedBy,
+  interval,
+  enabled,
+  pageSize,
+  tags,
+}: SearchAfterAndBulkCreateParams): Promise<boolean> => {
+  if (someResult.hits.hits.length === 0) {
+    return true;
+  }
+
+  logger.debug('[+] starting bulk insertion');
+  await singleBulkCreate({
+    someResult,
+    ruleParams,
+    services,
+    logger,
+    id,
+    signalsIndex,
+    name,
+    createdBy,
+    updatedBy,
+    interval,
+    enabled,
+    tags,
+  });
+  const totalHits =
+    typeof someResult.hits.total === 'number' ? someResult.hits.total : someResult.hits.total.value;
+  // maxTotalHitsSize represents the total number of docs to
+  // query for, no matter the size of each individual page of search results.
+  // If the total number of hits for the overall search result is greater than
+  // maxSignals, default to requesting a total of maxSignals, otherwise use the
+  // totalHits in the response from the searchAfter query.
+  const maxTotalHitsSize = totalHits >= ruleParams.maxSignals ? ruleParams.maxSignals : totalHits;
+
+  // number of docs in the current search result
+  let hitsSize = someResult.hits.hits.length;
+  logger.debug(`first size: ${hitsSize}`);
+  let sortIds = someResult.hits.hits[0].sort;
+  if (sortIds == null && totalHits > 0) {
+    logger.error('sortIds was empty on first search but expected more');
+    return false;
+  } else if (sortIds == null && totalHits === 0) {
+    return true;
+  }
+  let sortId;
+  if (sortIds != null) {
+    sortId = sortIds[0];
+  }
+  while (hitsSize < maxTotalHitsSize && hitsSize !== 0) {
+    try {
+      logger.debug(`sortIds: ${sortIds}`);
+      const searchAfterResult: SignalSearchResponse = await singleSearchAfter({
+        searchAfterSortId: sortId,
+        ruleParams,
+        services,
+        logger,
+        filter,
+        pageSize, // maximum number of docs to receive per search result.
+      });
+      if (searchAfterResult.hits.hits.length === 0) {
+        return true;
+      }
+      hitsSize += searchAfterResult.hits.hits.length;
+      logger.debug(`size adjusted: ${hitsSize}`);
+      sortIds = searchAfterResult.hits.hits[0].sort;
+      if (sortIds == null) {
+        logger.debug('sortIds was empty on search');
+        return true; // no more search results
+      }
+      sortId = sortIds[0];
+      logger.debug('next bulk index');
+      await singleBulkCreate({
+        someResult: searchAfterResult,
+        ruleParams,
+        services,
+        logger,
+        id,
+        signalsIndex,
+        name,
+        createdBy,
+        updatedBy,
+        interval,
+        enabled,
+        tags,
+      });
+      logger.debug('finished next bulk index');
+    } catch (exc) {
+      logger.error(`[-] search_after and bulk threw an error ${exc}`);
+      return false;
+    }
+  }
+  logger.debug(`[+] completed bulk index of ${maxTotalHitsSize}`);
+  return true;
+};
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/rules_alert_type.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/signal_rule_alert_type.ts
similarity index 96%
rename from x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/rules_alert_type.ts
rename to x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/signal_rule_alert_type.ts
index 9823d8b3b9bea..37467e405dd8e 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/rules_alert_type.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/signal_rule_alert_type.ts
@@ -13,18 +13,18 @@ import {
 } from '../../../../common/constants';
 
 import { buildEventsSearchQuery } from './build_events_query';
-import { searchAfterAndBulkCreate } from './utils';
-import { RuleAlertTypeDefinition } from './types';
-import { getFilter } from './get_filter';
 import { getInputIndex } from './get_input_output_index';
+import { searchAfterAndBulkCreate } from './search_after_bulk_create';
+import { getFilter } from './get_filter';
+import { SignalRuleAlertTypeDefinition } from './types';
 
-export const rulesAlertType = ({
+export const signalRulesAlertType = ({
   logger,
   version,
 }: {
   logger: Logger;
   version: string;
-}): RuleAlertTypeDefinition => {
+}): SignalRuleAlertTypeDefinition => {
   return {
     id: SIGNALS_ID,
     name: 'SIEM Signals',
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/single_bulk_create.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/single_bulk_create.test.ts
new file mode 100644
index 0000000000000..d58f0a22b763d
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/single_bulk_create.test.ts
@@ -0,0 +1,230 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { generateId } from './utils';
+import {
+  sampleRuleAlertParams,
+  sampleDocSearchResultsNoSortId,
+  mockLogger,
+  sampleRuleGuid,
+  sampleDocSearchResultsNoSortIdNoVersion,
+  sampleEmptyDocSearchResults,
+  sampleBulkCreateDuplicateResult,
+} from './__mocks__/es_results';
+import { savedObjectsClientMock } from 'src/core/server/mocks';
+import { DEFAULT_SIGNALS_INDEX } from '../../../../common/constants';
+import { singleBulkCreate } from './single_bulk_create';
+
+export const mockService = {
+  callCluster: jest.fn(),
+  alertInstanceFactory: jest.fn(),
+  savedObjectsClient: savedObjectsClientMock.create(),
+};
+
+describe('singleBulkCreate', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe('create signal id gereateId', () => {
+    test('two docs with same index, id, and version should have same id', () => {
+      const findex = 'myfakeindex';
+      const fid = 'somefakeid';
+      const version = '1';
+      const ruleId = 'rule-1';
+      // 'myfakeindexsomefakeid1rule-1'
+      const generatedHash = '342404d620be4344d6d90dd0461d1d1848aec457944d5c5f40cc0cbfedb36679';
+      const firstHash = generateId(findex, fid, version, ruleId);
+      const secondHash = generateId(findex, fid, version, ruleId);
+      expect(firstHash).toEqual(generatedHash);
+      expect(secondHash).toEqual(generatedHash);
+      expect(Buffer.byteLength(firstHash, 'utf8')).toBeLessThan(512); // 512 bytes is maximum size of _id field
+      expect(Buffer.byteLength(secondHash, 'utf8')).toBeLessThan(512);
+    });
+    test('two docs with different index, id, and version should have different id', () => {
+      const findex = 'myfakeindex';
+      const findex2 = 'mysecondfakeindex';
+      const fid = 'somefakeid';
+      const version = '1';
+      const ruleId = 'rule-1';
+      // 'myfakeindexsomefakeid1rule-1'
+      const firstGeneratedHash = '342404d620be4344d6d90dd0461d1d1848aec457944d5c5f40cc0cbfedb36679';
+      // 'mysecondfakeindexsomefakeid1rule-1'
+      const secondGeneratedHash =
+        'a852941273f805ffe9006e574601acc8ae1148d6c0b3f7f8c4785cba8f6b768a';
+      const firstHash = generateId(findex, fid, version, ruleId);
+      const secondHash = generateId(findex2, fid, version, ruleId);
+      expect(firstHash).toEqual(firstGeneratedHash);
+      expect(secondHash).toEqual(secondGeneratedHash);
+      expect(Buffer.byteLength(firstHash, 'utf8')).toBeLessThan(512); // 512 bytes is maximum size of _id field
+      expect(Buffer.byteLength(secondHash, 'utf8')).toBeLessThan(512);
+      expect(firstHash).not.toEqual(secondHash);
+    });
+    test('two docs with same index, different id, and same version should have different id', () => {
+      const findex = 'myfakeindex';
+      const fid = 'somefakeid';
+      const fid2 = 'somefakeid2';
+      const version = '1';
+      const ruleId = 'rule-1';
+      // 'myfakeindexsomefakeid1rule-1'
+      const firstGeneratedHash = '342404d620be4344d6d90dd0461d1d1848aec457944d5c5f40cc0cbfedb36679';
+      // 'myfakeindexsomefakeid21rule-1'
+      const secondGeneratedHash =
+        '7d33faea18159fd010c4b79890620e8b12cdc88ec1d370149d0e5552ce860255';
+      const firstHash = generateId(findex, fid, version, ruleId);
+      const secondHash = generateId(findex, fid2, version, ruleId);
+      expect(firstHash).toEqual(firstGeneratedHash);
+      expect(secondHash).toEqual(secondGeneratedHash);
+      expect(Buffer.byteLength(firstHash, 'utf8')).toBeLessThan(512); // 512 bytes is maximum size of _id field
+      expect(Buffer.byteLength(secondHash, 'utf8')).toBeLessThan(512);
+      expect(firstHash).not.toEqual(secondHash);
+    });
+    test('two docs with same index, same id, and different version should have different id', () => {
+      const findex = 'myfakeindex';
+      const fid = 'somefakeid';
+      const version = '1';
+      const version2 = '2';
+      const ruleId = 'rule-1';
+      // 'myfakeindexsomefakeid1rule-1'
+      const firstGeneratedHash = '342404d620be4344d6d90dd0461d1d1848aec457944d5c5f40cc0cbfedb36679';
+      // myfakeindexsomefakeid2rule-1'
+      const secondGeneratedHash =
+        'f016f3071fa9df9221d2fb2ba92389d4d388a4347c6ec7a4012c01cb1c640a40';
+      const firstHash = generateId(findex, fid, version, ruleId);
+      const secondHash = generateId(findex, fid, version2, ruleId);
+      expect(firstHash).toEqual(firstGeneratedHash);
+      expect(secondHash).toEqual(secondGeneratedHash);
+      expect(Buffer.byteLength(firstHash, 'utf8')).toBeLessThan(512); // 512 bytes is maximum size of _id field
+      expect(Buffer.byteLength(secondHash, 'utf8')).toBeLessThan(512);
+      expect(firstHash).not.toEqual(secondHash);
+    });
+    test('Ensure generated id is less than 512 bytes, even for really really long strings', () => {
+      const longIndexName =
+        'myfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindexmyfakeindex';
+      const fid = 'somefakeid';
+      const version = '1';
+      const ruleId = 'rule-1';
+      const firstHash = generateId(longIndexName, fid, version, ruleId);
+      expect(Buffer.byteLength(firstHash, 'utf8')).toBeLessThan(512); // 512 bytes is maximum size of _id field
+    });
+    test('two docs with same index, same id, same version number, and different rule ids should have different id', () => {
+      const findex = 'myfakeindex';
+      const fid = 'somefakeid';
+      const version = '1';
+      const ruleId = 'rule-1';
+      const ruleId2 = 'rule-2';
+      // 'myfakeindexsomefakeid1rule-1'
+      const firstGeneratedHash = '342404d620be4344d6d90dd0461d1d1848aec457944d5c5f40cc0cbfedb36679';
+      // myfakeindexsomefakeid1rule-2'
+      const secondGeneratedHash =
+        '1eb04f997086f8b3b143d4d9b18ac178c4a7423f71a5dad9ba8b9e92603c6863';
+      const firstHash = generateId(findex, fid, version, ruleId);
+      const secondHash = generateId(findex, fid, version, ruleId2);
+      expect(firstHash).toEqual(firstGeneratedHash);
+      expect(secondHash).toEqual(secondGeneratedHash);
+      expect(Buffer.byteLength(firstHash, 'utf8')).toBeLessThan(512); // 512 bytes is maximum size of _id field
+      expect(Buffer.byteLength(secondHash, 'utf8')).toBeLessThan(512);
+      expect(firstHash).not.toEqual(secondHash);
+    });
+  });
+  test('create successful bulk create', async () => {
+    const sampleParams = sampleRuleAlertParams();
+    const sampleSearchResult = sampleDocSearchResultsNoSortId;
+    mockService.callCluster.mockReturnValueOnce({
+      took: 100,
+      errors: false,
+      items: [
+        {
+          fakeItemValue: 'fakeItemKey',
+        },
+      ],
+    });
+    const successfulsingleBulkCreate = await singleBulkCreate({
+      someResult: sampleSearchResult(),
+      ruleParams: sampleParams,
+      services: mockService,
+      logger: mockLogger,
+      id: sampleRuleGuid,
+      signalsIndex: DEFAULT_SIGNALS_INDEX,
+      name: 'rule-name',
+      createdBy: 'elastic',
+      updatedBy: 'elastic',
+      interval: '5m',
+      enabled: true,
+      tags: ['some fake tag 1', 'some fake tag 2'],
+    });
+    expect(successfulsingleBulkCreate).toEqual(true);
+  });
+  test('create successful bulk create with docs with no versioning', async () => {
+    const sampleParams = sampleRuleAlertParams();
+    const sampleSearchResult = sampleDocSearchResultsNoSortIdNoVersion;
+    mockService.callCluster.mockReturnValueOnce({
+      took: 100,
+      errors: false,
+      items: [
+        {
+          fakeItemValue: 'fakeItemKey',
+        },
+      ],
+    });
+    const successfulsingleBulkCreate = await singleBulkCreate({
+      someResult: sampleSearchResult(),
+      ruleParams: sampleParams,
+      services: mockService,
+      logger: mockLogger,
+      id: sampleRuleGuid,
+      signalsIndex: DEFAULT_SIGNALS_INDEX,
+      name: 'rule-name',
+      createdBy: 'elastic',
+      updatedBy: 'elastic',
+      interval: '5m',
+      enabled: true,
+      tags: ['some fake tag 1', 'some fake tag 2'],
+    });
+    expect(successfulsingleBulkCreate).toEqual(true);
+  });
+  test('create unsuccessful bulk create due to empty search results', async () => {
+    const sampleParams = sampleRuleAlertParams();
+    const sampleSearchResult = sampleEmptyDocSearchResults;
+    mockService.callCluster.mockReturnValue(false);
+    const successfulsingleBulkCreate = await singleBulkCreate({
+      someResult: sampleSearchResult,
+      ruleParams: sampleParams,
+      services: mockService,
+      logger: mockLogger,
+      id: sampleRuleGuid,
+      signalsIndex: DEFAULT_SIGNALS_INDEX,
+      name: 'rule-name',
+      createdBy: 'elastic',
+      updatedBy: 'elastic',
+      interval: '5m',
+      enabled: true,
+      tags: ['some fake tag 1', 'some fake tag 2'],
+    });
+    expect(successfulsingleBulkCreate).toEqual(true);
+  });
+  test('create successful bulk create when bulk create has errors', async () => {
+    const sampleParams = sampleRuleAlertParams();
+    const sampleSearchResult = sampleDocSearchResultsNoSortId;
+    mockService.callCluster.mockReturnValue(sampleBulkCreateDuplicateResult);
+    const successfulsingleBulkCreate = await singleBulkCreate({
+      someResult: sampleSearchResult(),
+      ruleParams: sampleParams,
+      services: mockService,
+      logger: mockLogger,
+      id: sampleRuleGuid,
+      signalsIndex: DEFAULT_SIGNALS_INDEX,
+      name: 'rule-name',
+      createdBy: 'elastic',
+      updatedBy: 'elastic',
+      interval: '5m',
+      enabled: true,
+      tags: ['some fake tag 1', 'some fake tag 2'],
+    });
+    expect(mockLogger.error).toHaveBeenCalled();
+    expect(successfulsingleBulkCreate).toEqual(true);
+  });
+});
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/single_bulk_create.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/single_bulk_create.ts
new file mode 100644
index 0000000000000..40b2eeab938dc
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/single_bulk_create.ts
@@ -0,0 +1,106 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { performance } from 'perf_hooks';
+import { AlertServices } from '../../../../../alerting/server/types';
+import { SignalSearchResponse, BulkResponse } from './types';
+import { RuleTypeParams } from '../types';
+import { generateId } from './utils';
+import { buildBulkBody } from './build_bulk_body';
+import { Logger } from '../../../../../../../../src/core/server';
+
+interface SingleBulkCreateParams {
+  someResult: SignalSearchResponse;
+  ruleParams: RuleTypeParams;
+  services: AlertServices;
+  logger: Logger;
+  id: string;
+  signalsIndex: string;
+  name: string;
+  createdBy: string;
+  updatedBy: string;
+  interval: string;
+  enabled: boolean;
+  tags: string[];
+}
+
+// Bulk Index documents.
+export const singleBulkCreate = async ({
+  someResult,
+  ruleParams,
+  services,
+  logger,
+  id,
+  signalsIndex,
+  name,
+  createdBy,
+  updatedBy,
+  interval,
+  enabled,
+  tags,
+}: SingleBulkCreateParams): Promise<boolean> => {
+  if (someResult.hits.hits.length === 0) {
+    return true;
+  }
+  // index documents after creating an ID based on the
+  // source documents' originating index, and the original
+  // document _id. This will allow two documents from two
+  // different indexes with the same ID to be
+  // indexed, and prevents us from creating any updates
+  // to the documents once inserted into the signals index,
+  // while preventing duplicates from being added to the
+  // signals index if rules are re-run over the same time
+  // span. Also allow for versioning.
+  const bulkBody = someResult.hits.hits.flatMap(doc => [
+    {
+      create: {
+        _index: signalsIndex,
+        _id: generateId(
+          doc._index,
+          doc._id,
+          doc._version ? doc._version.toString() : '',
+          ruleParams.ruleId ?? ''
+        ),
+      },
+    },
+    buildBulkBody({ doc, ruleParams, id, name, createdBy, updatedBy, interval, enabled, tags }),
+  ]);
+  const time1 = performance.now();
+  const firstResult: BulkResponse = await services.callCluster('bulk', {
+    index: signalsIndex,
+    refresh: false,
+    body: bulkBody,
+  });
+  const time2 = performance.now();
+  logger.debug(
+    `individual bulk process time took: ${Number(time2 - time1).toFixed(2)} milliseconds`
+  );
+  logger.debug(`took property says bulk took: ${firstResult.took} milliseconds`);
+  if (firstResult.errors) {
+    // go through the response status errors and see what
+    // types of errors they are, count them up, and log them.
+    const errorCountMap = firstResult.items.reduce((acc: { [key: string]: number }, item) => {
+      if (item.create.error) {
+        const responseStatusKey = item.create.status.toString();
+        acc[responseStatusKey] = acc[responseStatusKey] ? acc[responseStatusKey] + 1 : 1;
+      }
+      return acc;
+    }, {});
+    /*
+     the logging output below should look like
+     {'409': 55}
+     which is read as "there were 55 counts of 409 errors returned from bulk create"
+    */
+    logger.error(
+      `[-] bulkResponse had errors with response statuses:counts of...\n${JSON.stringify(
+        errorCountMap,
+        null,
+        2
+      )}`
+    );
+  }
+  return true;
+};
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/single_search_after.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/single_search_after.test.ts
new file mode 100644
index 0000000000000..a5d1f66d3089e
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/single_search_after.test.ts
@@ -0,0 +1,73 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { savedObjectsClientMock } from 'src/core/server/mocks';
+import {
+  sampleRuleAlertParams,
+  sampleDocSearchResultsNoSortId,
+  mockLogger,
+  sampleDocSearchResultsWithSortId,
+} from './__mocks__/es_results';
+import { singleSearchAfter } from './single_search_after';
+
+export const mockService = {
+  callCluster: jest.fn(),
+  alertInstanceFactory: jest.fn(),
+  savedObjectsClient: savedObjectsClientMock.create(),
+};
+
+describe('singleSearchAfter', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  test('if singleSearchAfter works without a given sort id', async () => {
+    let searchAfterSortId;
+    const sampleParams = sampleRuleAlertParams();
+    mockService.callCluster.mockReturnValue(sampleDocSearchResultsNoSortId);
+    await expect(
+      singleSearchAfter({
+        searchAfterSortId,
+        ruleParams: sampleParams,
+        services: mockService,
+        logger: mockLogger,
+        pageSize: 1,
+        filter: undefined,
+      })
+    ).rejects.toThrow('Attempted to search after with empty sort id');
+  });
+  test('if singleSearchAfter works with a given sort id', async () => {
+    const searchAfterSortId = '1234567891111';
+    const sampleParams = sampleRuleAlertParams();
+    mockService.callCluster.mockReturnValue(sampleDocSearchResultsWithSortId);
+    const searchAfterResult = await singleSearchAfter({
+      searchAfterSortId,
+      ruleParams: sampleParams,
+      services: mockService,
+      logger: mockLogger,
+      pageSize: 1,
+      filter: undefined,
+    });
+    expect(searchAfterResult).toEqual(sampleDocSearchResultsWithSortId);
+  });
+  test('if singleSearchAfter throws error', async () => {
+    const searchAfterSortId = '1234567891111';
+    const sampleParams = sampleRuleAlertParams();
+    mockService.callCluster.mockImplementation(async () => {
+      throw Error('Fake Error');
+    });
+    await expect(
+      singleSearchAfter({
+        searchAfterSortId,
+        ruleParams: sampleParams,
+        services: mockService,
+        logger: mockLogger,
+        pageSize: 1,
+        filter: undefined,
+      })
+    ).rejects.toThrow('Fake Error');
+  });
+});
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/single_search_after.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/single_search_after.ts
new file mode 100644
index 0000000000000..3a99500cb3433
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/single_search_after.ts
@@ -0,0 +1,52 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { RuleTypeParams } from '../types';
+import { AlertServices } from '../../../../../alerting/server/types';
+import { Logger } from '../../../../../../../../src/core/server';
+import { SignalSearchResponse } from './types';
+import { buildEventsSearchQuery } from './build_events_query';
+
+interface SingleSearchAfterParams {
+  searchAfterSortId: string | undefined;
+  ruleParams: RuleTypeParams;
+  services: AlertServices;
+  logger: Logger;
+  pageSize: number;
+  filter: unknown;
+}
+
+// utilize search_after for paging results into bulk.
+export const singleSearchAfter = async ({
+  searchAfterSortId,
+  ruleParams,
+  services,
+  filter,
+  logger,
+  pageSize,
+}: SingleSearchAfterParams): Promise<SignalSearchResponse> => {
+  if (searchAfterSortId == null) {
+    throw Error('Attempted to search after with empty sort id');
+  }
+  try {
+    const searchAfterQuery = buildEventsSearchQuery({
+      index: ruleParams.index,
+      from: ruleParams.from,
+      to: ruleParams.to,
+      filter,
+      size: pageSize,
+      searchAfterSortId,
+    });
+    const nextSearchAfterResult: SignalSearchResponse = await services.callCluster(
+      'search',
+      searchAfterQuery
+    );
+    return nextSearchAfterResult;
+  } catch (exc) {
+    logger.error(`[-] nextSearchAfter threw an error ${exc}`);
+    throw exc;
+  }
+};
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/types.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/types.ts
new file mode 100644
index 0000000000000..213ceb29a6e25
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/types.ts
@@ -0,0 +1,123 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { RuleAlertParams, OutputRuleAlertRest } from '../types';
+import { SearchResponse } from '../../types';
+import { RequestFacade } from '../../../types';
+import { AlertType, State, AlertExecutorOptions } from '../../../../../alerting/server/types';
+
+export interface SignalsParams {
+  signalIds: string[] | undefined | null;
+  query: object | undefined | null;
+  status: 'open' | 'closed';
+}
+
+export type SignalsRestParams = Omit<SignalsParams, 'signalIds'> & {
+  signal_ids: SignalsParams['signalIds'];
+};
+
+export interface SignalsRequest extends RequestFacade {
+  payload: SignalsRestParams;
+}
+
+export type SearchTypes =
+  | string
+  | string[]
+  | number
+  | number[]
+  | boolean
+  | boolean[]
+  | object
+  | object[];
+
+export interface SignalSource {
+  [key: string]: SearchTypes;
+  '@timestamp': string;
+}
+
+export interface BulkResponse {
+  took: number;
+  errors: boolean;
+  items: [
+    {
+      create: {
+        _index: string;
+        _type?: string;
+        _id: string;
+        _version: number;
+        result?: string;
+        _shards?: {
+          total: number;
+          successful: number;
+          failed: number;
+        };
+        _seq_no?: number;
+        _primary_term?: number;
+        status: number;
+        error?: {
+          type: string;
+          reason: string;
+          index_uuid?: string;
+          shard: string;
+          index: string;
+        };
+      };
+    }
+  ];
+}
+
+export interface MGetResponse {
+  docs: GetResponse[];
+}
+export interface GetResponse {
+  _index: string;
+  _type: string;
+  _id: string;
+  _version: number;
+  _seq_no: number;
+  _primary_term: number;
+  found: boolean;
+  _source: SearchTypes;
+}
+
+export type SignalSearchResponse = SearchResponse<SignalSource>;
+export type SignalSourceHit = SignalSearchResponse['hits']['hits'][0];
+
+export type RuleExecutorOptions = Omit<AlertExecutorOptions, 'params'> & {
+  params: RuleAlertParams & {
+    scrollSize: number;
+    scrollLock: string;
+  };
+};
+
+// This returns true because by default a RuleAlertTypeDefinition is an AlertType
+// since we are only increasing the strictness of params.
+export const isAlertExecutor = (obj: SignalRuleAlertTypeDefinition): obj is AlertType => {
+  return true;
+};
+
+export type SignalRuleAlertTypeDefinition = Omit<AlertType, 'executor'> & {
+  executor: ({ services, params, state }: RuleExecutorOptions) => Promise<State | void>;
+};
+
+export interface Signal {
+  rule: Partial<OutputRuleAlertRest>;
+  parent: {
+    id: string;
+    type: string;
+    index: string;
+    depth: number;
+  };
+  original_time: string;
+  original_event?: SearchTypes;
+  status: 'open' | 'closed';
+}
+
+export interface SignalHit {
+  '@timestamp': string;
+  event: object;
+  signal: Partial<Signal>;
+}
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/utils.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/utils.ts
new file mode 100644
index 0000000000000..f25ce1d905466
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/utils.ts
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { createHash } from 'crypto';
+
+export const generateId = (
+  docIndex: string,
+  docId: string,
+  version: string,
+  ruleId: string
+): string =>
+  createHash('sha256')
+    .update(docIndex.concat(docId, version, ruleId))
+    .digest('hex');
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/types.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/types.ts
new file mode 100644
index 0000000000000..d02595c368aa7
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/types.ts
@@ -0,0 +1,67 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { esFilters } from '../../../../../../../src/plugins/data/server';
+
+export type PartialFilter = Partial<esFilters.Filter>;
+
+export interface IMitreAttack {
+  id: string;
+  name: string;
+  reference: string;
+}
+
+export interface ThreatParams {
+  framework: string;
+  tactic: IMitreAttack;
+  techniques: IMitreAttack[];
+}
+
+export interface RuleAlertParams {
+  description: string;
+  enabled: boolean;
+  falsePositives: string[];
+  filters: PartialFilter[] | undefined | null;
+  from: string;
+  immutable: boolean;
+  index: string[];
+  interval: string;
+  ruleId: string | undefined | null;
+  language: string | undefined | null;
+  maxSignals: number;
+  riskScore: number;
+  outputIndex: string;
+  name: string;
+  query: string | undefined | null;
+  references: string[];
+  savedId: string | undefined | null;
+  meta: Record<string, {}> | undefined | null;
+  severity: string;
+  tags: string[];
+  to: string;
+  threats: ThreatParams[] | undefined | null;
+  type: 'query' | 'saved_query';
+}
+
+export type RuleTypeParams = Omit<RuleAlertParams, 'name' | 'enabled' | 'interval' | 'tags'>;
+
+export type RuleAlertParamsRest = Omit<
+  RuleAlertParams,
+  'ruleId' | 'falsePositives' | 'maxSignals' | 'savedId' | 'riskScore' | 'outputIndex'
+> & {
+  rule_id: RuleAlertParams['ruleId'];
+  false_positives: RuleAlertParams['falsePositives'];
+  saved_id: RuleAlertParams['savedId'];
+  max_signals: RuleAlertParams['maxSignals'];
+  risk_score: RuleAlertParams['riskScore'];
+  output_index: RuleAlertParams['outputIndex'];
+};
+
+export type OutputRuleAlertRest = RuleAlertParamsRest & {
+  id: string;
+  created_by: string | undefined | null;
+  updated_by: string | undefined | null;
+};
diff --git a/x-pack/legacy/plugins/siem/server/lib/types.ts b/x-pack/legacy/plugins/siem/server/lib/types.ts
index e97a07e276dcf..9e4e477aa78d2 100644
--- a/x-pack/legacy/plugins/siem/server/lib/types.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/types.ts
@@ -23,7 +23,6 @@ import { Note } from './note/saved_object';
 import { PinnedEvent } from './pinned_event/saved_object';
 import { Timeline } from './timeline/saved_object';
 import { TLS } from './tls';
-import { SearchTypes, OutputRuleAlertRest } from './detection_engine/alerts/types';
 
 export * from './hosts';
 
@@ -55,25 +54,6 @@ export interface SiemContext {
   req: FrameworkRequest;
 }
 
-export interface Signal {
-  rule: Partial<OutputRuleAlertRest>;
-  parent: {
-    id: string;
-    type: string;
-    index: string;
-    depth: number;
-  };
-  original_time: string;
-  original_event?: SearchTypes;
-  status: 'open' | 'closed';
-}
-
-export interface SignalHit {
-  '@timestamp': string;
-  event: object;
-  signal: Partial<Signal>;
-}
-
 export interface TotalValue {
   value: number;
   relation: string;

From 8115e500ff9daf8172d02baca533a48787b9dcfa Mon Sep 17 00:00:00 2001
From: Xavier Mouligneau <189600+XavierM@users.noreply.github.com>
Date: Tue, 10 Dec 2019 10:46:56 -0500
Subject: [PATCH 04/24] [SIEM] [DETECTION ENG] Add MITRE ATT&CK (#52398)

* add mitre attack enterprise

* Add Mitre Att&ck on the about rule

* review

* fix internatiolazition

* bugs review

* fix ux with add reference
---
 x-pack/legacy/plugins/siem/package.json       |    1 +
 .../components/add_item_form/index.tsx        |   29 +-
 .../components/add_item_form/translations.ts  |   14 -
 .../components/description_step/index.tsx     |  124 +-
 .../create_rule/components/mitre/index.tsx    |  171 +
 .../components/mitre/translations.ts          |   36 +
 .../components/query_bar/index.tsx            |   59 +-
 .../step_about_rule/default_value.ts          |    7 +
 .../components/step_about_rule/index.tsx      |   11 +
 .../components/step_about_rule/schema.tsx     |   44 +-
 .../step_about_rule/translations.ts           |    7 +
 .../components/step_define_rule/index.tsx     |  267 +-
 .../components/step_define_rule/schema.tsx    |   21 -
 .../detection_engine/create_rule/helpers.ts   |   15 +-
 .../detection_engine/create_rule/index.tsx    |   15 +-
 .../create_rule/translations.ts               |    4 +
 .../detection_engine/create_rule/types.ts     |   16 +-
 .../mitre/mitre_tactics_techniques.ts         | 4696 +++++++++++++++++
 .../pages/detection_engine/mitre/types.ts     |   21 +
 .../extract_tactics_techniques_mitre.js       |  113 +
 20 files changed, 5441 insertions(+), 230 deletions(-)
 delete mode 100644 x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/add_item_form/translations.ts
 create mode 100644 x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/mitre/index.tsx
 create mode 100644 x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/mitre/translations.ts
 create mode 100644 x-pack/legacy/plugins/siem/public/pages/detection_engine/mitre/mitre_tactics_techniques.ts
 create mode 100644 x-pack/legacy/plugins/siem/public/pages/detection_engine/mitre/types.ts
 create mode 100644 x-pack/legacy/plugins/siem/scripts/extract_tactics_techniques_mitre.js

diff --git a/x-pack/legacy/plugins/siem/package.json b/x-pack/legacy/plugins/siem/package.json
index d239961ee75d7..ef6431327b5ab 100644
--- a/x-pack/legacy/plugins/siem/package.json
+++ b/x-pack/legacy/plugins/siem/package.json
@@ -5,6 +5,7 @@
   "private": true,
   "license": "Elastic-License",
   "scripts": {
+    "extract-mitre-attacks": "node scripts/extract_tactics_techniques_mitre.js & node ../../../../scripts/eslint ./public/pages/detection_engine/mitre/mitre_tactics_techniques.ts --fix",
     "build-graphql-types": "node scripts/generate_types_from_graphql.js",
     "cypress:open": "../../../node_modules/.bin/cypress open",
     "cypress:run": "../../../node_modules/.bin/cypress run --spec ./cypress/integration/**/*.spec.ts --reporter ../../../node_modules/cypress-multi-reporters --reporter-options configFile=./reporter_config.json; status=$?; ../../../node_modules/.bin/mochawesome-merge --reportDir ../../../../target/kibana-siem/cypress/results > ../../../../target/kibana-siem/cypress/results/output.json; ../../../../node_modules/.bin/marge ../../../../target/kibana-siem/cypress/results/output.json --reportDir ../../../../target/kibana-siem/cypress/results; mkdir -p ../../../../target/junit && cp ../../../../target/kibana-siem/cypress/results/*.xml ../../../../target/junit/ && exit $status;"
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/add_item_form/index.tsx b/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/add_item_form/index.tsx
index 04bca0cdbd61b..e972cd21b6be9 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/add_item_form/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/add_item_form/index.tsx
@@ -9,7 +9,7 @@ import { isEmpty } from 'lodash/fp';
 import React, { ChangeEvent, useCallback, useEffect, useState, useRef } from 'react';
 
 import { FieldHook, getFieldValidityAndErrorMessage } from '../shared_imports';
-import * as I18n from './translations';
+import * as CreateRuleI18n from '../../translations';
 
 interface AddItemProps {
   addText: string;
@@ -34,18 +34,21 @@ export const AddItem = ({ addText, dataTestSubj, field, idAria, isDisabled }: Ad
         ...inputsRef.current.slice(0, index),
         ...inputsRef.current.slice(index + 1),
       ];
-      if (inputsRef.current[index] != null) {
-        inputsRef.current[index].value = 're-render';
-      }
+      inputsRef.current = inputsRef.current.map((ref, i) => {
+        if (i >= index && inputsRef.current[index] != null) {
+          ref.value = 're-render';
+        }
+        return ref;
+      });
     },
     [field]
   );
 
   const addItem = useCallback(() => {
     const values = field.value as string[];
-    if (!isEmpty(values[values.length - 1])) {
+    if (!isEmpty(values) && values[values.length - 1]) {
       field.setValue([...values, '']);
-    } else {
+    } else if (isEmpty(values)) {
       field.setValue(['']);
     }
   }, [field]);
@@ -62,9 +65,12 @@ export const AddItem = ({ addText, dataTestSubj, field, idAria, isDisabled }: Ad
           ...inputsRef.current.slice(index + 1),
         ];
         setHaveBeenKeyboardDeleted(inputsRef.current.length - 1);
-        if (inputsRef.current[index] != null) {
-          inputsRef.current[index].value = 're-render';
-        }
+        inputsRef.current = inputsRef.current.map((ref, i) => {
+          if (i >= index && inputsRef.current[index] != null) {
+            ref.value = 're-render';
+          }
+          return ref;
+        });
       } else {
         field.setValue([...values.slice(0, index), value, ...values.slice(index + 1)]);
       }
@@ -114,7 +120,8 @@ export const AddItem = ({ addText, dataTestSubj, field, idAria, isDisabled }: Ad
             ...(index === values.length - 1
               ? { inputRef: handleLastInputRef.bind(null, index) }
               : {}),
-            ...(inputsRef.current[index] != null && inputsRef.current[index].value !== item
+            ...((inputsRef.current[index] != null && inputsRef.current[index].value !== item) ||
+            inputsRef.current[index] == null
               ? { value: item }
               : {}),
           };
@@ -127,7 +134,7 @@ export const AddItem = ({ addText, dataTestSubj, field, idAria, isDisabled }: Ad
                     iconType="trash"
                     isDisabled={isDisabled}
                     onClick={() => removeItem(index)}
-                    aria-label={I18n.DELETE}
+                    aria-label={CreateRuleI18n.DELETE}
                   />
                 }
                 onChange={e => updateItem(e, index)}
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/add_item_form/translations.ts b/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/add_item_form/translations.ts
deleted file mode 100644
index 98c15606d88fe..0000000000000
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/add_item_form/translations.ts
+++ /dev/null
@@ -1,14 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { i18n } from '@kbn/i18n';
-
-export const DELETE = i18n.translate(
-  'xpack.siem.detectionEngine.createRule.addItem.deleteDescription',
-  {
-    defaultMessage: 'Delete',
-  }
-);
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/description_step/index.tsx b/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/description_step/index.tsx
index 3e8147e5ca3c1..29e1bc228e066 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/description_step/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/description_step/index.tsx
@@ -4,7 +4,16 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { EuiBadge, EuiDescriptionList, EuiFlexGroup, EuiFlexItem, EuiTextArea } from '@elastic/eui';
+import {
+  EuiBadge,
+  EuiDescriptionList,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiTextArea,
+  EuiLink,
+  EuiText,
+  EuiListGroup,
+} from '@elastic/eui';
 import { isEmpty, chunk, get, pick } from 'lodash/fp';
 import React, { memo, ReactNode } from 'react';
 import styled from 'styled-components';
@@ -20,6 +29,9 @@ import { FilterLabel } from './filter_label';
 import { FormSchema } from '../shared_imports';
 import * as I18n from './translations';
 
+import { IMitreEnterpriseAttack } from '../../types';
+import { tacticsOptions, techniquesOptions } from '../../../mitre/mitre_tactics_techniques';
+
 interface StepRuleDescriptionProps {
   data: unknown;
   indexPatterns?: IIndexPattern;
@@ -36,16 +48,34 @@ const EuiFlexItemWidth = styled(EuiFlexItem)`
   width: 50%;
 `;
 
+const MyEuiListGroup = styled(EuiListGroup)`
+  padding: 0px;
+  .euiListGroupItem__button {
+    padding: 0px;
+  }
+`;
+
+const ThreatsEuiFlexGroup = styled(EuiFlexGroup)`
+  .euiFlexItem {
+    margin-bottom: 0px;
+  }
+`;
+
 export const StepRuleDescription = memo<StepRuleDescriptionProps>(
   ({ data, indexPatterns, schema }) => {
     const keys = Object.keys(schema);
+    const listItems = keys.reduce(
+      (acc: ListItems[], key: string) => [
+        ...acc,
+        ...buildListItems(data, pick(key, schema), indexPatterns),
+      ],
+      []
+    );
     return (
       <EuiFlexGroup gutterSize="none" direction="row" justifyContent="spaceAround">
-        {chunk(keys.includes('queryBar') ? 3 : Math.ceil(keys.length / 2), keys).map(key => (
-          <EuiFlexItemWidth grow={false}>
-            <EuiDescriptionList
-              listItems={buildListItems(data, pick(key, schema), indexPatterns)}
-            />
+        {chunk(Math.ceil(listItems.length / 2), listItems).map((chunckListItems, index) => (
+          <EuiFlexItemWidth key={`description-step-rule-${index}`} grow={false}>
+            <EuiDescriptionList listItems={chunckListItems} />
           </EuiFlexItemWidth>
         ))}
       </EuiFlexGroup>
@@ -77,7 +107,9 @@ const getDescriptionItem = (
   value: unknown,
   indexPatterns?: IIndexPattern
 ): ListItems[] => {
-  if (field === 'queryBar' && indexPatterns != null) {
+  if (field === 'useIndicesConfig') {
+    return [];
+  } else if (field === 'queryBar' && indexPatterns != null) {
     const filters = get('queryBar.filters', value) as esFilters.Filter[];
     const query = get('queryBar.query', value) as Query;
     const savedId = get('queryBar.saved_id', value);
@@ -123,6 +155,50 @@ const getDescriptionItem = (
       ];
     }
     return items;
+  } else if (field === 'threats') {
+    const threats: IMitreEnterpriseAttack[] = get(field, value).filter(
+      (threat: IMitreEnterpriseAttack) => threat.tactic.name !== 'none'
+    );
+    if (threats.length > 0) {
+      return [
+        {
+          title: label,
+          description: (
+            <ThreatsEuiFlexGroup direction="column">
+              {threats.map((threat, index) => {
+                const tactic = tacticsOptions.find(t => t.name === threat.tactic.name);
+                return (
+                  <EuiFlexItem key={`${threat.tactic.name}-${index}`}>
+                    <EuiText grow={false} size="s">
+                      <h5>
+                        <EuiLink href={threat.tactic.reference} target="_blank">
+                          {tactic != null ? tactic.text : ''}
+                        </EuiLink>
+                      </h5>
+                      <MyEuiListGroup
+                        flush={false}
+                        bordered={false}
+                        listItems={threat.techniques.map(technique => {
+                          const myTechnique = techniquesOptions.find(
+                            t => t.name === technique.name
+                          );
+                          return {
+                            label: myTechnique != null ? myTechnique.label : '',
+                            href: technique.reference,
+                            target: '_blank',
+                          };
+                        })}
+                      />
+                    </EuiText>
+                  </EuiFlexItem>
+                );
+              })}
+            </ThreatsEuiFlexGroup>
+          ),
+        },
+      ];
+    }
+    return [];
   } else if (field === 'description') {
     return [
       {
@@ -131,20 +207,26 @@ const getDescriptionItem = (
       },
     ];
   } else if (Array.isArray(get(field, value))) {
-    return [
-      {
-        title: label,
-        description: (
-          <EuiFlexGroup wrap responsive={false} gutterSize="xs">
-            {get(field, value).map((val: string) => (
-              <EuiFlexItem grow={false} key={`${field}-${val}`}>
-                <EuiBadgeWrap color="hollow">{val}</EuiBadgeWrap>
-              </EuiFlexItem>
-            ))}
-          </EuiFlexGroup>
-        ),
-      },
-    ];
+    const values: string[] = get(field, value);
+    if (!isEmpty(values) && values.filter(val => !isEmpty(val)).length > 0) {
+      return [
+        {
+          title: label,
+          description: (
+            <EuiFlexGroup responsive={false} gutterSize="xs">
+              {values.map((val: string) =>
+                isEmpty(val) ? null : (
+                  <EuiFlexItem grow={false} key={`${field}-${val}`}>
+                    <EuiBadgeWrap color="hollow">{val}</EuiBadgeWrap>
+                  </EuiFlexItem>
+                )
+              )}
+            </EuiFlexGroup>
+          ),
+        },
+      ];
+    }
+    return [];
   }
   return [
     {
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/mitre/index.tsx b/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/mitre/index.tsx
new file mode 100644
index 0000000000000..6ab4ca4b51447
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/mitre/index.tsx
@@ -0,0 +1,171 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  EuiButtonEmpty,
+  EuiButtonIcon,
+  EuiFormRow,
+  EuiSelect,
+  EuiSpacer,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiComboBox,
+  EuiFormControlLayout,
+} from '@elastic/eui';
+import { isEmpty, kebabCase, camelCase } from 'lodash/fp';
+import React, { ChangeEvent, useCallback } from 'react';
+import styled from 'styled-components';
+
+import { tacticsOptions, techniquesOptions } from '../../../mitre/mitre_tactics_techniques';
+import * as CreateRuleI18n from '../../translations';
+import { FieldHook, getFieldValidityAndErrorMessage } from '../shared_imports';
+import * as I18n from './translations';
+import { IMitreEnterpriseAttack } from '../../types';
+
+const MyEuiFormControlLayout = styled(EuiFormControlLayout)`
+  &.euiFormControlLayout--compressed {
+    height: fit-content !important;
+  }
+`;
+interface AddItemProps {
+  field: FieldHook;
+  dataTestSubj: string;
+  idAria: string;
+  isDisabled: boolean;
+}
+
+export const AddMitreThreat = ({ dataTestSubj, field, idAria, isDisabled }: AddItemProps) => {
+  const { isInvalid, errorMessage } = getFieldValidityAndErrorMessage(field);
+
+  const removeItem = useCallback(
+    (index: number) => {
+      const values = field.value as string[];
+      field.setValue([...values.slice(0, index), ...values.slice(index + 1)]);
+    },
+    [field]
+  );
+
+  const addItem = useCallback(() => {
+    const values = field.value as IMitreEnterpriseAttack[];
+    if (!isEmpty(values[values.length - 1])) {
+      field.setValue([
+        ...values,
+        { tactic: { id: 'none', name: 'none', reference: 'none' }, techniques: [] },
+      ]);
+    } else {
+      field.setValue([{ tactic: { id: 'none', name: 'none', reference: 'none' }, techniques: [] }]);
+    }
+  }, [field]);
+
+  const updateTactic = useCallback(
+    (index: number, event: ChangeEvent<HTMLSelectElement>) => {
+      const values = field.value as IMitreEnterpriseAttack[];
+      const { id, reference, name } = tacticsOptions.find(t => t.value === event.target.value) || {
+        id: '',
+        name: '',
+        reference: '',
+      };
+      field.setValue([
+        ...values.slice(0, index),
+        {
+          ...values[index],
+          tactic: { id, reference, name },
+          techniques: [],
+        },
+        ...values.slice(index + 1),
+      ]);
+    },
+    [field]
+  );
+
+  const updateTechniques = useCallback(
+    (index: number, selectedOptions: unknown[]) => {
+      field.setValue([
+        ...values.slice(0, index),
+        {
+          ...values[index],
+          techniques: selectedOptions,
+        },
+        ...values.slice(index + 1),
+      ]);
+    },
+    [field]
+  );
+
+  const values = field.value as IMitreEnterpriseAttack[];
+
+  return (
+    <EuiFormRow
+      label={field.label}
+      labelAppend={field.labelAppend}
+      error={errorMessage}
+      isInvalid={isInvalid}
+      fullWidth
+      data-test-subj={dataTestSubj}
+      describedByIds={idAria ? [idAria] : undefined}
+    >
+      <>
+        {values.map((item, index) => {
+          const euiSelectFieldProps = {
+            disabled: isDisabled,
+          };
+          return (
+            <div key={index}>
+              <EuiFlexGroup gutterSize="xs" justifyContent="spaceBetween" alignItems="center">
+                <EuiFlexItem grow={false}>
+                  <EuiSelect
+                    id="selectDocExample"
+                    options={[
+                      ...(item.tactic.name === 'none'
+                        ? [{ text: I18n.TACTIC_PLACEHOLDER, value: 'none' }]
+                        : []),
+                      ...tacticsOptions.map(t => ({ text: t.text, value: t.value })),
+                    ]}
+                    aria-label=""
+                    onChange={updateTactic.bind(null, index)}
+                    prepend={I18n.TACTIC}
+                    compressed
+                    fullWidth={false}
+                    value={camelCase(item.tactic.name)}
+                    {...euiSelectFieldProps}
+                  />
+                </EuiFlexItem>
+                <EuiFlexItem grow={true}>
+                  <MyEuiFormControlLayout compressed fullWidth prepend={I18n.TECHNIQUES}>
+                    <EuiComboBox
+                      compressed
+                      placeholder={I18n.TECHNIQUES_PLACEHOLDER}
+                      options={techniquesOptions.filter(t =>
+                        t.tactics.includes(kebabCase(item.tactic.name))
+                      )}
+                      selectedOptions={item.techniques}
+                      onChange={updateTechniques.bind(null, index)}
+                      isDisabled={isDisabled}
+                      fullWidth={true}
+                    />
+                  </MyEuiFormControlLayout>
+                </EuiFlexItem>
+                <EuiFlexItem grow={false}>
+                  <EuiButtonIcon
+                    color="danger"
+                    iconType="trash"
+                    isDisabled={isDisabled}
+                    onClick={() => removeItem(index)}
+                    aria-label={CreateRuleI18n.DELETE}
+                  />
+                </EuiFlexItem>
+              </EuiFlexGroup>
+              {values.length - 1 !== index && <EuiSpacer size="s" />}
+            </div>
+          );
+        })}
+        <EuiButtonEmpty size="xs" onClick={addItem} isDisabled={isDisabled}>
+          {I18n.ADD_MITRE_ATTACK}
+        </EuiButtonEmpty>
+      </>
+    </EuiFormRow>
+  );
+};
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/mitre/translations.ts b/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/mitre/translations.ts
new file mode 100644
index 0000000000000..22ee6cc3ef911
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/mitre/translations.ts
@@ -0,0 +1,36 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const TACTIC = i18n.translate('xpack.siem.detectionEngine.mitreAttack.tacticsDescription', {
+  defaultMessage: 'Tactic',
+});
+
+export const TECHNIQUES = i18n.translate(
+  'xpack.siem.detectionEngine.mitreAttack.techniquesDescription',
+  {
+    defaultMessage: 'Techniques',
+  }
+);
+
+export const ADD_MITRE_ATTACK = i18n.translate('xpack.siem.detectionEngine.mitreAttack.addTitle', {
+  defaultMessage: 'Add MITRE ATT&CK threat',
+});
+
+export const TECHNIQUES_PLACEHOLDER = i18n.translate(
+  'xpack.siem.detectionEngine.mitreAttack.techniquesPlaceHolderDescription',
+  {
+    defaultMessage: 'Select techniques ...',
+  }
+);
+
+export const TACTIC_PLACEHOLDER = i18n.translate(
+  'xpack.siem.detectionEngine.mitreAttack.tacticPlaceHolderDescription',
+  {
+    defaultMessage: 'Select tactic ...',
+  }
+);
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/query_bar/index.tsx b/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/query_bar/index.tsx
index 92b2f557d4cec..8dc402f00e621 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/query_bar/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/query_bar/index.tsx
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { EuiFormRow } from '@elastic/eui';
+import { EuiFormRow, EuiMutationObserver } from '@elastic/eui';
 import { isEqual } from 'lodash/fp';
 import React, { useCallback, useEffect, useState } from 'react';
 import { Subscription } from 'rxjs';
@@ -36,6 +36,7 @@ interface QueryBarDefineRuleProps {
   idAria: string;
   isLoading: boolean;
   indexPattern: IIndexPattern;
+  resizeParentContainer?: (height: number) => void;
 }
 
 const StyledEuiFormRow = styled(EuiFormRow)`
@@ -60,7 +61,9 @@ export const QueryBarDefineRule = ({
   idAria,
   indexPattern,
   isLoading = false,
+  resizeParentContainer,
 }: QueryBarDefineRuleProps) => {
+  const [originalHeight, setOriginalHeight] = useState(-1);
   const [savedQuery, setSavedQuery] = useState<SavedQuery | null>(null);
   const [queryDraft, setQueryDraft] = useState<Query>({ query: '', language: 'kuery' });
   const { isInvalid, errorMessage } = getFieldValidityAndErrorMessage(field);
@@ -165,6 +168,27 @@ export const QueryBarDefineRule = ({
     [field.value]
   );
 
+  const onMutation = (event: unknown, observer: unknown) => {
+    if (resizeParentContainer != null) {
+      const suggestionContainer = document.getElementById('kbnTypeahead__items');
+      if (suggestionContainer != null) {
+        const box = suggestionContainer.getBoundingClientRect();
+        const accordionContainer = document.getElementById('define-rule');
+        if (accordionContainer != null) {
+          const accordionBox = accordionContainer.getBoundingClientRect();
+          if (originalHeight === -1 || accordionBox.height < originalHeight + box.height) {
+            resizeParentContainer(originalHeight + box.height - 100);
+          }
+          if (originalHeight === -1) {
+            setOriginalHeight(accordionBox.height);
+          }
+        }
+      } else {
+        resizeParentContainer(-1);
+      }
+    }
+  };
+
   return (
     <StyledEuiFormRow
       label={field.label}
@@ -176,18 +200,27 @@ export const QueryBarDefineRule = ({
       data-test-subj={dataTestSubj}
       describedByIds={idAria ? [idAria] : undefined}
     >
-      <QueryBar
-        indexPattern={indexPattern}
-        isLoading={isLoading}
-        isRefreshPaused={false}
-        filterQuery={queryDraft}
-        filterManager={filterManager}
-        filters={filterManager.getFilters() || []}
-        onChangedQuery={onChangedQuery}
-        onSubmitQuery={onSubmitQuery}
-        savedQuery={savedQuery}
-        onSavedQuery={onSavedQuery}
-      />
+      <EuiMutationObserver
+        observerOptions={{ subtree: true, attributes: true, childList: true }}
+        onMutation={onMutation}
+      >
+        {mutationRef => (
+          <div ref={mutationRef}>
+            <QueryBar
+              indexPattern={indexPattern}
+              isLoading={isLoading}
+              isRefreshPaused={false}
+              filterQuery={queryDraft}
+              filterManager={filterManager}
+              filters={filterManager.getFilters() || []}
+              onChangedQuery={onChangedQuery}
+              onSubmitQuery={onSubmitQuery}
+              savedQuery={savedQuery}
+              onSavedQuery={onSavedQuery}
+            />
+          </div>
+        )}
+      </EuiMutationObserver>
     </StyledEuiFormRow>
   );
 };
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/step_about_rule/default_value.ts b/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/step_about_rule/default_value.ts
index 7c4d78f364479..504b5ca85a3ab 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/step_about_rule/default_value.ts
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/step_about_rule/default_value.ts
@@ -15,4 +15,11 @@ export const defaultValue: AboutStepRule = {
   references: [''],
   falsePositives: [''],
   tags: [],
+  threats: [
+    {
+      framework: 'MITRE ATT&CK',
+      tactic: { id: 'none', name: 'none', reference: 'none' },
+      techniques: [],
+    },
+  ],
 };
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/step_about_rule/index.tsx b/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/step_about_rule/index.tsx
index 56830f252748f..aeb70061c44bf 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/step_about_rule/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/step_about_rule/index.tsx
@@ -16,6 +16,7 @@ import { defaultValue } from './default_value';
 import { schema } from './schema';
 import * as I18n from './translations';
 import { StepRuleDescription } from '../description_step';
+import { AddMitreThreat } from '../mitre';
 
 const CommonUseField = getUseField({ component: Field });
 
@@ -114,6 +115,16 @@ export const StepAboutRule = memo<RuleStepProps>(({ isEditView, isLoading, setSt
             dataTestSubj: 'detectionEngineStepAboutRuleFalsePositives',
           }}
         />
+        <UseField
+          path="threats"
+          component={AddMitreThreat}
+          componentProps={{
+            compressed: true,
+            idAria: 'detectionEngineStepAboutRuleMitreThreats',
+            isDisabled: isLoading,
+            dataTestSubj: 'detectionEngineStepAboutRuleMitreThreats',
+          }}
+        />
         <CommonUseField
           path="tags"
           componentProps={{
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/step_about_rule/schema.tsx b/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/step_about_rule/schema.tsx
index da908bdf02e43..534c3142335c5 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/step_about_rule/schema.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/step_about_rule/schema.tsx
@@ -5,11 +5,20 @@
  */
 
 import { EuiText } from '@elastic/eui';
-import React from 'react';
 import { i18n } from '@kbn/i18n';
+import { isEmpty } from 'lodash/fp';
+import React from 'react';
 
 import * as CreateRuleI18n from '../../translations';
-import { FIELD_TYPES, fieldValidators, FormSchema } from '../shared_imports';
+import { IMitreEnterpriseAttack } from '../../types';
+import {
+  FIELD_TYPES,
+  fieldValidators,
+  FormSchema,
+  ValidationFunc,
+  ERROR_CODE,
+} from '../shared_imports';
+import * as I18n from './translations';
 
 const { emptyField } = fieldValidators;
 
@@ -101,6 +110,37 @@ export const schema: FormSchema = {
     ),
     labelAppend: <EuiText size="xs">{CreateRuleI18n.OPTIONAL_FIELD}</EuiText>,
   },
+  threats: {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.createRule.stepAboutRule.fieldMitreThreatLabel',
+      {
+        defaultMessage: 'MITRE ATT&CK',
+      }
+    ),
+    labelAppend: <EuiText size="xs">{CreateRuleI18n.OPTIONAL_FIELD}</EuiText>,
+    validations: [
+      {
+        validator: (
+          ...args: Parameters<ValidationFunc>
+        ): ReturnType<ValidationFunc<{}, ERROR_CODE>> | undefined => {
+          const [{ value, path }] = args;
+          let hasError = false;
+          (value as IMitreEnterpriseAttack[]).forEach(v => {
+            if (isEmpty(v.tactic.name) || (v.tactic.name !== 'none' && isEmpty(v.techniques))) {
+              hasError = true;
+            }
+          });
+          return hasError
+            ? {
+                code: 'ERR_FIELD_MISSING',
+                path,
+                message: I18n.CUSTOM_MITRE_ATTACK_TECHNIQUES_REQUIRED,
+              }
+            : undefined;
+        },
+      },
+    ],
+  },
   tags: {
     type: FIELD_TYPES.COMBO_BOX,
     label: i18n.translate('xpack.siem.detectionEngine.createRule.stepAboutRule.fieldTagsLabel', {
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/step_about_rule/translations.ts b/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/step_about_rule/translations.ts
index bd759b345d70d..017d4fe6fdf49 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/step_about_rule/translations.ts
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/step_about_rule/translations.ts
@@ -47,3 +47,10 @@ export const CRITICAL = i18n.translate(
     defaultMessage: 'Critical',
   }
 );
+
+export const CUSTOM_MITRE_ATTACK_TECHNIQUES_REQUIRED = i18n.translate(
+  'xpack.siem.detectionEngine.createRule.stepDefineRule.customMitreAttackTechniquesFieldRequiredError',
+  {
+    defaultMessage: 'At least one Technique is required with a Tactic.',
+  }
+);
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/step_define_rule/index.tsx b/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/step_define_rule/index.tsx
index 26306d3573926..6954bd6bf733f 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/step_define_rule/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/step_define_rule/index.tsx
@@ -6,11 +6,11 @@
 
 import { EuiHorizontalRule, EuiFlexGroup, EuiFlexItem, EuiButton } from '@elastic/eui';
 import { isEqual } from 'lodash/fp';
-import React, { memo, useCallback, useEffect, useState } from 'react';
+import React, { memo, useCallback, useState } from 'react';
 
 import { IIndexPattern } from '../../../../../../../../../../src/plugins/data/public';
 import { useFetchIndexPatterns } from '../../../../../containers/detection_engine/rules/fetch_index_patterns';
-import { DEFAULT_INDEX_KEY, DEFAULT_SIGNALS_INDEX_KEY } from '../../../../../../common/constants';
+import { DEFAULT_INDEX_KEY } from '../../../../../../common/constants';
 import { useKibanaUiSetting } from '../../../../../lib/settings/use_kibana_ui_setting';
 import * as CreateRuleI18n from '../../translations';
 import { DefineStepRule, RuleStep, RuleStepProps } from '../../types';
@@ -22,148 +22,133 @@ import * as I18n from './translations';
 
 const CommonUseField = getUseField({ component: Field });
 
-export const StepDefineRule = memo<RuleStepProps>(({ isEditView, isLoading, setStepData }) => {
-  const [initializeOutputIndex, setInitializeOutputIndex] = useState(true);
-  const [localUseIndicesConfig, setLocalUseIndicesConfig] = useState('');
-  const [
-    { indexPatterns: indexPatternQueryBar, isLoading: indexPatternLoadingQueryBar },
-    setIndices,
-  ] = useFetchIndexPatterns();
-  const [indicesConfig] = useKibanaUiSetting(DEFAULT_INDEX_KEY);
-  const [signalIndexConfig] = useKibanaUiSetting(DEFAULT_SIGNALS_INDEX_KEY);
-  const [myStepData, setMyStepData] = useState<DefineStepRule>({
-    index: indicesConfig || [],
-    isNew: true,
-    outputIndex: signalIndexConfig,
-    queryBar: {
-      query: { query: '', language: 'kuery' },
-      filters: [],
-      saved_id: null,
-    },
-    useIndicesConfig: 'true',
-  });
-  const { form } = useForm({
-    schema,
-    defaultValue: myStepData,
-    options: { stripEmptyFields: false },
-  });
+export const StepDefineRule = memo<RuleStepProps>(
+  ({ isEditView, isLoading, resizeParentContainer, setStepData }) => {
+    const [localUseIndicesConfig, setLocalUseIndicesConfig] = useState('');
+    const [
+      { indexPatterns: indexPatternQueryBar, isLoading: indexPatternLoadingQueryBar },
+      setIndices,
+    ] = useFetchIndexPatterns();
+    const [indicesConfig] = useKibanaUiSetting(DEFAULT_INDEX_KEY);
+    const [myStepData, setMyStepData] = useState<DefineStepRule>({
+      index: indicesConfig || [],
+      isNew: true,
+      queryBar: {
+        query: { query: '', language: 'kuery' },
+        filters: [],
+        saved_id: null,
+      },
+      useIndicesConfig: 'true',
+    });
+    const { form } = useForm({
+      schema,
+      defaultValue: myStepData,
+      options: { stripEmptyFields: false },
+    });
 
-  const onSubmit = useCallback(async () => {
-    const { isValid, data } = await form.submit();
-    if (isValid) {
-      setStepData(RuleStep.defineRule, data, isValid);
-      setMyStepData({ ...data, isNew: false } as DefineStepRule);
-    }
-  }, [form]);
+    const onSubmit = useCallback(async () => {
+      const { isValid, data } = await form.submit();
+      if (isValid) {
+        setStepData(RuleStep.defineRule, data, isValid);
+        setMyStepData({ ...data, isNew: false } as DefineStepRule);
+      }
+    }, [form]);
 
-  useEffect(() => {
-    if (signalIndexConfig != null && initializeOutputIndex) {
-      const outputIndexField = form.getFields().outputIndex;
-      outputIndexField.setValue(signalIndexConfig);
-      setInitializeOutputIndex(false);
-    }
-  }, [initializeOutputIndex, signalIndexConfig, form]);
-
-  return isEditView && myStepData != null ? (
-    <StepRuleDescription
-      indexPatterns={indexPatternQueryBar as IIndexPattern}
-      schema={schema}
-      data={myStepData}
-    />
-  ) : (
-    <>
-      <Form form={form} data-test-subj="stepDefineRule">
-        <CommonUseField
-          path="useIndicesConfig"
-          componentProps={{
-            idAria: 'detectionEngineStepDefineRuleUseIndicesConfig',
-            'data-test-subj': 'detectionEngineStepDefineRuleUseIndicesConfig',
-            euiFieldProps: {
-              disabled: isLoading,
-              options: [
-                {
-                  id: 'true',
-                  label: I18n.CONFIG_INDICES,
-                },
-                {
-                  id: 'false',
-                  label: I18n.CUSTOM_INDICES,
-                },
-              ],
-            },
-          }}
-        />
-        <CommonUseField
-          path="index"
-          componentProps={{
-            idAria: 'detectionEngineStepDefineRuleIndices',
-            'data-test-subj': 'detectionEngineStepDefineRuleIndices',
-            euiFieldProps: {
+    return isEditView && myStepData != null ? (
+      <StepRuleDescription
+        indexPatterns={indexPatternQueryBar as IIndexPattern}
+        schema={schema}
+        data={myStepData}
+      />
+    ) : (
+      <>
+        <Form form={form} data-test-subj="stepDefineRule">
+          <CommonUseField
+            path="useIndicesConfig"
+            componentProps={{
+              idAria: 'detectionEngineStepDefineRuleUseIndicesConfig',
+              'data-test-subj': 'detectionEngineStepDefineRuleUseIndicesConfig',
+              euiFieldProps: {
+                disabled: isLoading,
+                options: [
+                  {
+                    id: 'true',
+                    label: I18n.CONFIG_INDICES,
+                  },
+                  {
+                    id: 'false',
+                    label: I18n.CUSTOM_INDICES,
+                  },
+                ],
+              },
+            }}
+          />
+          <CommonUseField
+            path="index"
+            componentProps={{
+              idAria: 'detectionEngineStepDefineRuleIndices',
+              'data-test-subj': 'detectionEngineStepDefineRuleIndices',
+              euiFieldProps: {
+                compressed: true,
+                fullWidth: true,
+                isDisabled: isLoading,
+              },
+            }}
+          />
+          <UseField
+            path="queryBar"
+            component={QueryBarDefineRule}
+            componentProps={{
               compressed: true,
-              fullWidth: true,
+              loading: indexPatternLoadingQueryBar,
+              idAria: 'detectionEngineStepDefineRuleQueryBar',
+              indexPattern: indexPatternQueryBar,
               isDisabled: isLoading,
-            },
-          }}
-        />
-        <UseField
-          path="queryBar"
-          component={QueryBarDefineRule}
-          componentProps={{
-            compressed: true,
-            loading: indexPatternLoadingQueryBar,
-            idAria: 'detectionEngineStepDefineRuleQueryBar',
-            indexPattern: indexPatternQueryBar,
-            isDisabled: isLoading,
-            isLoading: indexPatternLoadingQueryBar,
-            dataTestSubj: 'detectionEngineStepDefineRuleQueryBar',
-          }}
-        />
-        <CommonUseField
-          path="outputIndex"
-          componentProps={{
-            idAria: 'detectionEngineStepDefineRuleOutputIndex',
-            'data-test-subj': 'detectionEngineStepDefineRuleOutputIndex',
-            euiFieldProps: {
-              compressed: true,
-              fullWidth: false,
-              disabled: isLoading,
-            },
-          }}
-        />
-        <FormDataProvider pathsToWatch="useIndicesConfig">
-          {({ useIndicesConfig }) => {
-            if (localUseIndicesConfig !== useIndicesConfig) {
-              const indexField = form.getFields().index;
-              if (
-                indexField != null &&
-                useIndicesConfig === 'true' &&
-                !isEqual(indexField.value, indicesConfig)
-              ) {
-                indexField.setValue(indicesConfig);
-                setIndices(indicesConfig);
-              } else if (
-                indexField != null &&
-                useIndicesConfig === 'false' &&
-                isEqual(indexField.value, indicesConfig)
-              ) {
-                indexField.setValue([]);
-                setIndices([]);
+              isLoading: indexPatternLoadingQueryBar,
+              dataTestSubj: 'detectionEngineStepDefineRuleQueryBar',
+              resizeParentContainer,
+            }}
+          />
+          <FormDataProvider pathsToWatch="useIndicesConfig">
+            {({ useIndicesConfig }) => {
+              if (localUseIndicesConfig !== useIndicesConfig) {
+                const indexField = form.getFields().index;
+                if (
+                  indexField != null &&
+                  useIndicesConfig === 'true' &&
+                  !isEqual(indexField.value, indicesConfig)
+                ) {
+                  indexField.setValue(indicesConfig);
+                  setIndices(indicesConfig);
+                } else if (
+                  indexField != null &&
+                  useIndicesConfig === 'false' &&
+                  isEqual(indexField.value, indicesConfig)
+                ) {
+                  indexField.setValue([]);
+                  setIndices([]);
+                }
+                setLocalUseIndicesConfig(useIndicesConfig);
               }
-              setLocalUseIndicesConfig(useIndicesConfig);
-            }
 
-            return null;
-          }}
-        </FormDataProvider>
-      </Form>
-      <EuiHorizontalRule margin="m" />
-      <EuiFlexGroup alignItems="center" justifyContent="flexEnd" gutterSize="xs" responsive={false}>
-        <EuiFlexItem grow={false}>
-          <EuiButton fill onClick={onSubmit} isDisabled={isLoading}>
-            {myStepData.isNew ? CreateRuleI18n.CONTINUE : CreateRuleI18n.UPDATE}
-          </EuiButton>
-        </EuiFlexItem>
-      </EuiFlexGroup>
-    </>
-  );
-});
+              return null;
+            }}
+          </FormDataProvider>
+        </Form>
+        <EuiHorizontalRule margin="m" />
+        <EuiFlexGroup
+          alignItems="center"
+          justifyContent="flexEnd"
+          gutterSize="xs"
+          responsive={false}
+        >
+          <EuiFlexItem grow={false}>
+            <EuiButton fill onClick={onSubmit} isDisabled={isLoading}>
+              {myStepData.isNew ? CreateRuleI18n.CONTINUE : CreateRuleI18n.UPDATE}
+            </EuiButton>
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      </>
+    );
+  }
+);
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/step_define_rule/schema.tsx b/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/step_define_rule/schema.tsx
index 9f1644e73bf0b..0f6c5f72e1683 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/step_define_rule/schema.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/components/step_define_rule/schema.tsx
@@ -26,27 +26,6 @@ import { CUSTOM_QUERY_REQUIRED, INVALID_CUSTOM_QUERY } from './translations';
 const { emptyField } = fieldValidators;
 
 export const schema: FormSchema = {
-  outputIndex: {
-    type: FIELD_TYPES.TEXT,
-    label: i18n.translate(
-      'xpack.siem.detectionEngine.createRule.stepDefineRule.fieldOutputIndiceNameLabel',
-      {
-        defaultMessage: 'Output index name',
-      }
-    ),
-    validations: [
-      {
-        validator: emptyField(
-          i18n.translate(
-            'xpack.siem.detectionEngine.createRule.stepDefineRule.outputIndiceNameFieldRequiredError',
-            {
-              defaultMessage: 'An output indice name for signals is required.',
-            }
-          )
-        ),
-      },
-    ],
-  },
   useIndicesConfig: {
     type: FIELD_TYPES.RADIO_GROUP,
     label: i18n.translate(
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/helpers.ts b/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/helpers.ts
index b864260dd3338..f6546a680ad81 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/helpers.ts
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/helpers.ts
@@ -40,13 +40,12 @@ const getTimeTypeValue = (time: string): { unit: string; value: number } => {
 };
 
 const formatDefineStepData = (defineStepData: DefineStepRule): DefineStepRuleJson => {
-  const { queryBar, useIndicesConfig, outputIndex, ...rest } = defineStepData;
+  const { queryBar, useIndicesConfig, ...rest } = defineStepData;
   const { filters, query, saved_id: savedId } = queryBar;
   return {
     ...rest,
     language: query.language,
     filters,
-    output_index: outputIndex,
     query: query.query as string,
     ...(savedId != null ? { saved_id: savedId } : {}),
   };
@@ -69,12 +68,22 @@ const formatScheduleStepData = (scheduleData: ScheduleStepRule): ScheduleStepRul
 };
 
 const formatAboutStepData = (aboutStepData: AboutStepRule): AboutStepRuleJson => {
-  const { falsePositives, references, riskScore, ...rest } = aboutStepData;
+  const { falsePositives, references, riskScore, threats, ...rest } = aboutStepData;
 
   return {
     false_positives: falsePositives.filter(item => !isEmpty(item)),
     references: references.filter(item => !isEmpty(item)),
     risk_score: riskScore,
+    threats: threats
+      .filter(threat => threat.tactic.name !== 'none')
+      .map(threat => ({
+        ...threat,
+        framework: 'MITRE ATT&CK',
+        techniques: threat.techniques.map(technique => {
+          const { id, name, reference } = technique;
+          return { id, name, reference };
+        }),
+      })),
     ...rest,
   };
 };
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/index.tsx b/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/index.tsx
index 878c7171d19ed..393b72d16b0a4 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/index.tsx
@@ -7,6 +7,7 @@
 import { EuiButtonEmpty, EuiAccordion, EuiHorizontalRule, EuiPanel, EuiSpacer } from '@elastic/eui';
 import React, { useCallback, useRef, useState } from 'react';
 import { Redirect } from 'react-router-dom';
+import styled from 'styled-components';
 
 import { HeaderPage } from '../../../components/header_page';
 import { WrapperPage } from '../../../components/wrapper_page';
@@ -24,7 +25,16 @@ import { DETECTION_ENGINE_PAGE_NAME } from '../../../components/link_to/redirect
 
 const stepsRuleOrder = [RuleStep.defineRule, RuleStep.aboutRule, RuleStep.scheduleRule];
 
+const ResizeEuiPanel = styled(EuiPanel)<{
+  height?: number;
+}>`
+  .euiAccordion__childWrapper {
+    height: ${props => (props.height !== -1 ? `${props.height}px !important` : 'auto')};
+  }
+`;
+
 export const CreateRuleComponent = React.memo(() => {
+  const [heightAccordion, setHeightAccordion] = useState(-1);
   const [openAccordionId, setOpenAccordionId] = useState<RuleStep | null>(RuleStep.defineRule);
   const defineRuleRef = useRef<EuiAccordion | null>(null);
   const aboutRuleRef = useRef<EuiAccordion | null>(null);
@@ -169,7 +179,7 @@ export const CreateRuleComponent = React.memo(() => {
           isLoading={isLoading}
           title={i18n.PAGE_TITLE}
         />
-        <EuiPanel>
+        <ResizeEuiPanel height={heightAccordion}>
           <EuiAccordion
             initialIsOpen={true}
             id={RuleStep.defineRule}
@@ -194,9 +204,10 @@ export const CreateRuleComponent = React.memo(() => {
               isEditView={isStepRuleInEditView[RuleStep.defineRule]}
               isLoading={isLoading}
               setStepData={setStepData}
+              resizeParentContainer={height => setHeightAccordion(height)}
             />
           </EuiAccordion>
-        </EuiPanel>
+        </ResizeEuiPanel>
         <EuiSpacer size="s" />
         <EuiPanel>
           <EuiAccordion
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/translations.ts b/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/translations.ts
index 1ef3a435bbc30..5ff9dffb658ab 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/translations.ts
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/translations.ts
@@ -42,3 +42,7 @@ export const CONTINUE = i18n.translate(
 export const UPDATE = i18n.translate('xpack.siem.detectionEngine.createRule.updateButtonTitle', {
   defaultMessage: 'Update',
 });
+
+export const DELETE = i18n.translate('xpack.siem.detectionEngine.createRule.deleteDescription', {
+  defaultMessage: 'Delete',
+});
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/types.ts b/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/types.ts
index 8c395c458e59a..241e4530b4b57 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/types.ts
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/create_rule/types.ts
@@ -23,6 +23,7 @@ export interface RuleStepProps {
   setStepData: (step: RuleStep, data: unknown, isValid: boolean) => void;
   isEditView: boolean;
   isLoading: boolean;
+  resizeParentContainer?: (height: number) => void;
 }
 
 interface StepRuleData {
@@ -36,10 +37,10 @@ export interface AboutStepRule extends StepRuleData {
   references: string[];
   falsePositives: string[];
   tags: string[];
+  threats: IMitreEnterpriseAttack[];
 }
 
 export interface DefineStepRule extends StepRuleData {
-  outputIndex: string;
   useIndicesConfig: string;
   index: string[];
   queryBar: FieldValueQueryBar;
@@ -53,7 +54,6 @@ export interface ScheduleStepRule extends StepRuleData {
 }
 
 export interface DefineStepRuleJson {
-  output_index: string;
   index: string[];
   filters: esFilters.Filter[];
   saved_id?: string;
@@ -69,8 +69,20 @@ export interface AboutStepRuleJson {
   references: string[];
   false_positives: string[];
   tags: string[];
+  threats: IMitreEnterpriseAttack[];
 }
 
 export type ScheduleStepRuleJson = ScheduleStepRule;
 
 export type FormatRuleType = 'query' | 'saved_query';
+
+export interface IMitreAttack {
+  id: string;
+  name: string;
+  reference: string;
+}
+export interface IMitreEnterpriseAttack {
+  framework: string;
+  tactic: IMitreAttack;
+  techniques: IMitreAttack[];
+}
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/mitre/mitre_tactics_techniques.ts b/x-pack/legacy/plugins/siem/public/pages/detection_engine/mitre/mitre_tactics_techniques.ts
new file mode 100644
index 0000000000000..160e006c4d267
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/mitre/mitre_tactics_techniques.ts
@@ -0,0 +1,4696 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+import { MitreTacticsOptions, MitreTechniquesOptions } from './types';
+
+export const tactics = [
+  {
+    name: 'Collection',
+    id: 'TA0009',
+    reference: 'https://attack.mitre.org/tactics/TA0009',
+  },
+  {
+    name: 'Command and Control',
+    id: 'TA0011',
+    reference: 'https://attack.mitre.org/tactics/TA0011',
+  },
+  {
+    name: 'Credential Access',
+    id: 'TA0006',
+    reference: 'https://attack.mitre.org/tactics/TA0006',
+  },
+  {
+    name: 'Defense Evasion',
+    id: 'TA0005',
+    reference: 'https://attack.mitre.org/tactics/TA0005',
+  },
+  {
+    name: 'Discovery',
+    id: 'TA0007',
+    reference: 'https://attack.mitre.org/tactics/TA0007',
+  },
+  {
+    name: 'Execution',
+    id: 'TA0002',
+    reference: 'https://attack.mitre.org/tactics/TA0002',
+  },
+  {
+    name: 'Exfiltration',
+    id: 'TA0010',
+    reference: 'https://attack.mitre.org/tactics/TA0010',
+  },
+  {
+    name: 'Impact',
+    id: 'TA0040',
+    reference: 'https://attack.mitre.org/tactics/TA0040',
+  },
+  {
+    name: 'Initial Access',
+    id: 'TA0001',
+    reference: 'https://attack.mitre.org/tactics/TA0001',
+  },
+  {
+    name: 'Lateral Movement',
+    id: 'TA0008',
+    reference: 'https://attack.mitre.org/tactics/TA0008',
+  },
+  {
+    name: 'Persistence',
+    id: 'TA0003',
+    reference: 'https://attack.mitre.org/tactics/TA0003',
+  },
+  {
+    name: 'Privilege Escalation',
+    id: 'TA0004',
+    reference: 'https://attack.mitre.org/tactics/TA0004',
+  },
+];
+
+export const tacticsOptions: MitreTacticsOptions[] = [
+  {
+    id: 'TA0009',
+    name: 'Collection',
+    reference: 'https://attack.mitre.org/tactics/TA0009',
+    text: i18n.translate('xpack.siem.detectionEngine.mitreAttackTactics.collectionDescription', {
+      defaultMessage: 'Collection (TA0009)',
+    }),
+    value: 'collection',
+  },
+  {
+    id: 'TA0011',
+    name: 'Command and Control',
+    reference: 'https://attack.mitre.org/tactics/TA0011',
+    text: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTactics.commandAndControlDescription',
+      { defaultMessage: 'Command and Control (TA0011)' }
+    ),
+    value: 'commandAndControl',
+  },
+  {
+    id: 'TA0006',
+    name: 'Credential Access',
+    reference: 'https://attack.mitre.org/tactics/TA0006',
+    text: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTactics.credentialAccessDescription',
+      { defaultMessage: 'Credential Access (TA0006)' }
+    ),
+    value: 'credentialAccess',
+  },
+  {
+    id: 'TA0005',
+    name: 'Defense Evasion',
+    reference: 'https://attack.mitre.org/tactics/TA0005',
+    text: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTactics.defenseEvasionDescription',
+      { defaultMessage: 'Defense Evasion (TA0005)' }
+    ),
+    value: 'defenseEvasion',
+  },
+  {
+    id: 'TA0007',
+    name: 'Discovery',
+    reference: 'https://attack.mitre.org/tactics/TA0007',
+    text: i18n.translate('xpack.siem.detectionEngine.mitreAttackTactics.discoveryDescription', {
+      defaultMessage: 'Discovery (TA0007)',
+    }),
+    value: 'discovery',
+  },
+  {
+    id: 'TA0002',
+    name: 'Execution',
+    reference: 'https://attack.mitre.org/tactics/TA0002',
+    text: i18n.translate('xpack.siem.detectionEngine.mitreAttackTactics.executionDescription', {
+      defaultMessage: 'Execution (TA0002)',
+    }),
+    value: 'execution',
+  },
+  {
+    id: 'TA0010',
+    name: 'Exfiltration',
+    reference: 'https://attack.mitre.org/tactics/TA0010',
+    text: i18n.translate('xpack.siem.detectionEngine.mitreAttackTactics.exfiltrationDescription', {
+      defaultMessage: 'Exfiltration (TA0010)',
+    }),
+    value: 'exfiltration',
+  },
+  {
+    id: 'TA0040',
+    name: 'Impact',
+    reference: 'https://attack.mitre.org/tactics/TA0040',
+    text: i18n.translate('xpack.siem.detectionEngine.mitreAttackTactics.impactDescription', {
+      defaultMessage: 'Impact (TA0040)',
+    }),
+    value: 'impact',
+  },
+  {
+    id: 'TA0001',
+    name: 'Initial Access',
+    reference: 'https://attack.mitre.org/tactics/TA0001',
+    text: i18n.translate('xpack.siem.detectionEngine.mitreAttackTactics.initialAccessDescription', {
+      defaultMessage: 'Initial Access (TA0001)',
+    }),
+    value: 'initialAccess',
+  },
+  {
+    id: 'TA0008',
+    name: 'Lateral Movement',
+    reference: 'https://attack.mitre.org/tactics/TA0008',
+    text: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTactics.lateralMovementDescription',
+      { defaultMessage: 'Lateral Movement (TA0008)' }
+    ),
+    value: 'lateralMovement',
+  },
+  {
+    id: 'TA0003',
+    name: 'Persistence',
+    reference: 'https://attack.mitre.org/tactics/TA0003',
+    text: i18n.translate('xpack.siem.detectionEngine.mitreAttackTactics.persistenceDescription', {
+      defaultMessage: 'Persistence (TA0003)',
+    }),
+    value: 'persistence',
+  },
+  {
+    id: 'TA0004',
+    name: 'Privilege Escalation',
+    reference: 'https://attack.mitre.org/tactics/TA0004',
+    text: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTactics.privilegeEscalationDescription',
+      { defaultMessage: 'Privilege Escalation (TA0004)' }
+    ),
+    value: 'privilegeEscalation',
+  },
+];
+
+export const techniques = [
+  {
+    name: '.bash_profile and .bashrc',
+    id: 'T1156',
+    reference: 'https://attack.mitre.org/techniques/T1156',
+    tactics: ['persistence'],
+  },
+  {
+    name: 'Access Token Manipulation',
+    id: 'T1134',
+    reference: 'https://attack.mitre.org/techniques/T1134',
+    tactics: ['defense-evasion', 'privilege-escalation'],
+  },
+  {
+    name: 'Accessibility Features',
+    id: 'T1015',
+    reference: 'https://attack.mitre.org/techniques/T1015',
+    tactics: ['persistence', 'privilege-escalation'],
+  },
+  {
+    name: 'Account Access Removal',
+    id: 'T1531',
+    reference: 'https://attack.mitre.org/techniques/T1531',
+    tactics: ['impact'],
+  },
+  {
+    name: 'Account Discovery',
+    id: 'T1087',
+    reference: 'https://attack.mitre.org/techniques/T1087',
+    tactics: ['discovery'],
+  },
+  {
+    name: 'Account Manipulation',
+    id: 'T1098',
+    reference: 'https://attack.mitre.org/techniques/T1098',
+    tactics: ['credential-access', 'persistence'],
+  },
+  {
+    name: 'AppCert DLLs',
+    id: 'T1182',
+    reference: 'https://attack.mitre.org/techniques/T1182',
+    tactics: ['persistence', 'privilege-escalation'],
+  },
+  {
+    name: 'AppInit DLLs',
+    id: 'T1103',
+    reference: 'https://attack.mitre.org/techniques/T1103',
+    tactics: ['persistence', 'privilege-escalation'],
+  },
+  {
+    name: 'AppleScript',
+    id: 'T1155',
+    reference: 'https://attack.mitre.org/techniques/T1155',
+    tactics: ['execution', 'lateral-movement'],
+  },
+  {
+    name: 'Application Access Token',
+    id: 'T1527',
+    reference: 'https://attack.mitre.org/techniques/T1527',
+    tactics: ['defense-evasion', 'lateral-movement'],
+  },
+  {
+    name: 'Application Deployment Software',
+    id: 'T1017',
+    reference: 'https://attack.mitre.org/techniques/T1017',
+    tactics: ['lateral-movement'],
+  },
+  {
+    name: 'Application Shimming',
+    id: 'T1138',
+    reference: 'https://attack.mitre.org/techniques/T1138',
+    tactics: ['persistence', 'privilege-escalation'],
+  },
+  {
+    name: 'Application Window Discovery',
+    id: 'T1010',
+    reference: 'https://attack.mitre.org/techniques/T1010',
+    tactics: ['discovery'],
+  },
+  {
+    name: 'Audio Capture',
+    id: 'T1123',
+    reference: 'https://attack.mitre.org/techniques/T1123',
+    tactics: ['collection'],
+  },
+  {
+    name: 'Authentication Package',
+    id: 'T1131',
+    reference: 'https://attack.mitre.org/techniques/T1131',
+    tactics: ['persistence'],
+  },
+  {
+    name: 'Automated Collection',
+    id: 'T1119',
+    reference: 'https://attack.mitre.org/techniques/T1119',
+    tactics: ['collection'],
+  },
+  {
+    name: 'Automated Exfiltration',
+    id: 'T1020',
+    reference: 'https://attack.mitre.org/techniques/T1020',
+    tactics: ['exfiltration'],
+  },
+  {
+    name: 'BITS Jobs',
+    id: 'T1197',
+    reference: 'https://attack.mitre.org/techniques/T1197',
+    tactics: ['defense-evasion', 'persistence'],
+  },
+  {
+    name: 'Bash History',
+    id: 'T1139',
+    reference: 'https://attack.mitre.org/techniques/T1139',
+    tactics: ['credential-access'],
+  },
+  {
+    name: 'Binary Padding',
+    id: 'T1009',
+    reference: 'https://attack.mitre.org/techniques/T1009',
+    tactics: ['defense-evasion'],
+  },
+  {
+    name: 'Bootkit',
+    id: 'T1067',
+    reference: 'https://attack.mitre.org/techniques/T1067',
+    tactics: ['persistence'],
+  },
+  {
+    name: 'Browser Bookmark Discovery',
+    id: 'T1217',
+    reference: 'https://attack.mitre.org/techniques/T1217',
+    tactics: ['discovery'],
+  },
+  {
+    name: 'Browser Extensions',
+    id: 'T1176',
+    reference: 'https://attack.mitre.org/techniques/T1176',
+    tactics: ['persistence'],
+  },
+  {
+    name: 'Brute Force',
+    id: 'T1110',
+    reference: 'https://attack.mitre.org/techniques/T1110',
+    tactics: ['credential-access'],
+  },
+  {
+    name: 'Bypass User Account Control',
+    id: 'T1088',
+    reference: 'https://attack.mitre.org/techniques/T1088',
+    tactics: ['defense-evasion', 'privilege-escalation'],
+  },
+  {
+    name: 'CMSTP',
+    id: 'T1191',
+    reference: 'https://attack.mitre.org/techniques/T1191',
+    tactics: ['defense-evasion', 'execution'],
+  },
+  {
+    name: 'Change Default File Association',
+    id: 'T1042',
+    reference: 'https://attack.mitre.org/techniques/T1042',
+    tactics: ['persistence'],
+  },
+  {
+    name: 'Clear Command History',
+    id: 'T1146',
+    reference: 'https://attack.mitre.org/techniques/T1146',
+    tactics: ['defense-evasion'],
+  },
+  {
+    name: 'Clipboard Data',
+    id: 'T1115',
+    reference: 'https://attack.mitre.org/techniques/T1115',
+    tactics: ['collection'],
+  },
+  {
+    name: 'Cloud Instance Metadata API',
+    id: 'T1522',
+    reference: 'https://attack.mitre.org/techniques/T1522',
+    tactics: ['credential-access'],
+  },
+  {
+    name: 'Cloud Service Dashboard',
+    id: 'T1538',
+    reference: 'https://attack.mitre.org/techniques/T1538',
+    tactics: ['discovery'],
+  },
+  {
+    name: 'Cloud Service Discovery',
+    id: 'T1526',
+    reference: 'https://attack.mitre.org/techniques/T1526',
+    tactics: ['discovery'],
+  },
+  {
+    name: 'Code Signing',
+    id: 'T1116',
+    reference: 'https://attack.mitre.org/techniques/T1116',
+    tactics: ['defense-evasion'],
+  },
+  {
+    name: 'Command-Line Interface',
+    id: 'T1059',
+    reference: 'https://attack.mitre.org/techniques/T1059',
+    tactics: ['execution'],
+  },
+  {
+    name: 'Commonly Used Port',
+    id: 'T1043',
+    reference: 'https://attack.mitre.org/techniques/T1043',
+    tactics: ['command-and-control'],
+  },
+  {
+    name: 'Communication Through Removable Media',
+    id: 'T1092',
+    reference: 'https://attack.mitre.org/techniques/T1092',
+    tactics: ['command-and-control'],
+  },
+  {
+    name: 'Compile After Delivery',
+    id: 'T1500',
+    reference: 'https://attack.mitre.org/techniques/T1500',
+    tactics: ['defense-evasion'],
+  },
+  {
+    name: 'Compiled HTML File',
+    id: 'T1223',
+    reference: 'https://attack.mitre.org/techniques/T1223',
+    tactics: ['defense-evasion', 'execution'],
+  },
+  {
+    name: 'Component Firmware',
+    id: 'T1109',
+    reference: 'https://attack.mitre.org/techniques/T1109',
+    tactics: ['defense-evasion', 'persistence'],
+  },
+  {
+    name: 'Component Object Model Hijacking',
+    id: 'T1122',
+    reference: 'https://attack.mitre.org/techniques/T1122',
+    tactics: ['defense-evasion', 'persistence'],
+  },
+  {
+    name: 'Component Object Model and Distributed COM',
+    id: 'T1175',
+    reference: 'https://attack.mitre.org/techniques/T1175',
+    tactics: ['lateral-movement', 'execution'],
+  },
+  {
+    name: 'Connection Proxy',
+    id: 'T1090',
+    reference: 'https://attack.mitre.org/techniques/T1090',
+    tactics: ['command-and-control', 'defense-evasion'],
+  },
+  {
+    name: 'Control Panel Items',
+    id: 'T1196',
+    reference: 'https://attack.mitre.org/techniques/T1196',
+    tactics: ['defense-evasion', 'execution'],
+  },
+  {
+    name: 'Create Account',
+    id: 'T1136',
+    reference: 'https://attack.mitre.org/techniques/T1136',
+    tactics: ['persistence'],
+  },
+  {
+    name: 'Credential Dumping',
+    id: 'T1003',
+    reference: 'https://attack.mitre.org/techniques/T1003',
+    tactics: ['credential-access'],
+  },
+  {
+    name: 'Credentials from Web Browsers',
+    id: 'T1503',
+    reference: 'https://attack.mitre.org/techniques/T1503',
+    tactics: ['credential-access'],
+  },
+  {
+    name: 'Credentials in Files',
+    id: 'T1081',
+    reference: 'https://attack.mitre.org/techniques/T1081',
+    tactics: ['credential-access'],
+  },
+  {
+    name: 'Credentials in Registry',
+    id: 'T1214',
+    reference: 'https://attack.mitre.org/techniques/T1214',
+    tactics: ['credential-access'],
+  },
+  {
+    name: 'Custom Command and Control Protocol',
+    id: 'T1094',
+    reference: 'https://attack.mitre.org/techniques/T1094',
+    tactics: ['command-and-control'],
+  },
+  {
+    name: 'Custom Cryptographic Protocol',
+    id: 'T1024',
+    reference: 'https://attack.mitre.org/techniques/T1024',
+    tactics: ['command-and-control'],
+  },
+  {
+    name: 'DCShadow',
+    id: 'T1207',
+    reference: 'https://attack.mitre.org/techniques/T1207',
+    tactics: ['defense-evasion'],
+  },
+  {
+    name: 'DLL Search Order Hijacking',
+    id: 'T1038',
+    reference: 'https://attack.mitre.org/techniques/T1038',
+    tactics: ['persistence', 'privilege-escalation', 'defense-evasion'],
+  },
+  {
+    name: 'DLL Side-Loading',
+    id: 'T1073',
+    reference: 'https://attack.mitre.org/techniques/T1073',
+    tactics: ['defense-evasion'],
+  },
+  {
+    name: 'Data Compressed',
+    id: 'T1002',
+    reference: 'https://attack.mitre.org/techniques/T1002',
+    tactics: ['exfiltration'],
+  },
+  {
+    name: 'Data Destruction',
+    id: 'T1485',
+    reference: 'https://attack.mitre.org/techniques/T1485',
+    tactics: ['impact'],
+  },
+  {
+    name: 'Data Encoding',
+    id: 'T1132',
+    reference: 'https://attack.mitre.org/techniques/T1132',
+    tactics: ['command-and-control'],
+  },
+  {
+    name: 'Data Encrypted',
+    id: 'T1022',
+    reference: 'https://attack.mitre.org/techniques/T1022',
+    tactics: ['exfiltration'],
+  },
+  {
+    name: 'Data Encrypted for Impact',
+    id: 'T1486',
+    reference: 'https://attack.mitre.org/techniques/T1486',
+    tactics: ['impact'],
+  },
+  {
+    name: 'Data Obfuscation',
+    id: 'T1001',
+    reference: 'https://attack.mitre.org/techniques/T1001',
+    tactics: ['command-and-control'],
+  },
+  {
+    name: 'Data Staged',
+    id: 'T1074',
+    reference: 'https://attack.mitre.org/techniques/T1074',
+    tactics: ['collection'],
+  },
+  {
+    name: 'Data Transfer Size Limits',
+    id: 'T1030',
+    reference: 'https://attack.mitre.org/techniques/T1030',
+    tactics: ['exfiltration'],
+  },
+  {
+    name: 'Data from Cloud Storage Object',
+    id: 'T1530',
+    reference: 'https://attack.mitre.org/techniques/T1530',
+    tactics: ['collection'],
+  },
+  {
+    name: 'Data from Information Repositories',
+    id: 'T1213',
+    reference: 'https://attack.mitre.org/techniques/T1213',
+    tactics: ['collection'],
+  },
+  {
+    name: 'Data from Local System',
+    id: 'T1005',
+    reference: 'https://attack.mitre.org/techniques/T1005',
+    tactics: ['collection'],
+  },
+  {
+    name: 'Data from Network Shared Drive',
+    id: 'T1039',
+    reference: 'https://attack.mitre.org/techniques/T1039',
+    tactics: ['collection'],
+  },
+  {
+    name: 'Data from Removable Media',
+    id: 'T1025',
+    reference: 'https://attack.mitre.org/techniques/T1025',
+    tactics: ['collection'],
+  },
+  {
+    name: 'Defacement',
+    id: 'T1491',
+    reference: 'https://attack.mitre.org/techniques/T1491',
+    tactics: ['impact'],
+  },
+  {
+    name: 'Deobfuscate/Decode Files or Information',
+    id: 'T1140',
+    reference: 'https://attack.mitre.org/techniques/T1140',
+    tactics: ['defense-evasion'],
+  },
+  {
+    name: 'Disabling Security Tools',
+    id: 'T1089',
+    reference: 'https://attack.mitre.org/techniques/T1089',
+    tactics: ['defense-evasion'],
+  },
+  {
+    name: 'Disk Content Wipe',
+    id: 'T1488',
+    reference: 'https://attack.mitre.org/techniques/T1488',
+    tactics: ['impact'],
+  },
+  {
+    name: 'Disk Structure Wipe',
+    id: 'T1487',
+    reference: 'https://attack.mitre.org/techniques/T1487',
+    tactics: ['impact'],
+  },
+  {
+    name: 'Domain Fronting',
+    id: 'T1172',
+    reference: 'https://attack.mitre.org/techniques/T1172',
+    tactics: ['command-and-control'],
+  },
+  {
+    name: 'Domain Generation Algorithms',
+    id: 'T1483',
+    reference: 'https://attack.mitre.org/techniques/T1483',
+    tactics: ['command-and-control'],
+  },
+  {
+    name: 'Domain Trust Discovery',
+    id: 'T1482',
+    reference: 'https://attack.mitre.org/techniques/T1482',
+    tactics: ['discovery'],
+  },
+  {
+    name: 'Drive-by Compromise',
+    id: 'T1189',
+    reference: 'https://attack.mitre.org/techniques/T1189',
+    tactics: ['initial-access'],
+  },
+  {
+    name: 'Dylib Hijacking',
+    id: 'T1157',
+    reference: 'https://attack.mitre.org/techniques/T1157',
+    tactics: ['persistence', 'privilege-escalation'],
+  },
+  {
+    name: 'Dynamic Data Exchange',
+    id: 'T1173',
+    reference: 'https://attack.mitre.org/techniques/T1173',
+    tactics: ['execution'],
+  },
+  {
+    name: 'Elevated Execution with Prompt',
+    id: 'T1514',
+    reference: 'https://attack.mitre.org/techniques/T1514',
+    tactics: ['privilege-escalation'],
+  },
+  {
+    name: 'Email Collection',
+    id: 'T1114',
+    reference: 'https://attack.mitre.org/techniques/T1114',
+    tactics: ['collection'],
+  },
+  {
+    name: 'Emond',
+    id: 'T1519',
+    reference: 'https://attack.mitre.org/techniques/T1519',
+    tactics: ['persistence', 'privilege-escalation'],
+  },
+  {
+    name: 'Endpoint Denial of Service',
+    id: 'T1499',
+    reference: 'https://attack.mitre.org/techniques/T1499',
+    tactics: ['impact'],
+  },
+  {
+    name: 'Execution Guardrails',
+    id: 'T1480',
+    reference: 'https://attack.mitre.org/techniques/T1480',
+    tactics: ['defense-evasion'],
+  },
+  {
+    name: 'Execution through API',
+    id: 'T1106',
+    reference: 'https://attack.mitre.org/techniques/T1106',
+    tactics: ['execution'],
+  },
+  {
+    name: 'Execution through Module Load',
+    id: 'T1129',
+    reference: 'https://attack.mitre.org/techniques/T1129',
+    tactics: ['execution'],
+  },
+  {
+    name: 'Exfiltration Over Alternative Protocol',
+    id: 'T1048',
+    reference: 'https://attack.mitre.org/techniques/T1048',
+    tactics: ['exfiltration'],
+  },
+  {
+    name: 'Exfiltration Over Command and Control Channel',
+    id: 'T1041',
+    reference: 'https://attack.mitre.org/techniques/T1041',
+    tactics: ['exfiltration'],
+  },
+  {
+    name: 'Exfiltration Over Other Network Medium',
+    id: 'T1011',
+    reference: 'https://attack.mitre.org/techniques/T1011',
+    tactics: ['exfiltration'],
+  },
+  {
+    name: 'Exfiltration Over Physical Medium',
+    id: 'T1052',
+    reference: 'https://attack.mitre.org/techniques/T1052',
+    tactics: ['exfiltration'],
+  },
+  {
+    name: 'Exploit Public-Facing Application',
+    id: 'T1190',
+    reference: 'https://attack.mitre.org/techniques/T1190',
+    tactics: ['initial-access'],
+  },
+  {
+    name: 'Exploitation for Client Execution',
+    id: 'T1203',
+    reference: 'https://attack.mitre.org/techniques/T1203',
+    tactics: ['execution'],
+  },
+  {
+    name: 'Exploitation for Credential Access',
+    id: 'T1212',
+    reference: 'https://attack.mitre.org/techniques/T1212',
+    tactics: ['credential-access'],
+  },
+  {
+    name: 'Exploitation for Defense Evasion',
+    id: 'T1211',
+    reference: 'https://attack.mitre.org/techniques/T1211',
+    tactics: ['defense-evasion'],
+  },
+  {
+    name: 'Exploitation for Privilege Escalation',
+    id: 'T1068',
+    reference: 'https://attack.mitre.org/techniques/T1068',
+    tactics: ['privilege-escalation'],
+  },
+  {
+    name: 'Exploitation of Remote Services',
+    id: 'T1210',
+    reference: 'https://attack.mitre.org/techniques/T1210',
+    tactics: ['lateral-movement'],
+  },
+  {
+    name: 'External Remote Services',
+    id: 'T1133',
+    reference: 'https://attack.mitre.org/techniques/T1133',
+    tactics: ['persistence', 'initial-access'],
+  },
+  {
+    name: 'Extra Window Memory Injection',
+    id: 'T1181',
+    reference: 'https://attack.mitre.org/techniques/T1181',
+    tactics: ['defense-evasion', 'privilege-escalation'],
+  },
+  {
+    name: 'Fallback Channels',
+    id: 'T1008',
+    reference: 'https://attack.mitre.org/techniques/T1008',
+    tactics: ['command-and-control'],
+  },
+  {
+    name: 'File Deletion',
+    id: 'T1107',
+    reference: 'https://attack.mitre.org/techniques/T1107',
+    tactics: ['defense-evasion'],
+  },
+  {
+    name: 'File System Logical Offsets',
+    id: 'T1006',
+    reference: 'https://attack.mitre.org/techniques/T1006',
+    tactics: ['defense-evasion'],
+  },
+  {
+    name: 'File System Permissions Weakness',
+    id: 'T1044',
+    reference: 'https://attack.mitre.org/techniques/T1044',
+    tactics: ['persistence', 'privilege-escalation'],
+  },
+  {
+    name: 'File and Directory Discovery',
+    id: 'T1083',
+    reference: 'https://attack.mitre.org/techniques/T1083',
+    tactics: ['discovery'],
+  },
+  {
+    name: 'File and Directory Permissions Modification',
+    id: 'T1222',
+    reference: 'https://attack.mitre.org/techniques/T1222',
+    tactics: ['defense-evasion'],
+  },
+  {
+    name: 'Firmware Corruption',
+    id: 'T1495',
+    reference: 'https://attack.mitre.org/techniques/T1495',
+    tactics: ['impact'],
+  },
+  {
+    name: 'Forced Authentication',
+    id: 'T1187',
+    reference: 'https://attack.mitre.org/techniques/T1187',
+    tactics: ['credential-access'],
+  },
+  {
+    name: 'Gatekeeper Bypass',
+    id: 'T1144',
+    reference: 'https://attack.mitre.org/techniques/T1144',
+    tactics: ['defense-evasion'],
+  },
+  {
+    name: 'Graphical User Interface',
+    id: 'T1061',
+    reference: 'https://attack.mitre.org/techniques/T1061',
+    tactics: ['execution'],
+  },
+  {
+    name: 'Group Policy Modification',
+    id: 'T1484',
+    reference: 'https://attack.mitre.org/techniques/T1484',
+    tactics: ['defense-evasion'],
+  },
+  {
+    name: 'HISTCONTROL',
+    id: 'T1148',
+    reference: 'https://attack.mitre.org/techniques/T1148',
+    tactics: ['defense-evasion'],
+  },
+  {
+    name: 'Hardware Additions',
+    id: 'T1200',
+    reference: 'https://attack.mitre.org/techniques/T1200',
+    tactics: ['initial-access'],
+  },
+  {
+    name: 'Hidden Files and Directories',
+    id: 'T1158',
+    reference: 'https://attack.mitre.org/techniques/T1158',
+    tactics: ['defense-evasion', 'persistence'],
+  },
+  {
+    name: 'Hidden Users',
+    id: 'T1147',
+    reference: 'https://attack.mitre.org/techniques/T1147',
+    tactics: ['defense-evasion'],
+  },
+  {
+    name: 'Hidden Window',
+    id: 'T1143',
+    reference: 'https://attack.mitre.org/techniques/T1143',
+    tactics: ['defense-evasion'],
+  },
+  {
+    name: 'Hooking',
+    id: 'T1179',
+    reference: 'https://attack.mitre.org/techniques/T1179',
+    tactics: ['persistence', 'privilege-escalation', 'credential-access'],
+  },
+  {
+    name: 'Hypervisor',
+    id: 'T1062',
+    reference: 'https://attack.mitre.org/techniques/T1062',
+    tactics: ['persistence'],
+  },
+  {
+    name: 'Image File Execution Options Injection',
+    id: 'T1183',
+    reference: 'https://attack.mitre.org/techniques/T1183',
+    tactics: ['privilege-escalation', 'persistence', 'defense-evasion'],
+  },
+  {
+    name: 'Implant Container Image',
+    id: 'T1525',
+    reference: 'https://attack.mitre.org/techniques/T1525',
+    tactics: ['persistence'],
+  },
+  {
+    name: 'Indicator Blocking',
+    id: 'T1054',
+    reference: 'https://attack.mitre.org/techniques/T1054',
+    tactics: ['defense-evasion'],
+  },
+  {
+    name: 'Indicator Removal from Tools',
+    id: 'T1066',
+    reference: 'https://attack.mitre.org/techniques/T1066',
+    tactics: ['defense-evasion'],
+  },
+  {
+    name: 'Indicator Removal on Host',
+    id: 'T1070',
+    reference: 'https://attack.mitre.org/techniques/T1070',
+    tactics: ['defense-evasion'],
+  },
+  {
+    name: 'Indirect Command Execution',
+    id: 'T1202',
+    reference: 'https://attack.mitre.org/techniques/T1202',
+    tactics: ['defense-evasion'],
+  },
+  {
+    name: 'Inhibit System Recovery',
+    id: 'T1490',
+    reference: 'https://attack.mitre.org/techniques/T1490',
+    tactics: ['impact'],
+  },
+  {
+    name: 'Input Capture',
+    id: 'T1056',
+    reference: 'https://attack.mitre.org/techniques/T1056',
+    tactics: ['collection', 'credential-access'],
+  },
+  {
+    name: 'Input Prompt',
+    id: 'T1141',
+    reference: 'https://attack.mitre.org/techniques/T1141',
+    tactics: ['credential-access'],
+  },
+  {
+    name: 'Install Root Certificate',
+    id: 'T1130',
+    reference: 'https://attack.mitre.org/techniques/T1130',
+    tactics: ['defense-evasion'],
+  },
+  {
+    name: 'InstallUtil',
+    id: 'T1118',
+    reference: 'https://attack.mitre.org/techniques/T1118',
+    tactics: ['defense-evasion', 'execution'],
+  },
+  {
+    name: 'Internal Spearphishing',
+    id: 'T1534',
+    reference: 'https://attack.mitre.org/techniques/T1534',
+    tactics: ['lateral-movement'],
+  },
+  {
+    name: 'Kerberoasting',
+    id: 'T1208',
+    reference: 'https://attack.mitre.org/techniques/T1208',
+    tactics: ['credential-access'],
+  },
+  {
+    name: 'Kernel Modules and Extensions',
+    id: 'T1215',
+    reference: 'https://attack.mitre.org/techniques/T1215',
+    tactics: ['persistence'],
+  },
+  {
+    name: 'Keychain',
+    id: 'T1142',
+    reference: 'https://attack.mitre.org/techniques/T1142',
+    tactics: ['credential-access'],
+  },
+  {
+    name: 'LC_LOAD_DYLIB Addition',
+    id: 'T1161',
+    reference: 'https://attack.mitre.org/techniques/T1161',
+    tactics: ['persistence'],
+  },
+  {
+    name: 'LC_MAIN Hijacking',
+    id: 'T1149',
+    reference: 'https://attack.mitre.org/techniques/T1149',
+    tactics: ['defense-evasion'],
+  },
+  {
+    name: 'LLMNR/NBT-NS Poisoning and Relay',
+    id: 'T1171',
+    reference: 'https://attack.mitre.org/techniques/T1171',
+    tactics: ['credential-access'],
+  },
+  {
+    name: 'LSASS Driver',
+    id: 'T1177',
+    reference: 'https://attack.mitre.org/techniques/T1177',
+    tactics: ['execution', 'persistence'],
+  },
+  {
+    name: 'Launch Agent',
+    id: 'T1159',
+    reference: 'https://attack.mitre.org/techniques/T1159',
+    tactics: ['persistence'],
+  },
+  {
+    name: 'Launch Daemon',
+    id: 'T1160',
+    reference: 'https://attack.mitre.org/techniques/T1160',
+    tactics: ['persistence', 'privilege-escalation'],
+  },
+  {
+    name: 'Launchctl',
+    id: 'T1152',
+    reference: 'https://attack.mitre.org/techniques/T1152',
+    tactics: ['defense-evasion', 'execution', 'persistence'],
+  },
+  {
+    name: 'Local Job Scheduling',
+    id: 'T1168',
+    reference: 'https://attack.mitre.org/techniques/T1168',
+    tactics: ['persistence', 'execution'],
+  },
+  {
+    name: 'Login Item',
+    id: 'T1162',
+    reference: 'https://attack.mitre.org/techniques/T1162',
+    tactics: ['persistence'],
+  },
+  {
+    name: 'Logon Scripts',
+    id: 'T1037',
+    reference: 'https://attack.mitre.org/techniques/T1037',
+    tactics: ['lateral-movement', 'persistence'],
+  },
+  {
+    name: 'Man in the Browser',
+    id: 'T1185',
+    reference: 'https://attack.mitre.org/techniques/T1185',
+    tactics: ['collection'],
+  },
+  {
+    name: 'Masquerading',
+    id: 'T1036',
+    reference: 'https://attack.mitre.org/techniques/T1036',
+    tactics: ['defense-evasion'],
+  },
+  {
+    name: 'Modify Existing Service',
+    id: 'T1031',
+    reference: 'https://attack.mitre.org/techniques/T1031',
+    tactics: ['persistence'],
+  },
+  {
+    name: 'Modify Registry',
+    id: 'T1112',
+    reference: 'https://attack.mitre.org/techniques/T1112',
+    tactics: ['defense-evasion'],
+  },
+  {
+    name: 'Mshta',
+    id: 'T1170',
+    reference: 'https://attack.mitre.org/techniques/T1170',
+    tactics: ['defense-evasion', 'execution'],
+  },
+  {
+    name: 'Multi-Stage Channels',
+    id: 'T1104',
+    reference: 'https://attack.mitre.org/techniques/T1104',
+    tactics: ['command-and-control'],
+  },
+  {
+    name: 'Multi-hop Proxy',
+    id: 'T1188',
+    reference: 'https://attack.mitre.org/techniques/T1188',
+    tactics: ['command-and-control'],
+  },
+  {
+    name: 'Multiband Communication',
+    id: 'T1026',
+    reference: 'https://attack.mitre.org/techniques/T1026',
+    tactics: ['command-and-control'],
+  },
+  {
+    name: 'Multilayer Encryption',
+    id: 'T1079',
+    reference: 'https://attack.mitre.org/techniques/T1079',
+    tactics: ['command-and-control'],
+  },
+  {
+    name: 'NTFS File Attributes',
+    id: 'T1096',
+    reference: 'https://attack.mitre.org/techniques/T1096',
+    tactics: ['defense-evasion'],
+  },
+  {
+    name: 'Netsh Helper DLL',
+    id: 'T1128',
+    reference: 'https://attack.mitre.org/techniques/T1128',
+    tactics: ['persistence'],
+  },
+  {
+    name: 'Network Denial of Service',
+    id: 'T1498',
+    reference: 'https://attack.mitre.org/techniques/T1498',
+    tactics: ['impact'],
+  },
+  {
+    name: 'Network Service Scanning',
+    id: 'T1046',
+    reference: 'https://attack.mitre.org/techniques/T1046',
+    tactics: ['discovery'],
+  },
+  {
+    name: 'Network Share Connection Removal',
+    id: 'T1126',
+    reference: 'https://attack.mitre.org/techniques/T1126',
+    tactics: ['defense-evasion'],
+  },
+  {
+    name: 'Network Share Discovery',
+    id: 'T1135',
+    reference: 'https://attack.mitre.org/techniques/T1135',
+    tactics: ['discovery'],
+  },
+  {
+    name: 'Network Sniffing',
+    id: 'T1040',
+    reference: 'https://attack.mitre.org/techniques/T1040',
+    tactics: ['credential-access', 'discovery'],
+  },
+  {
+    name: 'New Service',
+    id: 'T1050',
+    reference: 'https://attack.mitre.org/techniques/T1050',
+    tactics: ['persistence', 'privilege-escalation'],
+  },
+  {
+    name: 'Obfuscated Files or Information',
+    id: 'T1027',
+    reference: 'https://attack.mitre.org/techniques/T1027',
+    tactics: ['defense-evasion'],
+  },
+  {
+    name: 'Office Application Startup',
+    id: 'T1137',
+    reference: 'https://attack.mitre.org/techniques/T1137',
+    tactics: ['persistence'],
+  },
+  {
+    name: 'Parent PID Spoofing',
+    id: 'T1502',
+    reference: 'https://attack.mitre.org/techniques/T1502',
+    tactics: ['defense-evasion', 'privilege-escalation'],
+  },
+  {
+    name: 'Pass the Hash',
+    id: 'T1075',
+    reference: 'https://attack.mitre.org/techniques/T1075',
+    tactics: ['lateral-movement'],
+  },
+  {
+    name: 'Pass the Ticket',
+    id: 'T1097',
+    reference: 'https://attack.mitre.org/techniques/T1097',
+    tactics: ['lateral-movement'],
+  },
+  {
+    name: 'Password Filter DLL',
+    id: 'T1174',
+    reference: 'https://attack.mitre.org/techniques/T1174',
+    tactics: ['credential-access'],
+  },
+  {
+    name: 'Password Policy Discovery',
+    id: 'T1201',
+    reference: 'https://attack.mitre.org/techniques/T1201',
+    tactics: ['discovery'],
+  },
+  {
+    name: 'Path Interception',
+    id: 'T1034',
+    reference: 'https://attack.mitre.org/techniques/T1034',
+    tactics: ['persistence', 'privilege-escalation'],
+  },
+  {
+    name: 'Peripheral Device Discovery',
+    id: 'T1120',
+    reference: 'https://attack.mitre.org/techniques/T1120',
+    tactics: ['discovery'],
+  },
+  {
+    name: 'Permission Groups Discovery',
+    id: 'T1069',
+    reference: 'https://attack.mitre.org/techniques/T1069',
+    tactics: ['discovery'],
+  },
+  {
+    name: 'Plist Modification',
+    id: 'T1150',
+    reference: 'https://attack.mitre.org/techniques/T1150',
+    tactics: ['defense-evasion', 'persistence', 'privilege-escalation'],
+  },
+  {
+    name: 'Port Knocking',
+    id: 'T1205',
+    reference: 'https://attack.mitre.org/techniques/T1205',
+    tactics: ['defense-evasion', 'persistence', 'command-and-control'],
+  },
+  {
+    name: 'Port Monitors',
+    id: 'T1013',
+    reference: 'https://attack.mitre.org/techniques/T1013',
+    tactics: ['persistence', 'privilege-escalation'],
+  },
+  {
+    name: 'PowerShell',
+    id: 'T1086',
+    reference: 'https://attack.mitre.org/techniques/T1086',
+    tactics: ['execution'],
+  },
+  {
+    name: 'PowerShell Profile',
+    id: 'T1504',
+    reference: 'https://attack.mitre.org/techniques/T1504',
+    tactics: ['persistence', 'privilege-escalation'],
+  },
+  {
+    name: 'Private Keys',
+    id: 'T1145',
+    reference: 'https://attack.mitre.org/techniques/T1145',
+    tactics: ['credential-access'],
+  },
+  {
+    name: 'Process Discovery',
+    id: 'T1057',
+    reference: 'https://attack.mitre.org/techniques/T1057',
+    tactics: ['discovery'],
+  },
+  {
+    name: 'Process Doppelgänging',
+    id: 'T1186',
+    reference: 'https://attack.mitre.org/techniques/T1186',
+    tactics: ['defense-evasion'],
+  },
+  {
+    name: 'Process Hollowing',
+    id: 'T1093',
+    reference: 'https://attack.mitre.org/techniques/T1093',
+    tactics: ['defense-evasion'],
+  },
+  {
+    name: 'Process Injection',
+    id: 'T1055',
+    reference: 'https://attack.mitre.org/techniques/T1055',
+    tactics: ['defense-evasion', 'privilege-escalation'],
+  },
+  {
+    name: 'Query Registry',
+    id: 'T1012',
+    reference: 'https://attack.mitre.org/techniques/T1012',
+    tactics: ['discovery'],
+  },
+  {
+    name: 'Rc.common',
+    id: 'T1163',
+    reference: 'https://attack.mitre.org/techniques/T1163',
+    tactics: ['persistence'],
+  },
+  {
+    name: 'Re-opened Applications',
+    id: 'T1164',
+    reference: 'https://attack.mitre.org/techniques/T1164',
+    tactics: ['persistence'],
+  },
+  {
+    name: 'Redundant Access',
+    id: 'T1108',
+    reference: 'https://attack.mitre.org/techniques/T1108',
+    tactics: ['defense-evasion', 'persistence'],
+  },
+  {
+    name: 'Registry Run Keys / Startup Folder',
+    id: 'T1060',
+    reference: 'https://attack.mitre.org/techniques/T1060',
+    tactics: ['persistence'],
+  },
+  {
+    name: 'Regsvcs/Regasm',
+    id: 'T1121',
+    reference: 'https://attack.mitre.org/techniques/T1121',
+    tactics: ['defense-evasion', 'execution'],
+  },
+  {
+    name: 'Regsvr32',
+    id: 'T1117',
+    reference: 'https://attack.mitre.org/techniques/T1117',
+    tactics: ['defense-evasion', 'execution'],
+  },
+  {
+    name: 'Remote Access Tools',
+    id: 'T1219',
+    reference: 'https://attack.mitre.org/techniques/T1219',
+    tactics: ['command-and-control'],
+  },
+  {
+    name: 'Remote Desktop Protocol',
+    id: 'T1076',
+    reference: 'https://attack.mitre.org/techniques/T1076',
+    tactics: ['lateral-movement'],
+  },
+  {
+    name: 'Remote File Copy',
+    id: 'T1105',
+    reference: 'https://attack.mitre.org/techniques/T1105',
+    tactics: ['command-and-control', 'lateral-movement'],
+  },
+  {
+    name: 'Remote Services',
+    id: 'T1021',
+    reference: 'https://attack.mitre.org/techniques/T1021',
+    tactics: ['lateral-movement'],
+  },
+  {
+    name: 'Remote System Discovery',
+    id: 'T1018',
+    reference: 'https://attack.mitre.org/techniques/T1018',
+    tactics: ['discovery'],
+  },
+  {
+    name: 'Replication Through Removable Media',
+    id: 'T1091',
+    reference: 'https://attack.mitre.org/techniques/T1091',
+    tactics: ['lateral-movement', 'initial-access'],
+  },
+  {
+    name: 'Resource Hijacking',
+    id: 'T1496',
+    reference: 'https://attack.mitre.org/techniques/T1496',
+    tactics: ['impact'],
+  },
+  {
+    name: 'Revert Cloud Instance',
+    id: 'T1536',
+    reference: 'https://attack.mitre.org/techniques/T1536',
+    tactics: ['defense-evasion'],
+  },
+  {
+    name: 'Rootkit',
+    id: 'T1014',
+    reference: 'https://attack.mitre.org/techniques/T1014',
+    tactics: ['defense-evasion'],
+  },
+  {
+    name: 'Rundll32',
+    id: 'T1085',
+    reference: 'https://attack.mitre.org/techniques/T1085',
+    tactics: ['defense-evasion', 'execution'],
+  },
+  {
+    name: 'Runtime Data Manipulation',
+    id: 'T1494',
+    reference: 'https://attack.mitre.org/techniques/T1494',
+    tactics: ['impact'],
+  },
+  {
+    name: 'SID-History Injection',
+    id: 'T1178',
+    reference: 'https://attack.mitre.org/techniques/T1178',
+    tactics: ['privilege-escalation'],
+  },
+  {
+    name: 'SIP and Trust Provider Hijacking',
+    id: 'T1198',
+    reference: 'https://attack.mitre.org/techniques/T1198',
+    tactics: ['defense-evasion', 'persistence'],
+  },
+  {
+    name: 'SSH Hijacking',
+    id: 'T1184',
+    reference: 'https://attack.mitre.org/techniques/T1184',
+    tactics: ['lateral-movement'],
+  },
+  {
+    name: 'Scheduled Task',
+    id: 'T1053',
+    reference: 'https://attack.mitre.org/techniques/T1053',
+    tactics: ['execution', 'persistence', 'privilege-escalation'],
+  },
+  {
+    name: 'Scheduled Transfer',
+    id: 'T1029',
+    reference: 'https://attack.mitre.org/techniques/T1029',
+    tactics: ['exfiltration'],
+  },
+  {
+    name: 'Screen Capture',
+    id: 'T1113',
+    reference: 'https://attack.mitre.org/techniques/T1113',
+    tactics: ['collection'],
+  },
+  {
+    name: 'Screensaver',
+    id: 'T1180',
+    reference: 'https://attack.mitre.org/techniques/T1180',
+    tactics: ['persistence'],
+  },
+  {
+    name: 'Scripting',
+    id: 'T1064',
+    reference: 'https://attack.mitre.org/techniques/T1064',
+    tactics: ['defense-evasion', 'execution'],
+  },
+  {
+    name: 'Security Software Discovery',
+    id: 'T1063',
+    reference: 'https://attack.mitre.org/techniques/T1063',
+    tactics: ['discovery'],
+  },
+  {
+    name: 'Security Support Provider',
+    id: 'T1101',
+    reference: 'https://attack.mitre.org/techniques/T1101',
+    tactics: ['persistence'],
+  },
+  {
+    name: 'Securityd Memory',
+    id: 'T1167',
+    reference: 'https://attack.mitre.org/techniques/T1167',
+    tactics: ['credential-access'],
+  },
+  {
+    name: 'Server Software Component',
+    id: 'T1505',
+    reference: 'https://attack.mitre.org/techniques/T1505',
+    tactics: ['persistence'],
+  },
+  {
+    name: 'Service Execution',
+    id: 'T1035',
+    reference: 'https://attack.mitre.org/techniques/T1035',
+    tactics: ['execution'],
+  },
+  {
+    name: 'Service Registry Permissions Weakness',
+    id: 'T1058',
+    reference: 'https://attack.mitre.org/techniques/T1058',
+    tactics: ['persistence', 'privilege-escalation'],
+  },
+  {
+    name: 'Service Stop',
+    id: 'T1489',
+    reference: 'https://attack.mitre.org/techniques/T1489',
+    tactics: ['impact'],
+  },
+  {
+    name: 'Setuid and Setgid',
+    id: 'T1166',
+    reference: 'https://attack.mitre.org/techniques/T1166',
+    tactics: ['privilege-escalation', 'persistence'],
+  },
+  {
+    name: 'Shared Webroot',
+    id: 'T1051',
+    reference: 'https://attack.mitre.org/techniques/T1051',
+    tactics: ['lateral-movement'],
+  },
+  {
+    name: 'Shortcut Modification',
+    id: 'T1023',
+    reference: 'https://attack.mitre.org/techniques/T1023',
+    tactics: ['persistence'],
+  },
+  {
+    name: 'Signed Binary Proxy Execution',
+    id: 'T1218',
+    reference: 'https://attack.mitre.org/techniques/T1218',
+    tactics: ['defense-evasion', 'execution'],
+  },
+  {
+    name: 'Signed Script Proxy Execution',
+    id: 'T1216',
+    reference: 'https://attack.mitre.org/techniques/T1216',
+    tactics: ['defense-evasion', 'execution'],
+  },
+  {
+    name: 'Software Discovery',
+    id: 'T1518',
+    reference: 'https://attack.mitre.org/techniques/T1518',
+    tactics: ['discovery'],
+  },
+  {
+    name: 'Software Packing',
+    id: 'T1045',
+    reference: 'https://attack.mitre.org/techniques/T1045',
+    tactics: ['defense-evasion'],
+  },
+  {
+    name: 'Source',
+    id: 'T1153',
+    reference: 'https://attack.mitre.org/techniques/T1153',
+    tactics: ['execution'],
+  },
+  {
+    name: 'Space after Filename',
+    id: 'T1151',
+    reference: 'https://attack.mitre.org/techniques/T1151',
+    tactics: ['defense-evasion', 'execution'],
+  },
+  {
+    name: 'Spearphishing Attachment',
+    id: 'T1193',
+    reference: 'https://attack.mitre.org/techniques/T1193',
+    tactics: ['initial-access'],
+  },
+  {
+    name: 'Spearphishing Link',
+    id: 'T1192',
+    reference: 'https://attack.mitre.org/techniques/T1192',
+    tactics: ['initial-access'],
+  },
+  {
+    name: 'Spearphishing via Service',
+    id: 'T1194',
+    reference: 'https://attack.mitre.org/techniques/T1194',
+    tactics: ['initial-access'],
+  },
+  {
+    name: 'Standard Application Layer Protocol',
+    id: 'T1071',
+    reference: 'https://attack.mitre.org/techniques/T1071',
+    tactics: ['command-and-control'],
+  },
+  {
+    name: 'Standard Cryptographic Protocol',
+    id: 'T1032',
+    reference: 'https://attack.mitre.org/techniques/T1032',
+    tactics: ['command-and-control'],
+  },
+  {
+    name: 'Standard Non-Application Layer Protocol',
+    id: 'T1095',
+    reference: 'https://attack.mitre.org/techniques/T1095',
+    tactics: ['command-and-control'],
+  },
+  {
+    name: 'Startup Items',
+    id: 'T1165',
+    reference: 'https://attack.mitre.org/techniques/T1165',
+    tactics: ['persistence', 'privilege-escalation'],
+  },
+  {
+    name: 'Steal Application Access Token',
+    id: 'T1528',
+    reference: 'https://attack.mitre.org/techniques/T1528',
+    tactics: ['credential-access'],
+  },
+  {
+    name: 'Steal Web Session Cookie',
+    id: 'T1539',
+    reference: 'https://attack.mitre.org/techniques/T1539',
+    tactics: ['credential-access'],
+  },
+  {
+    name: 'Stored Data Manipulation',
+    id: 'T1492',
+    reference: 'https://attack.mitre.org/techniques/T1492',
+    tactics: ['impact'],
+  },
+  {
+    name: 'Sudo',
+    id: 'T1169',
+    reference: 'https://attack.mitre.org/techniques/T1169',
+    tactics: ['privilege-escalation'],
+  },
+  {
+    name: 'Sudo Caching',
+    id: 'T1206',
+    reference: 'https://attack.mitre.org/techniques/T1206',
+    tactics: ['privilege-escalation'],
+  },
+  {
+    name: 'Supply Chain Compromise',
+    id: 'T1195',
+    reference: 'https://attack.mitre.org/techniques/T1195',
+    tactics: ['initial-access'],
+  },
+  {
+    name: 'System Firmware',
+    id: 'T1019',
+    reference: 'https://attack.mitre.org/techniques/T1019',
+    tactics: ['persistence'],
+  },
+  {
+    name: 'System Information Discovery',
+    id: 'T1082',
+    reference: 'https://attack.mitre.org/techniques/T1082',
+    tactics: ['discovery'],
+  },
+  {
+    name: 'System Network Configuration Discovery',
+    id: 'T1016',
+    reference: 'https://attack.mitre.org/techniques/T1016',
+    tactics: ['discovery'],
+  },
+  {
+    name: 'System Network Connections Discovery',
+    id: 'T1049',
+    reference: 'https://attack.mitre.org/techniques/T1049',
+    tactics: ['discovery'],
+  },
+  {
+    name: 'System Owner/User Discovery',
+    id: 'T1033',
+    reference: 'https://attack.mitre.org/techniques/T1033',
+    tactics: ['discovery'],
+  },
+  {
+    name: 'System Service Discovery',
+    id: 'T1007',
+    reference: 'https://attack.mitre.org/techniques/T1007',
+    tactics: ['discovery'],
+  },
+  {
+    name: 'System Shutdown/Reboot',
+    id: 'T1529',
+    reference: 'https://attack.mitre.org/techniques/T1529',
+    tactics: ['impact'],
+  },
+  {
+    name: 'System Time Discovery',
+    id: 'T1124',
+    reference: 'https://attack.mitre.org/techniques/T1124',
+    tactics: ['discovery'],
+  },
+  {
+    name: 'Systemd Service',
+    id: 'T1501',
+    reference: 'https://attack.mitre.org/techniques/T1501',
+    tactics: ['persistence'],
+  },
+  {
+    name: 'Taint Shared Content',
+    id: 'T1080',
+    reference: 'https://attack.mitre.org/techniques/T1080',
+    tactics: ['lateral-movement'],
+  },
+  {
+    name: 'Template Injection',
+    id: 'T1221',
+    reference: 'https://attack.mitre.org/techniques/T1221',
+    tactics: ['defense-evasion'],
+  },
+  {
+    name: 'Third-party Software',
+    id: 'T1072',
+    reference: 'https://attack.mitre.org/techniques/T1072',
+    tactics: ['execution', 'lateral-movement'],
+  },
+  {
+    name: 'Time Providers',
+    id: 'T1209',
+    reference: 'https://attack.mitre.org/techniques/T1209',
+    tactics: ['persistence'],
+  },
+  {
+    name: 'Timestomp',
+    id: 'T1099',
+    reference: 'https://attack.mitre.org/techniques/T1099',
+    tactics: ['defense-evasion'],
+  },
+  {
+    name: 'Transfer Data to Cloud Account',
+    id: 'T1537',
+    reference: 'https://attack.mitre.org/techniques/T1537',
+    tactics: ['exfiltration'],
+  },
+  {
+    name: 'Transmitted Data Manipulation',
+    id: 'T1493',
+    reference: 'https://attack.mitre.org/techniques/T1493',
+    tactics: ['impact'],
+  },
+  {
+    name: 'Trap',
+    id: 'T1154',
+    reference: 'https://attack.mitre.org/techniques/T1154',
+    tactics: ['execution', 'persistence'],
+  },
+  {
+    name: 'Trusted Developer Utilities',
+    id: 'T1127',
+    reference: 'https://attack.mitre.org/techniques/T1127',
+    tactics: ['defense-evasion', 'execution'],
+  },
+  {
+    name: 'Trusted Relationship',
+    id: 'T1199',
+    reference: 'https://attack.mitre.org/techniques/T1199',
+    tactics: ['initial-access'],
+  },
+  {
+    name: 'Two-Factor Authentication Interception',
+    id: 'T1111',
+    reference: 'https://attack.mitre.org/techniques/T1111',
+    tactics: ['credential-access'],
+  },
+  {
+    name: 'Uncommonly Used Port',
+    id: 'T1065',
+    reference: 'https://attack.mitre.org/techniques/T1065',
+    tactics: ['command-and-control'],
+  },
+  {
+    name: 'Unused/Unsupported Cloud Regions',
+    id: 'T1535',
+    reference: 'https://attack.mitre.org/techniques/T1535',
+    tactics: ['defense-evasion'],
+  },
+  {
+    name: 'User Execution',
+    id: 'T1204',
+    reference: 'https://attack.mitre.org/techniques/T1204',
+    tactics: ['execution'],
+  },
+  {
+    name: 'Valid Accounts',
+    id: 'T1078',
+    reference: 'https://attack.mitre.org/techniques/T1078',
+    tactics: ['defense-evasion', 'persistence', 'privilege-escalation', 'initial-access'],
+  },
+  {
+    name: 'Video Capture',
+    id: 'T1125',
+    reference: 'https://attack.mitre.org/techniques/T1125',
+    tactics: ['collection'],
+  },
+  {
+    name: 'Virtualization/Sandbox Evasion',
+    id: 'T1497',
+    reference: 'https://attack.mitre.org/techniques/T1497',
+    tactics: ['defense-evasion', 'discovery'],
+  },
+  {
+    name: 'Web Service',
+    id: 'T1102',
+    reference: 'https://attack.mitre.org/techniques/T1102',
+    tactics: ['command-and-control', 'defense-evasion'],
+  },
+  {
+    name: 'Web Session Cookie',
+    id: 'T1506',
+    reference: 'https://attack.mitre.org/techniques/T1506',
+    tactics: ['defense-evasion', 'lateral-movement'],
+  },
+  {
+    name: 'Web Shell',
+    id: 'T1100',
+    reference: 'https://attack.mitre.org/techniques/T1100',
+    tactics: ['persistence', 'privilege-escalation'],
+  },
+  {
+    name: 'Windows Admin Shares',
+    id: 'T1077',
+    reference: 'https://attack.mitre.org/techniques/T1077',
+    tactics: ['lateral-movement'],
+  },
+  {
+    name: 'Windows Management Instrumentation',
+    id: 'T1047',
+    reference: 'https://attack.mitre.org/techniques/T1047',
+    tactics: ['execution'],
+  },
+  {
+    name: 'Windows Management Instrumentation Event Subscription',
+    id: 'T1084',
+    reference: 'https://attack.mitre.org/techniques/T1084',
+    tactics: ['persistence'],
+  },
+  {
+    name: 'Windows Remote Management',
+    id: 'T1028',
+    reference: 'https://attack.mitre.org/techniques/T1028',
+    tactics: ['execution', 'lateral-movement'],
+  },
+  {
+    name: 'Winlogon Helper DLL',
+    id: 'T1004',
+    reference: 'https://attack.mitre.org/techniques/T1004',
+    tactics: ['persistence'],
+  },
+  {
+    name: 'XSL Script Processing',
+    id: 'T1220',
+    reference: 'https://attack.mitre.org/techniques/T1220',
+    tactics: ['defense-evasion', 'execution'],
+  },
+];
+
+export const techniquesOptions: MitreTechniquesOptions[] = [
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.bashProfileAndBashrcDescription',
+      { defaultMessage: '.bash_profile and .bashrc (T1156)' }
+    ),
+    id: 'T1156',
+    name: '.bash_profile and .bashrc',
+    reference: 'https://attack.mitre.org/techniques/T1156',
+    tactics: 'persistence',
+    value: 'bashProfileAndBashrc',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.accessTokenManipulationDescription',
+      { defaultMessage: 'Access Token Manipulation (T1134)' }
+    ),
+    id: 'T1134',
+    name: 'Access Token Manipulation',
+    reference: 'https://attack.mitre.org/techniques/T1134',
+    tactics: 'defense-evasion,privilege-escalation',
+    value: 'accessTokenManipulation',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.accessibilityFeaturesDescription',
+      { defaultMessage: 'Accessibility Features (T1015)' }
+    ),
+    id: 'T1015',
+    name: 'Accessibility Features',
+    reference: 'https://attack.mitre.org/techniques/T1015',
+    tactics: 'persistence,privilege-escalation',
+    value: 'accessibilityFeatures',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.accountAccessRemovalDescription',
+      { defaultMessage: 'Account Access Removal (T1531)' }
+    ),
+    id: 'T1531',
+    name: 'Account Access Removal',
+    reference: 'https://attack.mitre.org/techniques/T1531',
+    tactics: 'impact',
+    value: 'accountAccessRemoval',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.accountDiscoveryDescription',
+      { defaultMessage: 'Account Discovery (T1087)' }
+    ),
+    id: 'T1087',
+    name: 'Account Discovery',
+    reference: 'https://attack.mitre.org/techniques/T1087',
+    tactics: 'discovery',
+    value: 'accountDiscovery',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.accountManipulationDescription',
+      { defaultMessage: 'Account Manipulation (T1098)' }
+    ),
+    id: 'T1098',
+    name: 'Account Manipulation',
+    reference: 'https://attack.mitre.org/techniques/T1098',
+    tactics: 'credential-access,persistence',
+    value: 'accountManipulation',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.appCertDlLsDescription',
+      { defaultMessage: 'AppCert DLLs (T1182)' }
+    ),
+    id: 'T1182',
+    name: 'AppCert DLLs',
+    reference: 'https://attack.mitre.org/techniques/T1182',
+    tactics: 'persistence,privilege-escalation',
+    value: 'appCertDlLs',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.appInitDlLsDescription',
+      { defaultMessage: 'AppInit DLLs (T1103)' }
+    ),
+    id: 'T1103',
+    name: 'AppInit DLLs',
+    reference: 'https://attack.mitre.org/techniques/T1103',
+    tactics: 'persistence,privilege-escalation',
+    value: 'appInitDlLs',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.appleScriptDescription',
+      { defaultMessage: 'AppleScript (T1155)' }
+    ),
+    id: 'T1155',
+    name: 'AppleScript',
+    reference: 'https://attack.mitre.org/techniques/T1155',
+    tactics: 'execution,lateral-movement',
+    value: 'appleScript',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.applicationAccessTokenDescription',
+      { defaultMessage: 'Application Access Token (T1527)' }
+    ),
+    id: 'T1527',
+    name: 'Application Access Token',
+    reference: 'https://attack.mitre.org/techniques/T1527',
+    tactics: 'defense-evasion,lateral-movement',
+    value: 'applicationAccessToken',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.applicationDeploymentSoftwareDescription',
+      { defaultMessage: 'Application Deployment Software (T1017)' }
+    ),
+    id: 'T1017',
+    name: 'Application Deployment Software',
+    reference: 'https://attack.mitre.org/techniques/T1017',
+    tactics: 'lateral-movement',
+    value: 'applicationDeploymentSoftware',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.applicationShimmingDescription',
+      { defaultMessage: 'Application Shimming (T1138)' }
+    ),
+    id: 'T1138',
+    name: 'Application Shimming',
+    reference: 'https://attack.mitre.org/techniques/T1138',
+    tactics: 'persistence,privilege-escalation',
+    value: 'applicationShimming',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.applicationWindowDiscoveryDescription',
+      { defaultMessage: 'Application Window Discovery (T1010)' }
+    ),
+    id: 'T1010',
+    name: 'Application Window Discovery',
+    reference: 'https://attack.mitre.org/techniques/T1010',
+    tactics: 'discovery',
+    value: 'applicationWindowDiscovery',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.audioCaptureDescription',
+      { defaultMessage: 'Audio Capture (T1123)' }
+    ),
+    id: 'T1123',
+    name: 'Audio Capture',
+    reference: 'https://attack.mitre.org/techniques/T1123',
+    tactics: 'collection',
+    value: 'audioCapture',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.authenticationPackageDescription',
+      { defaultMessage: 'Authentication Package (T1131)' }
+    ),
+    id: 'T1131',
+    name: 'Authentication Package',
+    reference: 'https://attack.mitre.org/techniques/T1131',
+    tactics: 'persistence',
+    value: 'authenticationPackage',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.automatedCollectionDescription',
+      { defaultMessage: 'Automated Collection (T1119)' }
+    ),
+    id: 'T1119',
+    name: 'Automated Collection',
+    reference: 'https://attack.mitre.org/techniques/T1119',
+    tactics: 'collection',
+    value: 'automatedCollection',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.automatedExfiltrationDescription',
+      { defaultMessage: 'Automated Exfiltration (T1020)' }
+    ),
+    id: 'T1020',
+    name: 'Automated Exfiltration',
+    reference: 'https://attack.mitre.org/techniques/T1020',
+    tactics: 'exfiltration',
+    value: 'automatedExfiltration',
+  },
+  {
+    label: i18n.translate('xpack.siem.detectionEngine.mitreAttackTechniques.bitsJobsDescription', {
+      defaultMessage: 'BITS Jobs (T1197)',
+    }),
+    id: 'T1197',
+    name: 'BITS Jobs',
+    reference: 'https://attack.mitre.org/techniques/T1197',
+    tactics: 'defense-evasion,persistence',
+    value: 'bitsJobs',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.bashHistoryDescription',
+      { defaultMessage: 'Bash History (T1139)' }
+    ),
+    id: 'T1139',
+    name: 'Bash History',
+    reference: 'https://attack.mitre.org/techniques/T1139',
+    tactics: 'credential-access',
+    value: 'bashHistory',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.binaryPaddingDescription',
+      { defaultMessage: 'Binary Padding (T1009)' }
+    ),
+    id: 'T1009',
+    name: 'Binary Padding',
+    reference: 'https://attack.mitre.org/techniques/T1009',
+    tactics: 'defense-evasion',
+    value: 'binaryPadding',
+  },
+  {
+    label: i18n.translate('xpack.siem.detectionEngine.mitreAttackTechniques.bootkitDescription', {
+      defaultMessage: 'Bootkit (T1067)',
+    }),
+    id: 'T1067',
+    name: 'Bootkit',
+    reference: 'https://attack.mitre.org/techniques/T1067',
+    tactics: 'persistence',
+    value: 'bootkit',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.browserBookmarkDiscoveryDescription',
+      { defaultMessage: 'Browser Bookmark Discovery (T1217)' }
+    ),
+    id: 'T1217',
+    name: 'Browser Bookmark Discovery',
+    reference: 'https://attack.mitre.org/techniques/T1217',
+    tactics: 'discovery',
+    value: 'browserBookmarkDiscovery',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.browserExtensionsDescription',
+      { defaultMessage: 'Browser Extensions (T1176)' }
+    ),
+    id: 'T1176',
+    name: 'Browser Extensions',
+    reference: 'https://attack.mitre.org/techniques/T1176',
+    tactics: 'persistence',
+    value: 'browserExtensions',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.bruteForceDescription',
+      { defaultMessage: 'Brute Force (T1110)' }
+    ),
+    id: 'T1110',
+    name: 'Brute Force',
+    reference: 'https://attack.mitre.org/techniques/T1110',
+    tactics: 'credential-access',
+    value: 'bruteForce',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.bypassUserAccountControlDescription',
+      { defaultMessage: 'Bypass User Account Control (T1088)' }
+    ),
+    id: 'T1088',
+    name: 'Bypass User Account Control',
+    reference: 'https://attack.mitre.org/techniques/T1088',
+    tactics: 'defense-evasion,privilege-escalation',
+    value: 'bypassUserAccountControl',
+  },
+  {
+    label: i18n.translate('xpack.siem.detectionEngine.mitreAttackTechniques.cmstpDescription', {
+      defaultMessage: 'CMSTP (T1191)',
+    }),
+    id: 'T1191',
+    name: 'CMSTP',
+    reference: 'https://attack.mitre.org/techniques/T1191',
+    tactics: 'defense-evasion,execution',
+    value: 'cmstp',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.changeDefaultFileAssociationDescription',
+      { defaultMessage: 'Change Default File Association (T1042)' }
+    ),
+    id: 'T1042',
+    name: 'Change Default File Association',
+    reference: 'https://attack.mitre.org/techniques/T1042',
+    tactics: 'persistence',
+    value: 'changeDefaultFileAssociation',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.clearCommandHistoryDescription',
+      { defaultMessage: 'Clear Command History (T1146)' }
+    ),
+    id: 'T1146',
+    name: 'Clear Command History',
+    reference: 'https://attack.mitre.org/techniques/T1146',
+    tactics: 'defense-evasion',
+    value: 'clearCommandHistory',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.clipboardDataDescription',
+      { defaultMessage: 'Clipboard Data (T1115)' }
+    ),
+    id: 'T1115',
+    name: 'Clipboard Data',
+    reference: 'https://attack.mitre.org/techniques/T1115',
+    tactics: 'collection',
+    value: 'clipboardData',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.cloudInstanceMetadataApiDescription',
+      { defaultMessage: 'Cloud Instance Metadata API (T1522)' }
+    ),
+    id: 'T1522',
+    name: 'Cloud Instance Metadata API',
+    reference: 'https://attack.mitre.org/techniques/T1522',
+    tactics: 'credential-access',
+    value: 'cloudInstanceMetadataApi',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.cloudServiceDashboardDescription',
+      { defaultMessage: 'Cloud Service Dashboard (T1538)' }
+    ),
+    id: 'T1538',
+    name: 'Cloud Service Dashboard',
+    reference: 'https://attack.mitre.org/techniques/T1538',
+    tactics: 'discovery',
+    value: 'cloudServiceDashboard',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.cloudServiceDiscoveryDescription',
+      { defaultMessage: 'Cloud Service Discovery (T1526)' }
+    ),
+    id: 'T1526',
+    name: 'Cloud Service Discovery',
+    reference: 'https://attack.mitre.org/techniques/T1526',
+    tactics: 'discovery',
+    value: 'cloudServiceDiscovery',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.codeSigningDescription',
+      { defaultMessage: 'Code Signing (T1116)' }
+    ),
+    id: 'T1116',
+    name: 'Code Signing',
+    reference: 'https://attack.mitre.org/techniques/T1116',
+    tactics: 'defense-evasion',
+    value: 'codeSigning',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.commandLineInterfaceDescription',
+      { defaultMessage: 'Command-Line Interface (T1059)' }
+    ),
+    id: 'T1059',
+    name: 'Command-Line Interface',
+    reference: 'https://attack.mitre.org/techniques/T1059',
+    tactics: 'execution',
+    value: 'commandLineInterface',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.commonlyUsedPortDescription',
+      { defaultMessage: 'Commonly Used Port (T1043)' }
+    ),
+    id: 'T1043',
+    name: 'Commonly Used Port',
+    reference: 'https://attack.mitre.org/techniques/T1043',
+    tactics: 'command-and-control',
+    value: 'commonlyUsedPort',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.communicationThroughRemovableMediaDescription',
+      { defaultMessage: 'Communication Through Removable Media (T1092)' }
+    ),
+    id: 'T1092',
+    name: 'Communication Through Removable Media',
+    reference: 'https://attack.mitre.org/techniques/T1092',
+    tactics: 'command-and-control',
+    value: 'communicationThroughRemovableMedia',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.compileAfterDeliveryDescription',
+      { defaultMessage: 'Compile After Delivery (T1500)' }
+    ),
+    id: 'T1500',
+    name: 'Compile After Delivery',
+    reference: 'https://attack.mitre.org/techniques/T1500',
+    tactics: 'defense-evasion',
+    value: 'compileAfterDelivery',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.compiledHtmlFileDescription',
+      { defaultMessage: 'Compiled HTML File (T1223)' }
+    ),
+    id: 'T1223',
+    name: 'Compiled HTML File',
+    reference: 'https://attack.mitre.org/techniques/T1223',
+    tactics: 'defense-evasion,execution',
+    value: 'compiledHtmlFile',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.componentFirmwareDescription',
+      { defaultMessage: 'Component Firmware (T1109)' }
+    ),
+    id: 'T1109',
+    name: 'Component Firmware',
+    reference: 'https://attack.mitre.org/techniques/T1109',
+    tactics: 'defense-evasion,persistence',
+    value: 'componentFirmware',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.componentObjectModelHijackingDescription',
+      { defaultMessage: 'Component Object Model Hijacking (T1122)' }
+    ),
+    id: 'T1122',
+    name: 'Component Object Model Hijacking',
+    reference: 'https://attack.mitre.org/techniques/T1122',
+    tactics: 'defense-evasion,persistence',
+    value: 'componentObjectModelHijacking',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.componentObjectModelAndDistributedComDescription',
+      { defaultMessage: 'Component Object Model and Distributed COM (T1175)' }
+    ),
+    id: 'T1175',
+    name: 'Component Object Model and Distributed COM',
+    reference: 'https://attack.mitre.org/techniques/T1175',
+    tactics: 'lateral-movement,execution',
+    value: 'componentObjectModelAndDistributedCom',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.connectionProxyDescription',
+      { defaultMessage: 'Connection Proxy (T1090)' }
+    ),
+    id: 'T1090',
+    name: 'Connection Proxy',
+    reference: 'https://attack.mitre.org/techniques/T1090',
+    tactics: 'command-and-control,defense-evasion',
+    value: 'connectionProxy',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.controlPanelItemsDescription',
+      { defaultMessage: 'Control Panel Items (T1196)' }
+    ),
+    id: 'T1196',
+    name: 'Control Panel Items',
+    reference: 'https://attack.mitre.org/techniques/T1196',
+    tactics: 'defense-evasion,execution',
+    value: 'controlPanelItems',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.createAccountDescription',
+      { defaultMessage: 'Create Account (T1136)' }
+    ),
+    id: 'T1136',
+    name: 'Create Account',
+    reference: 'https://attack.mitre.org/techniques/T1136',
+    tactics: 'persistence',
+    value: 'createAccount',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.credentialDumpingDescription',
+      { defaultMessage: 'Credential Dumping (T1003)' }
+    ),
+    id: 'T1003',
+    name: 'Credential Dumping',
+    reference: 'https://attack.mitre.org/techniques/T1003',
+    tactics: 'credential-access',
+    value: 'credentialDumping',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.credentialsFromWebBrowsersDescription',
+      { defaultMessage: 'Credentials from Web Browsers (T1503)' }
+    ),
+    id: 'T1503',
+    name: 'Credentials from Web Browsers',
+    reference: 'https://attack.mitre.org/techniques/T1503',
+    tactics: 'credential-access',
+    value: 'credentialsFromWebBrowsers',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.credentialsInFilesDescription',
+      { defaultMessage: 'Credentials in Files (T1081)' }
+    ),
+    id: 'T1081',
+    name: 'Credentials in Files',
+    reference: 'https://attack.mitre.org/techniques/T1081',
+    tactics: 'credential-access',
+    value: 'credentialsInFiles',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.credentialsInRegistryDescription',
+      { defaultMessage: 'Credentials in Registry (T1214)' }
+    ),
+    id: 'T1214',
+    name: 'Credentials in Registry',
+    reference: 'https://attack.mitre.org/techniques/T1214',
+    tactics: 'credential-access',
+    value: 'credentialsInRegistry',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.customCommandAndControlProtocolDescription',
+      { defaultMessage: 'Custom Command and Control Protocol (T1094)' }
+    ),
+    id: 'T1094',
+    name: 'Custom Command and Control Protocol',
+    reference: 'https://attack.mitre.org/techniques/T1094',
+    tactics: 'command-and-control',
+    value: 'customCommandAndControlProtocol',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.customCryptographicProtocolDescription',
+      { defaultMessage: 'Custom Cryptographic Protocol (T1024)' }
+    ),
+    id: 'T1024',
+    name: 'Custom Cryptographic Protocol',
+    reference: 'https://attack.mitre.org/techniques/T1024',
+    tactics: 'command-and-control',
+    value: 'customCryptographicProtocol',
+  },
+  {
+    label: i18n.translate('xpack.siem.detectionEngine.mitreAttackTechniques.dcShadowDescription', {
+      defaultMessage: 'DCShadow (T1207)',
+    }),
+    id: 'T1207',
+    name: 'DCShadow',
+    reference: 'https://attack.mitre.org/techniques/T1207',
+    tactics: 'defense-evasion',
+    value: 'dcShadow',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.dllSearchOrderHijackingDescription',
+      { defaultMessage: 'DLL Search Order Hijacking (T1038)' }
+    ),
+    id: 'T1038',
+    name: 'DLL Search Order Hijacking',
+    reference: 'https://attack.mitre.org/techniques/T1038',
+    tactics: 'persistence,privilege-escalation,defense-evasion',
+    value: 'dllSearchOrderHijacking',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.dllSideLoadingDescription',
+      { defaultMessage: 'DLL Side-Loading (T1073)' }
+    ),
+    id: 'T1073',
+    name: 'DLL Side-Loading',
+    reference: 'https://attack.mitre.org/techniques/T1073',
+    tactics: 'defense-evasion',
+    value: 'dllSideLoading',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.dataCompressedDescription',
+      { defaultMessage: 'Data Compressed (T1002)' }
+    ),
+    id: 'T1002',
+    name: 'Data Compressed',
+    reference: 'https://attack.mitre.org/techniques/T1002',
+    tactics: 'exfiltration',
+    value: 'dataCompressed',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.dataDestructionDescription',
+      { defaultMessage: 'Data Destruction (T1485)' }
+    ),
+    id: 'T1485',
+    name: 'Data Destruction',
+    reference: 'https://attack.mitre.org/techniques/T1485',
+    tactics: 'impact',
+    value: 'dataDestruction',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.dataEncodingDescription',
+      { defaultMessage: 'Data Encoding (T1132)' }
+    ),
+    id: 'T1132',
+    name: 'Data Encoding',
+    reference: 'https://attack.mitre.org/techniques/T1132',
+    tactics: 'command-and-control',
+    value: 'dataEncoding',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.dataEncryptedDescription',
+      { defaultMessage: 'Data Encrypted (T1022)' }
+    ),
+    id: 'T1022',
+    name: 'Data Encrypted',
+    reference: 'https://attack.mitre.org/techniques/T1022',
+    tactics: 'exfiltration',
+    value: 'dataEncrypted',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.dataEncryptedForImpactDescription',
+      { defaultMessage: 'Data Encrypted for Impact (T1486)' }
+    ),
+    id: 'T1486',
+    name: 'Data Encrypted for Impact',
+    reference: 'https://attack.mitre.org/techniques/T1486',
+    tactics: 'impact',
+    value: 'dataEncryptedForImpact',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.dataObfuscationDescription',
+      { defaultMessage: 'Data Obfuscation (T1001)' }
+    ),
+    id: 'T1001',
+    name: 'Data Obfuscation',
+    reference: 'https://attack.mitre.org/techniques/T1001',
+    tactics: 'command-and-control',
+    value: 'dataObfuscation',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.dataStagedDescription',
+      { defaultMessage: 'Data Staged (T1074)' }
+    ),
+    id: 'T1074',
+    name: 'Data Staged',
+    reference: 'https://attack.mitre.org/techniques/T1074',
+    tactics: 'collection',
+    value: 'dataStaged',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.dataTransferSizeLimitsDescription',
+      { defaultMessage: 'Data Transfer Size Limits (T1030)' }
+    ),
+    id: 'T1030',
+    name: 'Data Transfer Size Limits',
+    reference: 'https://attack.mitre.org/techniques/T1030',
+    tactics: 'exfiltration',
+    value: 'dataTransferSizeLimits',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.dataFromCloudStorageObjectDescription',
+      { defaultMessage: 'Data from Cloud Storage Object (T1530)' }
+    ),
+    id: 'T1530',
+    name: 'Data from Cloud Storage Object',
+    reference: 'https://attack.mitre.org/techniques/T1530',
+    tactics: 'collection',
+    value: 'dataFromCloudStorageObject',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.dataFromInformationRepositoriesDescription',
+      { defaultMessage: 'Data from Information Repositories (T1213)' }
+    ),
+    id: 'T1213',
+    name: 'Data from Information Repositories',
+    reference: 'https://attack.mitre.org/techniques/T1213',
+    tactics: 'collection',
+    value: 'dataFromInformationRepositories',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.dataFromLocalSystemDescription',
+      { defaultMessage: 'Data from Local System (T1005)' }
+    ),
+    id: 'T1005',
+    name: 'Data from Local System',
+    reference: 'https://attack.mitre.org/techniques/T1005',
+    tactics: 'collection',
+    value: 'dataFromLocalSystem',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.dataFromNetworkSharedDriveDescription',
+      { defaultMessage: 'Data from Network Shared Drive (T1039)' }
+    ),
+    id: 'T1039',
+    name: 'Data from Network Shared Drive',
+    reference: 'https://attack.mitre.org/techniques/T1039',
+    tactics: 'collection',
+    value: 'dataFromNetworkSharedDrive',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.dataFromRemovableMediaDescription',
+      { defaultMessage: 'Data from Removable Media (T1025)' }
+    ),
+    id: 'T1025',
+    name: 'Data from Removable Media',
+    reference: 'https://attack.mitre.org/techniques/T1025',
+    tactics: 'collection',
+    value: 'dataFromRemovableMedia',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.defacementDescription',
+      { defaultMessage: 'Defacement (T1491)' }
+    ),
+    id: 'T1491',
+    name: 'Defacement',
+    reference: 'https://attack.mitre.org/techniques/T1491',
+    tactics: 'impact',
+    value: 'defacement',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.deobfuscateDecodeFilesOrInformationDescription',
+      { defaultMessage: 'Deobfuscate/Decode Files or Information (T1140)' }
+    ),
+    id: 'T1140',
+    name: 'Deobfuscate/Decode Files or Information',
+    reference: 'https://attack.mitre.org/techniques/T1140',
+    tactics: 'defense-evasion',
+    value: 'deobfuscateDecodeFilesOrInformation',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.disablingSecurityToolsDescription',
+      { defaultMessage: 'Disabling Security Tools (T1089)' }
+    ),
+    id: 'T1089',
+    name: 'Disabling Security Tools',
+    reference: 'https://attack.mitre.org/techniques/T1089',
+    tactics: 'defense-evasion',
+    value: 'disablingSecurityTools',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.diskContentWipeDescription',
+      { defaultMessage: 'Disk Content Wipe (T1488)' }
+    ),
+    id: 'T1488',
+    name: 'Disk Content Wipe',
+    reference: 'https://attack.mitre.org/techniques/T1488',
+    tactics: 'impact',
+    value: 'diskContentWipe',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.diskStructureWipeDescription',
+      { defaultMessage: 'Disk Structure Wipe (T1487)' }
+    ),
+    id: 'T1487',
+    name: 'Disk Structure Wipe',
+    reference: 'https://attack.mitre.org/techniques/T1487',
+    tactics: 'impact',
+    value: 'diskStructureWipe',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.domainFrontingDescription',
+      { defaultMessage: 'Domain Fronting (T1172)' }
+    ),
+    id: 'T1172',
+    name: 'Domain Fronting',
+    reference: 'https://attack.mitre.org/techniques/T1172',
+    tactics: 'command-and-control',
+    value: 'domainFronting',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.domainGenerationAlgorithmsDescription',
+      { defaultMessage: 'Domain Generation Algorithms (T1483)' }
+    ),
+    id: 'T1483',
+    name: 'Domain Generation Algorithms',
+    reference: 'https://attack.mitre.org/techniques/T1483',
+    tactics: 'command-and-control',
+    value: 'domainGenerationAlgorithms',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.domainTrustDiscoveryDescription',
+      { defaultMessage: 'Domain Trust Discovery (T1482)' }
+    ),
+    id: 'T1482',
+    name: 'Domain Trust Discovery',
+    reference: 'https://attack.mitre.org/techniques/T1482',
+    tactics: 'discovery',
+    value: 'domainTrustDiscovery',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.driveByCompromiseDescription',
+      { defaultMessage: 'Drive-by Compromise (T1189)' }
+    ),
+    id: 'T1189',
+    name: 'Drive-by Compromise',
+    reference: 'https://attack.mitre.org/techniques/T1189',
+    tactics: 'initial-access',
+    value: 'driveByCompromise',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.dylibHijackingDescription',
+      { defaultMessage: 'Dylib Hijacking (T1157)' }
+    ),
+    id: 'T1157',
+    name: 'Dylib Hijacking',
+    reference: 'https://attack.mitre.org/techniques/T1157',
+    tactics: 'persistence,privilege-escalation',
+    value: 'dylibHijacking',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.dynamicDataExchangeDescription',
+      { defaultMessage: 'Dynamic Data Exchange (T1173)' }
+    ),
+    id: 'T1173',
+    name: 'Dynamic Data Exchange',
+    reference: 'https://attack.mitre.org/techniques/T1173',
+    tactics: 'execution',
+    value: 'dynamicDataExchange',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.elevatedExecutionWithPromptDescription',
+      { defaultMessage: 'Elevated Execution with Prompt (T1514)' }
+    ),
+    id: 'T1514',
+    name: 'Elevated Execution with Prompt',
+    reference: 'https://attack.mitre.org/techniques/T1514',
+    tactics: 'privilege-escalation',
+    value: 'elevatedExecutionWithPrompt',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.emailCollectionDescription',
+      { defaultMessage: 'Email Collection (T1114)' }
+    ),
+    id: 'T1114',
+    name: 'Email Collection',
+    reference: 'https://attack.mitre.org/techniques/T1114',
+    tactics: 'collection',
+    value: 'emailCollection',
+  },
+  {
+    label: i18n.translate('xpack.siem.detectionEngine.mitreAttackTechniques.emondDescription', {
+      defaultMessage: 'Emond (T1519)',
+    }),
+    id: 'T1519',
+    name: 'Emond',
+    reference: 'https://attack.mitre.org/techniques/T1519',
+    tactics: 'persistence,privilege-escalation',
+    value: 'emond',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.endpointDenialOfServiceDescription',
+      { defaultMessage: 'Endpoint Denial of Service (T1499)' }
+    ),
+    id: 'T1499',
+    name: 'Endpoint Denial of Service',
+    reference: 'https://attack.mitre.org/techniques/T1499',
+    tactics: 'impact',
+    value: 'endpointDenialOfService',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.executionGuardrailsDescription',
+      { defaultMessage: 'Execution Guardrails (T1480)' }
+    ),
+    id: 'T1480',
+    name: 'Execution Guardrails',
+    reference: 'https://attack.mitre.org/techniques/T1480',
+    tactics: 'defense-evasion',
+    value: 'executionGuardrails',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.executionThroughApiDescription',
+      { defaultMessage: 'Execution through API (T1106)' }
+    ),
+    id: 'T1106',
+    name: 'Execution through API',
+    reference: 'https://attack.mitre.org/techniques/T1106',
+    tactics: 'execution',
+    value: 'executionThroughApi',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.executionThroughModuleLoadDescription',
+      { defaultMessage: 'Execution through Module Load (T1129)' }
+    ),
+    id: 'T1129',
+    name: 'Execution through Module Load',
+    reference: 'https://attack.mitre.org/techniques/T1129',
+    tactics: 'execution',
+    value: 'executionThroughModuleLoad',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.exfiltrationOverAlternativeProtocolDescription',
+      { defaultMessage: 'Exfiltration Over Alternative Protocol (T1048)' }
+    ),
+    id: 'T1048',
+    name: 'Exfiltration Over Alternative Protocol',
+    reference: 'https://attack.mitre.org/techniques/T1048',
+    tactics: 'exfiltration',
+    value: 'exfiltrationOverAlternativeProtocol',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.exfiltrationOverCommandAndControlChannelDescription',
+      { defaultMessage: 'Exfiltration Over Command and Control Channel (T1041)' }
+    ),
+    id: 'T1041',
+    name: 'Exfiltration Over Command and Control Channel',
+    reference: 'https://attack.mitre.org/techniques/T1041',
+    tactics: 'exfiltration',
+    value: 'exfiltrationOverCommandAndControlChannel',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.exfiltrationOverOtherNetworkMediumDescription',
+      { defaultMessage: 'Exfiltration Over Other Network Medium (T1011)' }
+    ),
+    id: 'T1011',
+    name: 'Exfiltration Over Other Network Medium',
+    reference: 'https://attack.mitre.org/techniques/T1011',
+    tactics: 'exfiltration',
+    value: 'exfiltrationOverOtherNetworkMedium',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.exfiltrationOverPhysicalMediumDescription',
+      { defaultMessage: 'Exfiltration Over Physical Medium (T1052)' }
+    ),
+    id: 'T1052',
+    name: 'Exfiltration Over Physical Medium',
+    reference: 'https://attack.mitre.org/techniques/T1052',
+    tactics: 'exfiltration',
+    value: 'exfiltrationOverPhysicalMedium',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.exploitPublicFacingApplicationDescription',
+      { defaultMessage: 'Exploit Public-Facing Application (T1190)' }
+    ),
+    id: 'T1190',
+    name: 'Exploit Public-Facing Application',
+    reference: 'https://attack.mitre.org/techniques/T1190',
+    tactics: 'initial-access',
+    value: 'exploitPublicFacingApplication',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.exploitationForClientExecutionDescription',
+      { defaultMessage: 'Exploitation for Client Execution (T1203)' }
+    ),
+    id: 'T1203',
+    name: 'Exploitation for Client Execution',
+    reference: 'https://attack.mitre.org/techniques/T1203',
+    tactics: 'execution',
+    value: 'exploitationForClientExecution',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.exploitationForCredentialAccessDescription',
+      { defaultMessage: 'Exploitation for Credential Access (T1212)' }
+    ),
+    id: 'T1212',
+    name: 'Exploitation for Credential Access',
+    reference: 'https://attack.mitre.org/techniques/T1212',
+    tactics: 'credential-access',
+    value: 'exploitationForCredentialAccess',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.exploitationForDefenseEvasionDescription',
+      { defaultMessage: 'Exploitation for Defense Evasion (T1211)' }
+    ),
+    id: 'T1211',
+    name: 'Exploitation for Defense Evasion',
+    reference: 'https://attack.mitre.org/techniques/T1211',
+    tactics: 'defense-evasion',
+    value: 'exploitationForDefenseEvasion',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.exploitationForPrivilegeEscalationDescription',
+      { defaultMessage: 'Exploitation for Privilege Escalation (T1068)' }
+    ),
+    id: 'T1068',
+    name: 'Exploitation for Privilege Escalation',
+    reference: 'https://attack.mitre.org/techniques/T1068',
+    tactics: 'privilege-escalation',
+    value: 'exploitationForPrivilegeEscalation',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.exploitationOfRemoteServicesDescription',
+      { defaultMessage: 'Exploitation of Remote Services (T1210)' }
+    ),
+    id: 'T1210',
+    name: 'Exploitation of Remote Services',
+    reference: 'https://attack.mitre.org/techniques/T1210',
+    tactics: 'lateral-movement',
+    value: 'exploitationOfRemoteServices',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.externalRemoteServicesDescription',
+      { defaultMessage: 'External Remote Services (T1133)' }
+    ),
+    id: 'T1133',
+    name: 'External Remote Services',
+    reference: 'https://attack.mitre.org/techniques/T1133',
+    tactics: 'persistence,initial-access',
+    value: 'externalRemoteServices',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.extraWindowMemoryInjectionDescription',
+      { defaultMessage: 'Extra Window Memory Injection (T1181)' }
+    ),
+    id: 'T1181',
+    name: 'Extra Window Memory Injection',
+    reference: 'https://attack.mitre.org/techniques/T1181',
+    tactics: 'defense-evasion,privilege-escalation',
+    value: 'extraWindowMemoryInjection',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.fallbackChannelsDescription',
+      { defaultMessage: 'Fallback Channels (T1008)' }
+    ),
+    id: 'T1008',
+    name: 'Fallback Channels',
+    reference: 'https://attack.mitre.org/techniques/T1008',
+    tactics: 'command-and-control',
+    value: 'fallbackChannels',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.fileDeletionDescription',
+      { defaultMessage: 'File Deletion (T1107)' }
+    ),
+    id: 'T1107',
+    name: 'File Deletion',
+    reference: 'https://attack.mitre.org/techniques/T1107',
+    tactics: 'defense-evasion',
+    value: 'fileDeletion',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.fileSystemLogicalOffsetsDescription',
+      { defaultMessage: 'File System Logical Offsets (T1006)' }
+    ),
+    id: 'T1006',
+    name: 'File System Logical Offsets',
+    reference: 'https://attack.mitre.org/techniques/T1006',
+    tactics: 'defense-evasion',
+    value: 'fileSystemLogicalOffsets',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.fileSystemPermissionsWeaknessDescription',
+      { defaultMessage: 'File System Permissions Weakness (T1044)' }
+    ),
+    id: 'T1044',
+    name: 'File System Permissions Weakness',
+    reference: 'https://attack.mitre.org/techniques/T1044',
+    tactics: 'persistence,privilege-escalation',
+    value: 'fileSystemPermissionsWeakness',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.fileAndDirectoryDiscoveryDescription',
+      { defaultMessage: 'File and Directory Discovery (T1083)' }
+    ),
+    id: 'T1083',
+    name: 'File and Directory Discovery',
+    reference: 'https://attack.mitre.org/techniques/T1083',
+    tactics: 'discovery',
+    value: 'fileAndDirectoryDiscovery',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.fileAndDirectoryPermissionsModificationDescription',
+      { defaultMessage: 'File and Directory Permissions Modification (T1222)' }
+    ),
+    id: 'T1222',
+    name: 'File and Directory Permissions Modification',
+    reference: 'https://attack.mitre.org/techniques/T1222',
+    tactics: 'defense-evasion',
+    value: 'fileAndDirectoryPermissionsModification',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.firmwareCorruptionDescription',
+      { defaultMessage: 'Firmware Corruption (T1495)' }
+    ),
+    id: 'T1495',
+    name: 'Firmware Corruption',
+    reference: 'https://attack.mitre.org/techniques/T1495',
+    tactics: 'impact',
+    value: 'firmwareCorruption',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.forcedAuthenticationDescription',
+      { defaultMessage: 'Forced Authentication (T1187)' }
+    ),
+    id: 'T1187',
+    name: 'Forced Authentication',
+    reference: 'https://attack.mitre.org/techniques/T1187',
+    tactics: 'credential-access',
+    value: 'forcedAuthentication',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.gatekeeperBypassDescription',
+      { defaultMessage: 'Gatekeeper Bypass (T1144)' }
+    ),
+    id: 'T1144',
+    name: 'Gatekeeper Bypass',
+    reference: 'https://attack.mitre.org/techniques/T1144',
+    tactics: 'defense-evasion',
+    value: 'gatekeeperBypass',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.graphicalUserInterfaceDescription',
+      { defaultMessage: 'Graphical User Interface (T1061)' }
+    ),
+    id: 'T1061',
+    name: 'Graphical User Interface',
+    reference: 'https://attack.mitre.org/techniques/T1061',
+    tactics: 'execution',
+    value: 'graphicalUserInterface',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.groupPolicyModificationDescription',
+      { defaultMessage: 'Group Policy Modification (T1484)' }
+    ),
+    id: 'T1484',
+    name: 'Group Policy Modification',
+    reference: 'https://attack.mitre.org/techniques/T1484',
+    tactics: 'defense-evasion',
+    value: 'groupPolicyModification',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.histcontrolDescription',
+      { defaultMessage: 'HISTCONTROL (T1148)' }
+    ),
+    id: 'T1148',
+    name: 'HISTCONTROL',
+    reference: 'https://attack.mitre.org/techniques/T1148',
+    tactics: 'defense-evasion',
+    value: 'histcontrol',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.hardwareAdditionsDescription',
+      { defaultMessage: 'Hardware Additions (T1200)' }
+    ),
+    id: 'T1200',
+    name: 'Hardware Additions',
+    reference: 'https://attack.mitre.org/techniques/T1200',
+    tactics: 'initial-access',
+    value: 'hardwareAdditions',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.hiddenFilesAndDirectoriesDescription',
+      { defaultMessage: 'Hidden Files and Directories (T1158)' }
+    ),
+    id: 'T1158',
+    name: 'Hidden Files and Directories',
+    reference: 'https://attack.mitre.org/techniques/T1158',
+    tactics: 'defense-evasion,persistence',
+    value: 'hiddenFilesAndDirectories',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.hiddenUsersDescription',
+      { defaultMessage: 'Hidden Users (T1147)' }
+    ),
+    id: 'T1147',
+    name: 'Hidden Users',
+    reference: 'https://attack.mitre.org/techniques/T1147',
+    tactics: 'defense-evasion',
+    value: 'hiddenUsers',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.hiddenWindowDescription',
+      { defaultMessage: 'Hidden Window (T1143)' }
+    ),
+    id: 'T1143',
+    name: 'Hidden Window',
+    reference: 'https://attack.mitre.org/techniques/T1143',
+    tactics: 'defense-evasion',
+    value: 'hiddenWindow',
+  },
+  {
+    label: i18n.translate('xpack.siem.detectionEngine.mitreAttackTechniques.hookingDescription', {
+      defaultMessage: 'Hooking (T1179)',
+    }),
+    id: 'T1179',
+    name: 'Hooking',
+    reference: 'https://attack.mitre.org/techniques/T1179',
+    tactics: 'persistence,privilege-escalation,credential-access',
+    value: 'hooking',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.hypervisorDescription',
+      { defaultMessage: 'Hypervisor (T1062)' }
+    ),
+    id: 'T1062',
+    name: 'Hypervisor',
+    reference: 'https://attack.mitre.org/techniques/T1062',
+    tactics: 'persistence',
+    value: 'hypervisor',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.imageFileExecutionOptionsInjectionDescription',
+      { defaultMessage: 'Image File Execution Options Injection (T1183)' }
+    ),
+    id: 'T1183',
+    name: 'Image File Execution Options Injection',
+    reference: 'https://attack.mitre.org/techniques/T1183',
+    tactics: 'privilege-escalation,persistence,defense-evasion',
+    value: 'imageFileExecutionOptionsInjection',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.implantContainerImageDescription',
+      { defaultMessage: 'Implant Container Image (T1525)' }
+    ),
+    id: 'T1525',
+    name: 'Implant Container Image',
+    reference: 'https://attack.mitre.org/techniques/T1525',
+    tactics: 'persistence',
+    value: 'implantContainerImage',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.indicatorBlockingDescription',
+      { defaultMessage: 'Indicator Blocking (T1054)' }
+    ),
+    id: 'T1054',
+    name: 'Indicator Blocking',
+    reference: 'https://attack.mitre.org/techniques/T1054',
+    tactics: 'defense-evasion',
+    value: 'indicatorBlocking',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.indicatorRemovalFromToolsDescription',
+      { defaultMessage: 'Indicator Removal from Tools (T1066)' }
+    ),
+    id: 'T1066',
+    name: 'Indicator Removal from Tools',
+    reference: 'https://attack.mitre.org/techniques/T1066',
+    tactics: 'defense-evasion',
+    value: 'indicatorRemovalFromTools',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.indicatorRemovalOnHostDescription',
+      { defaultMessage: 'Indicator Removal on Host (T1070)' }
+    ),
+    id: 'T1070',
+    name: 'Indicator Removal on Host',
+    reference: 'https://attack.mitre.org/techniques/T1070',
+    tactics: 'defense-evasion',
+    value: 'indicatorRemovalOnHost',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.indirectCommandExecutionDescription',
+      { defaultMessage: 'Indirect Command Execution (T1202)' }
+    ),
+    id: 'T1202',
+    name: 'Indirect Command Execution',
+    reference: 'https://attack.mitre.org/techniques/T1202',
+    tactics: 'defense-evasion',
+    value: 'indirectCommandExecution',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.inhibitSystemRecoveryDescription',
+      { defaultMessage: 'Inhibit System Recovery (T1490)' }
+    ),
+    id: 'T1490',
+    name: 'Inhibit System Recovery',
+    reference: 'https://attack.mitre.org/techniques/T1490',
+    tactics: 'impact',
+    value: 'inhibitSystemRecovery',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.inputCaptureDescription',
+      { defaultMessage: 'Input Capture (T1056)' }
+    ),
+    id: 'T1056',
+    name: 'Input Capture',
+    reference: 'https://attack.mitre.org/techniques/T1056',
+    tactics: 'collection,credential-access',
+    value: 'inputCapture',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.inputPromptDescription',
+      { defaultMessage: 'Input Prompt (T1141)' }
+    ),
+    id: 'T1141',
+    name: 'Input Prompt',
+    reference: 'https://attack.mitre.org/techniques/T1141',
+    tactics: 'credential-access',
+    value: 'inputPrompt',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.installRootCertificateDescription',
+      { defaultMessage: 'Install Root Certificate (T1130)' }
+    ),
+    id: 'T1130',
+    name: 'Install Root Certificate',
+    reference: 'https://attack.mitre.org/techniques/T1130',
+    tactics: 'defense-evasion',
+    value: 'installRootCertificate',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.installUtilDescription',
+      { defaultMessage: 'InstallUtil (T1118)' }
+    ),
+    id: 'T1118',
+    name: 'InstallUtil',
+    reference: 'https://attack.mitre.org/techniques/T1118',
+    tactics: 'defense-evasion,execution',
+    value: 'installUtil',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.internalSpearphishingDescription',
+      { defaultMessage: 'Internal Spearphishing (T1534)' }
+    ),
+    id: 'T1534',
+    name: 'Internal Spearphishing',
+    reference: 'https://attack.mitre.org/techniques/T1534',
+    tactics: 'lateral-movement',
+    value: 'internalSpearphishing',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.kerberoastingDescription',
+      { defaultMessage: 'Kerberoasting (T1208)' }
+    ),
+    id: 'T1208',
+    name: 'Kerberoasting',
+    reference: 'https://attack.mitre.org/techniques/T1208',
+    tactics: 'credential-access',
+    value: 'kerberoasting',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.kernelModulesAndExtensionsDescription',
+      { defaultMessage: 'Kernel Modules and Extensions (T1215)' }
+    ),
+    id: 'T1215',
+    name: 'Kernel Modules and Extensions',
+    reference: 'https://attack.mitre.org/techniques/T1215',
+    tactics: 'persistence',
+    value: 'kernelModulesAndExtensions',
+  },
+  {
+    label: i18n.translate('xpack.siem.detectionEngine.mitreAttackTechniques.keychainDescription', {
+      defaultMessage: 'Keychain (T1142)',
+    }),
+    id: 'T1142',
+    name: 'Keychain',
+    reference: 'https://attack.mitre.org/techniques/T1142',
+    tactics: 'credential-access',
+    value: 'keychain',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.lcLoadDylibAdditionDescription',
+      { defaultMessage: 'LC_LOAD_DYLIB Addition (T1161)' }
+    ),
+    id: 'T1161',
+    name: 'LC_LOAD_DYLIB Addition',
+    reference: 'https://attack.mitre.org/techniques/T1161',
+    tactics: 'persistence',
+    value: 'lcLoadDylibAddition',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.lcMainHijackingDescription',
+      { defaultMessage: 'LC_MAIN Hijacking (T1149)' }
+    ),
+    id: 'T1149',
+    name: 'LC_MAIN Hijacking',
+    reference: 'https://attack.mitre.org/techniques/T1149',
+    tactics: 'defense-evasion',
+    value: 'lcMainHijacking',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.llmnrNbtNsPoisoningAndRelayDescription',
+      { defaultMessage: 'LLMNR/NBT-NS Poisoning and Relay (T1171)' }
+    ),
+    id: 'T1171',
+    name: 'LLMNR/NBT-NS Poisoning and Relay',
+    reference: 'https://attack.mitre.org/techniques/T1171',
+    tactics: 'credential-access',
+    value: 'llmnrNbtNsPoisoningAndRelay',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.lsassDriverDescription',
+      { defaultMessage: 'LSASS Driver (T1177)' }
+    ),
+    id: 'T1177',
+    name: 'LSASS Driver',
+    reference: 'https://attack.mitre.org/techniques/T1177',
+    tactics: 'execution,persistence',
+    value: 'lsassDriver',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.launchAgentDescription',
+      { defaultMessage: 'Launch Agent (T1159)' }
+    ),
+    id: 'T1159',
+    name: 'Launch Agent',
+    reference: 'https://attack.mitre.org/techniques/T1159',
+    tactics: 'persistence',
+    value: 'launchAgent',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.launchDaemonDescription',
+      { defaultMessage: 'Launch Daemon (T1160)' }
+    ),
+    id: 'T1160',
+    name: 'Launch Daemon',
+    reference: 'https://attack.mitre.org/techniques/T1160',
+    tactics: 'persistence,privilege-escalation',
+    value: 'launchDaemon',
+  },
+  {
+    label: i18n.translate('xpack.siem.detectionEngine.mitreAttackTechniques.launchctlDescription', {
+      defaultMessage: 'Launchctl (T1152)',
+    }),
+    id: 'T1152',
+    name: 'Launchctl',
+    reference: 'https://attack.mitre.org/techniques/T1152',
+    tactics: 'defense-evasion,execution,persistence',
+    value: 'launchctl',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.localJobSchedulingDescription',
+      { defaultMessage: 'Local Job Scheduling (T1168)' }
+    ),
+    id: 'T1168',
+    name: 'Local Job Scheduling',
+    reference: 'https://attack.mitre.org/techniques/T1168',
+    tactics: 'persistence,execution',
+    value: 'localJobScheduling',
+  },
+  {
+    label: i18n.translate('xpack.siem.detectionEngine.mitreAttackTechniques.loginItemDescription', {
+      defaultMessage: 'Login Item (T1162)',
+    }),
+    id: 'T1162',
+    name: 'Login Item',
+    reference: 'https://attack.mitre.org/techniques/T1162',
+    tactics: 'persistence',
+    value: 'loginItem',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.logonScriptsDescription',
+      { defaultMessage: 'Logon Scripts (T1037)' }
+    ),
+    id: 'T1037',
+    name: 'Logon Scripts',
+    reference: 'https://attack.mitre.org/techniques/T1037',
+    tactics: 'lateral-movement,persistence',
+    value: 'logonScripts',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.manInTheBrowserDescription',
+      { defaultMessage: 'Man in the Browser (T1185)' }
+    ),
+    id: 'T1185',
+    name: 'Man in the Browser',
+    reference: 'https://attack.mitre.org/techniques/T1185',
+    tactics: 'collection',
+    value: 'manInTheBrowser',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.masqueradingDescription',
+      { defaultMessage: 'Masquerading (T1036)' }
+    ),
+    id: 'T1036',
+    name: 'Masquerading',
+    reference: 'https://attack.mitre.org/techniques/T1036',
+    tactics: 'defense-evasion',
+    value: 'masquerading',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.modifyExistingServiceDescription',
+      { defaultMessage: 'Modify Existing Service (T1031)' }
+    ),
+    id: 'T1031',
+    name: 'Modify Existing Service',
+    reference: 'https://attack.mitre.org/techniques/T1031',
+    tactics: 'persistence',
+    value: 'modifyExistingService',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.modifyRegistryDescription',
+      { defaultMessage: 'Modify Registry (T1112)' }
+    ),
+    id: 'T1112',
+    name: 'Modify Registry',
+    reference: 'https://attack.mitre.org/techniques/T1112',
+    tactics: 'defense-evasion',
+    value: 'modifyRegistry',
+  },
+  {
+    label: i18n.translate('xpack.siem.detectionEngine.mitreAttackTechniques.mshtaDescription', {
+      defaultMessage: 'Mshta (T1170)',
+    }),
+    id: 'T1170',
+    name: 'Mshta',
+    reference: 'https://attack.mitre.org/techniques/T1170',
+    tactics: 'defense-evasion,execution',
+    value: 'mshta',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.multiStageChannelsDescription',
+      { defaultMessage: 'Multi-Stage Channels (T1104)' }
+    ),
+    id: 'T1104',
+    name: 'Multi-Stage Channels',
+    reference: 'https://attack.mitre.org/techniques/T1104',
+    tactics: 'command-and-control',
+    value: 'multiStageChannels',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.multiHopProxyDescription',
+      { defaultMessage: 'Multi-hop Proxy (T1188)' }
+    ),
+    id: 'T1188',
+    name: 'Multi-hop Proxy',
+    reference: 'https://attack.mitre.org/techniques/T1188',
+    tactics: 'command-and-control',
+    value: 'multiHopProxy',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.multibandCommunicationDescription',
+      { defaultMessage: 'Multiband Communication (T1026)' }
+    ),
+    id: 'T1026',
+    name: 'Multiband Communication',
+    reference: 'https://attack.mitre.org/techniques/T1026',
+    tactics: 'command-and-control',
+    value: 'multibandCommunication',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.multilayerEncryptionDescription',
+      { defaultMessage: 'Multilayer Encryption (T1079)' }
+    ),
+    id: 'T1079',
+    name: 'Multilayer Encryption',
+    reference: 'https://attack.mitre.org/techniques/T1079',
+    tactics: 'command-and-control',
+    value: 'multilayerEncryption',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.ntfsFileAttributesDescription',
+      { defaultMessage: 'NTFS File Attributes (T1096)' }
+    ),
+    id: 'T1096',
+    name: 'NTFS File Attributes',
+    reference: 'https://attack.mitre.org/techniques/T1096',
+    tactics: 'defense-evasion',
+    value: 'ntfsFileAttributes',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.netshHelperDllDescription',
+      { defaultMessage: 'Netsh Helper DLL (T1128)' }
+    ),
+    id: 'T1128',
+    name: 'Netsh Helper DLL',
+    reference: 'https://attack.mitre.org/techniques/T1128',
+    tactics: 'persistence',
+    value: 'netshHelperDll',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.networkDenialOfServiceDescription',
+      { defaultMessage: 'Network Denial of Service (T1498)' }
+    ),
+    id: 'T1498',
+    name: 'Network Denial of Service',
+    reference: 'https://attack.mitre.org/techniques/T1498',
+    tactics: 'impact',
+    value: 'networkDenialOfService',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.networkServiceScanningDescription',
+      { defaultMessage: 'Network Service Scanning (T1046)' }
+    ),
+    id: 'T1046',
+    name: 'Network Service Scanning',
+    reference: 'https://attack.mitre.org/techniques/T1046',
+    tactics: 'discovery',
+    value: 'networkServiceScanning',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.networkShareConnectionRemovalDescription',
+      { defaultMessage: 'Network Share Connection Removal (T1126)' }
+    ),
+    id: 'T1126',
+    name: 'Network Share Connection Removal',
+    reference: 'https://attack.mitre.org/techniques/T1126',
+    tactics: 'defense-evasion',
+    value: 'networkShareConnectionRemoval',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.networkShareDiscoveryDescription',
+      { defaultMessage: 'Network Share Discovery (T1135)' }
+    ),
+    id: 'T1135',
+    name: 'Network Share Discovery',
+    reference: 'https://attack.mitre.org/techniques/T1135',
+    tactics: 'discovery',
+    value: 'networkShareDiscovery',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.networkSniffingDescription',
+      { defaultMessage: 'Network Sniffing (T1040)' }
+    ),
+    id: 'T1040',
+    name: 'Network Sniffing',
+    reference: 'https://attack.mitre.org/techniques/T1040',
+    tactics: 'credential-access,discovery',
+    value: 'networkSniffing',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.newServiceDescription',
+      { defaultMessage: 'New Service (T1050)' }
+    ),
+    id: 'T1050',
+    name: 'New Service',
+    reference: 'https://attack.mitre.org/techniques/T1050',
+    tactics: 'persistence,privilege-escalation',
+    value: 'newService',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.obfuscatedFilesOrInformationDescription',
+      { defaultMessage: 'Obfuscated Files or Information (T1027)' }
+    ),
+    id: 'T1027',
+    name: 'Obfuscated Files or Information',
+    reference: 'https://attack.mitre.org/techniques/T1027',
+    tactics: 'defense-evasion',
+    value: 'obfuscatedFilesOrInformation',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.officeApplicationStartupDescription',
+      { defaultMessage: 'Office Application Startup (T1137)' }
+    ),
+    id: 'T1137',
+    name: 'Office Application Startup',
+    reference: 'https://attack.mitre.org/techniques/T1137',
+    tactics: 'persistence',
+    value: 'officeApplicationStartup',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.parentPidSpoofingDescription',
+      { defaultMessage: 'Parent PID Spoofing (T1502)' }
+    ),
+    id: 'T1502',
+    name: 'Parent PID Spoofing',
+    reference: 'https://attack.mitre.org/techniques/T1502',
+    tactics: 'defense-evasion,privilege-escalation',
+    value: 'parentPidSpoofing',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.passTheHashDescription',
+      { defaultMessage: 'Pass the Hash (T1075)' }
+    ),
+    id: 'T1075',
+    name: 'Pass the Hash',
+    reference: 'https://attack.mitre.org/techniques/T1075',
+    tactics: 'lateral-movement',
+    value: 'passTheHash',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.passTheTicketDescription',
+      { defaultMessage: 'Pass the Ticket (T1097)' }
+    ),
+    id: 'T1097',
+    name: 'Pass the Ticket',
+    reference: 'https://attack.mitre.org/techniques/T1097',
+    tactics: 'lateral-movement',
+    value: 'passTheTicket',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.passwordFilterDllDescription',
+      { defaultMessage: 'Password Filter DLL (T1174)' }
+    ),
+    id: 'T1174',
+    name: 'Password Filter DLL',
+    reference: 'https://attack.mitre.org/techniques/T1174',
+    tactics: 'credential-access',
+    value: 'passwordFilterDll',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.passwordPolicyDiscoveryDescription',
+      { defaultMessage: 'Password Policy Discovery (T1201)' }
+    ),
+    id: 'T1201',
+    name: 'Password Policy Discovery',
+    reference: 'https://attack.mitre.org/techniques/T1201',
+    tactics: 'discovery',
+    value: 'passwordPolicyDiscovery',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.pathInterceptionDescription',
+      { defaultMessage: 'Path Interception (T1034)' }
+    ),
+    id: 'T1034',
+    name: 'Path Interception',
+    reference: 'https://attack.mitre.org/techniques/T1034',
+    tactics: 'persistence,privilege-escalation',
+    value: 'pathInterception',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.peripheralDeviceDiscoveryDescription',
+      { defaultMessage: 'Peripheral Device Discovery (T1120)' }
+    ),
+    id: 'T1120',
+    name: 'Peripheral Device Discovery',
+    reference: 'https://attack.mitre.org/techniques/T1120',
+    tactics: 'discovery',
+    value: 'peripheralDeviceDiscovery',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.permissionGroupsDiscoveryDescription',
+      { defaultMessage: 'Permission Groups Discovery (T1069)' }
+    ),
+    id: 'T1069',
+    name: 'Permission Groups Discovery',
+    reference: 'https://attack.mitre.org/techniques/T1069',
+    tactics: 'discovery',
+    value: 'permissionGroupsDiscovery',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.plistModificationDescription',
+      { defaultMessage: 'Plist Modification (T1150)' }
+    ),
+    id: 'T1150',
+    name: 'Plist Modification',
+    reference: 'https://attack.mitre.org/techniques/T1150',
+    tactics: 'defense-evasion,persistence,privilege-escalation',
+    value: 'plistModification',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.portKnockingDescription',
+      { defaultMessage: 'Port Knocking (T1205)' }
+    ),
+    id: 'T1205',
+    name: 'Port Knocking',
+    reference: 'https://attack.mitre.org/techniques/T1205',
+    tactics: 'defense-evasion,persistence,command-and-control',
+    value: 'portKnocking',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.portMonitorsDescription',
+      { defaultMessage: 'Port Monitors (T1013)' }
+    ),
+    id: 'T1013',
+    name: 'Port Monitors',
+    reference: 'https://attack.mitre.org/techniques/T1013',
+    tactics: 'persistence,privilege-escalation',
+    value: 'portMonitors',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.powerShellDescription',
+      { defaultMessage: 'PowerShell (T1086)' }
+    ),
+    id: 'T1086',
+    name: 'PowerShell',
+    reference: 'https://attack.mitre.org/techniques/T1086',
+    tactics: 'execution',
+    value: 'powerShell',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.powerShellProfileDescription',
+      { defaultMessage: 'PowerShell Profile (T1504)' }
+    ),
+    id: 'T1504',
+    name: 'PowerShell Profile',
+    reference: 'https://attack.mitre.org/techniques/T1504',
+    tactics: 'persistence,privilege-escalation',
+    value: 'powerShellProfile',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.privateKeysDescription',
+      { defaultMessage: 'Private Keys (T1145)' }
+    ),
+    id: 'T1145',
+    name: 'Private Keys',
+    reference: 'https://attack.mitre.org/techniques/T1145',
+    tactics: 'credential-access',
+    value: 'privateKeys',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.processDiscoveryDescription',
+      { defaultMessage: 'Process Discovery (T1057)' }
+    ),
+    id: 'T1057',
+    name: 'Process Discovery',
+    reference: 'https://attack.mitre.org/techniques/T1057',
+    tactics: 'discovery',
+    value: 'processDiscovery',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.processDoppelgangingDescription',
+      { defaultMessage: 'Process Doppelgänging (T1186)' }
+    ),
+    id: 'T1186',
+    name: 'Process Doppelgänging',
+    reference: 'https://attack.mitre.org/techniques/T1186',
+    tactics: 'defense-evasion',
+    value: 'processDoppelganging',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.processHollowingDescription',
+      { defaultMessage: 'Process Hollowing (T1093)' }
+    ),
+    id: 'T1093',
+    name: 'Process Hollowing',
+    reference: 'https://attack.mitre.org/techniques/T1093',
+    tactics: 'defense-evasion',
+    value: 'processHollowing',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.processInjectionDescription',
+      { defaultMessage: 'Process Injection (T1055)' }
+    ),
+    id: 'T1055',
+    name: 'Process Injection',
+    reference: 'https://attack.mitre.org/techniques/T1055',
+    tactics: 'defense-evasion,privilege-escalation',
+    value: 'processInjection',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.queryRegistryDescription',
+      { defaultMessage: 'Query Registry (T1012)' }
+    ),
+    id: 'T1012',
+    name: 'Query Registry',
+    reference: 'https://attack.mitre.org/techniques/T1012',
+    tactics: 'discovery',
+    value: 'queryRegistry',
+  },
+  {
+    label: i18n.translate('xpack.siem.detectionEngine.mitreAttackTechniques.rcCommonDescription', {
+      defaultMessage: 'Rc.common (T1163)',
+    }),
+    id: 'T1163',
+    name: 'Rc.common',
+    reference: 'https://attack.mitre.org/techniques/T1163',
+    tactics: 'persistence',
+    value: 'rcCommon',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.reOpenedApplicationsDescription',
+      { defaultMessage: 'Re-opened Applications (T1164)' }
+    ),
+    id: 'T1164',
+    name: 'Re-opened Applications',
+    reference: 'https://attack.mitre.org/techniques/T1164',
+    tactics: 'persistence',
+    value: 'reOpenedApplications',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.redundantAccessDescription',
+      { defaultMessage: 'Redundant Access (T1108)' }
+    ),
+    id: 'T1108',
+    name: 'Redundant Access',
+    reference: 'https://attack.mitre.org/techniques/T1108',
+    tactics: 'defense-evasion,persistence',
+    value: 'redundantAccess',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.registryRunKeysStartupFolderDescription',
+      { defaultMessage: 'Registry Run Keys / Startup Folder (T1060)' }
+    ),
+    id: 'T1060',
+    name: 'Registry Run Keys / Startup Folder',
+    reference: 'https://attack.mitre.org/techniques/T1060',
+    tactics: 'persistence',
+    value: 'registryRunKeysStartupFolder',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.regsvcsRegasmDescription',
+      { defaultMessage: 'Regsvcs/Regasm (T1121)' }
+    ),
+    id: 'T1121',
+    name: 'Regsvcs/Regasm',
+    reference: 'https://attack.mitre.org/techniques/T1121',
+    tactics: 'defense-evasion,execution',
+    value: 'regsvcsRegasm',
+  },
+  {
+    label: i18n.translate('xpack.siem.detectionEngine.mitreAttackTechniques.regsvr32Description', {
+      defaultMessage: 'Regsvr32 (T1117)',
+    }),
+    id: 'T1117',
+    name: 'Regsvr32',
+    reference: 'https://attack.mitre.org/techniques/T1117',
+    tactics: 'defense-evasion,execution',
+    value: 'regsvr32',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.remoteAccessToolsDescription',
+      { defaultMessage: 'Remote Access Tools (T1219)' }
+    ),
+    id: 'T1219',
+    name: 'Remote Access Tools',
+    reference: 'https://attack.mitre.org/techniques/T1219',
+    tactics: 'command-and-control',
+    value: 'remoteAccessTools',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.remoteDesktopProtocolDescription',
+      { defaultMessage: 'Remote Desktop Protocol (T1076)' }
+    ),
+    id: 'T1076',
+    name: 'Remote Desktop Protocol',
+    reference: 'https://attack.mitre.org/techniques/T1076',
+    tactics: 'lateral-movement',
+    value: 'remoteDesktopProtocol',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.remoteFileCopyDescription',
+      { defaultMessage: 'Remote File Copy (T1105)' }
+    ),
+    id: 'T1105',
+    name: 'Remote File Copy',
+    reference: 'https://attack.mitre.org/techniques/T1105',
+    tactics: 'command-and-control,lateral-movement',
+    value: 'remoteFileCopy',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.remoteServicesDescription',
+      { defaultMessage: 'Remote Services (T1021)' }
+    ),
+    id: 'T1021',
+    name: 'Remote Services',
+    reference: 'https://attack.mitre.org/techniques/T1021',
+    tactics: 'lateral-movement',
+    value: 'remoteServices',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.remoteSystemDiscoveryDescription',
+      { defaultMessage: 'Remote System Discovery (T1018)' }
+    ),
+    id: 'T1018',
+    name: 'Remote System Discovery',
+    reference: 'https://attack.mitre.org/techniques/T1018',
+    tactics: 'discovery',
+    value: 'remoteSystemDiscovery',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.replicationThroughRemovableMediaDescription',
+      { defaultMessage: 'Replication Through Removable Media (T1091)' }
+    ),
+    id: 'T1091',
+    name: 'Replication Through Removable Media',
+    reference: 'https://attack.mitre.org/techniques/T1091',
+    tactics: 'lateral-movement,initial-access',
+    value: 'replicationThroughRemovableMedia',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.resourceHijackingDescription',
+      { defaultMessage: 'Resource Hijacking (T1496)' }
+    ),
+    id: 'T1496',
+    name: 'Resource Hijacking',
+    reference: 'https://attack.mitre.org/techniques/T1496',
+    tactics: 'impact',
+    value: 'resourceHijacking',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.revertCloudInstanceDescription',
+      { defaultMessage: 'Revert Cloud Instance (T1536)' }
+    ),
+    id: 'T1536',
+    name: 'Revert Cloud Instance',
+    reference: 'https://attack.mitre.org/techniques/T1536',
+    tactics: 'defense-evasion',
+    value: 'revertCloudInstance',
+  },
+  {
+    label: i18n.translate('xpack.siem.detectionEngine.mitreAttackTechniques.rootkitDescription', {
+      defaultMessage: 'Rootkit (T1014)',
+    }),
+    id: 'T1014',
+    name: 'Rootkit',
+    reference: 'https://attack.mitre.org/techniques/T1014',
+    tactics: 'defense-evasion',
+    value: 'rootkit',
+  },
+  {
+    label: i18n.translate('xpack.siem.detectionEngine.mitreAttackTechniques.rundll32Description', {
+      defaultMessage: 'Rundll32 (T1085)',
+    }),
+    id: 'T1085',
+    name: 'Rundll32',
+    reference: 'https://attack.mitre.org/techniques/T1085',
+    tactics: 'defense-evasion,execution',
+    value: 'rundll32',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.runtimeDataManipulationDescription',
+      { defaultMessage: 'Runtime Data Manipulation (T1494)' }
+    ),
+    id: 'T1494',
+    name: 'Runtime Data Manipulation',
+    reference: 'https://attack.mitre.org/techniques/T1494',
+    tactics: 'impact',
+    value: 'runtimeDataManipulation',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.sidHistoryInjectionDescription',
+      { defaultMessage: 'SID-History Injection (T1178)' }
+    ),
+    id: 'T1178',
+    name: 'SID-History Injection',
+    reference: 'https://attack.mitre.org/techniques/T1178',
+    tactics: 'privilege-escalation',
+    value: 'sidHistoryInjection',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.sipAndTrustProviderHijackingDescription',
+      { defaultMessage: 'SIP and Trust Provider Hijacking (T1198)' }
+    ),
+    id: 'T1198',
+    name: 'SIP and Trust Provider Hijacking',
+    reference: 'https://attack.mitre.org/techniques/T1198',
+    tactics: 'defense-evasion,persistence',
+    value: 'sipAndTrustProviderHijacking',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.sshHijackingDescription',
+      { defaultMessage: 'SSH Hijacking (T1184)' }
+    ),
+    id: 'T1184',
+    name: 'SSH Hijacking',
+    reference: 'https://attack.mitre.org/techniques/T1184',
+    tactics: 'lateral-movement',
+    value: 'sshHijacking',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.scheduledTaskDescription',
+      { defaultMessage: 'Scheduled Task (T1053)' }
+    ),
+    id: 'T1053',
+    name: 'Scheduled Task',
+    reference: 'https://attack.mitre.org/techniques/T1053',
+    tactics: 'execution,persistence,privilege-escalation',
+    value: 'scheduledTask',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.scheduledTransferDescription',
+      { defaultMessage: 'Scheduled Transfer (T1029)' }
+    ),
+    id: 'T1029',
+    name: 'Scheduled Transfer',
+    reference: 'https://attack.mitre.org/techniques/T1029',
+    tactics: 'exfiltration',
+    value: 'scheduledTransfer',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.screenCaptureDescription',
+      { defaultMessage: 'Screen Capture (T1113)' }
+    ),
+    id: 'T1113',
+    name: 'Screen Capture',
+    reference: 'https://attack.mitre.org/techniques/T1113',
+    tactics: 'collection',
+    value: 'screenCapture',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.screensaverDescription',
+      { defaultMessage: 'Screensaver (T1180)' }
+    ),
+    id: 'T1180',
+    name: 'Screensaver',
+    reference: 'https://attack.mitre.org/techniques/T1180',
+    tactics: 'persistence',
+    value: 'screensaver',
+  },
+  {
+    label: i18n.translate('xpack.siem.detectionEngine.mitreAttackTechniques.scriptingDescription', {
+      defaultMessage: 'Scripting (T1064)',
+    }),
+    id: 'T1064',
+    name: 'Scripting',
+    reference: 'https://attack.mitre.org/techniques/T1064',
+    tactics: 'defense-evasion,execution',
+    value: 'scripting',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.securitySoftwareDiscoveryDescription',
+      { defaultMessage: 'Security Software Discovery (T1063)' }
+    ),
+    id: 'T1063',
+    name: 'Security Software Discovery',
+    reference: 'https://attack.mitre.org/techniques/T1063',
+    tactics: 'discovery',
+    value: 'securitySoftwareDiscovery',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.securitySupportProviderDescription',
+      { defaultMessage: 'Security Support Provider (T1101)' }
+    ),
+    id: 'T1101',
+    name: 'Security Support Provider',
+    reference: 'https://attack.mitre.org/techniques/T1101',
+    tactics: 'persistence',
+    value: 'securitySupportProvider',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.securitydMemoryDescription',
+      { defaultMessage: 'Securityd Memory (T1167)' }
+    ),
+    id: 'T1167',
+    name: 'Securityd Memory',
+    reference: 'https://attack.mitre.org/techniques/T1167',
+    tactics: 'credential-access',
+    value: 'securitydMemory',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.serverSoftwareComponentDescription',
+      { defaultMessage: 'Server Software Component (T1505)' }
+    ),
+    id: 'T1505',
+    name: 'Server Software Component',
+    reference: 'https://attack.mitre.org/techniques/T1505',
+    tactics: 'persistence',
+    value: 'serverSoftwareComponent',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.serviceExecutionDescription',
+      { defaultMessage: 'Service Execution (T1035)' }
+    ),
+    id: 'T1035',
+    name: 'Service Execution',
+    reference: 'https://attack.mitre.org/techniques/T1035',
+    tactics: 'execution',
+    value: 'serviceExecution',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.serviceRegistryPermissionsWeaknessDescription',
+      { defaultMessage: 'Service Registry Permissions Weakness (T1058)' }
+    ),
+    id: 'T1058',
+    name: 'Service Registry Permissions Weakness',
+    reference: 'https://attack.mitre.org/techniques/T1058',
+    tactics: 'persistence,privilege-escalation',
+    value: 'serviceRegistryPermissionsWeakness',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.serviceStopDescription',
+      { defaultMessage: 'Service Stop (T1489)' }
+    ),
+    id: 'T1489',
+    name: 'Service Stop',
+    reference: 'https://attack.mitre.org/techniques/T1489',
+    tactics: 'impact',
+    value: 'serviceStop',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.setuidAndSetgidDescription',
+      { defaultMessage: 'Setuid and Setgid (T1166)' }
+    ),
+    id: 'T1166',
+    name: 'Setuid and Setgid',
+    reference: 'https://attack.mitre.org/techniques/T1166',
+    tactics: 'privilege-escalation,persistence',
+    value: 'setuidAndSetgid',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.sharedWebrootDescription',
+      { defaultMessage: 'Shared Webroot (T1051)' }
+    ),
+    id: 'T1051',
+    name: 'Shared Webroot',
+    reference: 'https://attack.mitre.org/techniques/T1051',
+    tactics: 'lateral-movement',
+    value: 'sharedWebroot',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.shortcutModificationDescription',
+      { defaultMessage: 'Shortcut Modification (T1023)' }
+    ),
+    id: 'T1023',
+    name: 'Shortcut Modification',
+    reference: 'https://attack.mitre.org/techniques/T1023',
+    tactics: 'persistence',
+    value: 'shortcutModification',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.signedBinaryProxyExecutionDescription',
+      { defaultMessage: 'Signed Binary Proxy Execution (T1218)' }
+    ),
+    id: 'T1218',
+    name: 'Signed Binary Proxy Execution',
+    reference: 'https://attack.mitre.org/techniques/T1218',
+    tactics: 'defense-evasion,execution',
+    value: 'signedBinaryProxyExecution',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.signedScriptProxyExecutionDescription',
+      { defaultMessage: 'Signed Script Proxy Execution (T1216)' }
+    ),
+    id: 'T1216',
+    name: 'Signed Script Proxy Execution',
+    reference: 'https://attack.mitre.org/techniques/T1216',
+    tactics: 'defense-evasion,execution',
+    value: 'signedScriptProxyExecution',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.softwareDiscoveryDescription',
+      { defaultMessage: 'Software Discovery (T1518)' }
+    ),
+    id: 'T1518',
+    name: 'Software Discovery',
+    reference: 'https://attack.mitre.org/techniques/T1518',
+    tactics: 'discovery',
+    value: 'softwareDiscovery',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.softwarePackingDescription',
+      { defaultMessage: 'Software Packing (T1045)' }
+    ),
+    id: 'T1045',
+    name: 'Software Packing',
+    reference: 'https://attack.mitre.org/techniques/T1045',
+    tactics: 'defense-evasion',
+    value: 'softwarePacking',
+  },
+  {
+    label: i18n.translate('xpack.siem.detectionEngine.mitreAttackTechniques.sourceDescription', {
+      defaultMessage: 'Source (T1153)',
+    }),
+    id: 'T1153',
+    name: 'Source',
+    reference: 'https://attack.mitre.org/techniques/T1153',
+    tactics: 'execution',
+    value: 'source',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.spaceAfterFilenameDescription',
+      { defaultMessage: 'Space after Filename (T1151)' }
+    ),
+    id: 'T1151',
+    name: 'Space after Filename',
+    reference: 'https://attack.mitre.org/techniques/T1151',
+    tactics: 'defense-evasion,execution',
+    value: 'spaceAfterFilename',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.spearphishingAttachmentDescription',
+      { defaultMessage: 'Spearphishing Attachment (T1193)' }
+    ),
+    id: 'T1193',
+    name: 'Spearphishing Attachment',
+    reference: 'https://attack.mitre.org/techniques/T1193',
+    tactics: 'initial-access',
+    value: 'spearphishingAttachment',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.spearphishingLinkDescription',
+      { defaultMessage: 'Spearphishing Link (T1192)' }
+    ),
+    id: 'T1192',
+    name: 'Spearphishing Link',
+    reference: 'https://attack.mitre.org/techniques/T1192',
+    tactics: 'initial-access',
+    value: 'spearphishingLink',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.spearphishingViaServiceDescription',
+      { defaultMessage: 'Spearphishing via Service (T1194)' }
+    ),
+    id: 'T1194',
+    name: 'Spearphishing via Service',
+    reference: 'https://attack.mitre.org/techniques/T1194',
+    tactics: 'initial-access',
+    value: 'spearphishingViaService',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.standardApplicationLayerProtocolDescription',
+      { defaultMessage: 'Standard Application Layer Protocol (T1071)' }
+    ),
+    id: 'T1071',
+    name: 'Standard Application Layer Protocol',
+    reference: 'https://attack.mitre.org/techniques/T1071',
+    tactics: 'command-and-control',
+    value: 'standardApplicationLayerProtocol',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.standardCryptographicProtocolDescription',
+      { defaultMessage: 'Standard Cryptographic Protocol (T1032)' }
+    ),
+    id: 'T1032',
+    name: 'Standard Cryptographic Protocol',
+    reference: 'https://attack.mitre.org/techniques/T1032',
+    tactics: 'command-and-control',
+    value: 'standardCryptographicProtocol',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.standardNonApplicationLayerProtocolDescription',
+      { defaultMessage: 'Standard Non-Application Layer Protocol (T1095)' }
+    ),
+    id: 'T1095',
+    name: 'Standard Non-Application Layer Protocol',
+    reference: 'https://attack.mitre.org/techniques/T1095',
+    tactics: 'command-and-control',
+    value: 'standardNonApplicationLayerProtocol',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.startupItemsDescription',
+      { defaultMessage: 'Startup Items (T1165)' }
+    ),
+    id: 'T1165',
+    name: 'Startup Items',
+    reference: 'https://attack.mitre.org/techniques/T1165',
+    tactics: 'persistence,privilege-escalation',
+    value: 'startupItems',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.stealApplicationAccessTokenDescription',
+      { defaultMessage: 'Steal Application Access Token (T1528)' }
+    ),
+    id: 'T1528',
+    name: 'Steal Application Access Token',
+    reference: 'https://attack.mitre.org/techniques/T1528',
+    tactics: 'credential-access',
+    value: 'stealApplicationAccessToken',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.stealWebSessionCookieDescription',
+      { defaultMessage: 'Steal Web Session Cookie (T1539)' }
+    ),
+    id: 'T1539',
+    name: 'Steal Web Session Cookie',
+    reference: 'https://attack.mitre.org/techniques/T1539',
+    tactics: 'credential-access',
+    value: 'stealWebSessionCookie',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.storedDataManipulationDescription',
+      { defaultMessage: 'Stored Data Manipulation (T1492)' }
+    ),
+    id: 'T1492',
+    name: 'Stored Data Manipulation',
+    reference: 'https://attack.mitre.org/techniques/T1492',
+    tactics: 'impact',
+    value: 'storedDataManipulation',
+  },
+  {
+    label: i18n.translate('xpack.siem.detectionEngine.mitreAttackTechniques.sudoDescription', {
+      defaultMessage: 'Sudo (T1169)',
+    }),
+    id: 'T1169',
+    name: 'Sudo',
+    reference: 'https://attack.mitre.org/techniques/T1169',
+    tactics: 'privilege-escalation',
+    value: 'sudo',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.sudoCachingDescription',
+      { defaultMessage: 'Sudo Caching (T1206)' }
+    ),
+    id: 'T1206',
+    name: 'Sudo Caching',
+    reference: 'https://attack.mitre.org/techniques/T1206',
+    tactics: 'privilege-escalation',
+    value: 'sudoCaching',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.supplyChainCompromiseDescription',
+      { defaultMessage: 'Supply Chain Compromise (T1195)' }
+    ),
+    id: 'T1195',
+    name: 'Supply Chain Compromise',
+    reference: 'https://attack.mitre.org/techniques/T1195',
+    tactics: 'initial-access',
+    value: 'supplyChainCompromise',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.systemFirmwareDescription',
+      { defaultMessage: 'System Firmware (T1019)' }
+    ),
+    id: 'T1019',
+    name: 'System Firmware',
+    reference: 'https://attack.mitre.org/techniques/T1019',
+    tactics: 'persistence',
+    value: 'systemFirmware',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.systemInformationDiscoveryDescription',
+      { defaultMessage: 'System Information Discovery (T1082)' }
+    ),
+    id: 'T1082',
+    name: 'System Information Discovery',
+    reference: 'https://attack.mitre.org/techniques/T1082',
+    tactics: 'discovery',
+    value: 'systemInformationDiscovery',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.systemNetworkConfigurationDiscoveryDescription',
+      { defaultMessage: 'System Network Configuration Discovery (T1016)' }
+    ),
+    id: 'T1016',
+    name: 'System Network Configuration Discovery',
+    reference: 'https://attack.mitre.org/techniques/T1016',
+    tactics: 'discovery',
+    value: 'systemNetworkConfigurationDiscovery',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.systemNetworkConnectionsDiscoveryDescription',
+      { defaultMessage: 'System Network Connections Discovery (T1049)' }
+    ),
+    id: 'T1049',
+    name: 'System Network Connections Discovery',
+    reference: 'https://attack.mitre.org/techniques/T1049',
+    tactics: 'discovery',
+    value: 'systemNetworkConnectionsDiscovery',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.systemOwnerUserDiscoveryDescription',
+      { defaultMessage: 'System Owner/User Discovery (T1033)' }
+    ),
+    id: 'T1033',
+    name: 'System Owner/User Discovery',
+    reference: 'https://attack.mitre.org/techniques/T1033',
+    tactics: 'discovery',
+    value: 'systemOwnerUserDiscovery',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.systemServiceDiscoveryDescription',
+      { defaultMessage: 'System Service Discovery (T1007)' }
+    ),
+    id: 'T1007',
+    name: 'System Service Discovery',
+    reference: 'https://attack.mitre.org/techniques/T1007',
+    tactics: 'discovery',
+    value: 'systemServiceDiscovery',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.systemShutdownRebootDescription',
+      { defaultMessage: 'System Shutdown/Reboot (T1529)' }
+    ),
+    id: 'T1529',
+    name: 'System Shutdown/Reboot',
+    reference: 'https://attack.mitre.org/techniques/T1529',
+    tactics: 'impact',
+    value: 'systemShutdownReboot',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.systemTimeDiscoveryDescription',
+      { defaultMessage: 'System Time Discovery (T1124)' }
+    ),
+    id: 'T1124',
+    name: 'System Time Discovery',
+    reference: 'https://attack.mitre.org/techniques/T1124',
+    tactics: 'discovery',
+    value: 'systemTimeDiscovery',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.systemdServiceDescription',
+      { defaultMessage: 'Systemd Service (T1501)' }
+    ),
+    id: 'T1501',
+    name: 'Systemd Service',
+    reference: 'https://attack.mitre.org/techniques/T1501',
+    tactics: 'persistence',
+    value: 'systemdService',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.taintSharedContentDescription',
+      { defaultMessage: 'Taint Shared Content (T1080)' }
+    ),
+    id: 'T1080',
+    name: 'Taint Shared Content',
+    reference: 'https://attack.mitre.org/techniques/T1080',
+    tactics: 'lateral-movement',
+    value: 'taintSharedContent',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.templateInjectionDescription',
+      { defaultMessage: 'Template Injection (T1221)' }
+    ),
+    id: 'T1221',
+    name: 'Template Injection',
+    reference: 'https://attack.mitre.org/techniques/T1221',
+    tactics: 'defense-evasion',
+    value: 'templateInjection',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.thirdPartySoftwareDescription',
+      { defaultMessage: 'Third-party Software (T1072)' }
+    ),
+    id: 'T1072',
+    name: 'Third-party Software',
+    reference: 'https://attack.mitre.org/techniques/T1072',
+    tactics: 'execution,lateral-movement',
+    value: 'thirdPartySoftware',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.timeProvidersDescription',
+      { defaultMessage: 'Time Providers (T1209)' }
+    ),
+    id: 'T1209',
+    name: 'Time Providers',
+    reference: 'https://attack.mitre.org/techniques/T1209',
+    tactics: 'persistence',
+    value: 'timeProviders',
+  },
+  {
+    label: i18n.translate('xpack.siem.detectionEngine.mitreAttackTechniques.timestompDescription', {
+      defaultMessage: 'Timestomp (T1099)',
+    }),
+    id: 'T1099',
+    name: 'Timestomp',
+    reference: 'https://attack.mitre.org/techniques/T1099',
+    tactics: 'defense-evasion',
+    value: 'timestomp',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.transferDataToCloudAccountDescription',
+      { defaultMessage: 'Transfer Data to Cloud Account (T1537)' }
+    ),
+    id: 'T1537',
+    name: 'Transfer Data to Cloud Account',
+    reference: 'https://attack.mitre.org/techniques/T1537',
+    tactics: 'exfiltration',
+    value: 'transferDataToCloudAccount',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.transmittedDataManipulationDescription',
+      { defaultMessage: 'Transmitted Data Manipulation (T1493)' }
+    ),
+    id: 'T1493',
+    name: 'Transmitted Data Manipulation',
+    reference: 'https://attack.mitre.org/techniques/T1493',
+    tactics: 'impact',
+    value: 'transmittedDataManipulation',
+  },
+  {
+    label: i18n.translate('xpack.siem.detectionEngine.mitreAttackTechniques.trapDescription', {
+      defaultMessage: 'Trap (T1154)',
+    }),
+    id: 'T1154',
+    name: 'Trap',
+    reference: 'https://attack.mitre.org/techniques/T1154',
+    tactics: 'execution,persistence',
+    value: 'trap',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.trustedDeveloperUtilitiesDescription',
+      { defaultMessage: 'Trusted Developer Utilities (T1127)' }
+    ),
+    id: 'T1127',
+    name: 'Trusted Developer Utilities',
+    reference: 'https://attack.mitre.org/techniques/T1127',
+    tactics: 'defense-evasion,execution',
+    value: 'trustedDeveloperUtilities',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.trustedRelationshipDescription',
+      { defaultMessage: 'Trusted Relationship (T1199)' }
+    ),
+    id: 'T1199',
+    name: 'Trusted Relationship',
+    reference: 'https://attack.mitre.org/techniques/T1199',
+    tactics: 'initial-access',
+    value: 'trustedRelationship',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.twoFactorAuthenticationInterceptionDescription',
+      { defaultMessage: 'Two-Factor Authentication Interception (T1111)' }
+    ),
+    id: 'T1111',
+    name: 'Two-Factor Authentication Interception',
+    reference: 'https://attack.mitre.org/techniques/T1111',
+    tactics: 'credential-access',
+    value: 'twoFactorAuthenticationInterception',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.uncommonlyUsedPortDescription',
+      { defaultMessage: 'Uncommonly Used Port (T1065)' }
+    ),
+    id: 'T1065',
+    name: 'Uncommonly Used Port',
+    reference: 'https://attack.mitre.org/techniques/T1065',
+    tactics: 'command-and-control',
+    value: 'uncommonlyUsedPort',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.unusedUnsupportedCloudRegionsDescription',
+      { defaultMessage: 'Unused/Unsupported Cloud Regions (T1535)' }
+    ),
+    id: 'T1535',
+    name: 'Unused/Unsupported Cloud Regions',
+    reference: 'https://attack.mitre.org/techniques/T1535',
+    tactics: 'defense-evasion',
+    value: 'unusedUnsupportedCloudRegions',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.userExecutionDescription',
+      { defaultMessage: 'User Execution (T1204)' }
+    ),
+    id: 'T1204',
+    name: 'User Execution',
+    reference: 'https://attack.mitre.org/techniques/T1204',
+    tactics: 'execution',
+    value: 'userExecution',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.validAccountsDescription',
+      { defaultMessage: 'Valid Accounts (T1078)' }
+    ),
+    id: 'T1078',
+    name: 'Valid Accounts',
+    reference: 'https://attack.mitre.org/techniques/T1078',
+    tactics: 'defense-evasion,persistence,privilege-escalation,initial-access',
+    value: 'validAccounts',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.videoCaptureDescription',
+      { defaultMessage: 'Video Capture (T1125)' }
+    ),
+    id: 'T1125',
+    name: 'Video Capture',
+    reference: 'https://attack.mitre.org/techniques/T1125',
+    tactics: 'collection',
+    value: 'videoCapture',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.virtualizationSandboxEvasionDescription',
+      { defaultMessage: 'Virtualization/Sandbox Evasion (T1497)' }
+    ),
+    id: 'T1497',
+    name: 'Virtualization/Sandbox Evasion',
+    reference: 'https://attack.mitre.org/techniques/T1497',
+    tactics: 'defense-evasion,discovery',
+    value: 'virtualizationSandboxEvasion',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.webServiceDescription',
+      { defaultMessage: 'Web Service (T1102)' }
+    ),
+    id: 'T1102',
+    name: 'Web Service',
+    reference: 'https://attack.mitre.org/techniques/T1102',
+    tactics: 'command-and-control,defense-evasion',
+    value: 'webService',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.webSessionCookieDescription',
+      { defaultMessage: 'Web Session Cookie (T1506)' }
+    ),
+    id: 'T1506',
+    name: 'Web Session Cookie',
+    reference: 'https://attack.mitre.org/techniques/T1506',
+    tactics: 'defense-evasion,lateral-movement',
+    value: 'webSessionCookie',
+  },
+  {
+    label: i18n.translate('xpack.siem.detectionEngine.mitreAttackTechniques.webShellDescription', {
+      defaultMessage: 'Web Shell (T1100)',
+    }),
+    id: 'T1100',
+    name: 'Web Shell',
+    reference: 'https://attack.mitre.org/techniques/T1100',
+    tactics: 'persistence,privilege-escalation',
+    value: 'webShell',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.windowsAdminSharesDescription',
+      { defaultMessage: 'Windows Admin Shares (T1077)' }
+    ),
+    id: 'T1077',
+    name: 'Windows Admin Shares',
+    reference: 'https://attack.mitre.org/techniques/T1077',
+    tactics: 'lateral-movement',
+    value: 'windowsAdminShares',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.windowsManagementInstrumentationDescription',
+      { defaultMessage: 'Windows Management Instrumentation (T1047)' }
+    ),
+    id: 'T1047',
+    name: 'Windows Management Instrumentation',
+    reference: 'https://attack.mitre.org/techniques/T1047',
+    tactics: 'execution',
+    value: 'windowsManagementInstrumentation',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.windowsManagementInstrumentationEventSubscriptionDescription',
+      { defaultMessage: 'Windows Management Instrumentation Event Subscription (T1084)' }
+    ),
+    id: 'T1084',
+    name: 'Windows Management Instrumentation Event Subscription',
+    reference: 'https://attack.mitre.org/techniques/T1084',
+    tactics: 'persistence',
+    value: 'windowsManagementInstrumentationEventSubscription',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.windowsRemoteManagementDescription',
+      { defaultMessage: 'Windows Remote Management (T1028)' }
+    ),
+    id: 'T1028',
+    name: 'Windows Remote Management',
+    reference: 'https://attack.mitre.org/techniques/T1028',
+    tactics: 'execution,lateral-movement',
+    value: 'windowsRemoteManagement',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.winlogonHelperDllDescription',
+      { defaultMessage: 'Winlogon Helper DLL (T1004)' }
+    ),
+    id: 'T1004',
+    name: 'Winlogon Helper DLL',
+    reference: 'https://attack.mitre.org/techniques/T1004',
+    tactics: 'persistence',
+    value: 'winlogonHelperDll',
+  },
+  {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.mitreAttackTechniques.xslScriptProcessingDescription',
+      { defaultMessage: 'XSL Script Processing (T1220)' }
+    ),
+    id: 'T1220',
+    name: 'XSL Script Processing',
+    reference: 'https://attack.mitre.org/techniques/T1220',
+    tactics: 'defense-evasion,execution',
+    value: 'xslScriptProcessing',
+  },
+];
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/mitre/types.ts b/x-pack/legacy/plugins/siem/public/pages/detection_engine/mitre/types.ts
new file mode 100644
index 0000000000000..a1e7a2e66ab83
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/mitre/types.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export interface MitreOptions {
+  id: string;
+  name: string;
+  reference: string;
+  value: string;
+}
+
+export interface MitreTacticsOptions extends MitreOptions {
+  text: string;
+}
+
+export interface MitreTechniquesOptions extends MitreOptions {
+  label: string;
+  tactics: string;
+}
diff --git a/x-pack/legacy/plugins/siem/scripts/extract_tactics_techniques_mitre.js b/x-pack/legacy/plugins/siem/scripts/extract_tactics_techniques_mitre.js
new file mode 100644
index 0000000000000..9648acecfe461
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/scripts/extract_tactics_techniques_mitre.js
@@ -0,0 +1,113 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+require('../../../../../src/setup_node_env');
+
+const fs = require('fs');
+// eslint-disable-next-line import/no-extraneous-dependencies
+const fetch = require('node-fetch');
+const { camelCase } = require('lodash');
+const { resolve } = require('path');
+
+
+const OUTPUT_DIRECTORY = resolve('public', 'pages', 'detection_engine', 'mitre');
+const MITRE_ENTREPRISE_ATTACK_URL = 'https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json';
+
+
+
+const getTacticsOptions = tactics => tactics.map(t => `{
+  id: '${t.id}',
+  name: '${t.name}',
+  reference: '${t.reference}',
+  text: i18n.translate(
+    'xpack.siem.detectionEngine.mitreAttackTactics.${camelCase(t.name)}Description', {
+      defaultMessage: '${t.name} (${t.id})'
+  }),
+  value: '${camelCase(t.name)}'
+}`.replace(/(\r\n|\n|\r)/gm, ' '));
+
+const getTechniquesOptions = techniques => techniques.map(t => `{
+  label: i18n.translate(
+    'xpack.siem.detectionEngine.mitreAttackTechniques.${camelCase(t.name)}Description', {
+      defaultMessage: '${t.name} (${t.id})'
+  }),
+  id: '${t.id}',
+  name: '${t.name}',
+  reference: '${t.reference}',
+  tactics: '${t.tactics.join()}',
+  value: '${camelCase(t.name)}'
+}`.replace(/(\r\n|\n|\r)/gm, ' '));
+
+const getIdReference = references => references.reduce((obj, extRef) => {
+  if (extRef.source_name === 'mitre-attack') {
+    return {
+      id: extRef.external_id, reference: extRef.url
+    };
+  }
+  return obj;
+}, { id: '', reference: '' });
+
+async function main() {
+  fetch(MITRE_ENTREPRISE_ATTACK_URL)
+    .then(res => res.json())
+    .then(json => {
+      const mitreData = json.objects;
+      const tactics = mitreData.filter(obj => obj.type === 'x-mitre-tactic').reduce((acc, item) => {
+        const { id, reference } = getIdReference(item.external_references);
+
+        return [...acc, {
+          name: item.name,
+          id,
+          reference,
+        }];
+      }, []);
+      const techniques = mitreData.filter(obj => obj.type === 'attack-pattern').reduce((acc, item) => {
+        let tactics = [];
+        const { id, reference } = getIdReference(item.external_references);
+        if (item.kill_chain_phases != null && item.kill_chain_phases.length > 0) {
+          item.kill_chain_phases.forEach(tactic => {
+            tactics = [...tactics, tactic.phase_name];
+          });
+        }
+
+        return [...acc, {
+          name: item.name,
+          id,
+          reference,
+          tactics,
+        }];
+      }, []);
+
+      const body =
+        `/*
+          * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+          * or more contributor license agreements. Licensed under the Elastic License;
+          * you may not use this file except in compliance with the Elastic License.
+          */
+
+          import { i18n } from '@kbn/i18n';
+
+          import { MitreTacticsOptions, MitreTechniquesOptions } from './types';
+
+          export const tactics = ${JSON.stringify(tactics, null, 2)};
+
+          export const tacticsOptions: MitreTacticsOptions[] =
+            ${JSON.stringify(getTacticsOptions(tactics), null, 2).replace(/}"/g, '}').replace(/"{/g, '{')};
+
+          export const techniques = ${JSON.stringify(techniques, null, 2)};
+
+          export const techniquesOptions: MitreTechniquesOptions[] =
+            ${JSON.stringify(getTechniquesOptions(techniques), null, 2).replace(/}"/g, '}').replace(/"{/g, '{')};
+      `;
+
+      fs.writeFileSync(`${OUTPUT_DIRECTORY}/mitre_tactics_techniques.ts`, body, 'utf-8');
+
+    });
+}
+
+if (require.main === module) {
+  main();
+}

From e71deb26832d65a9f488f7c2ab1ce73712b5e629 Mon Sep 17 00:00:00 2001
From: Tim Sullivan <tsullivan@users.noreply.github.com>
Date: Tue, 10 Dec 2019 09:24:13 -0700
Subject: [PATCH 05/24] [Reporting/Screenshots] Do not fail the report if
 request is aborted (#52344)

* [Reporting/Screenshots] Do not fail the report if request is aborted

* take pageRequestFailed out of pageExit observable
---
 .../browsers/chromium/driver_factory/index.ts | 43 ++++++++-----------
 1 file changed, 19 insertions(+), 24 deletions(-)

diff --git a/x-pack/legacy/plugins/reporting/server/browsers/chromium/driver_factory/index.ts b/x-pack/legacy/plugins/reporting/server/browsers/chromium/driver_factory/index.ts
index ca26f7d41c12a..daa7df343f8aa 100644
--- a/x-pack/legacy/plugins/reporting/server/browsers/chromium/driver_factory/index.ts
+++ b/x-pack/legacy/plugins/reporting/server/browsers/chromium/driver_factory/index.ts
@@ -15,7 +15,7 @@ import {
 } from 'puppeteer';
 import del from 'del';
 import * as Rx from 'rxjs';
-import { ignoreElements, mergeMap, tap } from 'rxjs/operators';
+import { ignoreElements, map, mergeMap, tap } from 'rxjs/operators';
 import { InnerSubscriber } from 'rxjs/internal/InnerSubscriber';
 
 import { BrowserConfig, NetworkPolicy } from '../../../../types';
@@ -144,7 +144,7 @@ export class HeadlessChromiumDriverFactory {
         terminate$
           .pipe(
             tap(signal => {
-              this.logger.debug(`Observer got signal: ${signal}`);
+              this.logger.debug(`Termination signal received: ${signal}`);
             }),
             ignoreElements()
           )
@@ -156,7 +156,6 @@ export class HeadlessChromiumDriverFactory {
       this.getProcessLogger(browser).subscribe();
 
       const driver$ = Rx.of(new HeadlessChromiumDriver(page, { inspect: this.browserConfig.inspect, networkPolicy: this.networkPolicy })); //  prettier-ignore
-
       const exit$ = this.getPageExit(browser, page);
 
       observer.next({ driver$, exit$ });
@@ -173,9 +172,9 @@ export class HeadlessChromiumDriverFactory {
     });
   }
 
-  getBrowserLogger(page: Page): Rx.Observable<ConsoleMessage> {
-    return Rx.fromEvent<ConsoleMessage>(page, 'console').pipe(
-      tap(line => {
+  getBrowserLogger(page: Page): Rx.Observable<void> {
+    const consoleMessages$ = Rx.fromEvent<ConsoleMessage>(page, 'console').pipe(
+      map(line => {
         if (line.type() === 'error') {
           this.logger.error(line.text(), ['headless-browser-console']);
         } else {
@@ -183,6 +182,19 @@ export class HeadlessChromiumDriverFactory {
         }
       })
     );
+
+    const pageRequestFailed$ = Rx.fromEvent<PuppeteerRequest>(page, 'requestfailed').pipe(
+      map(req => {
+        const failure = req.failure && req.failure();
+        if (failure) {
+          this.logger.warning(
+            `Request to [${req.url()}] failed! [${failure.errorText}]. This error will be ignored.`
+          );
+        }
+      })
+    );
+
+    return Rx.merge(consoleMessages$, pageRequestFailed$);
   }
 
   getProcessLogger(browser: Browser) {
@@ -208,18 +220,6 @@ export class HeadlessChromiumDriverFactory {
       mergeMap(err => Rx.throwError(err))
     );
 
-    const pageRequestFailed$ = Rx.fromEvent<PuppeteerRequest>(page, 'requestfailed').pipe(
-      mergeMap(req => {
-        const failure = req.failure && req.failure();
-        if (failure) {
-          return Rx.throwError(
-            new Error(`Request to [${req.url()}] failed! [${failure.errorText}]`)
-          );
-        }
-        return Rx.throwError(new Error(`Unknown failure!`));
-      })
-    );
-
     const browserDisconnect$ = Rx.fromEvent(browser, 'disconnected').pipe(
       mergeMap(() =>
         Rx.throwError(
@@ -230,11 +230,6 @@ export class HeadlessChromiumDriverFactory {
       )
     );
 
-    return Rx.merge(
-      pageError$,
-      uncaughtExceptionPageError$,
-      pageRequestFailed$,
-      browserDisconnect$
-    );
+    return Rx.merge(pageError$, uncaughtExceptionPageError$, browserDisconnect$);
   }
 }

From 618e70433b8455322be08b9175dfcf66ba5d80be Mon Sep 17 00:00:00 2001
From: Joe Reuter <johannes.reuter@elastic.co>
Date: Tue, 10 Dec 2019 17:32:56 +0100
Subject: [PATCH 06/24] Shim oss telemetry (#51168)

---
 .../legacy/plugins/oss_telemetry/index.d.ts   | 61 -------------------
 x-pack/legacy/plugins/oss_telemetry/index.js  | 24 --------
 x-pack/legacy/plugins/oss_telemetry/index.ts  | 41 +++++++++++++
 .../server/lib/collectors/index.ts            |  7 +--
 .../get_usage_collector.test.ts               | 46 +++++---------
 .../visualizations/get_usage_collector.ts     | 16 +++--
 .../register_usage_collector.ts               | 10 +--
 .../oss_telemetry/server/lib/tasks/index.ts   | 47 ++++++++++----
 .../tasks/visualizations/task_runner.test.ts  | 23 ++++---
 .../lib/tasks/visualizations/task_runner.ts   | 48 ++++++++-------
 .../plugins/oss_telemetry/server/plugin.ts    | 50 +++++++++++++++
 .../plugins/oss_telemetry/test_utils/index.ts | 51 ++++++++--------
 12 files changed, 223 insertions(+), 201 deletions(-)
 delete mode 100644 x-pack/legacy/plugins/oss_telemetry/index.d.ts
 delete mode 100644 x-pack/legacy/plugins/oss_telemetry/index.js
 create mode 100644 x-pack/legacy/plugins/oss_telemetry/index.ts
 create mode 100644 x-pack/legacy/plugins/oss_telemetry/server/plugin.ts

diff --git a/x-pack/legacy/plugins/oss_telemetry/index.d.ts b/x-pack/legacy/plugins/oss_telemetry/index.d.ts
deleted file mode 100644
index 1b592dabf2053..0000000000000
--- a/x-pack/legacy/plugins/oss_telemetry/index.d.ts
+++ /dev/null
@@ -1,61 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-export interface VisState {
-  type: string;
-}
-
-export interface Visualization {
-  visState: string;
-}
-
-export interface SavedObjectDoc {
-  _id: string;
-  _source: {
-    visualization: Visualization;
-    type: string;
-  };
-}
-
-export interface ESQueryResponse {
-  hits: {
-    hits: SavedObjectDoc[];
-  };
-}
-
-export interface TaskInstance {
-  state: {
-    runs: number;
-    stats: any;
-  };
-  error?: any;
-}
-
-export interface HapiServer {
-  plugins: {
-    xpack_main: any;
-    elasticsearch: {
-      getCluster: (
-        cluster: string
-      ) => {
-        callWithInternalUser: () => Promise<ESQueryResponse>;
-      };
-    };
-    task_manager: {
-      registerTaskDefinitions: (opts: any) => void;
-      ensureScheduled: (opts: any) => Promise<void>;
-      fetch: (
-        opts: any
-      ) => Promise<{
-        docs: TaskInstance[];
-      }>;
-    };
-  };
-  config: () => {
-    get: (prop: string) => any;
-  };
-  log: (context: string[], message: string) => void;
-}
diff --git a/x-pack/legacy/plugins/oss_telemetry/index.js b/x-pack/legacy/plugins/oss_telemetry/index.js
deleted file mode 100644
index f86baef020aa2..0000000000000
--- a/x-pack/legacy/plugins/oss_telemetry/index.js
+++ /dev/null
@@ -1,24 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { registerCollectors } from './server/lib/collectors';
-import { registerTasks, scheduleTasks } from './server/lib/tasks';
-import { PLUGIN_ID } from './constants';
-
-export const ossTelemetry = (kibana) => {
-  return new kibana.Plugin({
-    id: PLUGIN_ID,
-    require: ['elasticsearch', 'xpack_main'],
-    configPrefix: 'xpack.oss_telemetry',
-
-    init(server) {
-      const { usageCollection } = server.newPlatform.setup.plugins;
-      registerCollectors(usageCollection, server);
-      registerTasks(server);
-      scheduleTasks(server);
-    }
-  });
-};
diff --git a/x-pack/legacy/plugins/oss_telemetry/index.ts b/x-pack/legacy/plugins/oss_telemetry/index.ts
new file mode 100644
index 0000000000000..8b16c7cf13cad
--- /dev/null
+++ b/x-pack/legacy/plugins/oss_telemetry/index.ts
@@ -0,0 +1,41 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Logger, PluginInitializerContext } from 'kibana/server';
+import { PLUGIN_ID } from './constants';
+import { OssTelemetryPlugin } from './server/plugin';
+import { LegacyPluginInitializer } from '../../../../src/legacy/plugin_discovery/types';
+
+export const ossTelemetry: LegacyPluginInitializer = kibana => {
+  return new kibana.Plugin({
+    id: PLUGIN_ID,
+    require: ['elasticsearch', 'xpack_main'],
+    configPrefix: 'xpack.oss_telemetry',
+
+    init(server) {
+      const plugin = new OssTelemetryPlugin({
+        logger: {
+          get: () =>
+            ({
+              info: (message: string) => server.log(['info', 'task_manager'], message),
+              debug: (message: string) => server.log(['debug', 'task_manager'], message),
+              warn: (message: string) => server.log(['warn', 'task_manager'], message),
+              error: (message: string) => server.log(['error', 'task_manager'], message),
+            } as Logger),
+        },
+      } as PluginInitializerContext);
+      plugin.setup(server.newPlatform.setup.core, {
+        usageCollection: server.newPlatform.setup.plugins.usageCollection,
+        taskManager: server.plugins.task_manager,
+        __LEGACY: {
+          config: server.config(),
+          xpackMainStatus: ((server.plugins.xpack_main as unknown) as { status: any }).status
+            .plugin,
+        },
+      });
+    },
+  });
+};
diff --git a/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/index.ts b/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/index.ts
index 0121ed4304d26..3b47099fdc462 100644
--- a/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/index.ts
+++ b/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/index.ts
@@ -4,10 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
-import { HapiServer } from '../../../';
 import { registerVisualizationsCollector } from './visualizations/register_usage_collector';
+import { OssTelemetrySetupDependencies } from '../../plugin';
 
-export function registerCollectors(usageCollection: UsageCollectionSetup, server: HapiServer) {
-  registerVisualizationsCollector(usageCollection, server);
+export function registerCollectors(deps: OssTelemetrySetupDependencies) {
+  registerVisualizationsCollector(deps.usageCollection, deps.taskManager);
 }
diff --git a/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/visualizations/get_usage_collector.test.ts b/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/visualizations/get_usage_collector.test.ts
index d316562c826d6..ec35266646650 100644
--- a/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/visualizations/get_usage_collector.test.ts
+++ b/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/visualizations/get_usage_collector.test.ts
@@ -4,24 +4,12 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import sinon from 'sinon';
-import { HapiServer } from '../../../../';
-import {
-  getMockCallWithInternal,
-  getMockKbnServer,
-  getMockTaskFetch,
-} from '../../../../test_utils';
+import { getMockTaskFetch, getMockTaskManager } from '../../../../test_utils';
 import { getUsageCollector } from './get_usage_collector';
 
 describe('getVisualizationsCollector#fetch', () => {
-  let mockKbnServer: HapiServer;
-
-  beforeEach(() => {
-    mockKbnServer = getMockKbnServer(getMockCallWithInternal(), getMockTaskFetch());
-  });
-
   test('can return empty stats', async () => {
-    const { type, fetch } = getUsageCollector(mockKbnServer);
+    const { type, fetch } = getUsageCollector(getMockTaskManager());
     expect(type).toBe('visualization_types');
     const fetchResult = await fetch();
     expect(fetchResult).toEqual({});
@@ -34,11 +22,11 @@ describe('getVisualizationsCollector#fetch', () => {
           runs: 1,
           stats: { comic_books: { total: 16, max: 12, min: 2, avg: 6 } },
         },
+        taskType: 'test',
+        params: {},
       },
     ]);
-    mockKbnServer = getMockKbnServer(getMockCallWithInternal(), mockTaskFetch);
-
-    const { type, fetch } = getUsageCollector(mockKbnServer);
+    const { type, fetch } = getUsageCollector(getMockTaskManager(mockTaskFetch));
     expect(type).toBe('visualization_types');
     const fetchResult = await fetch();
     expect(fetchResult).toEqual({ comic_books: { avg: 6, max: 12, min: 2, total: 16 } });
@@ -46,23 +34,21 @@ describe('getVisualizationsCollector#fetch', () => {
 
   describe('Error handling', () => {
     test('Silently handles Task Manager NotInitialized', async () => {
-      const mockTaskFetch = sinon.stub();
-      mockTaskFetch.rejects(
-        new Error('NotInitialized taskManager is still waiting for plugins to load')
-      );
-      mockKbnServer = getMockKbnServer(getMockCallWithInternal(), mockTaskFetch);
-
-      const { fetch } = getUsageCollector(mockKbnServer);
-      await expect(fetch()).resolves.toBe(undefined);
+      const mockTaskFetch = jest.fn(() => {
+        throw new Error('NotInitialized taskManager is still waiting for plugins to load');
+      });
+      const { fetch } = getUsageCollector(getMockTaskManager(mockTaskFetch));
+      const result = await fetch();
+      expect(result).toBe(undefined);
     });
     // In real life, the CollectorSet calls fetch and handles errors
     test('defers the errors', async () => {
-      const mockTaskFetch = sinon.stub();
-      mockTaskFetch.rejects(new Error('BOOM'));
-      mockKbnServer = getMockKbnServer(getMockCallWithInternal(), mockTaskFetch);
+      const mockTaskFetch = jest.fn(() => {
+        throw new Error('BOOM');
+      });
 
-      const { fetch } = getUsageCollector(mockKbnServer);
-      await expect(fetch()).rejects.toMatchObject(new Error('BOOM'));
+      const { fetch } = getUsageCollector(getMockTaskManager(mockTaskFetch));
+      await expect(fetch()).rejects.toThrowErrorMatchingInlineSnapshot(`"BOOM"`);
     });
   });
 });
diff --git a/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/visualizations/get_usage_collector.ts b/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/visualizations/get_usage_collector.ts
index 63640c87f80a6..680cb97e0fda3 100644
--- a/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/visualizations/get_usage_collector.ts
+++ b/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/visualizations/get_usage_collector.ts
@@ -5,17 +5,15 @@
  */
 
 import { get } from 'lodash';
-import { HapiServer } from '../../../../';
+import { PluginSetupContract as TaskManagerPluginSetupContract } from '../../../../../task_manager/plugin';
 import { PLUGIN_ID, VIS_TELEMETRY_TASK, VIS_USAGE_TYPE } from '../../../../constants';
 
-async function isTaskManagerReady(server: HapiServer) {
-  const result = await fetch(server);
+async function isTaskManagerReady(taskManager: TaskManagerPluginSetupContract | undefined) {
+  const result = await fetch(taskManager);
   return result !== null;
 }
 
-async function fetch(server: HapiServer) {
-  const taskManager = server.plugins.task_manager;
-
+async function fetch(taskManager: TaskManagerPluginSetupContract | undefined) {
   if (!taskManager) {
     return null;
   }
@@ -40,12 +38,12 @@ async function fetch(server: HapiServer) {
   return docs;
 }
 
-export function getUsageCollector(server: HapiServer) {
+export function getUsageCollector(taskManager: TaskManagerPluginSetupContract | undefined) {
   let isCollectorReady = false;
   async function determineIfTaskManagerIsReady() {
     let isReady = false;
     try {
-      isReady = await isTaskManagerReady(server);
+      isReady = await isTaskManagerReady(taskManager);
     } catch (err) {} // eslint-disable-line
 
     if (isReady) {
@@ -60,7 +58,7 @@ export function getUsageCollector(server: HapiServer) {
     type: VIS_USAGE_TYPE,
     isReady: () => isCollectorReady,
     fetch: async () => {
-      const docs = await fetch(server);
+      const docs = await fetch(taskManager);
       // get the accumulated state from the recurring task
       return get(docs, '[0].state.stats');
     },
diff --git a/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/visualizations/register_usage_collector.ts b/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/visualizations/register_usage_collector.ts
index 09843a6f87ad7..1a47f68adcc58 100644
--- a/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/visualizations/register_usage_collector.ts
+++ b/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/visualizations/register_usage_collector.ts
@@ -5,13 +5,13 @@
  */
 
 import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
-import { HapiServer } from '../../../../';
+import { PluginSetupContract as TaskManagerPluginSetupContract } from '../../../../../task_manager/plugin';
 import { getUsageCollector } from './get_usage_collector';
 
 export function registerVisualizationsCollector(
-  usageCollection: UsageCollectionSetup,
-  server: HapiServer
+  collectorSet: UsageCollectionSetup,
+  taskManager: TaskManagerPluginSetupContract | undefined
 ): void {
-  const collector = usageCollection.makeUsageCollector(getUsageCollector(server));
-  usageCollection.registerCollector(collector);
+  const collector = collectorSet.makeUsageCollector(getUsageCollector(taskManager));
+  collectorSet.registerCollector(collector);
 }
diff --git a/x-pack/legacy/plugins/oss_telemetry/server/lib/tasks/index.ts b/x-pack/legacy/plugins/oss_telemetry/server/lib/tasks/index.ts
index 16e83a7938e60..cb6b4eab09741 100644
--- a/x-pack/legacy/plugins/oss_telemetry/server/lib/tasks/index.ts
+++ b/x-pack/legacy/plugins/oss_telemetry/server/lib/tasks/index.ts
@@ -4,15 +4,27 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { HapiServer } from '../../../';
+import { CoreSetup, Logger } from 'kibana/server';
+import { PluginSetupContract as TaskManagerPluginSetupContract } from '../../../../task_manager/plugin';
 import { PLUGIN_ID, VIS_TELEMETRY_TASK } from '../../../constants';
 import { visualizationsTaskRunner } from './visualizations/task_runner';
+import KbnServer from '../../../../../../../src/legacy/server/kbn_server';
+import { LegacyConfig } from '../../plugin';
+import { TaskInstance } from '../../../../task_manager';
 
-export function registerTasks(server: HapiServer) {
-  const taskManager = server.plugins.task_manager;
-
+export function registerTasks({
+  taskManager,
+  logger,
+  elasticsearch,
+  config,
+}: {
+  taskManager?: TaskManagerPluginSetupContract;
+  logger: Logger;
+  elasticsearch: CoreSetup['elasticsearch'];
+  config: LegacyConfig;
+}) {
   if (!taskManager) {
-    server.log(['debug', 'telemetry'], `Task manager is not available`);
+    logger.debug('Task manager is not available');
     return;
   }
 
@@ -20,18 +32,30 @@ export function registerTasks(server: HapiServer) {
     [VIS_TELEMETRY_TASK]: {
       title: 'X-Pack telemetry calculator for Visualizations',
       type: VIS_TELEMETRY_TASK,
-      createTaskRunner({ taskInstance }: { taskInstance: any }) {
+      createTaskRunner({ taskInstance }: { taskInstance: TaskInstance }) {
         return {
-          run: visualizationsTaskRunner(taskInstance, server),
+          run: visualizationsTaskRunner(taskInstance, config, elasticsearch),
         };
       },
     },
   });
 }
 
-export function scheduleTasks(server: HapiServer) {
-  const taskManager = server.plugins.task_manager;
-  const { kbnServer } = server.plugins.xpack_main.status.plugin;
+export function scheduleTasks({
+  taskManager,
+  xpackMainStatus,
+  logger,
+}: {
+  taskManager?: TaskManagerPluginSetupContract;
+  xpackMainStatus: { kbnServer: KbnServer };
+  logger: Logger;
+}) {
+  if (!taskManager) {
+    logger.debug('Task manager is not available');
+    return;
+  }
+
+  const { kbnServer } = xpackMainStatus;
 
   kbnServer.afterPluginsInit(() => {
     // The code block below can't await directly within "afterPluginsInit"
@@ -46,9 +70,10 @@ export function scheduleTasks(server: HapiServer) {
           id: `${PLUGIN_ID}-${VIS_TELEMETRY_TASK}`,
           taskType: VIS_TELEMETRY_TASK,
           state: { stats: {}, runs: 0 },
+          params: {},
         });
       } catch (e) {
-        server.log(['debug', 'telemetry'], `Error scheduling task, received ${e.message}`);
+        logger.debug(`Error scheduling task, received ${e.message}`);
       }
     })();
   });
diff --git a/x-pack/legacy/plugins/oss_telemetry/server/lib/tasks/visualizations/task_runner.test.ts b/x-pack/legacy/plugins/oss_telemetry/server/lib/tasks/visualizations/task_runner.test.ts
index 5db08ed291d6d..0663a5bd330ca 100644
--- a/x-pack/legacy/plugins/oss_telemetry/server/lib/tasks/visualizations/task_runner.test.ts
+++ b/x-pack/legacy/plugins/oss_telemetry/server/lib/tasks/visualizations/task_runner.test.ts
@@ -5,28 +5,30 @@
  */
 
 import moment from 'moment';
-import { HapiServer, TaskInstance } from '../../../../';
 import {
   getMockCallWithInternal,
-  getMockKbnServer,
+  getMockConfig,
+  getMockEs,
   getMockTaskInstance,
 } from '../../../../test_utils';
 import { visualizationsTaskRunner } from './task_runner';
+import { TaskInstance } from '../../../../../task_manager';
 
 describe('visualizationsTaskRunner', () => {
   let mockTaskInstance: TaskInstance;
-  let mockKbnServer: HapiServer;
   beforeEach(() => {
     mockTaskInstance = getMockTaskInstance();
-    mockKbnServer = getMockKbnServer();
   });
 
   describe('Error handling', () => {
     test('catches its own errors', async () => {
       const mockCallWithInternal = () => Promise.reject(new Error('Things did not go well!'));
-      mockKbnServer = getMockKbnServer(mockCallWithInternal);
 
-      const runner = visualizationsTaskRunner(mockTaskInstance, mockKbnServer);
+      const runner = visualizationsTaskRunner(
+        mockTaskInstance,
+        getMockConfig(),
+        getMockEs(mockCallWithInternal)
+      );
       const result = await runner();
       expect(result).toMatchObject({
         error: 'Things did not go well!',
@@ -45,7 +47,7 @@ describe('visualizationsTaskRunner', () => {
         .startOf('day')
         .toDate();
 
-    const runner = visualizationsTaskRunner(mockTaskInstance, mockKbnServer);
+    const runner = visualizationsTaskRunner(mockTaskInstance, getMockConfig(), getMockEs());
     const result = await runner();
 
     expect(result).toMatchObject({
@@ -123,9 +125,12 @@ describe('visualizationsTaskRunner', () => {
         },
       },
     ]);
-    mockKbnServer = getMockKbnServer(mockCallWithInternal);
 
-    const runner = visualizationsTaskRunner(mockTaskInstance, mockKbnServer);
+    const runner = visualizationsTaskRunner(
+      mockTaskInstance,
+      getMockConfig(),
+      getMockEs(mockCallWithInternal)
+    );
     const result = await runner();
 
     expect(result).toMatchObject({
diff --git a/x-pack/legacy/plugins/oss_telemetry/server/lib/tasks/visualizations/task_runner.ts b/x-pack/legacy/plugins/oss_telemetry/server/lib/tasks/visualizations/task_runner.ts
index 3372101c2b457..9d8f76f6a10dc 100644
--- a/x-pack/legacy/plugins/oss_telemetry/server/lib/tasks/visualizations/task_runner.ts
+++ b/x-pack/legacy/plugins/oss_telemetry/server/lib/tasks/visualizations/task_runner.ts
@@ -5,15 +5,12 @@
  */
 
 import _, { countBy, groupBy, mapValues } from 'lodash';
-import {
-  ESQueryResponse,
-  HapiServer,
-  SavedObjectDoc,
-  TaskInstance,
-  VisState,
-  Visualization,
-} from '../../../../';
+import { APICaller, CoreSetup } from 'kibana/server';
 import { getNextMidnight } from '../../get_next_midnight';
+import { VisState } from '../../../../../../../../src/legacy/core_plugins/visualizations/public';
+import { TaskInstance } from '../../../../../task_manager';
+import { ESSearchHit } from '../../../../../apm/typings/elasticsearch';
+import { LegacyConfig } from '../../../plugin';
 
 interface VisSummary {
   type: string;
@@ -23,7 +20,7 @@ interface VisSummary {
 /*
  * Parse the response data into telemetry payload
  */
-async function getStats(callCluster: (method: string, params: any) => Promise<any>, index: string) {
+async function getStats(callCluster: APICaller, index: string) {
   const searchParams = {
     size: 10000, // elasticsearch index.max_result_window default value
     index,
@@ -35,24 +32,26 @@ async function getStats(callCluster: (method: string, params: any) => Promise<an
       },
     },
   };
-  const esResponse: ESQueryResponse = await callCluster('search', searchParams);
+  const esResponse = await callCluster('search', searchParams);
   const size = _.get<number>(esResponse, 'hits.hits.length');
   if (size < 1) {
     return;
   }
 
   // `map` to get the raw types
-  const visSummaries: VisSummary[] = esResponse.hits.hits.map((hit: SavedObjectDoc) => {
-    const spacePhrases: string[] = hit._id.split(':');
-    const space = spacePhrases.length === 3 ? spacePhrases[0] : 'default'; // if in a custom space, the format of a saved object ID is space:type:id
-    const visualization: Visualization = _.get(hit, '_source.visualization', { visState: '{}' });
-    const visState: VisState = JSON.parse(visualization.visState);
+  const visSummaries: VisSummary[] = esResponse.hits.hits.map(
+    (hit: ESSearchHit<{ visState: string }>) => {
+      const spacePhrases: string[] = hit._id.split(':');
+      const space = spacePhrases.length === 3 ? spacePhrases[0] : 'default'; // if in a custom space, the format of a saved object ID is space:type:id
+      const visualization = _.get(hit, '_source.visualization', { visState: '{}' });
+      const visState: VisState = JSON.parse(visualization.visState);
 
-    return {
-      type: visState.type || '_na_',
-      space,
-    };
-  });
+      return {
+        type: visState.type || '_na_',
+        space,
+      };
+    }
+  );
 
   // organize stats per type
   const visTypes = groupBy(visSummaries, 'type');
@@ -72,9 +71,12 @@ async function getStats(callCluster: (method: string, params: any) => Promise<an
   });
 }
 
-export function visualizationsTaskRunner(taskInstance: TaskInstance, server: HapiServer) {
-  const { callWithInternalUser: callCluster } = server.plugins.elasticsearch.getCluster('data');
-  const config = server.config();
+export function visualizationsTaskRunner(
+  taskInstance: TaskInstance,
+  config: LegacyConfig,
+  es: CoreSetup['elasticsearch']
+) {
+  const { callAsInternalUser: callCluster } = es.createClient('data');
   const index = config.get('kibana.index').toString(); // cast to string for TypeScript
 
   return async () => {
diff --git a/x-pack/legacy/plugins/oss_telemetry/server/plugin.ts b/x-pack/legacy/plugins/oss_telemetry/server/plugin.ts
new file mode 100644
index 0000000000000..f661311fc24b8
--- /dev/null
+++ b/x-pack/legacy/plugins/oss_telemetry/server/plugin.ts
@@ -0,0 +1,50 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { CoreSetup, Logger, Plugin, PluginInitializerContext } from 'kibana/server';
+import { PluginSetupContract as TaskManagerPluginSetupContract } from '../../task_manager/plugin';
+import { registerCollectors } from './lib/collectors';
+import { registerTasks, scheduleTasks } from './lib/tasks';
+import KbnServer from '../../../../../src/legacy/server/kbn_server';
+import { UsageCollectionSetup } from '../../../../../src/plugins/usage_collection/server';
+
+export interface LegacyConfig {
+  get: (key: string) => string | number | boolean;
+}
+
+export interface OssTelemetrySetupDependencies {
+  usageCollection: UsageCollectionSetup;
+  __LEGACY: {
+    config: LegacyConfig;
+    xpackMainStatus: { kbnServer: KbnServer };
+  };
+  taskManager?: TaskManagerPluginSetupContract;
+}
+
+export class OssTelemetryPlugin implements Plugin {
+  private logger: Logger;
+
+  constructor(initializerContext: PluginInitializerContext) {
+    this.logger = initializerContext.logger.get();
+  }
+
+  public setup(core: CoreSetup, deps: OssTelemetrySetupDependencies) {
+    registerCollectors(deps);
+    registerTasks({
+      taskManager: deps.taskManager,
+      logger: this.logger,
+      elasticsearch: core.elasticsearch,
+      config: deps.__LEGACY.config,
+    });
+    scheduleTasks({
+      taskManager: deps.taskManager,
+      xpackMainStatus: deps.__LEGACY.xpackMainStatus,
+      logger: this.logger,
+    });
+  }
+
+  public start() {}
+}
diff --git a/x-pack/legacy/plugins/oss_telemetry/test_utils/index.ts b/x-pack/legacy/plugins/oss_telemetry/test_utils/index.ts
index 1cebe78b9c7f0..04e248d28b577 100644
--- a/x-pack/legacy/plugins/oss_telemetry/test_utils/index.ts
+++ b/x-pack/legacy/plugins/oss_telemetry/test_utils/index.ts
@@ -4,9 +4,16 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ESQueryResponse, HapiServer, SavedObjectDoc, TaskInstance } from '../';
+import { APICaller, CoreSetup } from 'kibana/server';
 
-export const getMockTaskInstance = (): TaskInstance => ({ state: { runs: 0, stats: {} } });
+import { TaskInstance } from '../../task_manager';
+import { PluginSetupContract as TaskManagerPluginSetupContract } from '../../task_manager/plugin';
+
+export const getMockTaskInstance = (): TaskInstance => ({
+  state: { runs: 0, stats: {} },
+  taskType: 'test',
+  params: {},
+});
 
 const defaultMockSavedObjects = [
   {
@@ -20,10 +27,15 @@ const defaultMockSavedObjects = [
 
 const defaultMockTaskDocs = [getMockTaskInstance()];
 
-export const getMockCallWithInternal = (hits: SavedObjectDoc[] = defaultMockSavedObjects) => {
-  return (): Promise<ESQueryResponse> => {
+export const getMockEs = (mockCallWithInternal: APICaller = getMockCallWithInternal()) =>
+  (({
+    createClient: () => ({ callAsInternalUser: mockCallWithInternal }),
+  } as unknown) as CoreSetup['elasticsearch']);
+
+export const getMockCallWithInternal = (hits: unknown[] = defaultMockSavedObjects): APICaller => {
+  return ((() => {
     return Promise.resolve({ hits: { hits } });
-  };
+  }) as unknown) as APICaller;
 };
 
 export const getMockTaskFetch = (docs: TaskInstance[] = defaultMockTaskDocs) => {
@@ -36,24 +48,13 @@ export const getMockConfig = () => {
   };
 };
 
-export const getMockKbnServer = (
-  mockCallWithInternal = getMockCallWithInternal(),
-  mockTaskFetch = getMockTaskFetch(),
-  mockConfig = getMockConfig()
-): HapiServer => ({
-  plugins: {
-    elasticsearch: {
-      getCluster: (cluster: string) => ({
-        callWithInternalUser: mockCallWithInternal,
-      }),
-    },
-    xpack_main: {},
-    task_manager: {
-      registerTaskDefinitions: (opts: any) => undefined,
-      ensureScheduled: (opts: any) => Promise.resolve(),
-      fetch: mockTaskFetch,
-    },
-  },
-  config: () => mockConfig,
-  log: () => undefined,
+export const getMockTaskManager = (fetch: any = getMockTaskFetch()) =>
+  (({
+    registerTaskDefinitions: () => undefined,
+    ensureScheduled: () => Promise.resolve(),
+    fetch,
+  } as unknown) as TaskManagerPluginSetupContract);
+
+export const getCluster = () => ({
+  callWithInternalUser: getMockCallWithInternal(),
 });

From 3c57f71c3ac2a781b49bf5cab252815d482a6599 Mon Sep 17 00:00:00 2001
From: Joe Reuter <johannes.reuter@elastic.co>
Date: Tue, 10 Dec 2019 17:50:00 +0100
Subject: [PATCH 07/24] Removing stateful saved object finder (#52166)

---
 .../dashboard/dashboard_app_controller.tsx    |  11 +-
 .../kibana/public/dashboard/legacy_imports.ts |   1 -
 .../open_search_panel.test.js.snap            |   4 +-
 .../components/top_nav/open_search_panel.js   |  11 +-
 .../top_nav/open_search_panel.test.js         |   2 +-
 .../visualize_embeddable_factory.tsx          |   3 +-
 .../kibana/public/visualize/legacy_imports.ts |   1 -
 .../visualize/listing/visualize_listing.html  |   1 +
 .../visualize/listing/visualize_listing.js    |   4 +-
 .../__snapshots__/new_vis_modal.test.tsx.snap |   2 +
 .../visualize/wizard/new_vis_modal.test.tsx   |   8 ++
 .../public/visualize/wizard/new_vis_modal.tsx |  10 +-
 .../search_selection/search_selection.tsx     |  10 +-
 .../public/visualize/wizard/show_new_vis.tsx  |   6 +-
 .../components/saved_object_finder.tsx        | 108 ----------------
 .../public/plugin.tsx                         |   2 +-
 .../saved_object_finder.test.tsx              |   2 +-
 .../saved_objects/saved_object_finder.tsx     |  28 ++++-
 .../public/np_ready/public/legacy.ts          |   3 -
 .../public/np_ready/public/plugin.tsx         |  15 ++-
 .../renderers/embeddable.tsx                  |  12 +-
 .../components/embeddable_flyout/flyout.tsx   |   4 +-
 .../graph/public/components/source_picker.tsx |   4 +-
 .../new_job/pages/index_or_search/page.tsx    |   7 +-
 .../components/embeddables/embedded_map.tsx   |   9 +-
 .../search_selection/search_selection.tsx     | 115 ++++++++++--------
 .../legacy/plugins/transform/public/plugin.ts |  13 +-
 .../legacy/plugins/transform/public/shim.ts   |   2 +-
 28 files changed, 196 insertions(+), 202 deletions(-)
 delete mode 100644 src/legacy/ui/public/saved_objects/components/saved_object_finder.tsx

diff --git a/src/legacy/core_plugins/kibana/public/dashboard/dashboard_app_controller.tsx b/src/legacy/core_plugins/kibana/public/dashboard/dashboard_app_controller.tsx
index 3b336ebfc11fe..fd49b26e0d948 100644
--- a/src/legacy/core_plugins/kibana/public/dashboard/dashboard_app_controller.tsx
+++ b/src/legacy/core_plugins/kibana/public/dashboard/dashboard_app_controller.tsx
@@ -36,7 +36,6 @@ import {
   AppStateClass as TAppStateClass,
   KbnUrl,
   SaveOptions,
-  SavedObjectFinder,
   unhashUrl,
 } from './legacy_imports';
 import { FilterStateManager, IndexPattern } from '../../../data/public';
@@ -70,6 +69,10 @@ import { DashboardAppScope } from './dashboard_app';
 import { VISUALIZE_EMBEDDABLE_TYPE } from '../visualize/embeddable';
 import { convertSavedDashboardPanelToPanelState } from './lib/embeddable_saved_object_converters';
 import { RenderDeps } from './application';
+import {
+  SavedObjectFinderProps,
+  SavedObjectFinderUi,
+} from '../../../../../plugins/kibana_react/public';
 
 export interface DashboardAppControllerDependencies extends RenderDeps {
   $scope: DashboardAppScope;
@@ -114,7 +117,7 @@ export class DashboardAppController {
         timefilter: { timefilter },
       },
     },
-    core: { notifications, overlays, chrome, injectedMetadata },
+    core: { notifications, overlays, chrome, injectedMetadata, uiSettings, savedObjects },
   }: DashboardAppControllerDependencies) {
     new FilterStateManager(globalState, getAppState, filterManager);
     const queryFilter = filterManager;
@@ -741,6 +744,10 @@ export class DashboardAppController {
     };
     navActions[TopNavIds.ADD] = () => {
       if (dashboardContainer && !isErrorEmbeddable(dashboardContainer)) {
+        const SavedObjectFinder = (props: SavedObjectFinderProps) => (
+          <SavedObjectFinderUi {...props} savedObjects={savedObjects} uiSettings={uiSettings} />
+        );
+
         openAddPanelFlyout({
           embeddable: dashboardContainer,
           getAllFactories: embeddables.getEmbeddableFactories,
diff --git a/src/legacy/core_plugins/kibana/public/dashboard/legacy_imports.ts b/src/legacy/core_plugins/kibana/public/dashboard/legacy_imports.ts
index b0f09f0cf9745..af0a833399a52 100644
--- a/src/legacy/core_plugins/kibana/public/dashboard/legacy_imports.ts
+++ b/src/legacy/core_plugins/kibana/public/dashboard/legacy_imports.ts
@@ -65,4 +65,3 @@ export { stateMonitorFactory, StateMonitor } from 'ui/state_management/state_mon
 export { ensureDefaultIndexPattern } from 'ui/legacy_compat';
 export { unhashUrl } from '../../../../../plugins/kibana_utils/public';
 export { IInjector } from 'ui/chrome';
-export { SavedObjectFinder } from 'ui/saved_objects/components/saved_object_finder';
diff --git a/src/legacy/core_plugins/kibana/public/discover/components/top_nav/__snapshots__/open_search_panel.test.js.snap b/src/legacy/core_plugins/kibana/public/discover/components/top_nav/__snapshots__/open_search_panel.test.js.snap
index cc53e4bdcdcf9..2878b11040cf3 100644
--- a/src/legacy/core_plugins/kibana/public/discover/components/top_nav/__snapshots__/open_search_panel.test.js.snap
+++ b/src/legacy/core_plugins/kibana/public/discover/components/top_nav/__snapshots__/open_search_panel.test.js.snap
@@ -26,7 +26,7 @@ exports[`render 1`] = `
     </EuiTitle>
   </EuiFlyoutHeader>
   <EuiFlyoutBody>
-    <SavedObjectFinder
+    <SavedObjectFinderUi
       noItemsMessage={
         <FormattedMessage
           defaultMessage="No matching searches found."
@@ -44,6 +44,8 @@ exports[`render 1`] = `
           },
         ]
       }
+      savedObjects={Object {}}
+      uiSettings={Object {}}
     />
   </EuiFlyoutBody>
   <EuiFlyoutFooter>
diff --git a/src/legacy/core_plugins/kibana/public/discover/components/top_nav/open_search_panel.js b/src/legacy/core_plugins/kibana/public/discover/components/top_nav/open_search_panel.js
index 0c3b52fbf0640..ec1763f44f25f 100644
--- a/src/legacy/core_plugins/kibana/public/discover/components/top_nav/open_search_panel.js
+++ b/src/legacy/core_plugins/kibana/public/discover/components/top_nav/open_search_panel.js
@@ -32,11 +32,16 @@ import {
   EuiFlyoutBody,
   EuiTitle,
 } from '@elastic/eui';
-import { SavedObjectFinder } from 'ui/saved_objects/components/saved_object_finder';
+import { SavedObjectFinderUi } from '../../../../../../../plugins/kibana_react/public';
+import { getServices } from '../../kibana_services';
 
 const SEARCH_OBJECT_TYPE = 'search';
 
 export function OpenSearchPanel(props) {
+  const {
+    core: { uiSettings, savedObjects },
+  } = getServices();
+
   return (
     <EuiFlyout ownFocus onClose={props.onClose} data-test-subj="loadSearchForm">
       <EuiFlyoutHeader hasBorder>
@@ -50,7 +55,7 @@ export function OpenSearchPanel(props) {
         </EuiTitle>
       </EuiFlyoutHeader>
       <EuiFlyoutBody>
-        <SavedObjectFinder
+        <SavedObjectFinderUi
           noItemsMessage={
             <FormattedMessage
               id="kbn.discover.topNav.openSearchPanel.noSearchesFoundDescription"
@@ -70,6 +75,8 @@ export function OpenSearchPanel(props) {
             window.location.assign(props.makeUrl(id));
             props.onClose();
           }}
+          uiSettings={uiSettings}
+          savedObjects={savedObjects}
         />
       </EuiFlyoutBody>
       <EuiFlyoutFooter>
diff --git a/src/legacy/core_plugins/kibana/public/discover/components/top_nav/open_search_panel.test.js b/src/legacy/core_plugins/kibana/public/discover/components/top_nav/open_search_panel.test.js
index ea5c0ef39604d..0c82aeea95294 100644
--- a/src/legacy/core_plugins/kibana/public/discover/components/top_nav/open_search_panel.test.js
+++ b/src/legacy/core_plugins/kibana/public/discover/components/top_nav/open_search_panel.test.js
@@ -23,7 +23,7 @@ import { shallow } from 'enzyme';
 jest.mock('../../kibana_services', () => {
   return {
     getServices: () => ({
-      SavedObjectFinder: jest.fn()
+      core: { uiSettings: {}, savedObjects: {} },
     }),
   };
 });
diff --git a/src/legacy/core_plugins/kibana/public/visualize/embeddable/visualize_embeddable_factory.tsx b/src/legacy/core_plugins/kibana/public/visualize/embeddable/visualize_embeddable_factory.tsx
index 7c9efa280c9f1..a377dafe9e512 100644
--- a/src/legacy/core_plugins/kibana/public/visualize/embeddable/visualize_embeddable_factory.tsx
+++ b/src/legacy/core_plugins/kibana/public/visualize/embeddable/visualize_embeddable_factory.tsx
@@ -199,7 +199,8 @@ export class VisualizeEmbeddableFactory extends EmbeddableFactory<
           editorParams: ['addToDashboard'],
         },
         npStart.core.http.basePath.prepend,
-        npStart.core.uiSettings
+        npStart.core.uiSettings,
+        npStart.core.savedObjects
       );
     }
     return undefined;
diff --git a/src/legacy/core_plugins/kibana/public/visualize/legacy_imports.ts b/src/legacy/core_plugins/kibana/public/visualize/legacy_imports.ts
index 6adcfd2cc7186..b9909e522b571 100644
--- a/src/legacy/core_plugins/kibana/public/visualize/legacy_imports.ts
+++ b/src/legacy/core_plugins/kibana/public/visualize/legacy_imports.ts
@@ -45,7 +45,6 @@ export { PrivateProvider } from 'ui/private/private';
 
 export { SavedObjectRegistryProvider } from 'ui/saved_objects';
 export { SavedObjectSaveModal } from 'ui/saved_objects/components/saved_object_save_modal';
-export { SavedObjectFinder } from 'ui/saved_objects/components/saved_object_finder';
 export { showSaveModal } from 'ui/saved_objects/show_saved_object_save_modal';
 
 export { subscribeWithScope } from 'ui/utils/subscribe_with_scope';
diff --git a/src/legacy/core_plugins/kibana/public/visualize/listing/visualize_listing.html b/src/legacy/core_plugins/kibana/public/visualize/listing/visualize_listing.html
index 4511ac61f7396..4ee8809fab228 100644
--- a/src/legacy/core_plugins/kibana/public/visualize/listing/visualize_listing.html
+++ b/src/legacy/core_plugins/kibana/public/visualize/listing/visualize_listing.html
@@ -16,6 +16,7 @@
     vis-types-registry="listingController.visTypeRegistry"
     add-base-path="listingController.addBasePath"
     ui-settings="listingController.uiSettings"
+    saved-objects="listingController.savedObjects"
   ></new-vis-modal>
 
 </div>
diff --git a/src/legacy/core_plugins/kibana/public/visualize/listing/visualize_listing.js b/src/legacy/core_plugins/kibana/public/visualize/listing/visualize_listing.js
index 9b02be0581b8d..b1ed5ce81d6ee 100644
--- a/src/legacy/core_plugins/kibana/public/visualize/listing/visualize_listing.js
+++ b/src/legacy/core_plugins/kibana/public/visualize/listing/visualize_listing.js
@@ -34,6 +34,7 @@ export function initListingDirective(app) {
       ['onClose', { watchDepth: 'reference' }],
       ['addBasePath', { watchDepth: 'reference' }],
       ['uiSettings', { watchDepth: 'reference' }],
+      ['savedObjects', { watchDepth: 'reference' }],
       'isOpen',
     ])
   );
@@ -54,7 +55,7 @@ export function VisualizeListingController($injector, createNewVis) {
     toastNotifications,
     uiSettings,
     visualizations,
-    core: { docLinks },
+    core: { docLinks, savedObjects },
   } = getServices();
   const kbnUrl = $injector.get('kbnUrl');
 
@@ -64,6 +65,7 @@ export function VisualizeListingController($injector, createNewVis) {
   this.showNewVisModal = false;
   this.addBasePath = addBasePath;
   this.uiSettings = uiSettings;
+  this.savedObjects = savedObjects;
 
   this.createNewVis = () => {
     this.showNewVisModal = true;
diff --git a/src/legacy/core_plugins/kibana/public/visualize/wizard/__snapshots__/new_vis_modal.test.tsx.snap b/src/legacy/core_plugins/kibana/public/visualize/wizard/__snapshots__/new_vis_modal.test.tsx.snap
index 5be5f58994887..04b7cddc75289 100644
--- a/src/legacy/core_plugins/kibana/public/visualize/wizard/__snapshots__/new_vis_modal.test.tsx.snap
+++ b/src/legacy/core_plugins/kibana/public/visualize/wizard/__snapshots__/new_vis_modal.test.tsx.snap
@@ -108,6 +108,7 @@ exports[`NewVisModal filter for visualization types should render as expected 1`
   }
   isOpen={true}
   onClose={[Function]}
+  savedObjects={Object {}}
   uiSettings={
     Object {
       "get": [MockFunction] {
@@ -1413,6 +1414,7 @@ exports[`NewVisModal should render as expected 1`] = `
   }
   isOpen={true}
   onClose={[Function]}
+  savedObjects={Object {}}
   uiSettings={
     Object {
       "get": [MockFunction] {
diff --git a/src/legacy/core_plugins/kibana/public/visualize/wizard/new_vis_modal.test.tsx b/src/legacy/core_plugins/kibana/public/visualize/wizard/new_vis_modal.test.tsx
index 0dd2091bbfee0..4eafd06c7bb20 100644
--- a/src/legacy/core_plugins/kibana/public/visualize/wizard/new_vis_modal.test.tsx
+++ b/src/legacy/core_plugins/kibana/public/visualize/wizard/new_vis_modal.test.tsx
@@ -29,6 +29,7 @@ jest.mock('../legacy_imports', () => ({
 }));
 
 import { NewVisModal } from './new_vis_modal';
+import { SavedObjectsStart } from 'kibana/public';
 
 describe('NewVisModal', () => {
   const defaultVisTypeParams = {
@@ -76,6 +77,7 @@ describe('NewVisModal', () => {
         visTypesRegistry={visTypes}
         addBasePath={addBasePath}
         uiSettings={uiSettings}
+        savedObjects={{} as SavedObjectsStart}
       />
     );
     expect(wrapper).toMatchSnapshot();
@@ -89,6 +91,7 @@ describe('NewVisModal', () => {
         visTypesRegistry={visTypes}
         addBasePath={addBasePath}
         uiSettings={uiSettings}
+        savedObjects={{} as SavedObjectsStart}
       />
     );
     expect(wrapper.find('[data-test-subj="visType-vis"]').exists()).toBe(true);
@@ -104,6 +107,7 @@ describe('NewVisModal', () => {
           visTypesRegistry={visTypes}
           addBasePath={addBasePath}
           uiSettings={uiSettings}
+          savedObjects={{} as SavedObjectsStart}
         />
       );
       const visButton = wrapper.find('button[data-test-subj="visType-vis"]');
@@ -121,6 +125,7 @@ describe('NewVisModal', () => {
           editorParams={['foo=true', 'bar=42']}
           addBasePath={addBasePath}
           uiSettings={uiSettings}
+          savedObjects={{} as SavedObjectsStart}
         />
       );
       const visButton = wrapper.find('button[data-test-subj="visType-vis"]');
@@ -138,6 +143,7 @@ describe('NewVisModal', () => {
           visTypesRegistry={visTypes}
           addBasePath={addBasePath}
           uiSettings={uiSettings}
+          savedObjects={{} as SavedObjectsStart}
         />
       );
       const searchBox = wrapper.find('input[data-test-subj="filterVisType"]');
@@ -156,6 +162,7 @@ describe('NewVisModal', () => {
           visTypesRegistry={visTypes}
           addBasePath={addBasePath}
           uiSettings={uiSettings}
+          savedObjects={{} as SavedObjectsStart}
         />
       );
       expect(wrapper.find('[data-test-subj="visType-visExp"]').exists()).toBe(false);
@@ -170,6 +177,7 @@ describe('NewVisModal', () => {
           visTypesRegistry={visTypes}
           addBasePath={addBasePath}
           uiSettings={uiSettings}
+          savedObjects={{} as SavedObjectsStart}
         />
       );
       expect(wrapper.find('[data-test-subj="visType-visExp"]').exists()).toBe(true);
diff --git a/src/legacy/core_plugins/kibana/public/visualize/wizard/new_vis_modal.tsx b/src/legacy/core_plugins/kibana/public/visualize/wizard/new_vis_modal.tsx
index 0b46b562f2146..0402265610fb1 100644
--- a/src/legacy/core_plugins/kibana/public/visualize/wizard/new_vis_modal.tsx
+++ b/src/legacy/core_plugins/kibana/public/visualize/wizard/new_vis_modal.tsx
@@ -22,7 +22,7 @@ import React from 'react';
 import { EuiModal, EuiOverlayMask } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 
-import { IUiSettingsClient } from 'kibana/public';
+import { IUiSettingsClient, SavedObjectsStart } from 'kibana/public';
 import { VisType } from '../legacy_imports';
 import { VisualizeConstants } from '../visualize_constants';
 import { createUiStatsReporter, METRIC_TYPE } from '../../../../ui_metric/public';
@@ -37,6 +37,7 @@ interface TypeSelectionProps {
   editorParams?: string[];
   addBasePath: (path: string) => string;
   uiSettings: IUiSettingsClient;
+  savedObjects: SavedObjectsStart;
 }
 
 interface TypeSelectionState {
@@ -81,7 +82,12 @@ class NewVisModal extends React.Component<TypeSelectionProps, TypeSelectionState
     const selectionModal =
       this.state.showSearchVisModal && this.state.visType ? (
         <EuiModal onClose={this.onCloseModal} className="visNewVisSearchDialog">
-          <SearchSelection onSearchSelected={this.onSearchSelected} visType={this.state.visType} />
+          <SearchSelection
+            onSearchSelected={this.onSearchSelected}
+            visType={this.state.visType}
+            uiSettings={this.props.uiSettings}
+            savedObjects={this.props.savedObjects}
+          />
         </EuiModal>
       ) : (
         <EuiModal
diff --git a/src/legacy/core_plugins/kibana/public/visualize/wizard/search_selection/search_selection.tsx b/src/legacy/core_plugins/kibana/public/visualize/wizard/search_selection/search_selection.tsx
index 1f83e3f5e2463..6088b68c7fbd7 100644
--- a/src/legacy/core_plugins/kibana/public/visualize/wizard/search_selection/search_selection.tsx
+++ b/src/legacy/core_plugins/kibana/public/visualize/wizard/search_selection/search_selection.tsx
@@ -21,12 +21,16 @@ import { EuiModalBody, EuiModalHeader, EuiModalHeaderTitle } from '@elastic/eui'
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import React from 'react';
+import { IUiSettingsClient, SavedObjectsStart } from 'kibana/public';
 
-import { SavedObjectFinder, VisType } from '../../legacy_imports';
+import { SavedObjectFinderUi } from '../../../../../../../plugins/kibana_react/public';
+import { VisType } from '../../legacy_imports';
 
 interface SearchSelectionProps {
   onSearchSelected: (searchId: string, searchType: string) => void;
   visType: VisType;
+  uiSettings: IUiSettingsClient;
+  savedObjects: SavedObjectsStart;
 }
 
 export class SearchSelection extends React.Component<SearchSelectionProps> {
@@ -50,7 +54,7 @@ export class SearchSelection extends React.Component<SearchSelectionProps> {
           </EuiModalHeaderTitle>
         </EuiModalHeader>
         <EuiModalBody>
-          <SavedObjectFinder
+          <SavedObjectFinderUi
             key="searchSavedObjectFinder"
             onChoose={this.props.onSearchSelected}
             showFilter
@@ -83,6 +87,8 @@ export class SearchSelection extends React.Component<SearchSelectionProps> {
               },
             ]}
             fixedPageSize={this.fixedPageSize}
+            uiSettings={this.props.uiSettings}
+            savedObjects={this.props.savedObjects}
           />
         </EuiModalBody>
       </React.Fragment>
diff --git a/src/legacy/core_plugins/kibana/public/visualize/wizard/show_new_vis.tsx b/src/legacy/core_plugins/kibana/public/visualize/wizard/show_new_vis.tsx
index 92320f7bb443a..88838e16c40e2 100644
--- a/src/legacy/core_plugins/kibana/public/visualize/wizard/show_new_vis.tsx
+++ b/src/legacy/core_plugins/kibana/public/visualize/wizard/show_new_vis.tsx
@@ -21,7 +21,7 @@ import React from 'react';
 import ReactDOM from 'react-dom';
 
 import { I18nProvider } from '@kbn/i18n/react';
-import { IUiSettingsClient } from 'kibana/public';
+import { IUiSettingsClient, SavedObjectsStart } from 'kibana/public';
 import { NewVisModal } from './new_vis_modal';
 import { TypesStart } from '../../../../visualizations/public/np_ready/public/types';
 
@@ -33,7 +33,8 @@ export function showNewVisModal(
   visTypeRegistry: TypesStart,
   { editorParams = [] }: ShowNewVisModalParams = {},
   addBasePath: (path: string) => string,
-  uiSettings: IUiSettingsClient
+  uiSettings: IUiSettingsClient,
+  savedObjects: SavedObjectsStart
 ) {
   const container = document.createElement('div');
   const onClose = () => {
@@ -51,6 +52,7 @@ export function showNewVisModal(
         editorParams={editorParams}
         addBasePath={addBasePath}
         uiSettings={uiSettings}
+        savedObjects={savedObjects}
       />
     </I18nProvider>
   );
diff --git a/src/legacy/ui/public/saved_objects/components/saved_object_finder.tsx b/src/legacy/ui/public/saved_objects/components/saved_object_finder.tsx
deleted file mode 100644
index 5b787eb265509..0000000000000
--- a/src/legacy/ui/public/saved_objects/components/saved_object_finder.tsx
+++ /dev/null
@@ -1,108 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import React from 'react';
-import { npStart } from 'ui/new_platform';
-import { IconType } from '@elastic/eui';
-import { SavedObjectAttributes } from 'src/core/server';
-import { SimpleSavedObject } from 'src/core/public';
-import { SavedObjectFinder as SavedObjectFinderNP } from '../../../../../plugins/kibana_react/public';
-
-/**
- * DO NOT USE THIS COMPONENT, IT IS DEPRECATED.
- * Use the one in `src/plugins/kibana_react` instead.
- */
-
-export interface SavedObjectMetaData<T extends SavedObjectAttributes> {
-  type: string;
-  name: string;
-  getIconForSavedObject(savedObject: SimpleSavedObject<T>): IconType;
-  getTooltipForSavedObject?(savedObject: SimpleSavedObject<T>): string;
-  showSavedObject?(savedObject: SimpleSavedObject<T>): boolean;
-}
-
-interface BaseSavedObjectFinder {
-  /**
-   * @deprecated
-   *
-   * Use component in `src/plugins/kibana_react` instead.
-   */
-  onChoose?: (
-    id: SimpleSavedObject<SavedObjectAttributes>['id'],
-    type: SimpleSavedObject<SavedObjectAttributes>['type'],
-    name: string
-  ) => void;
-  /**
-   * @deprecated
-   *
-   * Use component in `src/plugins/kibana_react` instead.
-   */
-  noItemsMessage?: React.ReactNode;
-  /**
-   * @deprecated
-   *
-   * Use component in `src/plugins/kibana_react` instead.
-   */
-  savedObjectMetaData: Array<SavedObjectMetaData<SavedObjectAttributes>>;
-  /**
-   * @deprecated
-   *
-   * Use component in `src/plugins/kibana_react` instead.
-   */
-  showFilter?: boolean;
-}
-
-interface SavedObjectFinderFixedPage extends BaseSavedObjectFinder {
-  /**
-   * @deprecated
-   *
-   * Use component in `src/plugins/kibana_react` instead.
-   */
-  initialPageSize?: undefined;
-  /**
-   * @deprecated
-   *
-   * Use component in `src/plugins/kibana_react` instead.
-   */
-  fixedPageSize: number;
-}
-
-interface SavedObjectFinderInitialPageSize extends BaseSavedObjectFinder {
-  /**
-   * @deprecated
-   *
-   * Use component in `src/plugins/kibana_react` instead.
-   */
-  initialPageSize?: 5 | 10 | 15 | 25;
-  /**
-   * @deprecated
-   *
-   * Use component in `src/plugins/kibana_react` instead.
-   */
-  fixedPageSize?: undefined;
-}
-type SavedObjectFinderProps = SavedObjectFinderFixedPage | SavedObjectFinderInitialPageSize;
-
-export const SavedObjectFinder: React.FC<SavedObjectFinderProps> = props => (
-  <SavedObjectFinderNP
-    savedObjects={npStart.core.savedObjects}
-    uiSettings={npStart.core.uiSettings}
-    {...props}
-  />
-);
diff --git a/src/plugins/dashboard_embeddable_container/public/plugin.tsx b/src/plugins/dashboard_embeddable_container/public/plugin.tsx
index 79cc9b6980545..d18fbba239ec0 100644
--- a/src/plugins/dashboard_embeddable_container/public/plugin.tsx
+++ b/src/plugins/dashboard_embeddable_container/public/plugin.tsx
@@ -27,7 +27,7 @@ import { ExpandPanelAction, ReplacePanelAction } from '.';
 import { DashboardContainerFactory } from './embeddable/dashboard_container_factory';
 import { Start as InspectorStartContract } from '../../../plugins/inspector/public';
 import {
-  SavedObjectFinder as SavedObjectFinderUi,
+  SavedObjectFinderUi,
   SavedObjectFinderProps,
   ExitFullScreenButton as ExitFullScreenButtonUi,
   ExitFullScreenButtonProps,
diff --git a/src/plugins/kibana_react/public/saved_objects/saved_object_finder.test.tsx b/src/plugins/kibana_react/public/saved_objects/saved_object_finder.test.tsx
index b35ba427378ab..58b396d57639b 100644
--- a/src/plugins/kibana_react/public/saved_objects/saved_object_finder.test.tsx
+++ b/src/plugins/kibana_react/public/saved_objects/saved_object_finder.test.tsx
@@ -35,7 +35,7 @@ import { IconType } from '@elastic/eui';
 import { shallow } from 'enzyme';
 import React from 'react';
 import * as sinon from 'sinon';
-import { SavedObjectFinder } from './saved_object_finder';
+import { SavedObjectFinderUi as SavedObjectFinder } from './saved_object_finder';
 // eslint-disable-next-line
 import { coreMock } from '../../../../core/public/mocks';
 
diff --git a/src/plugins/kibana_react/public/saved_objects/saved_object_finder.tsx b/src/plugins/kibana_react/public/saved_objects/saved_object_finder.tsx
index c65d428958767..51fbbd2ba3046 100644
--- a/src/plugins/kibana_react/public/saved_objects/saved_object_finder.tsx
+++ b/src/plugins/kibana_react/public/saved_objects/saved_object_finder.tsx
@@ -46,6 +46,7 @@ import { i18n } from '@kbn/i18n';
 
 import { SavedObjectAttributes } from '../../../../core/server';
 import { SimpleSavedObject, CoreStart } from '../../../../core/public';
+import { useKibana } from '../context';
 
 // TODO the typings for EuiListGroup are incorrect - maxWidth is missing. This can be removed when the types are adjusted
 const FixedEuiListGroup = (EuiListGroup as any) as React.FunctionComponent<
@@ -104,12 +105,18 @@ interface SavedObjectFinderInitialPageSize extends BaseSavedObjectFinder {
   initialPageSize?: 5 | 10 | 15 | 25;
   fixedPageSize?: undefined;
 }
-export type SavedObjectFinderProps = {
+
+export type SavedObjectFinderProps = SavedObjectFinderFixedPage | SavedObjectFinderInitialPageSize;
+
+export type SavedObjectFinderUiProps = {
   savedObjects: CoreStart['savedObjects'];
   uiSettings: CoreStart['uiSettings'];
-} & (SavedObjectFinderFixedPage | SavedObjectFinderInitialPageSize);
+} & SavedObjectFinderProps;
 
-class SavedObjectFinder extends React.Component<SavedObjectFinderProps, SavedObjectFinderState> {
+class SavedObjectFinderUi extends React.Component<
+  SavedObjectFinderUiProps,
+  SavedObjectFinderState
+> {
   public static propTypes = {
     onChoose: PropTypes.func,
     noItemsMessage: PropTypes.node,
@@ -174,7 +181,7 @@ class SavedObjectFinder extends React.Component<SavedObjectFinderProps, SavedObj
     }
   }, 300);
 
-  constructor(props: SavedObjectFinderProps) {
+  constructor(props: SavedObjectFinderUiProps) {
     super(props);
 
     this.state = {
@@ -523,4 +530,15 @@ class SavedObjectFinder extends React.Component<SavedObjectFinderProps, SavedObj
   }
 }
 
-export { SavedObjectFinder };
+const SavedObjectFinder = (props: SavedObjectFinderProps) => {
+  const { services } = useKibana();
+  return (
+    <SavedObjectFinderUi
+      {...props}
+      savedObjects={services.savedObject}
+      uiSettings={services.uiSettings}
+    />
+  );
+};
+
+export { SavedObjectFinder, SavedObjectFinderUi };
diff --git a/test/plugin_functional/plugins/kbn_tp_embeddable_explorer/public/np_ready/public/legacy.ts b/test/plugin_functional/plugins/kbn_tp_embeddable_explorer/public/np_ready/public/legacy.ts
index a310403c86b5d..1928d7ac72313 100644
--- a/test/plugin_functional/plugins/kbn_tp_embeddable_explorer/public/np_ready/public/legacy.ts
+++ b/test/plugin_functional/plugins/kbn_tp_embeddable_explorer/public/np_ready/public/legacy.ts
@@ -22,7 +22,6 @@ import 'uiExports/embeddableFactories';
 import 'uiExports/embeddableActions';
 
 import { npSetup, npStart } from 'ui/new_platform';
-import { SavedObjectFinder } from 'ui/saved_objects/components/saved_object_finder';
 import { ExitFullScreenButton } from 'ui/exit_full_screen';
 import uiRoutes from 'ui/routes';
 // @ts-ignore
@@ -39,7 +38,6 @@ export const setup = pluginInstance.setup(npSetup.core, {
   embeddable: npSetup.plugins.embeddable,
   inspector: npSetup.plugins.inspector,
   __LEGACY: {
-    SavedObjectFinder,
     ExitFullScreenButton,
   },
 });
@@ -64,7 +62,6 @@ export const start = pluginInstance.start(npStart.core, {
   inspector: npStart.plugins.inspector,
   uiActions: npStart.plugins.uiActions,
   __LEGACY: {
-    SavedObjectFinder,
     ExitFullScreenButton,
     onRenderComplete: (renderCompleteListener: () => void) => {
       if (rendered) {
diff --git a/test/plugin_functional/plugins/kbn_tp_embeddable_explorer/public/np_ready/public/plugin.tsx b/test/plugin_functional/plugins/kbn_tp_embeddable_explorer/public/np_ready/public/plugin.tsx
index 6b82a67b9fcda..adf898d9af2c7 100644
--- a/test/plugin_functional/plugins/kbn_tp_embeddable_explorer/public/np_ready/public/plugin.tsx
+++ b/test/plugin_functional/plugins/kbn_tp_embeddable_explorer/public/np_ready/public/plugin.tsx
@@ -38,6 +38,10 @@ import {
   ContactCardEmbeddableFactory,
 } from './embeddable_api';
 import { App } from './app';
+import {
+  SavedObjectFinderProps,
+  SavedObjectFinderUi,
+} from '../../../../../../../src/plugins/kibana_react/public/saved_objects';
 import {
   IEmbeddableStart,
   IEmbeddableSetup,
@@ -47,7 +51,6 @@ export interface SetupDependencies {
   embeddable: IEmbeddableSetup;
   inspector: InspectorSetupContract;
   __LEGACY: {
-    SavedObjectFinder: React.ComponentType<any>;
     ExitFullScreenButton: React.ComponentType<any>;
   };
 }
@@ -57,7 +60,6 @@ interface StartDependencies {
   uiActions: IUiActionsStart;
   inspector: InspectorStartContract;
   __LEGACY: {
-    SavedObjectFinder: React.ComponentType<any>;
     ExitFullScreenButton: React.ComponentType<any>;
     onRenderComplete: (onRenderComplete: () => void) => void;
   };
@@ -99,6 +101,13 @@ export class EmbeddableExplorerPublicPlugin
 
     plugins.__LEGACY.onRenderComplete(() => {
       const root = document.getElementById(REACT_ROOT_ID);
+      const SavedObjectFinder = (props: SavedObjectFinderProps) => (
+        <SavedObjectFinderUi
+          {...props}
+          savedObjects={core.savedObjects}
+          uiSettings={core.uiSettings}
+        />
+      );
       ReactDOM.render(
         <App
           getActions={plugins.uiActions.getTriggerCompatibleActions}
@@ -107,7 +116,7 @@ export class EmbeddableExplorerPublicPlugin
           notifications={core.notifications}
           overlays={core.overlays}
           inspector={plugins.inspector}
-          SavedObjectFinder={plugins.__LEGACY.SavedObjectFinder}
+          SavedObjectFinder={SavedObjectFinder}
           I18nContext={core.i18n.Context}
         />,
         root
diff --git a/x-pack/legacy/plugins/canvas/canvas_plugin_src/renderers/embeddable.tsx b/x-pack/legacy/plugins/canvas/canvas_plugin_src/renderers/embeddable.tsx
index 8810871e9161b..5c7ef1a8c1799 100644
--- a/x-pack/legacy/plugins/canvas/canvas_plugin_src/renderers/embeddable.tsx
+++ b/x-pack/legacy/plugins/canvas/canvas_plugin_src/renderers/embeddable.tsx
@@ -16,8 +16,11 @@ import {
 } from '../../../../../../src/legacy/core_plugins/embeddable_api/public/np_ready/public';
 import { start } from '../../../../../../src/legacy/core_plugins/embeddable_api/public/np_ready/public/legacy';
 import { EmbeddableExpression } from '../expression_types/embeddable';
-import { SavedObjectFinder } from '../../../../../../src/legacy/ui/public/saved_objects/components/saved_object_finder';
 import { RendererStrings } from '../../i18n';
+import {
+  SavedObjectFinderProps,
+  SavedObjectFinderUi,
+} from '../../../../../../src/plugins/kibana_react/public';
 
 const { embeddable: strings } = RendererStrings;
 
@@ -34,6 +37,13 @@ interface Handlers {
 }
 
 const renderEmbeddable = (embeddableObject: IEmbeddable, domNode: HTMLElement) => {
+  const SavedObjectFinder = (props: SavedObjectFinderProps) => (
+    <SavedObjectFinderUi
+      {...props}
+      savedObjects={npStart.core.savedObjects}
+      uiSettings={npStart.core.uiSettings}
+    />
+  );
   return (
     <div
       className="embeddable"
diff --git a/x-pack/legacy/plugins/canvas/public/components/embeddable_flyout/flyout.tsx b/x-pack/legacy/plugins/canvas/public/components/embeddable_flyout/flyout.tsx
index d09ef53f65fbb..786403f2748fa 100644
--- a/x-pack/legacy/plugins/canvas/public/components/embeddable_flyout/flyout.tsx
+++ b/x-pack/legacy/plugins/canvas/public/components/embeddable_flyout/flyout.tsx
@@ -8,7 +8,7 @@ import React from 'react';
 
 import { EuiFlyout, EuiFlyoutHeader, EuiFlyoutBody, EuiTitle } from '@elastic/eui';
 import {
-  SavedObjectFinder,
+  SavedObjectFinderUi,
   SavedObjectMetaData,
 } from '../../../../../../../src/plugins/kibana_react/public/saved_objects'; // eslint-disable-line
 import { start } from '../../../../../../../src/legacy/core_plugins/embeddable_api/public/np_ready/public/legacy';
@@ -64,7 +64,7 @@ export class AddEmbeddableFlyout extends React.Component<Props> {
           </EuiTitle>
         </EuiFlyoutHeader>
         <EuiFlyoutBody>
-          <SavedObjectFinder
+          <SavedObjectFinderUi
             onChoose={this.onAddPanel}
             savedObjectMetaData={availableSavedObjects}
             showFilter={true}
diff --git a/x-pack/legacy/plugins/graph/public/components/source_picker.tsx b/x-pack/legacy/plugins/graph/public/components/source_picker.tsx
index 2399ac24c199f..de920af8a48a5 100644
--- a/x-pack/legacy/plugins/graph/public/components/source_picker.tsx
+++ b/x-pack/legacy/plugins/graph/public/components/source_picker.tsx
@@ -8,7 +8,7 @@ import { i18n } from '@kbn/i18n';
 import React from 'react';
 
 import { CoreStart } from 'src/core/public';
-import { SavedObjectFinder } from '../../../../../../src/plugins/kibana_react/public';
+import { SavedObjectFinderUi } from '../../../../../../src/plugins/kibana_react/public';
 import { IndexPatternSavedObject } from '../types';
 
 export interface SourcePickerProps {
@@ -25,7 +25,7 @@ export function SourcePicker({
   onIndexPatternSelected,
 }: SourcePickerProps) {
   return (
-    <SavedObjectFinder
+    <SavedObjectFinderUi
       savedObjects={savedObjects}
       uiSettings={uiSettings}
       onChoose={(_id, _type, _name, indexPattern) => {
diff --git a/x-pack/legacy/plugins/ml/public/application/jobs/new_job/pages/index_or_search/page.tsx b/x-pack/legacy/plugins/ml/public/application/jobs/new_job/pages/index_or_search/page.tsx
index 68013bd243a91..cb311f04dd1d7 100644
--- a/x-pack/legacy/plugins/ml/public/application/jobs/new_job/pages/index_or_search/page.tsx
+++ b/x-pack/legacy/plugins/ml/public/application/jobs/new_job/pages/index_or_search/page.tsx
@@ -15,7 +15,8 @@ import {
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { SavedObjectFinder } from 'ui/saved_objects/components/saved_object_finder';
+import { npStart } from 'ui/new_platform';
+import { SavedObjectFinderUi } from '../../../../../../../../../../src/plugins/kibana_react/public';
 
 export interface PageProps {
   nextStepPath: string;
@@ -46,7 +47,7 @@ export const Page: FC<PageProps> = ({ nextStepPath }) => {
           </EuiPageHeaderSection>
         </EuiPageHeader>
         <EuiPageContent>
-          <SavedObjectFinder
+          <SavedObjectFinderUi
             key="searchSavedObjectFinder"
             onChoose={onObjectSelection}
             showFilter
@@ -76,6 +77,8 @@ export const Page: FC<PageProps> = ({ nextStepPath }) => {
               },
             ]}
             fixedPageSize={RESULTS_PER_PAGE}
+            uiSettings={npStart.core.uiSettings}
+            savedObjects={npStart.core.savedObjects}
           />
         </EuiPageContent>
       </EuiPageBody>
diff --git a/x-pack/legacy/plugins/siem/public/components/embeddables/embedded_map.tsx b/x-pack/legacy/plugins/siem/public/components/embeddables/embedded_map.tsx
index cb73cf73b8d06..1658002408fb0 100644
--- a/x-pack/legacy/plugins/siem/public/components/embeddables/embedded_map.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/embeddables/embedded_map.tsx
@@ -9,7 +9,6 @@ import React, { useEffect, useState } from 'react';
 import { createPortalNode, InPortal } from 'react-reverse-portal';
 import styled, { css } from 'styled-components';
 import { ELASTIC_WEBSITE_URL, DOC_LINK_VERSION } from 'ui/documentation_links';
-import { SavedObjectFinder } from 'ui/saved_objects/components/saved_object_finder';
 
 import { EmbeddablePanel } from '../../../../../../../src/legacy/core_plugins/embeddable_api/public/np_ready/public';
 import { start } from '../../../../../../../src/legacy/core_plugins/embeddable_api/public/np_ready/public/legacy';
@@ -29,6 +28,10 @@ import { MapToolTip } from './map_tool_tip/map_tool_tip';
 import * as i18n from './translations';
 import { MapEmbeddable, SetQuery } from './types';
 import { Query, esFilters } from '../../../../../../../src/plugins/data/public';
+import {
+  SavedObjectFinderProps,
+  SavedObjectFinderUi,
+} from '../../../../../../../src/plugins/kibana_react/public';
 
 interface EmbeddableMapProps {
   maintainRatio?: boolean;
@@ -176,6 +179,10 @@ export const EmbeddedMapComponent = ({
     }
   }, [startDate, endDate]);
 
+  const SavedObjectFinder = (props: SavedObjectFinderProps) => (
+    <SavedObjectFinderUi {...props} savedObjects={core.savedObjects} uiSettings={core.uiSettings} />
+  );
+
   return isError ? null : (
     <Embeddable>
       <EmbeddableHeader title={i18n.EMBEDDABLE_HEADER_TITLE}>
diff --git a/x-pack/legacy/plugins/transform/public/app/sections/transform_management/components/search_selection/search_selection.tsx b/x-pack/legacy/plugins/transform/public/app/sections/transform_management/components/search_selection/search_selection.tsx
index 1a270505d61a6..368c5aa806fe8 100644
--- a/x-pack/legacy/plugins/transform/public/app/sections/transform_management/components/search_selection/search_selection.tsx
+++ b/x-pack/legacy/plugins/transform/public/app/sections/transform_management/components/search_selection/search_selection.tsx
@@ -8,8 +8,8 @@ import { EuiModalBody, EuiModalHeader, EuiModalHeaderTitle } from '@elastic/eui'
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import React, { FC } from 'react';
-
-import { SavedObjectFinder } from 'ui/saved_objects/components/saved_object_finder';
+import { SavedObjectFinderUi } from '../../../../../../../../../../src/plugins/kibana_react/public';
+import { useAppDependencies } from '../../../../app_dependencies';
 
 interface SearchSelectionProps {
   onSearchSelected: (searchId: string, searchType: string) => void;
@@ -17,56 +17,63 @@ interface SearchSelectionProps {
 
 const fixedPageSize: number = 8;
 
-export const SearchSelection: FC<SearchSelectionProps> = ({ onSearchSelected }) => (
-  <>
-    <EuiModalHeader>
-      <EuiModalHeaderTitle>
-        <FormattedMessage
-          id="xpack.transform.newTransform.newTransformTitle"
-          defaultMessage="New transform"
-        />{' '}
-        /{' '}
-        <FormattedMessage
-          id="xpack.transform.newTransform.chooseSourceTitle"
-          defaultMessage="Choose a source"
+export const SearchSelection: FC<SearchSelectionProps> = ({ onSearchSelected }) => {
+  const {
+    core: { uiSettings, savedObjects },
+  } = useAppDependencies();
+  return (
+    <>
+      <EuiModalHeader>
+        <EuiModalHeaderTitle>
+          <FormattedMessage
+            id="xpack.transform.newTransform.newTransformTitle"
+            defaultMessage="New transform"
+          />{' '}
+          /{' '}
+          <FormattedMessage
+            id="xpack.transform.newTransform.chooseSourceTitle"
+            defaultMessage="Choose a source"
+          />
+        </EuiModalHeaderTitle>
+      </EuiModalHeader>
+      <EuiModalBody>
+        <SavedObjectFinderUi
+          key="searchSavedObjectFinder"
+          onChoose={onSearchSelected}
+          showFilter
+          noItemsMessage={i18n.translate(
+            'xpack.transform.newTransform.searchSelection.notFoundLabel',
+            {
+              defaultMessage: 'No matching indices or saved searches found.',
+            }
+          )}
+          savedObjectMetaData={[
+            {
+              type: 'search',
+              getIconForSavedObject: () => 'search',
+              name: i18n.translate(
+                'xpack.transform.newTransform.searchSelection.savedObjectType.search',
+                {
+                  defaultMessage: 'Saved search',
+                }
+              ),
+            },
+            {
+              type: 'index-pattern',
+              getIconForSavedObject: () => 'indexPatternApp',
+              name: i18n.translate(
+                'xpack.transform.newTransform.searchSelection.savedObjectType.indexPattern',
+                {
+                  defaultMessage: 'Index pattern',
+                }
+              ),
+            },
+          ]}
+          fixedPageSize={fixedPageSize}
+          uiSettings={uiSettings}
+          savedObjects={savedObjects}
         />
-      </EuiModalHeaderTitle>
-    </EuiModalHeader>
-    <EuiModalBody>
-      <SavedObjectFinder
-        key="searchSavedObjectFinder"
-        onChoose={onSearchSelected}
-        showFilter
-        noItemsMessage={i18n.translate(
-          'xpack.transform.newTransform.searchSelection.notFoundLabel',
-          {
-            defaultMessage: 'No matching indices or saved searches found.',
-          }
-        )}
-        savedObjectMetaData={[
-          {
-            type: 'search',
-            getIconForSavedObject: () => 'search',
-            name: i18n.translate(
-              'xpack.transform.newTransform.searchSelection.savedObjectType.search',
-              {
-                defaultMessage: 'Saved search',
-              }
-            ),
-          },
-          {
-            type: 'index-pattern',
-            getIconForSavedObject: () => 'indexPatternApp',
-            name: i18n.translate(
-              'xpack.transform.newTransform.searchSelection.savedObjectType.indexPattern',
-              {
-                defaultMessage: 'Index pattern',
-              }
-            ),
-          },
-        ]}
-        fixedPageSize={fixedPageSize}
-      />
-    </EuiModalBody>
-  </>
-);
+      </EuiModalBody>
+    </>
+  );
+};
diff --git a/x-pack/legacy/plugins/transform/public/plugin.ts b/x-pack/legacy/plugins/transform/public/plugin.ts
index e7cc83d16b3b9..08a3a06fc24fc 100644
--- a/x-pack/legacy/plugins/transform/public/plugin.ts
+++ b/x-pack/legacy/plugins/transform/public/plugin.ts
@@ -27,12 +27,21 @@ const template = `<kbn-management-app section="${KBN_MANAGEMENT_SECTION}"><div i
 
 export class Plugin {
   public start(core: Core, plugins: Plugins): void {
-    const { http, routing, legacyHttp, chrome, documentation, docTitle } = core;
+    const {
+      http,
+      routing,
+      legacyHttp,
+      chrome,
+      documentation,
+      docTitle,
+      uiSettings,
+      savedObjects,
+    } = core;
     const { management, savedSearches: coreSavedSearches, uiMetric } = plugins;
 
     // AppCore/AppPlugins to be passed on as React context
     const AppDependencies = {
-      core: { chrome, http, i18n: core.i18n },
+      core: { chrome, http, i18n: core.i18n, uiSettings, savedObjects },
       plugins: {
         management: { sections: management.sections },
         savedSearches: coreSavedSearches,
diff --git a/x-pack/legacy/plugins/transform/public/shim.ts b/x-pack/legacy/plugins/transform/public/shim.ts
index d5d831e3f314a..5d7c309ade211 100644
--- a/x-pack/legacy/plugins/transform/public/shim.ts
+++ b/x-pack/legacy/plugins/transform/public/shim.ts
@@ -18,7 +18,7 @@ export type npCore = typeof npStart.core;
 
 // AppCore/AppPlugins is the set of core features/plugins
 // we pass on via context/hooks to the app and its components.
-export type AppCore = Pick<npCore, 'chrome' | 'http' | 'i18n'>;
+export type AppCore = Pick<npCore, 'chrome' | 'http' | 'i18n' | 'savedObjects' | 'uiSettings'>;
 
 export interface AppPlugins {
   management: {

From cf28280496c76e58a1b937d16add9aab6350155b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Felix=20St=C3=BCrmer?= <weltenwort@users.noreply.github.com>
Date: Tue, 10 Dec 2019 19:21:10 +0100
Subject: [PATCH 08/24] [Logs UI] Generalize ML module management (#50662)

This abstracts the specific job details out of the ML module management hooks to enable re-use with the upcoming categorization module.

closes #50322
---
 .../log_analysis/results/log_entry_rate.ts    |  12 +-
 .../http_api/log_analysis/validation/index.ts |   2 +-
 .../{indices.ts => log_entry_rate_indices.ts} |  14 +-
 .../common/log_analysis/job_parameters.ts     |  18 +-
 .../analyze_in_ml_button.tsx                  |   9 +-
 .../logging/log_analysis_results/index.ts     |   7 +
 .../logs/log_analysis/api/ml_api_types.ts     |  27 ++-
 .../logs/log_analysis/api/ml_cleanup.ts       |  39 +++-
 .../api/ml_get_jobs_summary_api.ts            |  10 +-
 .../log_analysis/api/ml_setup_module_api.ts   |  47 ++---
 ...tterns_validate.ts => validate_indices.ts} |  14 +-
 .../containers/logs/log_analysis/index.ts     |   7 +-
 .../log_analysis_capabilities.tsx             |   2 +-
 .../log_analysis/log_analysis_cleanup.tsx     |  82 +++-----
 .../logs/log_analysis/log_analysis_jobs.tsx   | 169 ----------------
 .../logs/log_analysis/log_analysis_module.tsx | 167 +++++++++++++++
 ...ate.tsx => log_analysis_module_status.tsx} | 190 ++++++++++--------
 .../log_analysis/log_analysis_module_types.ts |  36 ++++
 .../log_analysis/log_analysis_setup_state.tsx |  92 +++++----
 .../logs/log_analysis/log_entry_rate.tsx      |  50 -----
 .../logs/log_analysis/ml_api_types.ts         |  28 ---
 .../infra/public/containers/source/index.ts   |   2 +-
 .../infra/public/containers/source/source.tsx |   1 +
 .../plugins/infra/public/pages/logs/index.tsx |   4 +-
 .../first_use.tsx                             |   0
 .../{analysis => log_entry_rate}/index.ts     |   0
 .../logs/log_entry_rate/module_descriptor.ts  | 107 ++++++++++
 .../{analysis => log_entry_rate}/page.tsx     |  14 +-
 .../page_content.tsx                          |  39 ++--
 .../page_providers.tsx                        |  16 +-
 .../page_results_content.tsx                  |  79 ++++----
 .../page_setup_content.tsx                    |  46 +++--
 .../page_setup_status_unknown.tsx             |   2 +-
 .../page_unavailable_content.tsx              |   2 +-
 .../sections/anomalies/chart.tsx              |   0
 .../sections/anomalies/expanded_row.tsx       |  25 ++-
 .../sections/anomalies/index.tsx              |   6 +-
 .../sections/anomalies/table.tsx              |   4 +-
 .../sections/helpers/data_formatters.tsx      |  26 ++-
 .../sections/log_rate/bar_chart.tsx           |   0
 .../sections/log_rate/index.tsx               |   2 +-
 .../service_calls}/get_log_entry_rate.ts      |   0
 .../setup/index.ts                            |   0
 .../analysis_setup_indices_form.tsx           |  17 +-
 .../analysis_setup_timerange_form.tsx         |   0
 .../setup/initial_configuration_step/index.ts |   0
 .../initial_configuration_step.tsx            |   0
 .../process_step/create_ml_jobs_button.tsx    |   0
 .../setup/process_step/index.ts               |   0
 .../setup/process_step/process_step.tsx       |   0
 .../process_step/recreate_ml_jobs_button.tsx  |   0
 .../setup/setup_steps.tsx                     |  24 ++-
 .../use_log_entry_rate_module.tsx             |  45 +++++
 .../use_log_entry_rate_results.ts}            |  78 +++----
 .../use_log_entry_rate_results_url_state.tsx} |   7 +-
 .../plugins/infra/server/infra_server.ts      |   8 +-
 .../lib/adapters/framework/adapter_types.ts   |   4 +-
 .../infra/server/routes/log_analysis/index.ts |   2 +-
 .../log_analysis/results/log_entry_rate.ts    |   5 +-
 .../{index_patterns => validation}/index.ts   |   2 +-
 .../validate.ts => validation/indices.ts}     |  25 +--
 61 files changed, 910 insertions(+), 704 deletions(-)
 rename x-pack/legacy/plugins/infra/common/http_api/log_analysis/validation/{indices.ts => log_entry_rate_indices.ts} (74%)
 rename x-pack/legacy/plugins/infra/public/{pages/logs/analysis/sections => components/logging/log_analysis_results}/analyze_in_ml_button.tsx (96%)
 create mode 100644 x-pack/legacy/plugins/infra/public/components/logging/log_analysis_results/index.ts
 rename x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/api/{index_patterns_validate.ts => validate_indices.ts} (70%)
 delete mode 100644 x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_jobs.tsx
 create mode 100644 x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_module.tsx
 rename x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/{log_analysis_status_state.tsx => log_analysis_module_status.tsx} (70%)
 create mode 100644 x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_module_types.ts
 delete mode 100644 x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_entry_rate.tsx
 delete mode 100644 x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/ml_api_types.ts
 rename x-pack/legacy/plugins/infra/public/pages/logs/{analysis => log_entry_rate}/first_use.tsx (100%)
 rename x-pack/legacy/plugins/infra/public/pages/logs/{analysis => log_entry_rate}/index.ts (100%)
 create mode 100644 x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/module_descriptor.ts
 rename x-pack/legacy/plugins/infra/public/pages/logs/{analysis => log_entry_rate}/page.tsx (53%)
 rename x-pack/legacy/plugins/infra/public/pages/logs/{analysis => log_entry_rate}/page_content.tsx (59%)
 rename x-pack/legacy/plugins/infra/public/pages/logs/{analysis => log_entry_rate}/page_providers.tsx (53%)
 rename x-pack/legacy/plugins/infra/public/pages/logs/{analysis => log_entry_rate}/page_results_content.tsx (78%)
 rename x-pack/legacy/plugins/infra/public/pages/logs/{analysis => log_entry_rate}/page_setup_content.tsx (70%)
 rename x-pack/legacy/plugins/infra/public/pages/logs/{analysis => log_entry_rate}/page_setup_status_unknown.tsx (92%)
 rename x-pack/legacy/plugins/infra/public/pages/logs/{analysis => log_entry_rate}/page_unavailable_content.tsx (95%)
 rename x-pack/legacy/plugins/infra/public/pages/logs/{analysis => log_entry_rate}/sections/anomalies/chart.tsx (100%)
 rename x-pack/legacy/plugins/infra/public/pages/logs/{analysis => log_entry_rate}/sections/anomalies/expanded_row.tsx (84%)
 rename x-pack/legacy/plugins/infra/public/pages/logs/{analysis => log_entry_rate}/sections/anomalies/index.tsx (97%)
 rename x-pack/legacy/plugins/infra/public/pages/logs/{analysis => log_entry_rate}/sections/anomalies/table.tsx (97%)
 rename x-pack/legacy/plugins/infra/public/pages/logs/{analysis => log_entry_rate}/sections/helpers/data_formatters.tsx (88%)
 rename x-pack/legacy/plugins/infra/public/pages/logs/{analysis => log_entry_rate}/sections/log_rate/bar_chart.tsx (100%)
 rename x-pack/legacy/plugins/infra/public/pages/logs/{analysis => log_entry_rate}/sections/log_rate/index.tsx (96%)
 rename x-pack/legacy/plugins/infra/public/{containers/logs/log_analysis/api => pages/logs/log_entry_rate/service_calls}/get_log_entry_rate.ts (100%)
 rename x-pack/legacy/plugins/infra/public/pages/logs/{analysis => log_entry_rate}/setup/index.ts (100%)
 rename x-pack/legacy/plugins/infra/public/pages/logs/{analysis => log_entry_rate}/setup/initial_configuration_step/analysis_setup_indices_form.tsx (91%)
 rename x-pack/legacy/plugins/infra/public/pages/logs/{analysis => log_entry_rate}/setup/initial_configuration_step/analysis_setup_timerange_form.tsx (100%)
 rename x-pack/legacy/plugins/infra/public/pages/logs/{analysis => log_entry_rate}/setup/initial_configuration_step/index.ts (100%)
 rename x-pack/legacy/plugins/infra/public/pages/logs/{analysis => log_entry_rate}/setup/initial_configuration_step/initial_configuration_step.tsx (100%)
 rename x-pack/legacy/plugins/infra/public/pages/logs/{analysis => log_entry_rate}/setup/process_step/create_ml_jobs_button.tsx (100%)
 rename x-pack/legacy/plugins/infra/public/pages/logs/{analysis => log_entry_rate}/setup/process_step/index.ts (100%)
 rename x-pack/legacy/plugins/infra/public/pages/logs/{analysis => log_entry_rate}/setup/process_step/process_step.tsx (100%)
 rename x-pack/legacy/plugins/infra/public/pages/logs/{analysis => log_entry_rate}/setup/process_step/recreate_ml_jobs_button.tsx (100%)
 rename x-pack/legacy/plugins/infra/public/pages/logs/{analysis => log_entry_rate}/setup/setup_steps.tsx (84%)
 create mode 100644 x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/use_log_entry_rate_module.tsx
 rename x-pack/legacy/plugins/infra/public/{containers/logs/log_analysis/log_analysis_results.tsx => pages/logs/log_entry_rate/use_log_entry_rate_results.ts} (58%)
 rename x-pack/legacy/plugins/infra/public/{containers/logs/log_analysis/log_analysis_results_url_state.tsx => pages/logs/log_entry_rate/use_log_entry_rate_results_url_state.tsx} (96%)
 rename x-pack/legacy/plugins/infra/server/routes/log_analysis/{index_patterns => validation}/index.ts (89%)
 rename x-pack/legacy/plugins/infra/server/routes/log_analysis/{index_patterns/validate.ts => validation/indices.ts} (77%)

diff --git a/x-pack/legacy/plugins/infra/common/http_api/log_analysis/results/log_entry_rate.ts b/x-pack/legacy/plugins/infra/common/http_api/log_analysis/results/log_entry_rate.ts
index 5a1412fd8f3d4..dfc3d2aabd11a 100644
--- a/x-pack/legacy/plugins/infra/common/http_api/log_analysis/results/log_entry_rate.ts
+++ b/x-pack/legacy/plugins/infra/common/http_api/log_analysis/results/log_entry_rate.ts
@@ -29,7 +29,7 @@ export type GetLogEntryRateRequestPayload = rt.TypeOf<typeof getLogEntryRateRequ
  * response
  */
 
-export const logEntryRateAnomaly = rt.type({
+export const logEntryRateAnomalyRT = rt.type({
   actualLogEntryRate: rt.number,
   anomalyScore: rt.number,
   duration: rt.number,
@@ -39,22 +39,26 @@ export const logEntryRateAnomaly = rt.type({
 
 export const logEntryRatePartitionRT = rt.type({
   analysisBucketCount: rt.number,
-  anomalies: rt.array(logEntryRateAnomaly),
+  anomalies: rt.array(logEntryRateAnomalyRT),
   averageActualLogEntryRate: rt.number,
   maximumAnomalyScore: rt.number,
   numberOfLogEntries: rt.number,
   partitionId: rt.string,
 });
 
-export const logEntryRateHistogramBucket = rt.type({
+export type LogEntryRatePartition = rt.TypeOf<typeof logEntryRatePartitionRT>;
+
+export const logEntryRateHistogramBucketRT = rt.type({
   partitions: rt.array(logEntryRatePartitionRT),
   startTime: rt.number,
 });
 
+export type LogEntryRateHistogramBucket = rt.TypeOf<typeof logEntryRateHistogramBucketRT>;
+
 export const getLogEntryRateSuccessReponsePayloadRT = rt.type({
   data: rt.type({
     bucketDuration: rt.number,
-    histogramBuckets: rt.array(logEntryRateHistogramBucket),
+    histogramBuckets: rt.array(logEntryRateHistogramBucketRT),
     totalNumberOfLogEntries: rt.number,
   }),
 });
diff --git a/x-pack/legacy/plugins/infra/common/http_api/log_analysis/validation/index.ts b/x-pack/legacy/plugins/infra/common/http_api/log_analysis/validation/index.ts
index 727faca69298e..f23ef7ee7c302 100644
--- a/x-pack/legacy/plugins/infra/common/http_api/log_analysis/validation/index.ts
+++ b/x-pack/legacy/plugins/infra/common/http_api/log_analysis/validation/index.ts
@@ -4,4 +4,4 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export * from './indices';
+export * from './log_entry_rate_indices';
diff --git a/x-pack/legacy/plugins/infra/common/http_api/log_analysis/validation/indices.ts b/x-pack/legacy/plugins/infra/common/http_api/log_analysis/validation/log_entry_rate_indices.ts
similarity index 74%
rename from x-pack/legacy/plugins/infra/common/http_api/log_analysis/validation/indices.ts
rename to x-pack/legacy/plugins/infra/common/http_api/log_analysis/validation/log_entry_rate_indices.ts
index 62d81dc136853..5b2509074f6ed 100644
--- a/x-pack/legacy/plugins/infra/common/http_api/log_analysis/validation/indices.ts
+++ b/x-pack/legacy/plugins/infra/common/http_api/log_analysis/validation/log_entry_rate_indices.ts
@@ -6,14 +6,24 @@
 
 import * as rt from 'io-ts';
 
-export const LOG_ANALYSIS_VALIDATION_INDICES_PATH = '/api/infra/log_analysis/validation/indices';
+export const LOG_ANALYSIS_VALIDATE_INDICES_PATH =
+  '/api/infra/log_analysis/validation/log_entry_rate_indices';
 
 /**
  * Request types
  */
+export const validationIndicesFieldSpecificationRT = rt.type({
+  name: rt.string,
+  validTypes: rt.array(rt.string),
+});
+
+export type ValidationIndicesFieldSpecification = rt.TypeOf<
+  typeof validationIndicesFieldSpecificationRT
+>;
+
 export const validationIndicesRequestPayloadRT = rt.type({
   data: rt.type({
-    timestampField: rt.string,
+    fields: rt.array(validationIndicesFieldSpecificationRT),
     indices: rt.array(rt.string),
   }),
 });
diff --git a/x-pack/legacy/plugins/infra/common/log_analysis/job_parameters.ts b/x-pack/legacy/plugins/infra/common/log_analysis/job_parameters.ts
index 5cfe38394a2ce..626e90b65a7d8 100644
--- a/x-pack/legacy/plugins/infra/common/log_analysis/job_parameters.ts
+++ b/x-pack/legacy/plugins/infra/common/log_analysis/job_parameters.ts
@@ -4,19 +4,25 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { JobType } from './log_analysis';
+import * as rt from 'io-ts';
 
 export const bucketSpan = 900000;
 
+export const partitionField = 'event.dataset';
+
 export const getJobIdPrefix = (spaceId: string, sourceId: string) =>
   `kibana-logs-ui-${spaceId}-${sourceId}-`;
 
-export const getJobId = (spaceId: string, sourceId: string, jobType: JobType) =>
+export const getJobId = (spaceId: string, sourceId: string, jobType: string) =>
   `${getJobIdPrefix(spaceId, sourceId)}${jobType}`;
 
-export const getDatafeedId = (spaceId: string, sourceId: string, jobType: JobType) =>
+export const getDatafeedId = (spaceId: string, sourceId: string, jobType: string) =>
   `datafeed-${getJobId(spaceId, sourceId, jobType)}`;
 
-export const getAllModuleJobIds = (spaceId: string, sourceId: string) => [
-  getJobId(spaceId, sourceId, 'log-entry-rate'),
-];
+export const jobSourceConfigurationRT = rt.type({
+  indexPattern: rt.string,
+  timestampField: rt.string,
+  bucketSpan: rt.number,
+});
+
+export type JobSourceConfiguration = rt.TypeOf<typeof jobSourceConfigurationRT>;
diff --git a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/sections/analyze_in_ml_button.tsx b/x-pack/legacy/plugins/infra/public/components/logging/log_analysis_results/analyze_in_ml_button.tsx
similarity index 96%
rename from x-pack/legacy/plugins/infra/public/pages/logs/analysis/sections/analyze_in_ml_button.tsx
rename to x-pack/legacy/plugins/infra/public/components/logging/log_analysis_results/analyze_in_ml_button.tsx
index ef81f229034bd..c5d83e1c205cc 100644
--- a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/sections/analyze_in_ml_button.tsx
+++ b/x-pack/legacy/plugins/infra/public/components/logging/log_analysis_results/analyze_in_ml_button.tsx
@@ -4,14 +4,15 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React from 'react';
-import url from 'url';
 import { EuiButton } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
+import React from 'react';
+import { encode } from 'rison-node';
 import chrome from 'ui/chrome';
 import { QueryString } from 'ui/utils/query_string';
-import { encode } from 'rison-node';
-import { TimeRange } from '../../../../../common/http_api/shared/time_range';
+import url from 'url';
+
+import { TimeRange } from '../../../../common/http_api/shared/time_range';
 
 export const AnalyzeInMlButton: React.FunctionComponent<{
   jobId: string;
diff --git a/x-pack/legacy/plugins/infra/public/components/logging/log_analysis_results/index.ts b/x-pack/legacy/plugins/infra/public/components/logging/log_analysis_results/index.ts
new file mode 100644
index 0000000000000..8a4ceb70252a3
--- /dev/null
+++ b/x-pack/legacy/plugins/infra/public/components/logging/log_analysis_results/index.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export * from './analyze_in_ml_button';
diff --git a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/api/ml_api_types.ts b/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/api/ml_api_types.ts
index deb3d528e42c2..9d4d419ceebe3 100644
--- a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/api/ml_api_types.ts
+++ b/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/api/ml_api_types.ts
@@ -6,11 +6,30 @@
 
 import * as rt from 'io-ts';
 
+import { jobSourceConfigurationRT } from '../../../../../common/log_analysis';
+
 export const jobCustomSettingsRT = rt.partial({
   job_revision: rt.number,
-  logs_source_config: rt.partial({
-    indexPattern: rt.string,
-    timestampField: rt.string,
-    bucketSpan: rt.number,
+  logs_source_config: rt.partial(jobSourceConfigurationRT.props),
+});
+
+export const getMlCapabilitiesResponsePayloadRT = rt.type({
+  capabilities: rt.type({
+    canGetJobs: rt.boolean,
+    canCreateJob: rt.boolean,
+    canDeleteJob: rt.boolean,
+    canOpenJob: rt.boolean,
+    canCloseJob: rt.boolean,
+    canForecastJob: rt.boolean,
+    canGetDatafeeds: rt.boolean,
+    canStartStopDatafeed: rt.boolean,
+    canUpdateJob: rt.boolean,
+    canUpdateDatafeed: rt.boolean,
+    canPreviewDatafeed: rt.boolean,
   }),
+  isPlatinumOrTrialLicense: rt.boolean,
+  mlFeatureEnabledInSpace: rt.boolean,
+  upgradeInProgress: rt.boolean,
 });
+
+export type GetMlCapabilitiesResponsePayload = rt.TypeOf<typeof getMlCapabilitiesResponsePayloadRT>;
diff --git a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/api/ml_cleanup.ts b/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/api/ml_cleanup.ts
index 209da920c4c8b..5054f607fa5dc 100644
--- a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/api/ml_cleanup.ts
+++ b/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/api/ml_cleanup.ts
@@ -9,17 +9,22 @@ import { pipe } from 'fp-ts/lib/pipeable';
 import { fold } from 'fp-ts/lib/Either';
 import { identity } from 'fp-ts/lib/function';
 import { kfetch } from 'ui/kfetch';
-import { getAllModuleJobIds, getDatafeedId } from '../../../../../common/log_analysis';
+
+import { getDatafeedId, getJobId } from '../../../../../common/log_analysis';
 import { throwErrors, createPlainError } from '../../../../../common/runtime_types';
 
-export const callDeleteJobs = async (spaceId: string, sourceId: string) => {
+export const callDeleteJobs = async <JobType extends string>(
+  spaceId: string,
+  sourceId: string,
+  jobTypes: JobType[]
+) => {
   // NOTE: Deleting the jobs via this API will delete the datafeeds at the same time
   const deleteJobsResponse = await kfetch({
     method: 'POST',
     pathname: '/api/ml/jobs/delete_jobs',
     body: JSON.stringify(
       deleteJobsRequestPayloadRT.encode({
-        jobIds: getAllModuleJobIds(spaceId, sourceId),
+        jobIds: jobTypes.map(jobType => getJobId(spaceId, sourceId, jobType)),
       })
     ),
   });
@@ -42,15 +47,24 @@ export const callGetJobDeletionTasks = async () => {
   );
 };
 
-export const callStopDatafeed = async (spaceId: string, sourceId: string) => {
+export const callStopDatafeeds = async <JobType extends string>(
+  spaceId: string,
+  sourceId: string,
+  jobTypes: JobType[]
+) => {
   // Stop datafeed due to https://github.com/elastic/kibana/issues/44652
   const stopDatafeedResponse = await kfetch({
     method: 'POST',
-    pathname: `/api/ml/datafeeds/${getDatafeedId(spaceId, sourceId, 'log-entry-rate')}/_stop`,
+    pathname: '/api/ml/jobs/stop_datafeeds',
+    body: JSON.stringify(
+      stopDatafeedsRequestPayloadRT.encode({
+        datafeedIds: jobTypes.map(jobType => getDatafeedId(spaceId, sourceId, jobType)),
+      })
+    ),
   });
 
   return pipe(
-    stopDatafeedResponsePayloadRT.decode(stopDatafeedResponse),
+    stopDatafeedsResponsePayloadRT.decode(stopDatafeedResponse),
     fold(throwErrors(createPlainError), identity)
   );
 };
@@ -68,10 +82,19 @@ export const deleteJobsResponsePayloadRT = rt.record(
   })
 );
 
+export type DeleteJobsResponsePayload = rt.TypeOf<typeof deleteJobsResponsePayloadRT>;
+
 export const getJobDeletionTasksResponsePayloadRT = rt.type({
   jobIds: rt.array(rt.string),
 });
 
-export const stopDatafeedResponsePayloadRT = rt.type({
-  stopped: rt.boolean,
+export const stopDatafeedsRequestPayloadRT = rt.type({
+  datafeedIds: rt.array(rt.string),
 });
+
+export const stopDatafeedsResponsePayloadRT = rt.record(
+  rt.string,
+  rt.type({
+    stopped: rt.boolean,
+  })
+);
diff --git a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/api/ml_get_jobs_summary_api.ts b/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/api/ml_get_jobs_summary_api.ts
index 6171d10b5f1aa..91e517b0db008 100644
--- a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/api/ml_get_jobs_summary_api.ts
+++ b/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/api/ml_get_jobs_summary_api.ts
@@ -12,15 +12,19 @@ import { kfetch } from 'ui/kfetch';
 
 import { jobCustomSettingsRT } from './ml_api_types';
 import { throwErrors, createPlainError } from '../../../../../common/runtime_types';
-import { getAllModuleJobIds } from '../../../../../common/log_analysis';
+import { getJobId } from '../../../../../common/log_analysis';
 
-export const callJobsSummaryAPI = async (spaceId: string, sourceId: string) => {
+export const callJobsSummaryAPI = async <JobType extends string>(
+  spaceId: string,
+  sourceId: string,
+  jobTypes: JobType[]
+) => {
   const response = await kfetch({
     method: 'POST',
     pathname: '/api/ml/jobs/jobs_summary',
     body: JSON.stringify(
       fetchJobStatusRequestPayloadRT.encode({
-        jobIds: getAllModuleJobIds(spaceId, sourceId),
+        jobIds: jobTypes.map(jobType => getJobId(spaceId, sourceId, jobType)),
       })
     ),
   });
diff --git a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/api/ml_setup_module_api.ts b/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/api/ml_setup_module_api.ts
index 1c937513c7950..80a4f975cdd57 100644
--- a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/api/ml_setup_module_api.ts
+++ b/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/api/ml_setup_module_api.ts
@@ -12,7 +12,6 @@ import { kfetch } from 'ui/kfetch';
 
 import { throwErrors, createPlainError } from '../../../../../common/runtime_types';
 import { getJobIdPrefix } from '../../../../../common/log_analysis';
-import { jobCustomSettingsRT } from './ml_api_types';
 
 export const callSetupMlModuleAPI = async (
   moduleId: string,
@@ -21,8 +20,8 @@ export const callSetupMlModuleAPI = async (
   spaceId: string,
   sourceId: string,
   indexPattern: string,
-  timeField: string,
-  bucketSpan: number
+  jobOverrides: SetupMlModuleJobOverrides[] = [],
+  datafeedOverrides: SetupMlModuleDatafeedOverrides[] = []
 ) => {
   const response = await kfetch({
     method: 'POST',
@@ -34,25 +33,8 @@ export const callSetupMlModuleAPI = async (
         indexPatternName: indexPattern,
         prefix: getJobIdPrefix(spaceId, sourceId),
         startDatafeed: true,
-        jobOverrides: [
-          {
-            job_id: 'log-entry-rate' as const,
-            analysis_config: {
-              bucket_span: `${bucketSpan}ms`,
-            },
-            data_description: {
-              time_field: timeField,
-            },
-            custom_settings: {
-              logs_source_config: {
-                indexPattern,
-                timestampField: timeField,
-                bucketSpan,
-              },
-            },
-          },
-        ],
-        datafeedOverrides: [],
+        jobOverrides,
+        datafeedOverrides,
       })
     ),
   });
@@ -68,23 +50,20 @@ const setupMlModuleTimeParamsRT = rt.partial({
   end: rt.number,
 });
 
-const setupMlModuleLogEntryRateJobOverridesRT = rt.type({
-  job_id: rt.literal('log-entry-rate'),
-  analysis_config: rt.type({
-    bucket_span: rt.string,
-  }),
-  data_description: rt.type({
-    time_field: rt.string,
-  }),
-  custom_settings: jobCustomSettingsRT,
-});
+const setupMlModuleJobOverridesRT = rt.object;
+
+export type SetupMlModuleJobOverrides = rt.TypeOf<typeof setupMlModuleJobOverridesRT>;
+
+const setupMlModuleDatafeedOverridesRT = rt.object;
+
+export type SetupMlModuleDatafeedOverrides = rt.TypeOf<typeof setupMlModuleDatafeedOverridesRT>;
 
 const setupMlModuleRequestParamsRT = rt.type({
   indexPatternName: rt.string,
   prefix: rt.string,
   startDatafeed: rt.boolean,
-  jobOverrides: rt.array(setupMlModuleLogEntryRateJobOverridesRT),
-  datafeedOverrides: rt.array(rt.object),
+  jobOverrides: rt.array(setupMlModuleJobOverridesRT),
+  datafeedOverrides: rt.array(setupMlModuleDatafeedOverridesRT),
 });
 
 const setupMlModuleRequestPayloadRT = rt.intersection([
diff --git a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/api/index_patterns_validate.ts b/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/api/validate_indices.ts
similarity index 70%
rename from x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/api/index_patterns_validate.ts
rename to x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/api/validate_indices.ts
index 440ee10e4223d..0d2e9b673488e 100644
--- a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/api/index_patterns_validate.ts
+++ b/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/api/validate_indices.ts
@@ -10,20 +10,22 @@ import { identity } from 'fp-ts/lib/function';
 import { kfetch } from 'ui/kfetch';
 
 import {
-  LOG_ANALYSIS_VALIDATION_INDICES_PATH,
+  LOG_ANALYSIS_VALIDATE_INDICES_PATH,
+  ValidationIndicesFieldSpecification,
   validationIndicesRequestPayloadRT,
   validationIndicesResponsePayloadRT,
 } from '../../../../../common/http_api';
 
 import { throwErrors, createPlainError } from '../../../../../common/runtime_types';
 
-export const callIndexPatternsValidate = async (timestampField: string, indices: string[]) => {
+export const callValidateIndicesAPI = async (
+  indices: string[],
+  fields: ValidationIndicesFieldSpecification[]
+) => {
   const response = await kfetch({
     method: 'POST',
-    pathname: LOG_ANALYSIS_VALIDATION_INDICES_PATH,
-    body: JSON.stringify(
-      validationIndicesRequestPayloadRT.encode({ data: { timestampField, indices } })
-    ),
+    pathname: LOG_ANALYSIS_VALIDATE_INDICES_PATH,
+    body: JSON.stringify(validationIndicesRequestPayloadRT.encode({ data: { indices, fields } })),
   });
 
   return pipe(
diff --git a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/index.ts b/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/index.ts
index cbe3b2ef1e9b8..eb044c86e50fe 100644
--- a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/index.ts
+++ b/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/index.ts
@@ -6,7 +6,6 @@
 
 export * from './log_analysis_capabilities';
 export * from './log_analysis_cleanup';
-export * from './log_analysis_jobs';
-export * from './log_analysis_results';
-export * from './log_analysis_results_url_state';
-export * from './log_analysis_status_state';
+export * from './log_analysis_module';
+export * from './log_analysis_module_status';
+export * from './log_analysis_module_types';
diff --git a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_capabilities.tsx b/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_capabilities.tsx
index 7ac7d051e6783..35a3ac737ada3 100644
--- a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_capabilities.tsx
+++ b/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_capabilities.tsx
@@ -15,7 +15,7 @@ import { useTrackedPromise } from '../../../utils/use_tracked_promise';
 import {
   getMlCapabilitiesResponsePayloadRT,
   GetMlCapabilitiesResponsePayload,
-} from './ml_api_types';
+} from './api/ml_api_types';
 import { throwErrors, createPlainError } from '../../../../common/runtime_types';
 
 export const useLogAnalysisCapabilities = () => {
diff --git a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_cleanup.tsx b/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_cleanup.tsx
index 1b79d3c1ef786..a37d18cc33cfd 100644
--- a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_cleanup.tsx
+++ b/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_cleanup.tsx
@@ -4,64 +4,46 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import createContainer from 'constate';
-import { useMemo } from 'react';
-import { useTrackedPromise } from '../../../utils/use_tracked_promise';
-import { callDeleteJobs, callStopDatafeed, callGetJobDeletionTasks } from './api/ml_cleanup';
-import { getAllModuleJobIds } from '../../../../common/log_analysis';
-
-export const useLogAnalysisCleanup = ({
-  sourceId,
-  spaceId,
-}: {
-  sourceId: string;
-  spaceId: string;
-}) => {
-  const [cleanupMLResourcesRequest, cleanupMLResources] = useTrackedPromise(
-    {
-      cancelPreviousOn: 'resolution',
-      createPromise: async () => {
-        try {
-          await callStopDatafeed(spaceId, sourceId);
-        } catch (err) {
-          // Datefeed has been deleted / doesn't exist, proceed with deleting jobs anyway
-          if (err && err.res && err.res.status === 404) {
-            return await deleteJobs(spaceId, sourceId);
-          } else {
-            throw err;
-          }
-        }
-
-        return await deleteJobs(spaceId, sourceId);
-      },
-    },
-    [spaceId, sourceId]
-  );
-
-  const isCleaningUp = useMemo(() => cleanupMLResourcesRequest.state === 'pending', [
-    cleanupMLResourcesRequest.state,
-  ]);
+import { getJobId } from '../../../../common/log_analysis';
+import { callDeleteJobs, callGetJobDeletionTasks, callStopDatafeeds } from './api/ml_cleanup';
+
+export const cleanUpJobsAndDatafeeds = async <JobType extends string>(
+  spaceId: string,
+  sourceId: string,
+  jobTypes: JobType[]
+) => {
+  try {
+    await callStopDatafeeds(spaceId, sourceId, jobTypes);
+  } catch (err) {
+    // Proceed only if datafeed has been deleted or didn't exist in the first place
+    if (err?.res?.status !== 404) {
+      throw err;
+    }
+  }
 
-  return {
-    cleanupMLResources,
-    isCleaningUp,
-  };
+  return await deleteJobs(spaceId, sourceId, jobTypes);
 };
 
-export const LogAnalysisCleanup = createContainer(useLogAnalysisCleanup);
-
-const deleteJobs = async (spaceId: string, sourceId: string) => {
-  const deleteJobsResponse = await callDeleteJobs(spaceId, sourceId);
-  await waitUntilJobsAreDeleted(spaceId, sourceId);
+const deleteJobs = async <JobType extends string>(
+  spaceId: string,
+  sourceId: string,
+  jobTypes: JobType[]
+) => {
+  const deleteJobsResponse = await callDeleteJobs(spaceId, sourceId, jobTypes);
+  await waitUntilJobsAreDeleted(spaceId, sourceId, jobTypes);
   return deleteJobsResponse;
 };
 
-const waitUntilJobsAreDeleted = async (spaceId: string, sourceId: string) => {
+const waitUntilJobsAreDeleted = async <JobType extends string>(
+  spaceId: string,
+  sourceId: string,
+  jobTypes: JobType[]
+) => {
+  const moduleJobIds = jobTypes.map(jobType => getJobId(spaceId, sourceId, jobType));
   while (true) {
-    const response = await callGetJobDeletionTasks();
-    const jobIdsBeingDeleted = response.jobIds;
-    const moduleJobIds = getAllModuleJobIds(spaceId, sourceId);
+    const { jobIds: jobIdsBeingDeleted } = await callGetJobDeletionTasks();
     const needToWait = jobIdsBeingDeleted.some(jobId => moduleJobIds.includes(jobId));
+
     if (needToWait) {
       await timeout(1000);
     } else {
diff --git a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_jobs.tsx b/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_jobs.tsx
deleted file mode 100644
index 0f386f416b866..0000000000000
--- a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_jobs.tsx
+++ /dev/null
@@ -1,169 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import createContainer from 'constate';
-import { useMemo, useCallback, useEffect } from 'react';
-
-import { callGetMlModuleAPI } from './api/ml_get_module';
-import { bucketSpan, getJobId } from '../../../../common/log_analysis';
-import { useTrackedPromise } from '../../../utils/use_tracked_promise';
-import { callJobsSummaryAPI } from './api/ml_get_jobs_summary_api';
-import { callSetupMlModuleAPI, SetupMlModuleResponsePayload } from './api/ml_setup_module_api';
-import { useLogAnalysisCleanup } from './log_analysis_cleanup';
-import { useStatusState } from './log_analysis_status_state';
-
-const MODULE_ID = 'logs_ui_analysis';
-
-export const useLogAnalysisJobs = ({
-  indexPattern,
-  sourceId,
-  spaceId,
-  timeField,
-}: {
-  indexPattern: string;
-  sourceId: string;
-  spaceId: string;
-  timeField: string;
-}) => {
-  const { cleanupMLResources } = useLogAnalysisCleanup({ sourceId, spaceId });
-  const [statusState, dispatch] = useStatusState({
-    bucketSpan,
-    indexPattern,
-    timestampField: timeField,
-  });
-
-  const [fetchModuleDefinitionRequest, fetchModuleDefinition] = useTrackedPromise(
-    {
-      cancelPreviousOn: 'resolution',
-      createPromise: async () => {
-        dispatch({ type: 'fetchingModuleDefinition' });
-        return await callGetMlModuleAPI(MODULE_ID);
-      },
-      onResolve: response => {
-        dispatch({
-          type: 'fetchedModuleDefinition',
-          spaceId,
-          sourceId,
-          moduleDefinition: response,
-        });
-      },
-      onReject: () => {
-        dispatch({ type: 'failedFetchingModuleDefinition' });
-      },
-    },
-    []
-  );
-
-  const [setupMlModuleRequest, setupMlModule] = useTrackedPromise(
-    {
-      cancelPreviousOn: 'resolution',
-      createPromise: async (
-        indices: string[],
-        start: number | undefined,
-        end: number | undefined
-      ) => {
-        dispatch({ type: 'startedSetup' });
-        return await callSetupMlModuleAPI(
-          MODULE_ID,
-          start,
-          end,
-          spaceId,
-          sourceId,
-          indices.join(','),
-          timeField,
-          bucketSpan
-        );
-      },
-      onResolve: ({ datafeeds, jobs }: SetupMlModuleResponsePayload) => {
-        dispatch({ type: 'finishedSetup', datafeeds, jobs, spaceId, sourceId });
-      },
-      onReject: () => {
-        dispatch({ type: 'failedSetup' });
-      },
-    },
-    [spaceId, sourceId, timeField, bucketSpan]
-  );
-
-  const [fetchJobStatusRequest, fetchJobStatus] = useTrackedPromise(
-    {
-      cancelPreviousOn: 'resolution',
-      createPromise: async () => {
-        dispatch({ type: 'fetchingJobStatuses' });
-        return await callJobsSummaryAPI(spaceId, sourceId);
-      },
-      onResolve: jobResponse => {
-        dispatch({ type: 'fetchedJobStatuses', payload: jobResponse, spaceId, sourceId });
-      },
-      onReject: err => {
-        dispatch({ type: 'failedFetchingJobStatuses' });
-      },
-    },
-    [spaceId, sourceId]
-  );
-
-  const isLoadingSetupStatus = useMemo(
-    () =>
-      fetchJobStatusRequest.state === 'pending' || fetchModuleDefinitionRequest.state === 'pending',
-    [fetchJobStatusRequest.state, fetchModuleDefinitionRequest.state]
-  );
-
-  const availableIndices = useMemo(() => indexPattern.split(','), [indexPattern]);
-
-  const viewResults = useCallback(() => {
-    dispatch({ type: 'viewedResults' });
-  }, []);
-
-  const cleanupAndSetup = useCallback(
-    (indices: string[], start: number | undefined, end: number | undefined) => {
-      dispatch({ type: 'startedSetup' });
-      cleanupMLResources()
-        .then(() => {
-          setupMlModule(indices, start, end);
-        })
-        .catch(() => {
-          dispatch({ type: 'failedSetup' });
-        });
-    },
-    [cleanupMLResources, setupMlModule]
-  );
-
-  const viewSetupForReconfiguration = useCallback(() => {
-    dispatch({ type: 'requestedJobConfigurationUpdate' });
-  }, []);
-
-  const viewSetupForUpdate = useCallback(() => {
-    dispatch({ type: 'requestedJobDefinitionUpdate' });
-  }, []);
-
-  useEffect(() => {
-    fetchModuleDefinition();
-  }, [fetchModuleDefinition]);
-
-  const jobIds = useMemo(() => {
-    return {
-      'log-entry-rate': getJobId(spaceId, sourceId, 'log-entry-rate'),
-    };
-  }, [sourceId, spaceId]);
-
-  return {
-    availableIndices,
-    fetchJobStatus,
-    isLoadingSetupStatus,
-    jobStatus: statusState.jobStatus,
-    lastSetupErrorMessages: statusState.lastSetupErrorMessages,
-    cleanupAndSetup,
-    setup: setupMlModule,
-    setupMlModuleRequest,
-    setupStatus: statusState.setupStatus,
-    timestampField: timeField,
-    viewSetupForReconfiguration,
-    viewSetupForUpdate,
-    viewResults,
-    jobIds,
-  };
-};
-
-export const LogAnalysisJobs = createContainer(useLogAnalysisJobs);
diff --git a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_module.tsx b/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_module.tsx
new file mode 100644
index 0000000000000..189b58d7923f8
--- /dev/null
+++ b/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_module.tsx
@@ -0,0 +1,167 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { useCallback, useMemo } from 'react';
+
+import { useTrackedPromise } from '../../../utils/use_tracked_promise';
+import { useModuleStatus } from './log_analysis_module_status';
+import { ModuleDescriptor, ModuleSourceConfiguration } from './log_analysis_module_types';
+
+export const useLogAnalysisModule = <JobType extends string>({
+  sourceConfiguration,
+  moduleDescriptor,
+}: {
+  sourceConfiguration: ModuleSourceConfiguration;
+  moduleDescriptor: ModuleDescriptor<JobType>;
+}) => {
+  const { spaceId, sourceId, timestampField, indices } = sourceConfiguration;
+  const [moduleStatus, dispatchModuleStatus] = useModuleStatus(moduleDescriptor.jobTypes, {
+    bucketSpan: moduleDescriptor.bucketSpan,
+    indexPattern: indices.join(','),
+    timestampField,
+  });
+
+  const [fetchModuleDefinitionRequest, fetchModuleDefinition] = useTrackedPromise(
+    {
+      cancelPreviousOn: 'resolution',
+      createPromise: async () => {
+        dispatchModuleStatus({ type: 'fetchingModuleDefinition' });
+        return await moduleDescriptor.getModuleDefinition();
+      },
+      onResolve: response => {
+        dispatchModuleStatus({
+          type: 'fetchedModuleDefinition',
+          spaceId,
+          sourceId,
+          moduleDefinition: response,
+        });
+      },
+      onReject: () => {
+        dispatchModuleStatus({ type: 'failedFetchingModuleDefinition' });
+      },
+    },
+    [moduleDescriptor.getModuleDefinition, spaceId, sourceId]
+  );
+
+  const [fetchJobStatusRequest, fetchJobStatus] = useTrackedPromise(
+    {
+      cancelPreviousOn: 'resolution',
+      createPromise: async () => {
+        dispatchModuleStatus({ type: 'fetchingJobStatuses' });
+        return await moduleDescriptor.getJobSummary(spaceId, sourceId);
+      },
+      onResolve: jobResponse => {
+        dispatchModuleStatus({
+          type: 'fetchedJobStatuses',
+          payload: jobResponse,
+          spaceId,
+          sourceId,
+        });
+      },
+      onReject: () => {
+        dispatchModuleStatus({ type: 'failedFetchingJobStatuses' });
+      },
+    },
+    [spaceId, sourceId]
+  );
+
+  const isLoadingModuleStatus = useMemo(
+    () =>
+      fetchJobStatusRequest.state === 'pending' || fetchModuleDefinitionRequest.state === 'pending',
+    [fetchJobStatusRequest.state, fetchModuleDefinitionRequest.state]
+  );
+
+  const [, setUpModule] = useTrackedPromise(
+    {
+      cancelPreviousOn: 'resolution',
+      createPromise: async (
+        selectedIndices: string[],
+        start: number | undefined,
+        end: number | undefined
+      ) => {
+        dispatchModuleStatus({ type: 'startedSetup' });
+        return await moduleDescriptor.setUpModule(start, end, {
+          indices: selectedIndices,
+          sourceId,
+          spaceId,
+          timestampField,
+        });
+      },
+      onResolve: ({ datafeeds, jobs }) => {
+        dispatchModuleStatus({ type: 'finishedSetup', datafeeds, jobs, spaceId, sourceId });
+      },
+      onReject: () => {
+        dispatchModuleStatus({ type: 'failedSetup' });
+      },
+    },
+    [moduleDescriptor.setUpModule, spaceId, sourceId, timestampField]
+  );
+
+  const [cleanUpModuleRequest, cleanUpModule] = useTrackedPromise(
+    {
+      cancelPreviousOn: 'resolution',
+      createPromise: async () => {
+        return await moduleDescriptor.cleanUpModule(spaceId, sourceId);
+      },
+    },
+    [spaceId, sourceId]
+  );
+
+  const isCleaningUp = useMemo(() => cleanUpModuleRequest.state === 'pending', [
+    cleanUpModuleRequest.state,
+  ]);
+
+  const cleanUpAndSetUpModule = useCallback(
+    (selectedIndices: string[], start: number | undefined, end: number | undefined) => {
+      dispatchModuleStatus({ type: 'startedSetup' });
+      cleanUpModule()
+        .then(() => {
+          setUpModule(selectedIndices, start, end);
+        })
+        .catch(() => {
+          dispatchModuleStatus({ type: 'failedSetup' });
+        });
+    },
+    [cleanUpModule, setUpModule]
+  );
+
+  const viewSetupForReconfiguration = useCallback(() => {
+    dispatchModuleStatus({ type: 'requestedJobConfigurationUpdate' });
+  }, []);
+
+  const viewSetupForUpdate = useCallback(() => {
+    dispatchModuleStatus({ type: 'requestedJobDefinitionUpdate' });
+  }, []);
+
+  const viewResults = useCallback(() => {
+    dispatchModuleStatus({ type: 'viewedResults' });
+  }, []);
+
+  const jobIds = useMemo(() => moduleDescriptor.getJobIds(spaceId, sourceId), [
+    moduleDescriptor.getJobIds,
+    spaceId,
+    sourceId,
+  ]);
+
+  return {
+    cleanUpAndSetUpModule,
+    cleanUpModule,
+    fetchJobStatus,
+    fetchModuleDefinition,
+    isCleaningUp,
+    isLoadingModuleStatus,
+    jobIds,
+    jobStatus: moduleStatus.jobStatus,
+    lastSetupErrorMessages: moduleStatus.lastSetupErrorMessages,
+    moduleDescriptor,
+    setUpModule,
+    setupStatus: moduleStatus.setupStatus,
+    sourceConfiguration,
+    viewResults,
+    viewSetupForReconfiguration,
+    viewSetupForUpdate,
+  };
+};
diff --git a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_status_state.tsx b/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_module_status.tsx
similarity index 70%
rename from x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_status_state.tsx
rename to x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_module_status.tsx
index 1f4c924ea3da5..6d634538cd7fe 100644
--- a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_status_state.tsx
+++ b/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_module_status.tsx
@@ -7,20 +7,19 @@
 import { useReducer } from 'react';
 
 import {
+  JobSourceConfiguration,
+  JobStatus,
+  SetupStatus,
   getDatafeedId,
   getJobId,
   isJobStatusWithResults,
-  JobStatus,
-  JobType,
-  jobTypeRT,
-  SetupStatus,
 } from '../../../../common/log_analysis';
 import { FetchJobStatusResponsePayload, JobSummary } from './api/ml_get_jobs_summary_api';
 import { GetMlModuleResponsePayload, JobDefinition } from './api/ml_get_module';
 import { SetupMlModuleResponsePayload } from './api/ml_setup_module_api';
 import { MandatoryProperty } from '../../../../common/utility_types';
 
-interface StatusReducerState {
+interface StatusReducerState<JobType extends string> {
   jobDefinitions: JobDefinition[];
   jobStatus: Record<JobType, JobStatus>;
   jobSummaries: JobSummary[];
@@ -65,42 +64,60 @@ type StatusReducerAction =
   | { type: 'requestedJobDefinitionUpdate' }
   | { type: 'viewedResults' };
 
-const createInitialState = (sourceConfiguration: JobSourceConfiguration): StatusReducerState => ({
+const createInitialState = <JobType extends string>({
+  jobTypes,
+  sourceConfiguration,
+}: {
+  jobTypes: JobType[];
+  sourceConfiguration: JobSourceConfiguration;
+}): StatusReducerState<JobType> => ({
   jobDefinitions: [],
-  jobStatus: {
-    'log-entry-rate': 'unknown',
-  },
+  jobStatus: jobTypes.reduce(
+    (accumulatedJobStatus, jobType) => ({
+      ...accumulatedJobStatus,
+      [jobType]: 'unknown',
+    }),
+    {} as Record<JobType, JobStatus>
+  ),
   jobSummaries: [],
   lastSetupErrorMessages: [],
   setupStatus: 'initializing',
   sourceConfiguration,
 });
 
-function statusReducer(state: StatusReducerState, action: StatusReducerAction): StatusReducerState {
+const createStatusReducer = <JobType extends string>(jobTypes: JobType[]) => (
+  state: StatusReducerState<JobType>,
+  action: StatusReducerAction
+): StatusReducerState<JobType> => {
   switch (action.type) {
     case 'startedSetup': {
       return {
         ...state,
-        jobStatus: {
-          'log-entry-rate': 'initializing',
-        },
+        jobStatus: jobTypes.reduce(
+          (accumulatedJobStatus, jobType) => ({
+            ...accumulatedJobStatus,
+            [jobType]: 'initializing',
+          }),
+          {} as Record<JobType, JobStatus>
+        ),
         setupStatus: 'pending',
       };
     }
     case 'finishedSetup': {
       const { jobs, datafeeds, spaceId, sourceId } = action;
-      const nextJobStatus = {
-        ...state.jobStatus,
-        'log-entry-rate':
-          hasSuccessfullyCreatedJob(getJobId(spaceId, sourceId, 'log-entry-rate'))(jobs) &&
-          hasSuccessfullyStartedDatafeed(getDatafeedId(spaceId, sourceId, 'log-entry-rate'))(
-            datafeeds
-          )
-            ? ('started' as JobStatus)
-            : ('failed' as JobStatus),
-      };
-      const nextSetupStatus = Object.values(nextJobStatus).every(jobState =>
-        ['started'].includes(jobState)
+      const nextJobStatus = jobTypes.reduce(
+        (accumulatedJobStatus, jobType) => ({
+          ...accumulatedJobStatus,
+          [jobType]:
+            hasSuccessfullyCreatedJob(getJobId(spaceId, sourceId, jobType))(jobs) &&
+            hasSuccessfullyStartedDatafeed(getDatafeedId(spaceId, sourceId, jobType))(datafeeds)
+              ? 'started'
+              : 'failed',
+        }),
+        {} as Record<JobType, JobStatus>
+      );
+      const nextSetupStatus = Object.values<JobStatus>(nextJobStatus).every(
+        jobState => jobState === 'started'
       )
         ? 'succeeded'
         : 'failed';
@@ -122,10 +139,13 @@ function statusReducer(state: StatusReducerState, action: StatusReducerAction):
     case 'failedSetup': {
       return {
         ...state,
-        jobStatus: {
-          ...state.jobStatus,
-          'log-entry-rate': 'failed',
-        },
+        jobStatus: jobTypes.reduce(
+          (accumulatedJobStatus, jobType) => ({
+            ...accumulatedJobStatus,
+            [jobType]: 'failed',
+          }),
+          {} as Record<JobType, JobStatus>
+        ),
         setupStatus: 'failed',
       };
     }
@@ -140,10 +160,13 @@ function statusReducer(state: StatusReducerState, action: StatusReducerAction):
       const { payload: jobSummaries, spaceId, sourceId } = action;
       const { jobDefinitions, setupStatus, sourceConfiguration } = state;
 
-      const nextJobStatus = {
-        ...state.jobStatus,
-        'log-entry-rate': getJobStatus(getJobId(spaceId, sourceId, 'log-entry-rate'))(jobSummaries),
-      };
+      const nextJobStatus = jobTypes.reduce(
+        (accumulatedJobStatus, jobType) => ({
+          ...accumulatedJobStatus,
+          [jobType]: getJobStatus(getJobId(spaceId, sourceId, jobType))(jobSummaries),
+        }),
+        {} as Record<JobType, JobStatus>
+      );
       const nextSetupStatus = getSetupStatus(
         spaceId,
         sourceId,
@@ -164,10 +187,13 @@ function statusReducer(state: StatusReducerState, action: StatusReducerAction):
       return {
         ...state,
         setupStatus: 'unknown',
-        jobStatus: {
-          ...state.jobStatus,
-          'log-entry-rate': 'unknown',
-        },
+        jobStatus: jobTypes.reduce(
+          (accumulatedJobStatus, jobType) => ({
+            ...accumulatedJobStatus,
+            [jobType]: 'unknown',
+          }),
+          {} as Record<JobType, JobStatus>
+        ),
       };
     }
     case 'fetchedModuleDefinition': {
@@ -230,7 +256,7 @@ function statusReducer(state: StatusReducerState, action: StatusReducerAction):
       return state;
     }
   }
-}
+};
 
 const hasSuccessfullyCreatedJob = (jobId: string) => (
   jobSetupResponses: SetupMlModuleResponsePayload['jobs']
@@ -281,7 +307,7 @@ const getJobStatus = (jobId: string) => (jobSummaries: FetchJobStatusResponsePay
       }
     )[0] || 'missing';
 
-const getSetupStatus = (
+const getSetupStatus = <JobType extends string>(
   spaceId: string,
   sourceId: string,
   sourceConfiguration: JobSourceConfiguration,
@@ -289,44 +315,43 @@ const getSetupStatus = (
   jobDefinitions: JobDefinition[],
   jobSummaries: JobSummary[]
 ) => (previousSetupStatus: SetupStatus) =>
-  Object.entries(everyJobStatus).reduce<SetupStatus>((setupStatus, [jobType, jobStatus]) => {
-    if (!jobTypeRT.is(jobType)) {
-      return setupStatus;
-    }
+  Object.entries<JobStatus>(everyJobStatus).reduce<SetupStatus>(
+    (setupStatus, [jobType, jobStatus]) => {
+      const jobId = getJobId(spaceId, sourceId, jobType);
+      const jobDefinition = jobDefinitions.find(({ id }) => id === jobType);
 
-    const jobId = getJobId(spaceId, sourceId, jobType);
-    const jobDefinition = jobDefinitions.find(({ id }) => id === jobType);
+      if (jobStatus === 'missing') {
+        return 'required';
+      } else if (
+        setupStatus === 'required' ||
+        setupStatus === 'requiredForUpdate' ||
+        setupStatus === 'requiredForReconfiguration'
+      ) {
+        return setupStatus;
+      } else if (
+        setupStatus === 'skippedButUpdatable' ||
+        (jobDefinition &&
+          !isJobRevisionCurrent(
+            jobId,
+            jobDefinition.config.custom_settings.job_revision || 0
+          )(jobSummaries))
+      ) {
+        return 'skippedButUpdatable';
+      } else if (
+        setupStatus === 'skippedButReconfigurable' ||
+        !isJobConfigurationConsistent(jobId, sourceConfiguration)(jobSummaries)
+      ) {
+        return 'skippedButReconfigurable';
+      } else if (setupStatus === 'hiddenAfterSuccess') {
+        return setupStatus;
+      } else if (setupStatus === 'skipped' || isJobStatusWithResults(jobStatus)) {
+        return 'skipped';
+      }
 
-    if (jobStatus === 'missing') {
-      return 'required';
-    } else if (
-      setupStatus === 'required' ||
-      setupStatus === 'requiredForUpdate' ||
-      setupStatus === 'requiredForReconfiguration'
-    ) {
       return setupStatus;
-    } else if (
-      setupStatus === 'skippedButUpdatable' ||
-      (jobDefinition &&
-        !isJobRevisionCurrent(
-          jobId,
-          jobDefinition.config.custom_settings.job_revision || 0
-        )(jobSummaries))
-    ) {
-      return 'skippedButUpdatable';
-    } else if (
-      setupStatus === 'skippedButReconfigurable' ||
-      !isJobConfigurationConsistent(jobId, sourceConfiguration)(jobSummaries)
-    ) {
-      return 'skippedButReconfigurable';
-    } else if (setupStatus === 'hiddenAfterSuccess') {
-      return setupStatus;
-    } else if (setupStatus === 'skipped' || isJobStatusWithResults(jobStatus)) {
-      return 'skipped';
-    }
-
-    return setupStatus;
-  }, previousSetupStatus);
+    },
+    previousSetupStatus
+  );
 
 const isJobRevisionCurrent = (jobId: string, currentRevision: number) => (
   jobSummaries: FetchJobStatusResponsePayload
@@ -377,12 +402,13 @@ const isIndexPatternSubset = (indexPatternSubset: string, indexPatternSuperset:
 const hasError = <Value extends any>(value: Value): value is MandatoryProperty<Value, 'error'> =>
   value.error != null;
 
-export const useStatusState = (sourceConfiguration: JobSourceConfiguration) => {
-  return useReducer(statusReducer, sourceConfiguration, createInitialState);
+export const useModuleStatus = <JobType extends string>(
+  jobTypes: JobType[],
+  sourceConfiguration: JobSourceConfiguration
+) => {
+  return useReducer(
+    createStatusReducer(jobTypes),
+    { jobTypes, sourceConfiguration },
+    createInitialState
+  );
 };
-
-interface JobSourceConfiguration {
-  bucketSpan: number;
-  indexPattern: string;
-  timestampField: string;
-}
diff --git a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_module_types.ts b/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_module_types.ts
new file mode 100644
index 0000000000000..dc9f25b492635
--- /dev/null
+++ b/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_module_types.ts
@@ -0,0 +1,36 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { DeleteJobsResponsePayload } from './api/ml_cleanup';
+import { FetchJobStatusResponsePayload } from './api/ml_get_jobs_summary_api';
+import { GetMlModuleResponsePayload } from './api/ml_get_module';
+import { SetupMlModuleResponsePayload } from './api/ml_setup_module_api';
+import { ValidationIndicesResponsePayload } from '../../../../common/http_api/log_analysis';
+
+export interface ModuleDescriptor<JobType extends string> {
+  moduleId: string;
+  jobTypes: JobType[];
+  bucketSpan: number;
+  getJobIds: (spaceId: string, sourceId: string) => Record<JobType, string>;
+  getJobSummary: (spaceId: string, sourceId: string) => Promise<FetchJobStatusResponsePayload>;
+  getModuleDefinition: () => Promise<GetMlModuleResponsePayload>;
+  setUpModule: (
+    start: number | undefined,
+    end: number | undefined,
+    sourceConfiguration: ModuleSourceConfiguration
+  ) => Promise<SetupMlModuleResponsePayload>;
+  cleanUpModule: (spaceId: string, sourceId: string) => Promise<DeleteJobsResponsePayload>;
+  validateSetupIndices: (
+    sourceConfiguration: ModuleSourceConfiguration
+  ) => Promise<ValidationIndicesResponsePayload>;
+}
+
+export interface ModuleSourceConfiguration {
+  indices: string[];
+  sourceId: string;
+  spaceId: string;
+  timestampField: string;
+}
diff --git a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_setup_state.tsx b/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_setup_state.tsx
index c965c50bedccc..275c0194be3b2 100644
--- a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_setup_state.tsx
+++ b/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_setup_state.tsx
@@ -4,15 +4,12 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { useState, useCallback, useMemo, useEffect } from 'react';
+import { useCallback, useEffect, useMemo, useState } from 'react';
 
+import { ValidationIndicesError } from '../../../../common/http_api';
 import { isExampleDataIndex } from '../../../../common/log_analysis';
-import {
-  ValidationIndicesError,
-  ValidationIndicesResponsePayload,
-} from '../../../../common/http_api';
 import { useTrackedPromise } from '../../../utils/use_tracked_promise';
-import { callIndexPatternsValidate } from './api/index_patterns_validate';
+import { ModuleDescriptor, ModuleSourceConfiguration } from './log_analysis_module_types';
 
 type SetupHandler = (
   indices: string[],
@@ -25,53 +22,69 @@ export type ValidationIndicesUIError =
   | { error: 'NETWORK_ERROR' }
   | { error: 'TOO_FEW_SELECTED_INDICES' };
 
-export interface ValidatedIndex {
-  index: string;
-  errors: ValidationIndicesError[];
+interface ValidIndex {
+  validity: 'valid';
+  name: string;
   isSelected: boolean;
 }
 
-interface AnalysisSetupStateArguments {
-  availableIndices: string[];
+interface InvalidIndex {
+  validity: 'invalid';
+  name: string;
+  errors: ValidationIndicesError[];
+}
+
+export type ValidatedIndex = ValidIndex | InvalidIndex;
+
+interface AnalysisSetupStateArguments<JobType extends string> {
   cleanupAndSetupModule: SetupHandler;
+  moduleDescriptor: ModuleDescriptor<JobType>;
   setupModule: SetupHandler;
-  timestampField: string;
+  sourceConfiguration: ModuleSourceConfiguration;
 }
 
 const fourWeeksInMs = 86400000 * 7 * 4;
 
-export const useAnalysisSetupState = ({
-  availableIndices,
+export const useAnalysisSetupState = <JobType extends string>({
   cleanupAndSetupModule,
+  moduleDescriptor: { validateSetupIndices },
   setupModule,
-  timestampField,
-}: AnalysisSetupStateArguments) => {
+  sourceConfiguration,
+}: AnalysisSetupStateArguments<JobType>) => {
   const [startTime, setStartTime] = useState<number | undefined>(Date.now() - fourWeeksInMs);
   const [endTime, setEndTime] = useState<number | undefined>(undefined);
 
-  // Prepare the validation
-  const [validatedIndices, setValidatedIndices] = useState<ValidatedIndex[]>(
-    availableIndices.map(index => ({
-      index,
-      errors: [],
-      isSelected: false,
-    }))
-  );
+  const [validatedIndices, setValidatedIndices] = useState<ValidatedIndex[]>([]);
+
   const [validateIndicesRequest, validateIndices] = useTrackedPromise(
     {
       cancelPreviousOn: 'resolution',
       createPromise: async () => {
-        return await callIndexPatternsValidate(timestampField, availableIndices);
+        return await validateSetupIndices(sourceConfiguration);
       },
-      onResolve: ({ data }: ValidationIndicesResponsePayload) => {
-        setValidatedIndices(
-          availableIndices.map(index => {
-            const errors = data.errors.filter(error => error.index === index);
-            return {
-              index,
-              errors,
-              isSelected: errors.length === 0 && !isExampleDataIndex(index),
-            };
+      onResolve: ({ data: { errors } }) => {
+        setValidatedIndices(previousValidatedIndices =>
+          sourceConfiguration.indices.map(indexName => {
+            const previousValidatedIndex = previousValidatedIndices.filter(
+              ({ name }) => name === indexName
+            )[0];
+            const indexValiationErrors = errors.filter(({ index }) => index === indexName);
+            if (indexValiationErrors.length > 0) {
+              return {
+                validity: 'invalid',
+                name: indexName,
+                errors: indexValiationErrors,
+              };
+            } else {
+              return {
+                validity: 'valid',
+                name: indexName,
+                isSelected:
+                  previousValidatedIndex?.validity === 'valid'
+                    ? previousValidatedIndex?.isSelected
+                    : !isExampleDataIndex(indexName),
+              };
+            }
           })
         );
       },
@@ -79,7 +92,7 @@ export const useAnalysisSetupState = ({
         setValidatedIndices([]);
       },
     },
-    [availableIndices, timestampField]
+    [sourceConfiguration.indices]
   );
 
   useEffect(() => {
@@ -87,7 +100,10 @@ export const useAnalysisSetupState = ({
   }, [validateIndices]);
 
   const selectedIndexNames = useMemo(
-    () => validatedIndices.filter(i => i.isSelected).map(i => i.index),
+    () =>
+      validatedIndices
+        .filter(index => index.validity === 'valid' && index.isSelected)
+        .map(i => i.name),
     [validatedIndices]
   );
 
@@ -120,7 +136,9 @@ export const useAnalysisSetupState = ({
     }
 
     return validatedIndices.reduce<ValidationIndicesUIError[]>((errors, index) => {
-      return selectedIndexNames.includes(index.index) ? errors.concat(index.errors) : errors;
+      return index.validity === 'invalid' && selectedIndexNames.includes(index.name)
+        ? [...errors, ...index.errors]
+        : errors;
     }, []);
   }, [selectedIndexNames, validatedIndices, validateIndicesRequest.state]);
 
diff --git a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_entry_rate.tsx b/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_entry_rate.tsx
deleted file mode 100644
index 8b21a7e829894..0000000000000
--- a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_entry_rate.tsx
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { useMemo, useState } from 'react';
-
-import { GetLogEntryRateSuccessResponsePayload } from '../../../../common/http_api/log_analysis';
-import { useTrackedPromise } from '../../../utils/use_tracked_promise';
-import { callGetLogEntryRateAPI } from './api/get_log_entry_rate';
-
-type LogEntryRateResults = GetLogEntryRateSuccessResponsePayload['data'];
-
-export const useLogEntryRate = ({
-  sourceId,
-  startTime,
-  endTime,
-  bucketDuration,
-}: {
-  sourceId: string;
-  startTime: number;
-  endTime: number;
-  bucketDuration: number;
-}) => {
-  const [logEntryRate, setLogEntryRate] = useState<LogEntryRateResults | null>(null);
-
-  const [getLogEntryRateRequest, getLogEntryRate] = useTrackedPromise(
-    {
-      cancelPreviousOn: 'resolution',
-      createPromise: async () => {
-        return await callGetLogEntryRateAPI(sourceId, startTime, endTime, bucketDuration);
-      },
-      onResolve: response => {
-        setLogEntryRate(response.data);
-      },
-    },
-    [sourceId, startTime, endTime, bucketDuration]
-  );
-
-  const isLoading = useMemo(() => getLogEntryRateRequest.state === 'pending', [
-    getLogEntryRateRequest.state,
-  ]);
-
-  return {
-    getLogEntryRate,
-    isLoading,
-    logEntryRate,
-  };
-};
diff --git a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/ml_api_types.ts b/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/ml_api_types.ts
deleted file mode 100644
index ee70edc31d49b..0000000000000
--- a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/ml_api_types.ts
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import * as rt from 'io-ts';
-
-export const getMlCapabilitiesResponsePayloadRT = rt.type({
-  capabilities: rt.type({
-    canGetJobs: rt.boolean,
-    canCreateJob: rt.boolean,
-    canDeleteJob: rt.boolean,
-    canOpenJob: rt.boolean,
-    canCloseJob: rt.boolean,
-    canForecastJob: rt.boolean,
-    canGetDatafeeds: rt.boolean,
-    canStartStopDatafeed: rt.boolean,
-    canUpdateJob: rt.boolean,
-    canUpdateDatafeed: rt.boolean,
-    canPreviewDatafeed: rt.boolean,
-  }),
-  isPlatinumOrTrialLicense: rt.boolean,
-  mlFeatureEnabledInSpace: rt.boolean,
-  upgradeInProgress: rt.boolean,
-});
-
-export type GetMlCapabilitiesResponsePayload = rt.TypeOf<typeof getMlCapabilitiesResponsePayloadRT>;
diff --git a/x-pack/legacy/plugins/infra/public/containers/source/index.ts b/x-pack/legacy/plugins/infra/public/containers/source/index.ts
index 9442836f2a6c6..5911decf21774 100644
--- a/x-pack/legacy/plugins/infra/public/containers/source/index.ts
+++ b/x-pack/legacy/plugins/infra/public/containers/source/index.ts
@@ -4,4 +4,4 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export { Source, useSource } from './source';
+export * from './source';
diff --git a/x-pack/legacy/plugins/infra/public/containers/source/source.tsx b/x-pack/legacy/plugins/infra/public/containers/source/source.tsx
index 955529c9759c4..4729f7aa31f0b 100644
--- a/x-pack/legacy/plugins/infra/public/containers/source/source.tsx
+++ b/x-pack/legacy/plugins/infra/public/containers/source/source.tsx
@@ -176,3 +176,4 @@ export const useSource = ({ sourceId }: { sourceId: string }) => {
 };
 
 export const Source = createContainer(useSource);
+export const [SourceProvider, useSourceContext] = Source;
diff --git a/x-pack/legacy/plugins/infra/public/pages/logs/index.tsx b/x-pack/legacy/plugins/infra/public/pages/logs/index.tsx
index 1630de11bbdff..4eddecf732f75 100644
--- a/x-pack/legacy/plugins/infra/public/pages/logs/index.tsx
+++ b/x-pack/legacy/plugins/infra/public/pages/logs/index.tsx
@@ -21,7 +21,7 @@ import { Source, useSource } from '../../containers/source';
 import { StreamPage } from './stream';
 import { SettingsPage } from '../shared/settings';
 import { AppNavigation } from '../../components/navigation/app_navigation';
-import { AnalysisPage } from './analysis';
+import { LogEntryRatePage } from './log_entry_rate';
 import {
   useLogAnalysisCapabilities,
   LogAnalysisCapabilities,
@@ -98,7 +98,7 @@ export const LogsPage = injectUICapabilities(({ match, uiCapabilities }: LogsPag
 
               <Switch>
                 <Route path={streamTab.path} component={StreamPage} />
-                <Route path={logRateTab.path} component={AnalysisPage} />
+                <Route path={logRateTab.path} component={LogEntryRatePage} />
                 <Route path={settingsTab.path} component={SettingsPage} />
                 <RedirectWithQueryParams
                   from={`${match.path}/analysis`}
diff --git a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/first_use.tsx b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/first_use.tsx
similarity index 100%
rename from x-pack/legacy/plugins/infra/public/pages/logs/analysis/first_use.tsx
rename to x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/first_use.tsx
diff --git a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/index.ts b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/index.ts
similarity index 100%
rename from x-pack/legacy/plugins/infra/public/pages/logs/analysis/index.ts
rename to x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/index.ts
diff --git a/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/module_descriptor.ts b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/module_descriptor.ts
new file mode 100644
index 0000000000000..52be313264335
--- /dev/null
+++ b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/module_descriptor.ts
@@ -0,0 +1,107 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { bucketSpan, getJobId, partitionField } from '../../../../common/log_analysis';
+
+import {
+  ModuleDescriptor,
+  ModuleSourceConfiguration,
+  cleanUpJobsAndDatafeeds,
+} from '../../../containers/logs/log_analysis';
+import { callJobsSummaryAPI } from '../../../containers/logs/log_analysis/api/ml_get_jobs_summary_api';
+import { callGetMlModuleAPI } from '../../../containers/logs/log_analysis/api/ml_get_module';
+import { callSetupMlModuleAPI } from '../../../containers/logs/log_analysis/api/ml_setup_module_api';
+import { callValidateIndicesAPI } from '../../../containers/logs/log_analysis/api/validate_indices';
+
+const jobTypes = ['log-entry-rate'];
+const moduleId = 'logs_ui_analysis';
+
+type JobType = typeof jobTypes[0];
+
+const getJobIds = (spaceId: string, sourceId: string) =>
+  jobTypes.reduce(
+    (accumulatedJobIds, jobType) => ({
+      ...accumulatedJobIds,
+      [jobType]: getJobId(spaceId, sourceId, jobType),
+    }),
+    {} as Record<JobType, string>
+  );
+
+const getJobSummary = async (spaceId: string, sourceId: string) => {
+  const response = await callJobsSummaryAPI(spaceId, sourceId, jobTypes);
+  const jobIds = Object.values(getJobIds(spaceId, sourceId));
+
+  return response.filter(jobSummary => jobIds.includes(jobSummary.id));
+};
+
+const getModuleDefinition = async () => {
+  return await callGetMlModuleAPI(moduleId);
+};
+
+const setUpModule = async (
+  start: number | undefined,
+  end: number | undefined,
+  { spaceId, sourceId, indices, timestampField }: ModuleSourceConfiguration
+) => {
+  const indexNamePattern = indices.join(',');
+  const jobOverrides = [
+    {
+      job_id: 'log-entry-rate' as const,
+      analysis_config: {
+        bucket_span: `${bucketSpan}ms`,
+      },
+      data_description: {
+        time_field: timestampField,
+      },
+      custom_settings: {
+        logs_source_config: {
+          indexPattern: indexNamePattern,
+          timestampField,
+          bucketSpan,
+        },
+      },
+    },
+  ];
+
+  return callSetupMlModuleAPI(
+    moduleId,
+    start,
+    end,
+    spaceId,
+    sourceId,
+    indexNamePattern,
+    jobOverrides
+  );
+};
+
+const cleanUpModule = async (spaceId: string, sourceId: string) => {
+  return await cleanUpJobsAndDatafeeds(spaceId, sourceId, jobTypes);
+};
+
+const validateSetupIndices = async ({ indices, timestampField }: ModuleSourceConfiguration) => {
+  return await callValidateIndicesAPI(indices, [
+    {
+      name: timestampField,
+      validTypes: ['date'],
+    },
+    {
+      name: partitionField,
+      validTypes: ['keyword'],
+    },
+  ]);
+};
+
+export const logEntryRateModule: ModuleDescriptor<JobType> = {
+  moduleId,
+  jobTypes,
+  bucketSpan,
+  getJobIds,
+  getJobSummary,
+  getModuleDefinition,
+  setUpModule,
+  cleanUpModule,
+  validateSetupIndices,
+};
diff --git a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/page.tsx b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/page.tsx
similarity index 53%
rename from x-pack/legacy/plugins/infra/public/pages/logs/analysis/page.tsx
rename to x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/page.tsx
index d82da895f9a5a..5ff5cd4db7168 100644
--- a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/page.tsx
+++ b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/page.tsx
@@ -7,15 +7,15 @@
 import React from 'react';
 
 import { ColumnarPage } from '../../../components/page';
-import { AnalysisPageContent } from './page_content';
-import { AnalysisPageProviders } from './page_providers';
+import { LogEntryRatePageContent } from './page_content';
+import { LogEntryRatePageProviders } from './page_providers';
 
-export const AnalysisPage = () => {
+export const LogEntryRatePage = () => {
   return (
-    <AnalysisPageProviders>
-      <ColumnarPage data-test-subj="infraLogsAnalysisPage">
-        <AnalysisPageContent />
+    <LogEntryRatePageProviders>
+      <ColumnarPage data-test-subj="logsLogEntryRatePage">
+        <LogEntryRatePageContent />
       </ColumnarPage>
-    </AnalysisPageProviders>
+    </LogEntryRatePageProviders>
   );
 };
diff --git a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/page_content.tsx b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/page_content.tsx
similarity index 59%
rename from x-pack/legacy/plugins/infra/public/pages/logs/analysis/page_content.tsx
rename to x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/page_content.tsx
index f0a26eae25ecb..e62164cb17b2c 100644
--- a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/page_content.tsx
+++ b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/page_content.tsx
@@ -9,34 +9,37 @@ import React, { useContext, useEffect } from 'react';
 
 import { isSetupStatusWithResults } from '../../../../common/log_analysis';
 import { LoadingPage } from '../../../components/loading_page';
-import { LogAnalysisCapabilities, LogAnalysisJobs } from '../../../containers/logs/log_analysis';
+import { LogAnalysisCapabilities } from '../../../containers/logs/log_analysis';
 import { Source } from '../../../containers/source';
-import { AnalysisResultsContent } from './page_results_content';
-import { AnalysisSetupContent } from './page_setup_content';
-import { AnalysisUnavailableContent } from './page_unavailable_content';
-import { AnalysisSetupStatusUnknownContent } from './page_setup_status_unknown';
+import { LogEntryRateResultsContent } from './page_results_content';
+import { LogEntryRateSetupContent } from './page_setup_content';
+import { LogEntryRateUnavailableContent } from './page_unavailable_content';
+import { LogEntryRateSetupStatusUnknownContent } from './page_setup_status_unknown';
+import { useLogEntryRateModuleContext } from './use_log_entry_rate_module';
 
-export const AnalysisPageContent = () => {
+export const LogEntryRatePageContent = () => {
   const { sourceId } = useContext(Source.Context);
   const { hasLogAnalysisCapabilites } = useContext(LogAnalysisCapabilities.Context);
 
   const {
-    availableIndices,
-    cleanupAndSetup,
+    cleanUpAndSetUpModule: cleanupAndSetup,
     fetchJobStatus,
+    fetchModuleDefinition,
     lastSetupErrorMessages,
-    setup,
+    moduleDescriptor,
+    setUpModule,
     setupStatus,
-    timestampField,
+    sourceConfiguration,
     viewResults,
-  } = useContext(LogAnalysisJobs.Context);
+  } = useLogEntryRateModuleContext();
 
   useEffect(() => {
+    fetchModuleDefinition();
     fetchJobStatus();
   }, []);
 
   if (!hasLogAnalysisCapabilites) {
-    return <AnalysisUnavailableContent />;
+    return <LogEntryRateUnavailableContent />;
   } else if (setupStatus === 'initializing') {
     return (
       <LoadingPage
@@ -46,23 +49,23 @@ export const AnalysisPageContent = () => {
       />
     );
   } else if (setupStatus === 'unknown') {
-    return <AnalysisSetupStatusUnknownContent retry={fetchJobStatus} />;
+    return <LogEntryRateSetupStatusUnknownContent retry={fetchJobStatus} />;
   } else if (isSetupStatusWithResults(setupStatus)) {
     return (
-      <AnalysisResultsContent
+      <LogEntryRateResultsContent
         sourceId={sourceId}
         isFirstUse={setupStatus === 'hiddenAfterSuccess'}
       />
     );
   } else {
     return (
-      <AnalysisSetupContent
-        availableIndices={availableIndices}
+      <LogEntryRateSetupContent
         cleanupAndSetup={cleanupAndSetup}
         errorMessages={lastSetupErrorMessages}
-        setup={setup}
+        moduleDescriptor={moduleDescriptor}
+        setup={setUpModule}
         setupStatus={setupStatus}
-        timestampField={timestampField}
+        sourceConfiguration={sourceConfiguration}
         viewResults={viewResults}
       />
     );
diff --git a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/page_providers.tsx b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/page_providers.tsx
similarity index 53%
rename from x-pack/legacy/plugins/infra/public/pages/logs/analysis/page_providers.tsx
rename to x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/page_providers.tsx
index fba32f6cbd6d0..67c8ea7660a26 100644
--- a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/page_providers.tsx
+++ b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/page_providers.tsx
@@ -4,24 +4,24 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React, { useContext } from 'react';
+import React from 'react';
 
-import { LogAnalysisJobs } from '../../../containers/logs/log_analysis';
-import { Source } from '../../../containers/source';
+import { useSourceContext } from '../../../containers/source';
 import { useKibanaSpaceId } from '../../../utils/use_kibana_space_id';
+import { LogEntryRateModuleProvider } from './use_log_entry_rate_module';
 
-export const AnalysisPageProviders: React.FunctionComponent = ({ children }) => {
-  const { sourceId, source } = useContext(Source.Context);
+export const LogEntryRatePageProviders: React.FunctionComponent = ({ children }) => {
+  const { sourceId, source } = useSourceContext();
   const spaceId = useKibanaSpaceId();
 
   return (
-    <LogAnalysisJobs.Provider
+    <LogEntryRateModuleProvider
       indexPattern={source ? source.configuration.logAlias : ''}
       sourceId={sourceId}
       spaceId={spaceId}
-      timeField={source ? source.configuration.fields.timestamp : ''}
+      timestampField={source ? source.configuration.fields.timestamp : ''}
     >
       {children}
-    </LogAnalysisJobs.Provider>
+    </LogEntryRateModuleProvider>
   );
 };
diff --git a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/page_results_content.tsx b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/page_results_content.tsx
similarity index 78%
rename from x-pack/legacy/plugins/infra/public/pages/logs/analysis/page_results_content.tsx
rename to x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/page_results_content.tsx
index 7fa9ff3c93db7..be637bc29a0db 100644
--- a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/page_results_content.tsx
+++ b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/page_results_content.tsx
@@ -17,36 +17,36 @@ import {
 import numeral from '@elastic/numeral';
 import { FormattedMessage } from '@kbn/i18n/react';
 import moment from 'moment';
-import React, { useCallback, useContext, useMemo, useState } from 'react';
+import React, { useCallback, useMemo, useState, useEffect } from 'react';
 
 import euiStyled from '../../../../../../common/eui_styled_components';
 import { TimeRange } from '../../../../common/http_api/shared/time_range';
 import { bucketSpan } from '../../../../common/log_analysis';
 import { LoadingOverlayWrapper } from '../../../components/loading_overlay_wrapper';
-import {
-  LogAnalysisJobs,
-  StringTimeRange,
-  useLogAnalysisResults,
-  useLogAnalysisResultsUrlState,
-} from '../../../containers/logs/log_analysis';
 import { useInterval } from '../../../hooks/use_interval';
 import { useTrackPageview } from '../../../hooks/use_track_metric';
 import { useKibanaUiSetting } from '../../../utils/use_kibana_ui_setting';
 import { FirstUseCallout } from './first_use';
 import { AnomaliesResults } from './sections/anomalies';
 import { LogRateResults } from './sections/log_rate';
+import { useLogEntryRateModuleContext } from './use_log_entry_rate_module';
+import { useLogEntryRateResults } from './use_log_entry_rate_results';
+import {
+  StringTimeRange,
+  useLogAnalysisResultsUrlState,
+} from './use_log_entry_rate_results_url_state';
 
 const JOB_STATUS_POLLING_INTERVAL = 30000;
 
-export const AnalysisResultsContent = ({
+export const LogEntryRateResultsContent = ({
   sourceId,
   isFirstUse,
 }: {
   sourceId: string;
   isFirstUse: boolean;
 }) => {
-  useTrackPageview({ app: 'infra_logs', path: 'analysis_results' });
-  useTrackPageview({ app: 'infra_logs', path: 'analysis_results', delay: 15000 });
+  useTrackPageview({ app: 'infra_logs', path: 'log_entry_rate_results' });
+  useTrackPageview({ app: 'infra_logs', path: 'log_entry_rate_results', delay: 15000 });
 
   const [dateFormat] = useKibanaUiSetting('dateFormat', 'MMMM D, YYYY h:mm A');
 
@@ -65,32 +65,20 @@ export const AnalysisResultsContent = ({
     lastChangedTime: Date.now(),
   }));
 
-  const bucketDuration = useMemo(() => {
-    // This function takes the current time range in ms,
-    // works out the bucket interval we'd need to always
-    // display 100 data points, and then takes that new
-    // value and works out the nearest multiple of
-    // 900000 (15 minutes) to it, so that we don't end up with
-    // jaggy bucket boundaries between the ML buckets and our
-    // aggregation buckets.
-    const msRange = moment(queryTimeRange.value.endTime).diff(
-      moment(queryTimeRange.value.startTime)
-    );
-    const bucketIntervalInMs = msRange / 100;
-    const result = bucketSpan * Math.round(bucketIntervalInMs / bucketSpan);
-    const roundedResult = parseInt(Number(result).toFixed(0), 10);
-    return roundedResult < bucketSpan ? bucketSpan : roundedResult;
-  }, [queryTimeRange.value.startTime, queryTimeRange.value.endTime]);
+  const bucketDuration = useMemo(
+    () => getBucketDuration(queryTimeRange.value.startTime, queryTimeRange.value.endTime),
+    [queryTimeRange.value.endTime, queryTimeRange.value.startTime]
+  );
 
-  const { isLoading, logRateResults } = useLogAnalysisResults({
+  const { getLogEntryRate, isLoading, logEntryRate } = useLogEntryRateResults({
     sourceId,
     startTime: queryTimeRange.value.startTime,
     endTime: queryTimeRange.value.endTime,
     bucketDuration,
-    lastRequestTime: queryTimeRange.lastChangedTime,
   });
-  const hasResults = useMemo(() => logRateResults && logRateResults.histogramBuckets.length > 0, [
-    logRateResults,
+
+  const hasResults = useMemo(() => (logEntryRate?.histogramBuckets?.length ?? 0) > 0, [
+    logEntryRate,
   ]);
 
   const handleQueryTimeRangeChange = useCallback(
@@ -145,7 +133,11 @@ export const AnalysisResultsContent = ({
     viewSetupForReconfiguration,
     viewSetupForUpdate,
     jobIds,
-  } = useContext(LogAnalysisJobs.Context);
+  } = useLogEntryRateModuleContext();
+
+  useEffect(() => {
+    getLogEntryRate();
+  }, [getLogEntryRate, queryTimeRange.lastChangedTime]);
 
   useInterval(() => {
     fetchJobStatus();
@@ -168,7 +160,7 @@ export const AnalysisResultsContent = ({
           <EuiPanel paddingSize="l">
             <EuiFlexGroup justifyContent="spaceBetween" alignItems="center">
               <EuiFlexItem grow={false}>
-                {logRateResults ? (
+                {logEntryRate ? (
                   <LoadingOverlayWrapper isLoading={isLoading}>
                     <EuiText size="s">
                       <FormattedMessage
@@ -178,7 +170,7 @@ export const AnalysisResultsContent = ({
                           numberOfLogs: (
                             <EuiBadge color="primary">
                               <EuiText size="s" color="ghost">
-                                {numeral(logRateResults.totalNumberOfLogEntries).format('0.00a')}
+                                {numeral(logEntryRate.totalNumberOfLogEntries).format('0.00a')}
                               </EuiText>
                             </EuiBadge>
                           ),
@@ -210,7 +202,7 @@ export const AnalysisResultsContent = ({
             {isFirstUse && !hasResults ? <FirstUseCallout /> : null}
             <LogRateResults
               isLoading={isLoading}
-              results={logRateResults}
+              results={logEntryRate}
               setTimeRange={handleChartTimeRangeChange}
               timeRange={queryTimeRange.value}
             />
@@ -223,7 +215,7 @@ export const AnalysisResultsContent = ({
               jobStatus={jobStatus['log-entry-rate']}
               viewSetupForReconfiguration={viewSetupForReconfiguration}
               viewSetupForUpdate={viewSetupForUpdate}
-              results={logRateResults}
+              results={logEntryRate}
               setTimeRange={handleChartTimeRangeChange}
               setupStatus={setupStatus}
               timeRange={queryTimeRange.value}
@@ -250,6 +242,23 @@ const stringToNumericTimeRange = (timeRange: StringTimeRange): TimeRange => ({
   ).valueOf(),
 });
 
+/**
+ * This function takes the current time range in ms,
+ * works out the bucket interval we'd need to always
+ * display 100 data points, and then takes that new
+ * value and works out the nearest multiple of
+ * 900000 (15 minutes) to it, so that we don't end up with
+ * jaggy bucket boundaries between the ML buckets and our
+ * aggregation buckets.
+ */
+const getBucketDuration = (startTime: number, endTime: number) => {
+  const msRange = moment(endTime).diff(moment(startTime));
+  const bucketIntervalInMs = msRange / 100;
+  const result = bucketSpan * Math.round(bucketIntervalInMs / bucketSpan);
+  const roundedResult = parseInt(Number(result).toFixed(0), 10);
+  return roundedResult < bucketSpan ? bucketSpan : roundedResult;
+};
+
 // This is needed due to the flex-basis: 100% !important; rule that
 // kicks in on small screens via media queries breaking when using direction="column"
 export const ResultsContentPage = euiStyled(EuiPage)`
diff --git a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/page_setup_content.tsx b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/page_setup_content.tsx
similarity index 70%
rename from x-pack/legacy/plugins/infra/public/pages/logs/analysis/page_setup_content.tsx
rename to x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/page_setup_content.tsx
index 7ae174c4a7899..6c04404b91231 100644
--- a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/page_setup_content.tsx
+++ b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/page_setup_content.tsx
@@ -4,23 +4,25 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React from 'react';
 import {
   EuiPage,
   EuiPageBody,
   EuiPageContent,
+  EuiPageContentBody,
   EuiPageContentHeader,
   EuiPageContentHeaderSection,
-  EuiPageContentBody,
+  EuiSpacer,
   EuiText,
   EuiTitle,
-  EuiSpacer,
 } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
+import React from 'react';
+
 import euiStyled from '../../../../../../common/eui_styled_components';
 import { SetupStatus } from '../../../../common/log_analysis';
+import { ModuleDescriptor, ModuleSourceConfiguration } from '../../../containers/logs/log_analysis';
 import { useTrackPageview } from '../../../hooks/use_track_metric';
-import { AnalysisSetupSteps } from './setup';
+import { LogEntryRateSetupSteps } from './setup';
 
 type SetupHandler = (
   indices: string[],
@@ -28,32 +30,32 @@ type SetupHandler = (
   endTime: number | undefined
 ) => void;
 
-interface AnalysisSetupContentProps {
-  availableIndices: string[];
+interface LogEntryRateSetupContentProps<JobType extends string> {
   cleanupAndSetup: SetupHandler;
   errorMessages: string[];
+  moduleDescriptor: ModuleDescriptor<JobType>;
   setup: SetupHandler;
   setupStatus: SetupStatus;
-  timestampField: string;
+  sourceConfiguration: ModuleSourceConfiguration;
   viewResults: () => void;
 }
 
-export const AnalysisSetupContent: React.FunctionComponent<AnalysisSetupContentProps> = ({
-  availableIndices,
+export const LogEntryRateSetupContent = <JobType extends string>({
   cleanupAndSetup,
   errorMessages,
   setup,
   setupStatus,
-  timestampField,
   viewResults,
-}) => {
-  useTrackPageview({ app: 'infra_logs', path: 'analysis_setup' });
-  useTrackPageview({ app: 'infra_logs', path: 'analysis_setup', delay: 15000 });
+  moduleDescriptor,
+  sourceConfiguration,
+}: LogEntryRateSetupContentProps<JobType>) => {
+  useTrackPageview({ app: 'infra_logs', path: 'log_entry_rate_setup' });
+  useTrackPageview({ app: 'infra_logs', path: 'log_entry_rate_setup', delay: 15000 });
 
   return (
-    <AnalysisSetupPage>
+    <LogEntryRateSetupPage>
       <EuiPageBody>
-        <AnalysisPageContent
+        <LogEntryRateSetupPageContent
           verticalPosition="center"
           horizontalPosition="center"
           data-test-subj="analysisSetupContent"
@@ -78,27 +80,27 @@ export const AnalysisSetupContent: React.FunctionComponent<AnalysisSetupContentP
               />
             </EuiText>
             <EuiSpacer />
-            <AnalysisSetupSteps
-              availableIndices={availableIndices}
+            <LogEntryRateSetupSteps
               cleanupAndSetup={cleanupAndSetup}
               errorMessages={errorMessages}
               setup={setup}
               setupStatus={setupStatus}
-              timestampField={timestampField}
               viewResults={viewResults}
+              moduleDescriptor={moduleDescriptor}
+              sourceConfiguration={sourceConfiguration}
             />
           </EuiPageContentBody>
-        </AnalysisPageContent>
+        </LogEntryRateSetupPageContent>
       </EuiPageBody>
-    </AnalysisSetupPage>
+    </LogEntryRateSetupPage>
   );
 };
 
 // !important due to https://github.com/elastic/eui/issues/2232
-const AnalysisPageContent = euiStyled(EuiPageContent)`
+const LogEntryRateSetupPageContent = euiStyled(EuiPageContent)`
   max-width: 768px !important;
 `;
 
-const AnalysisSetupPage = euiStyled(EuiPage)`
+const LogEntryRateSetupPage = euiStyled(EuiPage)`
   height: 100%;
 `;
diff --git a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/page_setup_status_unknown.tsx b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/page_setup_status_unknown.tsx
similarity index 92%
rename from x-pack/legacy/plugins/infra/public/pages/logs/analysis/page_setup_status_unknown.tsx
rename to x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/page_setup_status_unknown.tsx
index 953b0841ffe92..4c685bd42b937 100644
--- a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/page_setup_status_unknown.tsx
+++ b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/page_setup_status_unknown.tsx
@@ -14,7 +14,7 @@ interface Props {
   retry: () => void;
 }
 
-export const AnalysisSetupStatusUnknownContent: React.FunctionComponent<Props> = ({
+export const LogEntryRateSetupStatusUnknownContent: React.FunctionComponent<Props> = ({
   retry,
 }: Props) => (
   <EmptyPrompt
diff --git a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/page_unavailable_content.tsx b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/page_unavailable_content.tsx
similarity index 95%
rename from x-pack/legacy/plugins/infra/public/pages/logs/analysis/page_unavailable_content.tsx
rename to x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/page_unavailable_content.tsx
index 870b97b8012ea..c77e5d408fe5f 100644
--- a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/page_unavailable_content.tsx
+++ b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/page_unavailable_content.tsx
@@ -10,7 +10,7 @@ import { FormattedMessage } from '@kbn/i18n/react';
 import { EuiEmptyPrompt, EuiLink, EuiButton } from '@elastic/eui';
 import euiStyled from '../../../../../../common/eui_styled_components';
 
-export const AnalysisUnavailableContent: React.FunctionComponent<{}> = () => (
+export const LogEntryRateUnavailableContent: React.FunctionComponent<{}> = () => (
   <EmptyPrompt
     title={
       <h2>
diff --git a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/sections/anomalies/chart.tsx b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/sections/anomalies/chart.tsx
similarity index 100%
rename from x-pack/legacy/plugins/infra/public/pages/logs/analysis/sections/anomalies/chart.tsx
rename to x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/sections/anomalies/chart.tsx
diff --git a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/sections/anomalies/expanded_row.tsx b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/sections/anomalies/expanded_row.tsx
similarity index 84%
rename from x-pack/legacy/plugins/infra/public/pages/logs/analysis/sections/anomalies/expanded_row.tsx
rename to x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/sections/anomalies/expanded_row.tsx
index 0586f5282ddf7..f8a7f12364cf9 100644
--- a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/sections/anomalies/expanded_row.tsx
+++ b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/sections/anomalies/expanded_row.tsx
@@ -4,38 +4,37 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React, { useMemo } from 'react';
-import { i18n } from '@kbn/i18n';
+import { EuiFlexGroup, EuiFlexItem, EuiSpacer, EuiStat } from '@elastic/eui';
 import numeral from '@elastic/numeral';
-import { EuiFlexGroup, EuiFlexItem, EuiStat, EuiSpacer } from '@elastic/eui';
-import { AnomaliesChart } from './chart';
-import { LogRateResults } from '../../../../../containers/logs/log_analysis/log_analysis_results';
+import { i18n } from '@kbn/i18n';
+import React, { useMemo } from 'react';
+
 import { TimeRange } from '../../../../../../common/http_api/shared/time_range';
+import { AnalyzeInMlButton } from '../../../../../components/logging/log_analysis_results';
+import { LogEntryRateResults } from '../../use_log_entry_rate_results';
 import {
-  getLogEntryRateSeriesForPartition,
   getAnnotationsForPartition,
+  getLogEntryRateSeriesForPartition,
   getTotalNumberOfLogEntriesForPartition,
 } from '../helpers/data_formatters';
-import { AnalyzeInMlButton } from '../analyze_in_ml_button';
+import { AnomaliesChart } from './chart';
 
 export const AnomaliesTableExpandedRow: React.FunctionComponent<{
   partitionId: string;
   topAnomalyScore: number;
-  results: LogRateResults;
+  results: LogEntryRateResults;
   setTimeRange: (timeRange: TimeRange) => void;
   timeRange: TimeRange;
   jobId: string;
 }> = ({ results, timeRange, setTimeRange, partitionId, jobId }) => {
   const logEntryRateSeries = useMemo(
     () =>
-      results && results.histogramBuckets
-        ? getLogEntryRateSeriesForPartition(results, partitionId)
-        : [],
+      results?.histogramBuckets ? getLogEntryRateSeriesForPartition(results, partitionId) : [],
     [results, partitionId]
   );
   const anomalyAnnotations = useMemo(
     () =>
-      results && results.histogramBuckets
+      results?.histogramBuckets
         ? getAnnotationsForPartition(results, partitionId)
         : {
             warning: [],
@@ -47,7 +46,7 @@ export const AnomaliesTableExpandedRow: React.FunctionComponent<{
   );
   const totalNumberOfLogEntries = useMemo(
     () =>
-      results && results.histogramBuckets
+      results?.histogramBuckets
         ? getTotalNumberOfLogEntriesForPartition(results, partitionId)
         : undefined,
     [results, partitionId]
diff --git a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/sections/anomalies/index.tsx b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/sections/anomalies/index.tsx
similarity index 97%
rename from x-pack/legacy/plugins/infra/public/pages/logs/analysis/sections/anomalies/index.tsx
rename to x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/sections/anomalies/index.tsx
index e870c2d442719..38aa4b068c9e9 100644
--- a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/sections/anomalies/index.tsx
+++ b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/sections/anomalies/index.tsx
@@ -18,7 +18,7 @@ import { i18n } from '@kbn/i18n';
 import React, { useMemo } from 'react';
 
 import euiStyled from '../../../../../../../../common/eui_styled_components';
-import { LogRateResults } from '../../../../../containers/logs/log_analysis/log_analysis_results';
+import { LogEntryRateResults } from '../../use_log_entry_rate_results';
 import { TimeRange } from '../../../../../../common/http_api/shared/time_range';
 import { JobStatus, SetupStatus } from '../../../../../../common/log_analysis';
 import {
@@ -30,13 +30,13 @@ import {
 import { AnomaliesChart } from './chart';
 import { AnomaliesTable } from './table';
 import { LogAnalysisJobProblemIndicator } from '../../../../../components/logging/log_analysis_job_status';
-import { AnalyzeInMlButton } from '../analyze_in_ml_button';
+import { AnalyzeInMlButton } from '../../../../../components/logging/log_analysis_results';
 import { LoadingOverlayWrapper } from '../../../../../components/loading_overlay_wrapper';
 
 export const AnomaliesResults: React.FunctionComponent<{
   isLoading: boolean;
   jobStatus: JobStatus;
-  results: LogRateResults | null;
+  results: LogEntryRateResults | null;
   setTimeRange: (timeRange: TimeRange) => void;
   setupStatus: SetupStatus;
   timeRange: TimeRange;
diff --git a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/sections/anomalies/table.tsx b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/sections/anomalies/table.tsx
similarity index 97%
rename from x-pack/legacy/plugins/infra/public/pages/logs/analysis/sections/anomalies/table.tsx
rename to x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/sections/anomalies/table.tsx
index c0016d07c290b..2057d75f72354 100644
--- a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/sections/anomalies/table.tsx
+++ b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/sections/anomalies/table.tsx
@@ -9,7 +9,7 @@ import { EuiBasicTable, EuiButtonIcon } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { RIGHT_ALIGNMENT } from '@elastic/eui/lib/services';
 import { TimeRange } from '../../../../../../common/http_api/shared/time_range';
-import { LogRateResults } from '../../../../../containers/logs/log_analysis/log_analysis_results';
+import { LogEntryRateResults } from '../../use_log_entry_rate_results';
 import { AnomaliesTableExpandedRow } from './expanded_row';
 import { formatAnomalyScore, getFriendlyNameForPartitionId } from '../helpers/data_formatters';
 import euiStyled from '../../../../../../../../common/eui_styled_components';
@@ -50,7 +50,7 @@ const maxAnomalyScoreColumnName = i18n.translate(
 );
 
 export const AnomaliesTable: React.FunctionComponent<{
-  results: LogRateResults;
+  results: LogEntryRateResults;
   setTimeRange: (timeRange: TimeRange) => void;
   timeRange: TimeRange;
   jobId: string;
diff --git a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/sections/helpers/data_formatters.tsx b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/sections/helpers/data_formatters.tsx
similarity index 88%
rename from x-pack/legacy/plugins/infra/public/pages/logs/analysis/sections/helpers/data_formatters.tsx
rename to x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/sections/helpers/data_formatters.tsx
index 74a3b5f80a577..f9b85fc4e20c2 100644
--- a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/sections/helpers/data_formatters.tsx
+++ b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/sections/helpers/data_formatters.tsx
@@ -6,18 +6,19 @@
 
 import { RectAnnotationDatum } from '@elastic/charts';
 import { i18n } from '@kbn/i18n';
-import { LogRateResults } from '../../../../../containers/logs/log_analysis/log_analysis_results';
 
-export type MLSeverityScoreCategories = 'warning' | 'minor' | 'major' | 'critical';
-type MLSeverityScores = Record<MLSeverityScoreCategories, number>;
-const ML_SEVERITY_SCORES: MLSeverityScores = {
+import { LogEntryRateResults } from '../../use_log_entry_rate_results';
+
+const ML_SEVERITY_SCORES = {
   warning: 3,
   minor: 25,
   major: 50,
   critical: 75,
 };
 
-export const getLogEntryRatePartitionedSeries = (results: LogRateResults) => {
+export type MLSeverityScoreCategories = keyof typeof ML_SEVERITY_SCORES;
+
+export const getLogEntryRatePartitionedSeries = (results: LogEntryRateResults) => {
   return results.histogramBuckets.reduce<Array<{ group: string; time: number; value: number }>>(
     (buckets, bucket) => {
       return [
@@ -33,7 +34,7 @@ export const getLogEntryRatePartitionedSeries = (results: LogRateResults) => {
   );
 };
 
-export const getLogEntryRateCombinedSeries = (results: LogRateResults) => {
+export const getLogEntryRateCombinedSeries = (results: LogEntryRateResults) => {
   return results.histogramBuckets.reduce<Array<{ time: number; value: number }>>(
     (buckets, bucket) => {
       return [
@@ -50,7 +51,10 @@ export const getLogEntryRateCombinedSeries = (results: LogRateResults) => {
   );
 };
 
-export const getLogEntryRateSeriesForPartition = (results: LogRateResults, partitionId: string) => {
+export const getLogEntryRateSeriesForPartition = (
+  results: LogEntryRateResults,
+  partitionId: string
+) => {
   return results.partitionBuckets[partitionId].buckets.reduce<
     Array<{ time: number; value: number }>
   >((buckets, bucket) => {
@@ -64,7 +68,7 @@ export const getLogEntryRateSeriesForPartition = (results: LogRateResults, parti
   }, []);
 };
 
-export const getAnnotationsForPartition = (results: LogRateResults, partitionId: string) => {
+export const getAnnotationsForPartition = (results: LogEntryRateResults, partitionId: string) => {
   return results.partitionBuckets[partitionId].buckets.reduce<
     Record<MLSeverityScoreCategories, RectAnnotationDatum[]>
   >(
@@ -106,13 +110,13 @@ export const getAnnotationsForPartition = (results: LogRateResults, partitionId:
 };
 
 export const getTotalNumberOfLogEntriesForPartition = (
-  results: LogRateResults,
+  results: LogEntryRateResults,
   partitionId: string
 ) => {
   return results.partitionBuckets[partitionId].totalNumberOfLogEntries;
 };
 
-export const getAnnotationsForAll = (results: LogRateResults) => {
+export const getAnnotationsForAll = (results: LogEntryRateResults) => {
   return results.histogramBuckets.reduce<Record<MLSeverityScoreCategories, RectAnnotationDatum[]>>(
     (annotatedBucketsBySeverity, bucket) => {
       const maxAnomalyScoresByPartition = bucket.partitions.reduce<
@@ -169,7 +173,7 @@ export const getAnnotationsForAll = (results: LogRateResults) => {
   );
 };
 
-export const getTopAnomalyScoreAcrossAllPartitions = (results: LogRateResults) => {
+export const getTopAnomalyScoreAcrossAllPartitions = (results: LogEntryRateResults) => {
   const allTopScores = Object.values(results.partitionBuckets).reduce(
     (scores: number[], partition) => {
       return [...scores, partition.topAnomalyScore];
diff --git a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/sections/log_rate/bar_chart.tsx b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/sections/log_rate/bar_chart.tsx
similarity index 100%
rename from x-pack/legacy/plugins/infra/public/pages/logs/analysis/sections/log_rate/bar_chart.tsx
rename to x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/sections/log_rate/bar_chart.tsx
diff --git a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/sections/log_rate/index.tsx b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/sections/log_rate/index.tsx
similarity index 96%
rename from x-pack/legacy/plugins/infra/public/pages/logs/analysis/sections/log_rate/index.tsx
rename to x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/sections/log_rate/index.tsx
index 44805520f3b9e..a11dc9d4d607a 100644
--- a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/sections/log_rate/index.tsx
+++ b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/sections/log_rate/index.tsx
@@ -8,7 +8,7 @@ import { EuiEmptyPrompt, EuiLoadingSpinner, EuiSpacer, EuiTitle, EuiText } from
 import { i18n } from '@kbn/i18n';
 import React, { useMemo } from 'react';
 
-import { LogRateResults as Results } from '../../../../../containers/logs/log_analysis/log_analysis_results';
+import { LogEntryRateResults as Results } from '../../use_log_entry_rate_results';
 import { TimeRange } from '../../../../../../common/http_api/shared/time_range';
 import { LogEntryRateBarChart } from './bar_chart';
 import { getLogEntryRatePartitionedSeries } from '../helpers/data_formatters';
diff --git a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/api/get_log_entry_rate.ts b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/service_calls/get_log_entry_rate.ts
similarity index 100%
rename from x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/api/get_log_entry_rate.ts
rename to x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/service_calls/get_log_entry_rate.ts
diff --git a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/setup/index.ts b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/setup/index.ts
similarity index 100%
rename from x-pack/legacy/plugins/infra/public/pages/logs/analysis/setup/index.ts
rename to x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/setup/index.ts
diff --git a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/setup/initial_configuration_step/analysis_setup_indices_form.tsx b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/setup/initial_configuration_step/analysis_setup_indices_form.tsx
similarity index 91%
rename from x-pack/legacy/plugins/infra/public/pages/logs/analysis/setup/initial_configuration_step/analysis_setup_indices_form.tsx
rename to x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/setup/initial_configuration_step/analysis_setup_indices_form.tsx
index 585a65b9ad1c8..91662c49adace 100644
--- a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/setup/initial_configuration_step/analysis_setup_indices_form.tsx
+++ b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/setup/initial_configuration_step/analysis_setup_indices_form.tsx
@@ -25,7 +25,7 @@ export const AnalysisSetupIndicesForm: React.FunctionComponent<{
       onChangeSelectedIndices(
         indices.map(index => {
           const checkbox = event.currentTarget;
-          return index.index === checkbox.id ? { ...index, isSelected: checkbox.checked } : index;
+          return index.name === checkbox.id ? { ...index, isSelected: checkbox.checked } : index;
         })
       );
     },
@@ -35,22 +35,21 @@ export const AnalysisSetupIndicesForm: React.FunctionComponent<{
   const choices = useMemo(
     () =>
       indices.map(index => {
-        const validIndex = index.errors.length === 0;
         const checkbox = (
           <EuiCheckbox
-            key={index.index}
-            id={index.index}
-            label={<EuiCode>{index.index}</EuiCode>}
+            key={index.name}
+            id={index.name}
+            label={<EuiCode>{index.name}</EuiCode>}
             onChange={handleCheckboxChange}
-            checked={index.isSelected}
-            disabled={!validIndex}
+            checked={index.validity === 'valid' && index.isSelected}
+            disabled={index.validity === 'invalid'}
           />
         );
 
-        return validIndex ? (
+        return index.validity === 'valid' ? (
           checkbox
         ) : (
-          <div key={index.index}>
+          <div key={index.name}>
             <EuiToolTip content={formatValidationError(index.errors)}>{checkbox}</EuiToolTip>
           </div>
         );
diff --git a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/setup/initial_configuration_step/analysis_setup_timerange_form.tsx b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/setup/initial_configuration_step/analysis_setup_timerange_form.tsx
similarity index 100%
rename from x-pack/legacy/plugins/infra/public/pages/logs/analysis/setup/initial_configuration_step/analysis_setup_timerange_form.tsx
rename to x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/setup/initial_configuration_step/analysis_setup_timerange_form.tsx
diff --git a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/setup/initial_configuration_step/index.ts b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/setup/initial_configuration_step/index.ts
similarity index 100%
rename from x-pack/legacy/plugins/infra/public/pages/logs/analysis/setup/initial_configuration_step/index.ts
rename to x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/setup/initial_configuration_step/index.ts
diff --git a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/setup/initial_configuration_step/initial_configuration_step.tsx b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/setup/initial_configuration_step/initial_configuration_step.tsx
similarity index 100%
rename from x-pack/legacy/plugins/infra/public/pages/logs/analysis/setup/initial_configuration_step/initial_configuration_step.tsx
rename to x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/setup/initial_configuration_step/initial_configuration_step.tsx
diff --git a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/setup/process_step/create_ml_jobs_button.tsx b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/setup/process_step/create_ml_jobs_button.tsx
similarity index 100%
rename from x-pack/legacy/plugins/infra/public/pages/logs/analysis/setup/process_step/create_ml_jobs_button.tsx
rename to x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/setup/process_step/create_ml_jobs_button.tsx
diff --git a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/setup/process_step/index.ts b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/setup/process_step/index.ts
similarity index 100%
rename from x-pack/legacy/plugins/infra/public/pages/logs/analysis/setup/process_step/index.ts
rename to x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/setup/process_step/index.ts
diff --git a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/setup/process_step/process_step.tsx b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/setup/process_step/process_step.tsx
similarity index 100%
rename from x-pack/legacy/plugins/infra/public/pages/logs/analysis/setup/process_step/process_step.tsx
rename to x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/setup/process_step/process_step.tsx
diff --git a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/setup/process_step/recreate_ml_jobs_button.tsx b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/setup/process_step/recreate_ml_jobs_button.tsx
similarity index 100%
rename from x-pack/legacy/plugins/infra/public/pages/logs/analysis/setup/process_step/recreate_ml_jobs_button.tsx
rename to x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/setup/process_step/recreate_ml_jobs_button.tsx
diff --git a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/setup/setup_steps.tsx b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/setup/setup_steps.tsx
similarity index 84%
rename from x-pack/legacy/plugins/infra/public/pages/logs/analysis/setup/setup_steps.tsx
rename to x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/setup/setup_steps.tsx
index 4643516e73fac..967c69dfae950 100644
--- a/x-pack/legacy/plugins/infra/public/pages/logs/analysis/setup/setup_steps.tsx
+++ b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/setup/setup_steps.tsx
@@ -12,6 +12,10 @@ import { SetupStatus } from '../../../../../common/log_analysis';
 import { useAnalysisSetupState } from '../../../../containers/logs/log_analysis/log_analysis_setup_state';
 import { InitialConfigurationStep } from './initial_configuration_step';
 import { ProcessStep } from './process_step';
+import {
+  ModuleDescriptor,
+  ModuleSourceConfiguration,
+} from '../../../../containers/logs/log_analysis';
 
 type SetupHandler = (
   indices: string[],
@@ -19,25 +23,25 @@ type SetupHandler = (
   endTime: number | undefined
 ) => void;
 
-interface AnalysisSetupStepsProps {
-  availableIndices: string[];
+interface LogEntryRateSetupStepsProps<JobType extends string> {
   cleanupAndSetup: SetupHandler;
   errorMessages: string[];
   setup: SetupHandler;
   setupStatus: SetupStatus;
-  timestampField: string;
   viewResults: () => void;
+  moduleDescriptor: ModuleDescriptor<JobType>;
+  sourceConfiguration: ModuleSourceConfiguration;
 }
 
-export const AnalysisSetupSteps: React.FunctionComponent<AnalysisSetupStepsProps> = ({
-  availableIndices,
+export const LogEntryRateSetupSteps = <JobType extends string>({
   cleanupAndSetup: cleanupAndSetupModule,
   errorMessages,
   setup: setupModule,
   setupStatus,
-  timestampField,
   viewResults,
-}: AnalysisSetupStepsProps) => {
+  moduleDescriptor,
+  sourceConfiguration,
+}: LogEntryRateSetupStepsProps<JobType>) => {
   const {
     setup,
     cleanupAndSetup,
@@ -50,10 +54,10 @@ export const AnalysisSetupSteps: React.FunctionComponent<AnalysisSetupStepsProps
     validatedIndices,
     setValidatedIndices,
   } = useAnalysisSetupState({
-    availableIndices,
-    setupModule,
     cleanupAndSetupModule,
-    timestampField,
+    moduleDescriptor,
+    setupModule,
+    sourceConfiguration,
   });
 
   const steps = [
diff --git a/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/use_log_entry_rate_module.tsx b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/use_log_entry_rate_module.tsx
new file mode 100644
index 0000000000000..ab6a6578601bf
--- /dev/null
+++ b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/use_log_entry_rate_module.tsx
@@ -0,0 +1,45 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import createContainer from 'constate';
+import { useMemo } from 'react';
+
+import {
+  useLogAnalysisModule,
+  ModuleSourceConfiguration,
+} from '../../../containers/logs/log_analysis';
+import { logEntryRateModule } from './module_descriptor';
+
+export const useLogEntryRateModule = ({
+  indexPattern,
+  sourceId,
+  spaceId,
+  timestampField,
+}: {
+  indexPattern: string;
+  sourceId: string;
+  spaceId: string;
+  timestampField: string;
+}) => {
+  const sourceConfiguration: ModuleSourceConfiguration = useMemo(
+    () => ({
+      indices: indexPattern.split(','),
+      sourceId,
+      spaceId,
+      timestampField,
+    }),
+    [indexPattern]
+  );
+
+  return useLogAnalysisModule({
+    moduleDescriptor: logEntryRateModule,
+    sourceConfiguration,
+  });
+};
+
+export const [LogEntryRateModuleProvider, useLogEntryRateModuleContext] = createContainer(
+  useLogEntryRateModule
+);
diff --git a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_results.tsx b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/use_log_entry_rate_results.ts
similarity index 58%
rename from x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_results.tsx
rename to x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/use_log_entry_rate_results.ts
index 81a80fb565a4b..de2b873001cce 100644
--- a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_results.tsx
+++ b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/use_log_entry_rate_results.ts
@@ -4,75 +4,77 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import createContainer from 'constate';
-import { useMemo, useEffect } from 'react';
+import { useMemo, useState } from 'react';
 
-import { useLogEntryRate } from './log_entry_rate';
-import { GetLogEntryRateSuccessResponsePayload } from '../../../../common/http_api/log_analysis';
+import {
+  GetLogEntryRateSuccessResponsePayload,
+  LogEntryRateHistogramBucket,
+  LogEntryRatePartition,
+} from '../../../../common/http_api/log_analysis';
+import { useTrackedPromise } from '../../../utils/use_tracked_promise';
+import { callGetLogEntryRateAPI } from './service_calls/get_log_entry_rate';
 
-type PartitionBucket = {
+type PartitionBucket = LogEntryRatePartition & {
   startTime: number;
-} & GetLogEntryRateSuccessResponsePayload['data']['histogramBuckets'][0]['partitions'][0];
+};
 
 type PartitionRecord = Record<
   string,
   { buckets: PartitionBucket[]; topAnomalyScore: number; totalNumberOfLogEntries: number }
 >;
 
-export interface LogRateResults {
+export interface LogEntryRateResults {
   bucketDuration: number;
   totalNumberOfLogEntries: number;
-  histogramBuckets: GetLogEntryRateSuccessResponsePayload['data']['histogramBuckets'];
+  histogramBuckets: LogEntryRateHistogramBucket[];
   partitionBuckets: PartitionRecord;
 }
 
-export const useLogAnalysisResults = ({
+export const useLogEntryRateResults = ({
   sourceId,
   startTime,
   endTime,
   bucketDuration = 15 * 60 * 1000,
-  lastRequestTime,
 }: {
   sourceId: string;
   startTime: number;
   endTime: number;
-  bucketDuration?: number;
-  lastRequestTime: number;
+  bucketDuration: number;
 }) => {
-  const { isLoading: isLoadingLogEntryRate, logEntryRate, getLogEntryRate } = useLogEntryRate({
-    sourceId,
-    startTime,
-    endTime,
-    bucketDuration,
-  });
-
-  const isLoading = useMemo(() => isLoadingLogEntryRate, [isLoadingLogEntryRate]);
+  const [logEntryRate, setLogEntryRate] = useState<LogEntryRateResults | null>(null);
 
-  useEffect(() => {
-    getLogEntryRate();
-  }, [sourceId, startTime, endTime, bucketDuration, lastRequestTime]);
+  const [getLogEntryRateRequest, getLogEntryRate] = useTrackedPromise(
+    {
+      cancelPreviousOn: 'resolution',
+      createPromise: async () => {
+        return await callGetLogEntryRateAPI(sourceId, startTime, endTime, bucketDuration);
+      },
+      onResolve: ({ data }) => {
+        setLogEntryRate({
+          bucketDuration: data.bucketDuration,
+          totalNumberOfLogEntries: data.totalNumberOfLogEntries,
+          histogramBuckets: data.histogramBuckets,
+          partitionBuckets: formatLogEntryRateResultsByPartition(data),
+        });
+      },
+      onReject: () => {
+        setLogEntryRate(null);
+      },
+    },
+    [sourceId, startTime, endTime, bucketDuration]
+  );
 
-  const logRateResults: LogRateResults | null = useMemo(() => {
-    if (logEntryRate) {
-      return {
-        bucketDuration: logEntryRate.bucketDuration,
-        totalNumberOfLogEntries: logEntryRate.totalNumberOfLogEntries,
-        histogramBuckets: logEntryRate.histogramBuckets,
-        partitionBuckets: formatLogEntryRateResultsByPartition(logEntryRate),
-      };
-    } else {
-      return null;
-    }
-  }, [logEntryRate]);
+  const isLoading = useMemo(() => getLogEntryRateRequest.state === 'pending', [
+    getLogEntryRateRequest.state,
+  ]);
 
   return {
+    getLogEntryRate,
     isLoading,
-    logRateResults,
+    logEntryRate,
   };
 };
 
-export const LogAnalysisResults = createContainer(useLogAnalysisResults);
-
 const formatLogEntryRateResultsByPartition = (
   results: GetLogEntryRateSuccessResponsePayload['data']
 ): PartitionRecord => {
diff --git a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_results_url_state.tsx b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/use_log_entry_rate_results_url_state.tsx
similarity index 96%
rename from x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_results_url_state.tsx
rename to x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/use_log_entry_rate_results_url_state.tsx
index 19fb7f238fc04..017be6be49e16 100644
--- a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_results_url_state.tsx
+++ b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/use_log_entry_rate_results_url_state.tsx
@@ -4,11 +4,12 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { useEffect } from 'react';
-import * as rt from 'io-ts';
-import { identity, constant } from 'fp-ts/lib/function';
 import { fold } from 'fp-ts/lib/Either';
+import { constant, identity } from 'fp-ts/lib/function';
 import { pipe } from 'fp-ts/lib/pipeable';
+import * as rt from 'io-ts';
+import { useEffect } from 'react';
+
 import { useUrlState } from '../../../utils/use_url_state';
 
 const autoRefreshRT = rt.union([
diff --git a/x-pack/legacy/plugins/infra/server/infra_server.ts b/x-pack/legacy/plugins/infra/server/infra_server.ts
index 845e54e18c7c5..e0c8f607daa93 100644
--- a/x-pack/legacy/plugins/infra/server/infra_server.ts
+++ b/x-pack/legacy/plugins/infra/server/infra_server.ts
@@ -12,8 +12,8 @@ import { createSourceStatusResolvers } from './graphql/source_status';
 import { createSourcesResolvers } from './graphql/sources';
 import { InfraBackendLibs } from './lib/infra_types';
 import {
-  initLogAnalysisGetLogEntryRateRoute,
-  initIndexPatternsValidateRoute,
+  initGetLogEntryRateRoute,
+  initValidateLogAnalysisIndicesRoute,
 } from './routes/log_analysis';
 import { initMetricExplorerRoute } from './routes/metrics_explorer';
 import { initMetadataRoute } from './routes/metadata';
@@ -33,10 +33,10 @@ export const initInfraServer = (libs: InfraBackendLibs) => {
   libs.framework.registerGraphQLEndpoint('/graphql', schema);
 
   initIpToHostName(libs);
-  initLogAnalysisGetLogEntryRateRoute(libs);
+  initGetLogEntryRateRoute(libs);
   initSnapshotRoute(libs);
   initNodeDetailsRoute(libs);
-  initIndexPatternsValidateRoute(libs);
+  initValidateLogAnalysisIndicesRoute(libs);
   initMetricExplorerRoute(libs);
   initMetadataRoute(libs);
 };
diff --git a/x-pack/legacy/plugins/infra/server/lib/adapters/framework/adapter_types.ts b/x-pack/legacy/plugins/infra/server/lib/adapters/framework/adapter_types.ts
index 625607c098028..e88736b08b95b 100644
--- a/x-pack/legacy/plugins/infra/server/lib/adapters/framework/adapter_types.ts
+++ b/x-pack/legacy/plugins/infra/server/lib/adapters/framework/adapter_types.ts
@@ -29,12 +29,12 @@ export interface InfraServerPluginDeps {
 export interface CallWithRequestParams extends GenericParams {
   max_concurrent_shard_requests?: number;
   name?: string;
-  index?: string;
+  index?: string | string[];
   ignore_unavailable?: boolean;
   allow_no_indices?: boolean;
   size?: number;
   terminate_after?: number;
-  fields?: string;
+  fields?: string | string[];
 }
 
 export type InfraResponse = Lifecycle.ReturnValue;
diff --git a/x-pack/legacy/plugins/infra/server/routes/log_analysis/index.ts b/x-pack/legacy/plugins/infra/server/routes/log_analysis/index.ts
index 7364d167efe47..378e32cb3582c 100644
--- a/x-pack/legacy/plugins/infra/server/routes/log_analysis/index.ts
+++ b/x-pack/legacy/plugins/infra/server/routes/log_analysis/index.ts
@@ -5,4 +5,4 @@
  */
 
 export * from './results';
-export * from './index_patterns';
+export * from './validation';
diff --git a/x-pack/legacy/plugins/infra/server/routes/log_analysis/results/log_entry_rate.ts b/x-pack/legacy/plugins/infra/server/routes/log_analysis/results/log_entry_rate.ts
index 973080c880e6d..02866e797e305 100644
--- a/x-pack/legacy/plugins/infra/server/routes/log_analysis/results/log_entry_rate.ts
+++ b/x-pack/legacy/plugins/infra/server/routes/log_analysis/results/log_entry_rate.ts
@@ -22,10 +22,7 @@ import { NoLogRateResultsIndexError } from '../../../lib/log_analysis';
 
 const anyObject = schema.object({}, { allowUnknowns: true });
 
-export const initLogAnalysisGetLogEntryRateRoute = ({
-  framework,
-  logAnalysis,
-}: InfraBackendLibs) => {
+export const initGetLogEntryRateRoute = ({ framework, logAnalysis }: InfraBackendLibs) => {
   framework.registerRoute(
     {
       method: 'post',
diff --git a/x-pack/legacy/plugins/infra/server/routes/log_analysis/index_patterns/index.ts b/x-pack/legacy/plugins/infra/server/routes/log_analysis/validation/index.ts
similarity index 89%
rename from x-pack/legacy/plugins/infra/server/routes/log_analysis/index_patterns/index.ts
rename to x-pack/legacy/plugins/infra/server/routes/log_analysis/validation/index.ts
index a85e119e7318a..727faca69298e 100644
--- a/x-pack/legacy/plugins/infra/server/routes/log_analysis/index_patterns/index.ts
+++ b/x-pack/legacy/plugins/infra/server/routes/log_analysis/validation/index.ts
@@ -4,4 +4,4 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export * from './validate';
+export * from './indices';
diff --git a/x-pack/legacy/plugins/infra/server/routes/log_analysis/index_patterns/validate.ts b/x-pack/legacy/plugins/infra/server/routes/log_analysis/validation/indices.ts
similarity index 77%
rename from x-pack/legacy/plugins/infra/server/routes/log_analysis/index_patterns/validate.ts
rename to x-pack/legacy/plugins/infra/server/routes/log_analysis/validation/indices.ts
index 1f64da1859b5f..ba143a597b66d 100644
--- a/x-pack/legacy/plugins/infra/server/routes/log_analysis/index_patterns/validate.ts
+++ b/x-pack/legacy/plugins/infra/server/routes/log_analysis/validation/indices.ts
@@ -11,7 +11,7 @@ import { identity } from 'fp-ts/lib/function';
 import { schema } from '@kbn/config-schema';
 import { InfraBackendLibs } from '../../../lib/infra_types';
 import {
-  LOG_ANALYSIS_VALIDATION_INDICES_PATH,
+  LOG_ANALYSIS_VALIDATE_INDICES_PATH,
   validationIndicesRequestPayloadRT,
   validationIndicesResponsePayloadRT,
   ValidationIndicesError,
@@ -19,14 +19,13 @@ import {
 
 import { throwErrors } from '../../../../common/runtime_types';
 
-const partitionField = 'event.dataset';
 const escapeHatch = schema.object({}, { allowUnknowns: true });
 
-export const initIndexPatternsValidateRoute = ({ framework }: InfraBackendLibs) => {
+export const initValidateLogAnalysisIndicesRoute = ({ framework }: InfraBackendLibs) => {
   framework.registerRoute(
     {
       method: 'post',
-      path: LOG_ANALYSIS_VALIDATION_INDICES_PATH,
+      path: LOG_ANALYSIS_VALIDATE_INDICES_PATH,
       validate: { body: escapeHatch },
     },
     async (requestContext, request, response) => {
@@ -36,7 +35,7 @@ export const initIndexPatternsValidateRoute = ({ framework }: InfraBackendLibs)
           fold(throwErrors(Boom.badRequest), identity)
         );
 
-        const { timestampField, indices } = payload.data;
+        const { fields, indices } = payload.data;
         const errors: ValidationIndicesError[] = [];
 
         // Query each pattern individually, to map correctly the errors
@@ -44,7 +43,7 @@ export const initIndexPatternsValidateRoute = ({ framework }: InfraBackendLibs)
           indices.map(async index => {
             const fieldCaps = await framework.callWithRequest(requestContext, 'fieldCaps', {
               index,
-              fields: `${timestampField},${partitionField}`,
+              fields: fields.map(field => field.name),
             });
 
             if (fieldCaps.indices.length === 0) {
@@ -55,32 +54,30 @@ export const initIndexPatternsValidateRoute = ({ framework }: InfraBackendLibs)
               return;
             }
 
-            ([
-              [timestampField, 'date'],
-              [partitionField, 'keyword'],
-            ] as const).forEach(([field, fieldType]) => {
-              const fieldMetadata = fieldCaps.fields[field];
+            fields.forEach(({ name: fieldName, validTypes }) => {
+              const fieldMetadata = fieldCaps.fields[fieldName];
 
               if (fieldMetadata === undefined) {
                 errors.push({
                   error: 'FIELD_NOT_FOUND',
                   index,
-                  field,
+                  field: fieldName,
                 });
               } else {
                 const fieldTypes = Object.keys(fieldMetadata);
 
-                if (fieldTypes.length > 1 || fieldTypes[0] !== fieldType) {
+                if (!fieldTypes.every(fieldType => validTypes.includes(fieldType))) {
                   errors.push({
                     error: `FIELD_NOT_VALID`,
                     index,
-                    field,
+                    field: fieldName,
                   });
                 }
               }
             });
           })
         );
+
         return response.ok({
           body: validationIndicesResponsePayloadRT.encode({ data: { errors } }),
         });

From 48d897e6e7127c28b92be1fc210c06d268a2d982 Mon Sep 17 00:00:00 2001
From: Frank Hassanabad <frank.hassanabad@elastic.co>
Date: Tue, 10 Dec 2019 12:01:48 -0700
Subject: [PATCH 09/24] [SIEM][Detection Engine] Adds the default name space to
 the end of the signals index

## Summary

One liner to add the `default` to the end of the siem signals index for people to play with it.

### Checklist

Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR.

~~- [ ] This was checked for cross-browser compatibility, [including a check against IE11](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility)~~

~~- [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)~~

~~- [ ] [Documentation](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#writing-documentation) was added for features that require explanation or tutorials~~

~~- [ ] [Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios~~

~~- [ ] This was checked for [keyboard-only and screenreader accessibility](https://developer.mozilla.org/en-US/docs/Learn/Tools_and_testing/Cross_browser_testing/Accessibility#Accessibility_testing_checklist)~~

### For maintainers

~~- [ ] This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~~

~~- [ ] This includes a feature addition or change that requires a release note and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~~
---
 .../siem/public/pages/detection_engine/signals/index.tsx        | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/signals/index.tsx b/x-pack/legacy/plugins/siem/public/pages/detection_engine/signals/index.tsx
index ca178db9cd97f..74b7b9349c2cb 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/signals/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/signals/index.tsx
@@ -64,7 +64,7 @@ export const SignalsTable = React.memo(() => {
       <GlobalTime>
         {({ to, from, setQuery, deleteQuery, isInitializing }) => (
           <StatefulEventsViewer
-            defaultIndices={[DEFAULT_SIGNALS_INDEX]}
+            defaultIndices={[`${DEFAULT_SIGNALS_INDEX}-default`]}
             defaultFilters={filterGroup === FILTER_OPEN ? signalsOpenFilters : signalsClosedFilters}
             defaultModel={signalsDefaultModel}
             end={to}

From 2dcb44850a04cf0943ce2673e8b264a4f1a64f33 Mon Sep 17 00:00:00 2001
From: "Christiane (Tina) Heiligers" <christiane.heiligers@elastic.co>
Date: Tue, 10 Dec 2019 12:55:41 -0700
Subject: [PATCH 10/24] [Telemetry/Pulse] Updates advanced settings text for
 usage data (#52657)

* [Telemetry/Pulse] Updates advanced settings text for usage data
---
 .../__snapshots__/telemetry_form.test.js.snap | 31 +++++++++++--------
 .../public/components/telemetry_form.js       | 28 +++++++++++------
 2 files changed, 36 insertions(+), 23 deletions(-)

diff --git a/src/legacy/core_plugins/telemetry/public/components/__snapshots__/telemetry_form.test.js.snap b/src/legacy/core_plugins/telemetry/public/components/__snapshots__/telemetry_form.test.js.snap
index a7f8d72e016f8..079a43e77616d 100644
--- a/src/legacy/core_plugins/telemetry/public/components/__snapshots__/telemetry_form.test.js.snap
+++ b/src/legacy/core_plugins/telemetry/public/components/__snapshots__/telemetry_form.test.js.snap
@@ -38,7 +38,24 @@ exports[`TelemetryForm renders as expected when allows to change optIn status 1`
             "defVal": true,
             "description": <React.Fragment>
               <p>
-                Help us improve the Elastic Stack by providing usage statistics for basic features. We will not share this data outside of Elastic.
+                <FormattedMessage
+                  defaultMessage="Enabling data usage collection helps us manage and improve our products and services. See our {privacyStatementLink} for more details."
+                  id="telemetry.telemetryConfigAndLinkDescription"
+                  values={
+                    Object {
+                      "privacyStatementLink": <ForwardRef
+                        href="https://www.elastic.co/legal/privacy-statement"
+                        target="_blank"
+                      >
+                        <FormattedMessage
+                          defaultMessage="Privacy Statement"
+                          id="telemetry.readOurUsageDataPrivacyStatementLinkText"
+                          values={Object {}}
+                        />
+                      </ForwardRef>,
+                    }
+                  }
+                />
               </p>
               <p>
                 <ForwardRef
@@ -51,18 +68,6 @@ exports[`TelemetryForm renders as expected when allows to change optIn status 1`
                   />
                 </ForwardRef>
               </p>
-              <p>
-                <ForwardRef
-                  href="https://www.elastic.co/legal/privacy-statement"
-                  target="_blank"
-                >
-                  <FormattedMessage
-                    defaultMessage="Read our usage data privacy statement"
-                    id="telemetry.readOurUsageDataPrivacyStatementLinkText"
-                    values={Object {}}
-                  />
-                </ForwardRef>
-              </p>
             </React.Fragment>,
             "type": "boolean",
             "value": false,
diff --git a/src/legacy/core_plugins/telemetry/public/components/telemetry_form.js b/src/legacy/core_plugins/telemetry/public/components/telemetry_form.js
index d4bbe1029b40d..f6012a271cde5 100644
--- a/src/legacy/core_plugins/telemetry/public/components/telemetry_form.js
+++ b/src/legacy/core_plugins/telemetry/public/components/telemetry_form.js
@@ -29,7 +29,7 @@ import {
   EuiSpacer,
   EuiText,
 } from '@elastic/eui';
-import { getConfigTelemetryDesc, PRIVACY_STATEMENT_URL } from '../../common/constants';
+import { PRIVACY_STATEMENT_URL } from '../../common/constants';
 import { OptInExampleFlyout } from './opt_in_details_component';
 import { Field } from 'ui/management';
 import { FormattedMessage } from '@kbn/i18n/react';
@@ -162,7 +162,23 @@ export class TelemetryForm extends Component {
 
   renderDescription = () => (
     <Fragment>
-      <p>{getConfigTelemetryDesc()}</p>
+      <p>
+        <FormattedMessage
+          id="telemetry.telemetryConfigAndLinkDescription"
+          defaultMessage="Enabling data usage collection helps us manage and improve our products and services.
+          See our {privacyStatementLink} for more details."
+          values={{
+            privacyStatementLink: (
+              <EuiLink href={PRIVACY_STATEMENT_URL} target="_blank">
+                <FormattedMessage
+                  id="telemetry.readOurUsageDataPrivacyStatementLinkText"
+                  defaultMessage="Privacy Statement"
+                />
+              </EuiLink>
+            )
+          }}
+        />
+      </p>
       <p>
         <EuiLink onClick={this.toggleExample}>
           <FormattedMessage
@@ -171,14 +187,6 @@ export class TelemetryForm extends Component {
           />
         </EuiLink>
       </p>
-      <p>
-        <EuiLink href={PRIVACY_STATEMENT_URL} target="_blank">
-          <FormattedMessage
-            id="telemetry.readOurUsageDataPrivacyStatementLinkText"
-            defaultMessage="Read our usage data privacy statement"
-          />
-        </EuiLink>
-      </p>
     </Fragment>
   )
 

From 6e476e845d38018a1f069edadd81065ac5490dd0 Mon Sep 17 00:00:00 2001
From: gchaps <33642766+gchaps@users.noreply.github.com>
Date: Tue, 10 Dec 2019 12:30:11 -0800
Subject: [PATCH 11/24] [DOCS] Updtes description of
 elasticsearch.requestHeadersWhitelist (#52675)

---
 docs/setup/settings.asciidoc | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docs/setup/settings.asciidoc b/docs/setup/settings.asciidoc
index 39c87d97af4ba..5cda7b2b214f0 100644
--- a/docs/setup/settings.asciidoc
+++ b/docs/setup/settings.asciidoc
@@ -65,6 +65,8 @@ connects to this Kibana instance.
 `elasticsearch.requestHeadersWhitelist:`:: *Default: `[ 'authorization' ]`* List
 of Kibana client-side headers to send to Elasticsearch. To send *no* client-side
 headers, set this value to [] (an empty list).
+Removing the `authorization` header from being whitelisted means that you cannot 
+use <<basic-authentication, basic authentication>> in Kibana.
 
 `elasticsearch.requestTimeout:`:: *Default: 30000* Time in milliseconds to wait
 for responses from the back end or Elasticsearch. This value must be a positive

From 0eb4c18fe09c3f01bee3ec16206738a3a53f78ae Mon Sep 17 00:00:00 2001
From: Tiago Costa <tiagoffcc@hotmail.com>
Date: Tue, 10 Dec 2019 22:05:19 +0000
Subject: [PATCH 12/24] feat(NA): add trap for SIGINT in the git precommit hook
 (#52662)

---
 src/dev/register_git_hook/register_git_hook.js | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/src/dev/register_git_hook/register_git_hook.js b/src/dev/register_git_hook/register_git_hook.js
index a61922078e687..31136cab0adae 100644
--- a/src/dev/register_git_hook/register_git_hook.js
+++ b/src/dev/register_git_hook/register_git_hook.js
@@ -58,6 +58,15 @@ function getKbnPrecommitGitHookScript(rootPath, nodeHome, platform) {
 
   set -euo pipefail
 
+  # Make it possible to terminate pre commit hook
+  # using ctrl-c so nothing else would happen or be
+  # sent to the output.
+  #
+  # The correct exit code on that situation
+  # according the linux documentation project is 130
+  # https://www.tldp.org/LDP/abs/html/exitcodes.html
+  trap "exit 130" SIGINT
+
   has_node() {
     command -v node >/dev/null 2>&1
   }

From 79fc07c0c3505a0d45ac00aca7573cb21ef3c531 Mon Sep 17 00:00:00 2001
From: Stacey Gammon <gammon@elastic.co>
Date: Tue, 10 Dec 2019 18:02:03 -0500
Subject: [PATCH 13/24] Add top level examples folder and command to run,
 `--run-examples`. (#52027)

* Add top level examples folder and command to run, `--run-examples`.

* Add comment explaining reason --run-examples flag turns off base path.
---
 .ci/packer_cache.sh                           |  1 +
 examples/README.md                            |  8 +++
 examples/demo_search/README.md                |  8 +++
 .../demo_search/common/index.ts               |  5 +-
 .../demo_search/kibana.json                   |  0
 .../demo_search/package.json                  |  2 +-
 .../public/demo_search_strategy.ts            |  4 +-
 .../demo_search/public/index.ts               |  0
 .../demo_search/public/plugin.ts              |  6 +-
 .../server/demo_search_strategy.ts            |  2 +-
 .../demo_search/server/index.ts               |  0
 .../demo_search/server/plugin.ts              |  2 +-
 .../demo_search/tsconfig.json                 |  4 +-
 examples/search_explorer/README.md            |  8 +++
 .../search_explorer/kibana.json               |  0
 .../search_explorer/package.json              |  2 +-
 .../search_explorer/public/application.tsx    |  2 +-
 .../search_explorer/public/demo_strategy.tsx  |  2 +-
 .../search_explorer/public/do_search.tsx      |  5 +-
 .../search_explorer/public/documentation.tsx  |  0
 .../search_explorer/public/es_strategy.tsx    | 10 ++--
 .../search_explorer/public/guide_section.tsx  |  0
 .../search_explorer/public/index.ts           |  0
 .../search_explorer/public/page.tsx           |  0
 .../search_explorer/public/plugin.tsx         |  2 +-
 .../search_explorer/public/search_api.tsx     | 16 +++---
 .../search_explorer/tsconfig.json             |  4 +-
 package.json                                  |  1 +
 packages/kbn-pm/dist/index.js                 |  1 +
 packages/kbn-pm/src/config.ts                 |  1 +
 renovate.json5                                |  1 +
 scripts/functional_tests.js                   |  1 +
 src/cli/serve/serve.js                        | 15 ++++-
 src/dev/renovate/package_globs.ts             |  1 +
 src/dev/typescript/projects.ts                |  3 +
 test/examples/README.md                       | 23 ++++++++
 test/examples/config.js                       | 55 +++++++++++++++++++
 .../search/demo_data.ts                       |  0
 .../search/es_search.ts                       |  0
 .../test_suites => examples}/search/index.ts  |  0
 test/plugin_functional/config.js              |  1 -
 41 files changed, 156 insertions(+), 40 deletions(-)
 create mode 100644 examples/README.md
 create mode 100644 examples/demo_search/README.md
 rename {test/plugin_functional/plugins => examples}/demo_search/common/index.ts (90%)
 rename {test/plugin_functional/plugins => examples}/demo_search/kibana.json (100%)
 rename {test/plugin_functional/plugins => examples}/demo_search/package.json (88%)
 rename {test/plugin_functional/plugins => examples}/demo_search/public/demo_search_strategy.ts (96%)
 rename {test/plugin_functional/plugins => examples}/demo_search/public/index.ts (100%)
 rename {test/plugin_functional/plugins => examples}/demo_search/public/plugin.ts (92%)
 rename {test/plugin_functional/plugins => examples}/demo_search/server/demo_search_strategy.ts (94%)
 rename {test/plugin_functional/plugins => examples}/demo_search/server/index.ts (100%)
 rename {test/plugin_functional/plugins => examples}/demo_search/server/plugin.ts (97%)
 rename {test/plugin_functional/plugins => examples}/demo_search/tsconfig.json (75%)
 create mode 100644 examples/search_explorer/README.md
 rename {test/plugin_functional/plugins => examples}/search_explorer/kibana.json (100%)
 rename {test/plugin_functional/plugins => examples}/search_explorer/package.json (87%)
 rename {test/plugin_functional/plugins => examples}/search_explorer/public/application.tsx (97%)
 rename {test/plugin_functional/plugins => examples}/search_explorer/public/demo_strategy.tsx (98%)
 rename {test/plugin_functional/plugins => examples}/search_explorer/public/do_search.tsx (97%)
 rename {test/plugin_functional/plugins => examples}/search_explorer/public/documentation.tsx (100%)
 rename {test/plugin_functional/plugins => examples}/search_explorer/public/es_strategy.tsx (87%)
 rename {test/plugin_functional/plugins => examples}/search_explorer/public/guide_section.tsx (100%)
 rename {test/plugin_functional/plugins => examples}/search_explorer/public/index.ts (100%)
 rename {test/plugin_functional/plugins => examples}/search_explorer/public/page.tsx (100%)
 rename {test/plugin_functional/plugins => examples}/search_explorer/public/plugin.tsx (94%)
 rename {test/plugin_functional/plugins => examples}/search_explorer/public/search_api.tsx (70%)
 rename {test/plugin_functional/plugins => examples}/search_explorer/tsconfig.json (73%)
 create mode 100644 test/examples/README.md
 create mode 100644 test/examples/config.js
 rename test/{plugin_functional/test_suites => examples}/search/demo_data.ts (100%)
 rename test/{plugin_functional/test_suites => examples}/search/es_search.ts (100%)
 rename test/{plugin_functional/test_suites => examples}/search/index.ts (100%)

diff --git a/.ci/packer_cache.sh b/.ci/packer_cache.sh
index b697f22c009d1..ab68a60dcfc27 100755
--- a/.ci/packer_cache.sh
+++ b/.ci/packer_cache.sh
@@ -44,6 +44,7 @@ tar -cf "$HOME/.kibana/bootstrap_cache/$branch.tar" \
   x-pack/legacy/plugins/*/node_modules \
   x-pack/legacy/plugins/reporting/.chromium \
   test/plugin_functional/plugins/*/node_modules \
+  examples/*/node_modules \
   .es \
   .chromedriver \
   .geckodriver;
diff --git a/examples/README.md b/examples/README.md
new file mode 100644
index 0000000000000..7cade0b35f820
--- /dev/null
+++ b/examples/README.md
@@ -0,0 +1,8 @@
+## Example plugins
+
+This folder contains example plugins.  To run the plugins in this folder, use the `--run-examples` flag, via
+
+```
+yarn start --run-examples
+```
+
diff --git a/examples/demo_search/README.md b/examples/demo_search/README.md
new file mode 100644
index 0000000000000..f0b461e3287b4
--- /dev/null
+++ b/examples/demo_search/README.md
@@ -0,0 +1,8 @@
+## Demo search strategy
+
+This example registers a custom search strategy that simply takes a name string in the request and returns the
+string `Hello {name}`
+
+To see the demo search strategy in action, navigate to the `Search explorer` app.
+
+To run these examples, use the command `yarn start --run-examples`.
\ No newline at end of file
diff --git a/test/plugin_functional/plugins/demo_search/common/index.ts b/examples/demo_search/common/index.ts
similarity index 90%
rename from test/plugin_functional/plugins/demo_search/common/index.ts
rename to examples/demo_search/common/index.ts
index 9254412ece291..6587ee96ef61b 100644
--- a/test/plugin_functional/plugins/demo_search/common/index.ts
+++ b/examples/demo_search/common/index.ts
@@ -17,10 +17,7 @@
  * under the License.
  */
 
-import {
-  IKibanaSearchRequest,
-  IKibanaSearchResponse,
-} from '../../../../../src/plugins/data/public';
+import { IKibanaSearchRequest, IKibanaSearchResponse } from '../../../src/plugins/data/public';
 
 export const DEMO_SEARCH_STRATEGY = 'DEMO_SEARCH_STRATEGY';
 
diff --git a/test/plugin_functional/plugins/demo_search/kibana.json b/examples/demo_search/kibana.json
similarity index 100%
rename from test/plugin_functional/plugins/demo_search/kibana.json
rename to examples/demo_search/kibana.json
diff --git a/test/plugin_functional/plugins/demo_search/package.json b/examples/demo_search/package.json
similarity index 88%
rename from test/plugin_functional/plugins/demo_search/package.json
rename to examples/demo_search/package.json
index 1f4fa1421906a..404002a50e710 100644
--- a/test/plugin_functional/plugins/demo_search/package.json
+++ b/examples/demo_search/package.json
@@ -8,7 +8,7 @@
   },
   "license": "Apache-2.0",
   "scripts": {
-    "kbn": "node ../../../../scripts/kbn.js",
+    "kbn": "node ../../scripts/kbn.js",
     "build": "rm -rf './target' && tsc"
   },
   "devDependencies": {
diff --git a/test/plugin_functional/plugins/demo_search/public/demo_search_strategy.ts b/examples/demo_search/public/demo_search_strategy.ts
similarity index 96%
rename from test/plugin_functional/plugins/demo_search/public/demo_search_strategy.ts
rename to examples/demo_search/public/demo_search_strategy.ts
index 298eaaaf420e0..d2854151e14c8 100644
--- a/test/plugin_functional/plugins/demo_search/public/demo_search_strategy.ts
+++ b/examples/demo_search/public/demo_search_strategy.ts
@@ -22,8 +22,8 @@ import {
   ISearchContext,
   SYNC_SEARCH_STRATEGY,
   ISearchGeneric,
-} from '../../../../../src/plugins/data/public';
-import { TSearchStrategyProvider, ISearchStrategy } from '../../../../../src/plugins/data/public';
+} from '../../../src/plugins/data/public';
+import { TSearchStrategyProvider, ISearchStrategy } from '../../../src/plugins/data/public';
 
 import { DEMO_SEARCH_STRATEGY, IDemoResponse } from '../common';
 
diff --git a/test/plugin_functional/plugins/demo_search/public/index.ts b/examples/demo_search/public/index.ts
similarity index 100%
rename from test/plugin_functional/plugins/demo_search/public/index.ts
rename to examples/demo_search/public/index.ts
diff --git a/test/plugin_functional/plugins/demo_search/public/plugin.ts b/examples/demo_search/public/plugin.ts
similarity index 92%
rename from test/plugin_functional/plugins/demo_search/public/plugin.ts
rename to examples/demo_search/public/plugin.ts
index 37f8d3955708a..81ba585b99190 100644
--- a/test/plugin_functional/plugins/demo_search/public/plugin.ts
+++ b/examples/demo_search/public/plugin.ts
@@ -17,8 +17,8 @@
  * under the License.
  */
 
-import { DataPublicPluginSetup } from '../../../../../src/plugins/data/public';
-import { Plugin, CoreSetup, PluginInitializerContext } from '../../../../../src/core/public';
+import { DataPublicPluginSetup } from '../../../src/plugins/data/public';
+import { Plugin, CoreSetup, PluginInitializerContext } from '../../../src/core/public';
 import { DEMO_SEARCH_STRATEGY } from '../common';
 import { demoClientSearchStrategyProvider } from './demo_search_strategy';
 import { IDemoRequest, IDemoResponse } from '../common';
@@ -36,7 +36,7 @@ interface DemoDataSearchSetupDependencies {
  * If the caller does not pass in the right `request` shape, typescript will
  * complain. The caller will also get a typed response.
  */
-declare module '../../../../../src/plugins/data/public' {
+declare module '../../../src/plugins/data/public' {
   export interface IRequestTypesMap {
     [DEMO_SEARCH_STRATEGY]: IDemoRequest;
   }
diff --git a/test/plugin_functional/plugins/demo_search/server/demo_search_strategy.ts b/examples/demo_search/server/demo_search_strategy.ts
similarity index 94%
rename from test/plugin_functional/plugins/demo_search/server/demo_search_strategy.ts
rename to examples/demo_search/server/demo_search_strategy.ts
index d3f2360add6c0..5b0883be1fc51 100644
--- a/test/plugin_functional/plugins/demo_search/server/demo_search_strategy.ts
+++ b/examples/demo_search/server/demo_search_strategy.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import { TSearchStrategyProvider } from 'src/plugins/data/server';
+import { TSearchStrategyProvider } from '../../../src/plugins/data/server';
 import { DEMO_SEARCH_STRATEGY } from '../common';
 
 export const demoSearchStrategyProvider: TSearchStrategyProvider<typeof DEMO_SEARCH_STRATEGY> = () => {
diff --git a/test/plugin_functional/plugins/demo_search/server/index.ts b/examples/demo_search/server/index.ts
similarity index 100%
rename from test/plugin_functional/plugins/demo_search/server/index.ts
rename to examples/demo_search/server/index.ts
diff --git a/test/plugin_functional/plugins/demo_search/server/plugin.ts b/examples/demo_search/server/plugin.ts
similarity index 97%
rename from test/plugin_functional/plugins/demo_search/server/plugin.ts
rename to examples/demo_search/server/plugin.ts
index c6628e7c76820..23c82225563c8 100644
--- a/test/plugin_functional/plugins/demo_search/server/plugin.ts
+++ b/examples/demo_search/server/plugin.ts
@@ -35,7 +35,7 @@ interface IDemoSearchExplorerDeps {
  * If the caller does not pass in the right `request` shape, typescript will
  * complain. The caller will also get a typed response.
  */
-declare module '../../../../../src/plugins/data/server' {
+declare module '../../../src/plugins/data/server' {
   export interface IRequestTypesMap {
     [DEMO_SEARCH_STRATEGY]: IDemoRequest;
   }
diff --git a/test/plugin_functional/plugins/demo_search/tsconfig.json b/examples/demo_search/tsconfig.json
similarity index 75%
rename from test/plugin_functional/plugins/demo_search/tsconfig.json
rename to examples/demo_search/tsconfig.json
index 304ffdc0a299d..7fa03739119b4 100644
--- a/test/plugin_functional/plugins/demo_search/tsconfig.json
+++ b/examples/demo_search/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../../../tsconfig.json",
+  "extends": "../../tsconfig.json",
   "compilerOptions": {
     "outDir": "./target",
     "skipLibCheck": true
@@ -10,7 +10,7 @@
     "public/**/*.ts",
     "public/**/*.tsx",
     "server/**/*.ts",
-    "../../../../typings/**/*"
+    "../../typings/**/*"
   ],
   "exclude": []
 }
diff --git a/examples/search_explorer/README.md b/examples/search_explorer/README.md
new file mode 100644
index 0000000000000..0e5a48cf22dc1
--- /dev/null
+++ b/examples/search_explorer/README.md
@@ -0,0 +1,8 @@
+## Search explorer
+
+This example search explorer app shows how to use different search strategies in order to retrieve data.
+
+One demo uses the built in elasticsearch search strategy, and runs a search against data in elasticsearch. The
+other demo uses the custom demo search strategy, a custom search strategy registerd inside the [demo_search plugin](../demo_search).
+
+To run this example, use the command `yarn start --run-examples`.
\ No newline at end of file
diff --git a/test/plugin_functional/plugins/search_explorer/kibana.json b/examples/search_explorer/kibana.json
similarity index 100%
rename from test/plugin_functional/plugins/search_explorer/kibana.json
rename to examples/search_explorer/kibana.json
diff --git a/test/plugin_functional/plugins/search_explorer/package.json b/examples/search_explorer/package.json
similarity index 87%
rename from test/plugin_functional/plugins/search_explorer/package.json
rename to examples/search_explorer/package.json
index 9a5e0e83a2207..62d0127c30cc6 100644
--- a/test/plugin_functional/plugins/search_explorer/package.json
+++ b/examples/search_explorer/package.json
@@ -8,7 +8,7 @@
   },
   "license": "Apache-2.0",
   "scripts": {
-    "kbn": "node ../../../../scripts/kbn.js",
+    "kbn": "node ../../scripts/kbn.js",
     "build": "rm -rf './target' && tsc"
   },
   "devDependencies": {
diff --git a/test/plugin_functional/plugins/search_explorer/public/application.tsx b/examples/search_explorer/public/application.tsx
similarity index 97%
rename from test/plugin_functional/plugins/search_explorer/public/application.tsx
rename to examples/search_explorer/public/application.tsx
index 4762209a548c1..801a3c615ac61 100644
--- a/test/plugin_functional/plugins/search_explorer/public/application.tsx
+++ b/examples/search_explorer/public/application.tsx
@@ -28,7 +28,7 @@ import {
   EuiSideNav,
 } from '@elastic/eui';
 
-import { AppMountContext, AppMountParameters } from '../../../../../src/core/public';
+import { AppMountContext, AppMountParameters } from '../../../src/core/public';
 import { EsSearchTest } from './es_strategy';
 import { Page } from './page';
 import { DemoStrategy } from './demo_strategy';
diff --git a/test/plugin_functional/plugins/search_explorer/public/demo_strategy.tsx b/examples/search_explorer/public/demo_strategy.tsx
similarity index 98%
rename from test/plugin_functional/plugins/search_explorer/public/demo_strategy.tsx
rename to examples/search_explorer/public/demo_strategy.tsx
index 8a0dd31e3595f..7c6c21d2b7aed 100644
--- a/test/plugin_functional/plugins/search_explorer/public/demo_strategy.tsx
+++ b/examples/search_explorer/public/demo_strategy.tsx
@@ -25,7 +25,7 @@ import {
   EuiFlexGroup,
   EuiFieldText,
 } from '@elastic/eui';
-import { ISearchGeneric } from '../../../../../src/plugins/data/public';
+import { ISearchGeneric } from '../../../src/plugins/data/public';
 import { DoSearch } from './do_search';
 import { GuideSection } from './guide_section';
 
diff --git a/test/plugin_functional/plugins/search_explorer/public/do_search.tsx b/examples/search_explorer/public/do_search.tsx
similarity index 97%
rename from test/plugin_functional/plugins/search_explorer/public/do_search.tsx
rename to examples/search_explorer/public/do_search.tsx
index e039e4ff3f63f..f279b9fcd6e23 100644
--- a/test/plugin_functional/plugins/search_explorer/public/do_search.tsx
+++ b/examples/search_explorer/public/do_search.tsx
@@ -21,10 +21,7 @@ import React from 'react';
 import { EuiButton, EuiCodeBlock, EuiFlexItem, EuiFlexGroup, EuiText } from '@elastic/eui';
 import { EuiProgress } from '@elastic/eui';
 import { Observable } from 'rxjs';
-import {
-  IKibanaSearchResponse,
-  IKibanaSearchRequest,
-} from '../../../../../src/plugins/data/public';
+import { IKibanaSearchResponse, IKibanaSearchRequest } from '../../../src/plugins/data/public';
 
 interface Props {
   request: IKibanaSearchRequest;
diff --git a/test/plugin_functional/plugins/search_explorer/public/documentation.tsx b/examples/search_explorer/public/documentation.tsx
similarity index 100%
rename from test/plugin_functional/plugins/search_explorer/public/documentation.tsx
rename to examples/search_explorer/public/documentation.tsx
diff --git a/test/plugin_functional/plugins/search_explorer/public/es_strategy.tsx b/examples/search_explorer/public/es_strategy.tsx
similarity index 87%
rename from test/plugin_functional/plugins/search_explorer/public/es_strategy.tsx
rename to examples/search_explorer/public/es_strategy.tsx
index d35c67191a1f8..e26c11a646669 100644
--- a/test/plugin_functional/plugins/search_explorer/public/es_strategy.tsx
+++ b/examples/search_explorer/public/es_strategy.tsx
@@ -29,19 +29,19 @@ import {
   ISearchGeneric,
   IEsSearchResponse,
   IEsSearchRequest,
-} from '../../../../../src/plugins/data/public';
+} from '../../../src/plugins/data/public';
 import { DoSearch } from './do_search';
 import { GuideSection } from './guide_section';
 
 // @ts-ignore
-import serverPlugin from '!!raw-loader!./../../../../../src/plugins/data/server/search/es_search/es_search_service';
+import serverPlugin from '!!raw-loader!./../../../src/plugins/data/server/search/es_search/es_search_service';
 // @ts-ignore
-import serverStrategy from '!!raw-loader!./../../../../../src/plugins/data/server/search/es_search/es_search_strategy';
+import serverStrategy from '!!raw-loader!./../../../src/plugins/data/server/search/es_search/es_search_strategy';
 
 // @ts-ignore
-import publicPlugin from '!!raw-loader!./../../../../../src/plugins/data/public/search/es_search/es_search_service';
+import publicPlugin from '!!raw-loader!./../../../src/plugins/data/public/search/es_search/es_search_service';
 // @ts-ignore
-import publicStrategy from '!!raw-loader!./../../../../../src/plugins/data/public/search/es_search/es_search_strategy';
+import publicStrategy from '!!raw-loader!./../../../src/plugins/data/public/search/es_search/es_search_strategy';
 
 interface Props {
   search: ISearchGeneric;
diff --git a/test/plugin_functional/plugins/search_explorer/public/guide_section.tsx b/examples/search_explorer/public/guide_section.tsx
similarity index 100%
rename from test/plugin_functional/plugins/search_explorer/public/guide_section.tsx
rename to examples/search_explorer/public/guide_section.tsx
diff --git a/test/plugin_functional/plugins/search_explorer/public/index.ts b/examples/search_explorer/public/index.ts
similarity index 100%
rename from test/plugin_functional/plugins/search_explorer/public/index.ts
rename to examples/search_explorer/public/index.ts
diff --git a/test/plugin_functional/plugins/search_explorer/public/page.tsx b/examples/search_explorer/public/page.tsx
similarity index 100%
rename from test/plugin_functional/plugins/search_explorer/public/page.tsx
rename to examples/search_explorer/public/page.tsx
diff --git a/test/plugin_functional/plugins/search_explorer/public/plugin.tsx b/examples/search_explorer/public/plugin.tsx
similarity index 94%
rename from test/plugin_functional/plugins/search_explorer/public/plugin.tsx
rename to examples/search_explorer/public/plugin.tsx
index cbe1073aa186b..a7a6fd11341a4 100644
--- a/test/plugin_functional/plugins/search_explorer/public/plugin.tsx
+++ b/examples/search_explorer/public/plugin.tsx
@@ -18,7 +18,7 @@
  */
 
 import { Plugin, CoreSetup } from 'kibana/public';
-import { ISearchAppMountContext } from '../../../../../src/plugins/data/public';
+import { ISearchAppMountContext } from '../../../src/plugins/data/public';
 
 declare module 'kibana/public' {
   interface AppMountContext {
diff --git a/test/plugin_functional/plugins/search_explorer/public/search_api.tsx b/examples/search_explorer/public/search_api.tsx
similarity index 70%
rename from test/plugin_functional/plugins/search_explorer/public/search_api.tsx
rename to examples/search_explorer/public/search_api.tsx
index 8ec6225d1f172..fc68571e4ef68 100644
--- a/test/plugin_functional/plugins/search_explorer/public/search_api.tsx
+++ b/examples/search_explorer/public/search_api.tsx
@@ -20,22 +20,22 @@ import React from 'react';
 import { GuideSection } from './guide_section';
 
 // @ts-ignore
-import publicSetupContract from '!!raw-loader!./../../../../../src/plugins/data/public/search/i_search_setup';
+import publicSetupContract from '!!raw-loader!./../../../src/plugins/data/public/search/i_search_setup';
 // @ts-ignore
-import publicSearchStrategy from '!!raw-loader!./../../../../../src/plugins/data/public/search/i_search_strategy';
+import publicSearchStrategy from '!!raw-loader!./../../../src/plugins/data/public/search/i_search_strategy';
 // @ts-ignore
-import publicSearch from '!!raw-loader!./../../../../../src/plugins/data/public/search/i_search';
+import publicSearch from '!!raw-loader!./../../../src/plugins/data/public/search/i_search';
 // @ts-ignore
-import publicPlugin from '!!raw-loader!./../../../../../src/plugins/data/public/search/search_service';
+import publicPlugin from '!!raw-loader!./../../../src/plugins/data/public/search/search_service';
 
 // @ts-ignore
-import serverSetupContract from '!!raw-loader!./../../../../../src/plugins/data/server/search/i_search_setup';
+import serverSetupContract from '!!raw-loader!./../../../src/plugins/data/server/search/i_search_setup';
 // @ts-ignore
-import serverSearchStrategy from '!!raw-loader!./../../../../../src/plugins/data/server/search/i_search_strategy';
+import serverSearchStrategy from '!!raw-loader!./../../../src/plugins/data/server/search/i_search_strategy';
 // @ts-ignore
-import serverSearch from '!!raw-loader!./../../../../../src/plugins/data/server/search/i_search';
+import serverSearch from '!!raw-loader!./../../../src/plugins/data/server/search/i_search';
 // @ts-ignore
-import serverPlugin from '!!raw-loader!./../../../../../src/plugins/data/server/search/search_service';
+import serverPlugin from '!!raw-loader!./../../../src/plugins/data/server/search/search_service';
 
 export const SearchApiPage = () => (
   <GuideSection
diff --git a/test/plugin_functional/plugins/search_explorer/tsconfig.json b/examples/search_explorer/tsconfig.json
similarity index 73%
rename from test/plugin_functional/plugins/search_explorer/tsconfig.json
rename to examples/search_explorer/tsconfig.json
index 1ba21f11b7de2..d508076b33199 100644
--- a/test/plugin_functional/plugins/search_explorer/tsconfig.json
+++ b/examples/search_explorer/tsconfig.json
@@ -1,5 +1,5 @@
 {
-  "extends": "../../../../tsconfig.json",
+  "extends": "../../tsconfig.json",
   "compilerOptions": {
     "outDir": "./target",
     "skipLibCheck": true
@@ -9,7 +9,7 @@
     "public/**/*.ts",
     "public/**/*.tsx",
     "server/**/*.ts",
-    "../../../../typings/**/*",
+    "../../typings/**/*",
   ],
   "exclude": []
 }
diff --git a/package.json b/package.json
index 8ccb138a3aced..8c4311a36767e 100644
--- a/package.json
+++ b/package.json
@@ -96,6 +96,7 @@
       "packages/*",
       "x-pack",
       "x-pack/legacy/plugins/*",
+      "examples/*",
       "test/plugin_functional/plugins/*",
       "test/interpreter_functional/plugins/*"
     ],
diff --git a/packages/kbn-pm/dist/index.js b/packages/kbn-pm/dist/index.js
index bbe12a93c241f..aea85c13d7f32 100644
--- a/packages/kbn-pm/dist/index.js
+++ b/packages/kbn-pm/dist/index.js
@@ -23185,6 +23185,7 @@ function getProjectPaths(rootPath, options = {}) {
 
   projectPaths.push(Object(path__WEBPACK_IMPORTED_MODULE_0__["resolve"])(rootPath, 'test/plugin_functional/plugins/*'));
   projectPaths.push(Object(path__WEBPACK_IMPORTED_MODULE_0__["resolve"])(rootPath, 'test/interpreter_functional/plugins/*'));
+  projectPaths.push(Object(path__WEBPACK_IMPORTED_MODULE_0__["resolve"])(rootPath, 'examples/*'));
 
   if (!ossOnly) {
     projectPaths.push(Object(path__WEBPACK_IMPORTED_MODULE_0__["resolve"])(rootPath, 'x-pack'));
diff --git a/packages/kbn-pm/src/config.ts b/packages/kbn-pm/src/config.ts
index 4886b0c266a89..2e42a182e7ec3 100644
--- a/packages/kbn-pm/src/config.ts
+++ b/packages/kbn-pm/src/config.ts
@@ -44,6 +44,7 @@ export function getProjectPaths(rootPath: string, options: IProjectPathOptions =
   // correct and the expect behavior.
   projectPaths.push(resolve(rootPath, 'test/plugin_functional/plugins/*'));
   projectPaths.push(resolve(rootPath, 'test/interpreter_functional/plugins/*'));
+  projectPaths.push(resolve(rootPath, 'examples/*'));
 
   if (!ossOnly) {
     projectPaths.push(resolve(rootPath, 'x-pack'));
diff --git a/renovate.json5 b/renovate.json5
index 3886715618e99..e4cb02604f50b 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -13,6 +13,7 @@
     'x-pack/package.json',
     'x-pack/legacy/plugins/*/package.json',
     'packages/*/package.json',
+    'examples/*/package.json',
     'test/plugin_functional/plugins/*/package.json',
     'test/interpreter_functional/plugins/*/package.json',
   ],
diff --git a/scripts/functional_tests.js b/scripts/functional_tests.js
index b65cd3835cc0a..2526e2b14e9a5 100644
--- a/scripts/functional_tests.js
+++ b/scripts/functional_tests.js
@@ -24,4 +24,5 @@ require('@kbn/test').runTestsCli([
   require.resolve('../test/plugin_functional/config.js'),
   require.resolve('../test/interpreter_functional/config.ts'),
   require.resolve('../test/ui_capabilities/newsfeed_err/config.ts'),
+  require.resolve('../test/examples/config.js')
 ]);
diff --git a/src/cli/serve/serve.js b/src/cli/serve/serve.js
index 48b5db318d1c2..fd0502e07e422 100644
--- a/src/cli/serve/serve.js
+++ b/src/cli/serve/serve.js
@@ -144,6 +144,11 @@ function applyConfigOverrides(rawConfig, opts, extraCliOptions) {
   set('plugins.paths', _.compact([].concat(
     get('plugins.paths'),
     opts.pluginPath,
+    opts.runExamples ? [
+      // Ideally this would automatically include all plugins in the examples dir
+      fromRoot('examples/demo_search'),
+      fromRoot('examples/search_explorer'),
+    ] : [],
 
     XPACK_INSTALLED && !opts.oss
       ? [XPACK_DIR]
@@ -201,7 +206,8 @@ export default function (program) {
 
   if (!IS_KIBANA_DISTRIBUTABLE) {
     command
-      .option('--oss', 'Start Kibana without X-Pack');
+      .option('--oss', 'Start Kibana without X-Pack')
+      .option('--run-examples', 'Adds plugin paths for all the Kibana example plugins and runs with no base path');
   }
 
   if (CAN_CLUSTER) {
@@ -238,7 +244,12 @@ export default function (program) {
           silent: !!opts.silent,
           watch: !!opts.watch,
           repl: !!opts.repl,
-          basePath: !!opts.basePath,
+          // We want to run without base path when the `--run-examples` flag is given so that we can use local
+          // links in other documentation sources, like "View this tutorial [here](http://localhost:5601/app/tutorial/xyz)".
+          // We can tell users they only have to run with `yarn start --run-examples` to get those
+          // local links to work.  Similar to what we do for "View in Console" links in our
+          // elastic.co links.
+          basePath: opts.runExamples ? false : !!opts.basePath,
           optimize: !!opts.optimize,
           oss: !!opts.oss
         },
diff --git a/src/dev/renovate/package_globs.ts b/src/dev/renovate/package_globs.ts
index dd98f929be8ed..825e6ffed0ec6 100644
--- a/src/dev/renovate/package_globs.ts
+++ b/src/dev/renovate/package_globs.ts
@@ -28,6 +28,7 @@ export const PACKAGE_GLOBS = [
   'x-pack/package.json',
   'x-pack/legacy/plugins/*/package.json',
   'packages/*/package.json',
+  'examples/*/package.json',
   'test/plugin_functional/plugins/*/package.json',
   'test/interpreter_functional/plugins/*/package.json',
 ];
diff --git a/src/dev/typescript/projects.ts b/src/dev/typescript/projects.ts
index 2f8894f77ebc1..602657ad73836 100644
--- a/src/dev/typescript/projects.ts
+++ b/src/dev/typescript/projects.ts
@@ -40,6 +40,9 @@ export const PROJECTS = [
   ...glob
     .sync('packages/*/tsconfig.json', { cwd: REPO_ROOT })
     .map(path => new Project(resolve(REPO_ROOT, path))),
+  ...glob
+    .sync('examples/*/tsconfig.json', { cwd: REPO_ROOT })
+    .map(path => new Project(resolve(REPO_ROOT, path))),
   ...glob
     .sync('test/plugin_functional/plugins/*/tsconfig.json', { cwd: REPO_ROOT })
     .map(path => new Project(resolve(REPO_ROOT, path))),
diff --git a/test/examples/README.md b/test/examples/README.md
new file mode 100644
index 0000000000000..44656f949bc72
--- /dev/null
+++ b/test/examples/README.md
@@ -0,0 +1,23 @@
+# Example plugin functional tests
+
+This folder contains functional tests for the example plugins.
+
+## Run the test
+
+To run these tests during development you can use the following commands:
+
+```
+# Start the test server (can continue running)
+node scripts/functional_tests_server.js --config test/examples/config.js
+# Start a test run
+node scripts/functional_test_runner.js --config test/examples/config.js
+```
+
+## Run Kibana with a test plugin
+
+In case you want to start Kibana with the example plugins, you can just run:
+
+```
+yarn start --run-examples
+```
+
diff --git a/test/examples/config.js b/test/examples/config.js
new file mode 100644
index 0000000000000..b954390dc54ad
--- /dev/null
+++ b/test/examples/config.js
@@ -0,0 +1,55 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import path from 'path';
+import { services } from '../plugin_functional/services';
+
+export default async function ({ readConfigFile }) {
+  const functionalConfig = await readConfigFile(require.resolve('../functional/config'));
+
+  return {
+    testFiles: [
+      require.resolve('./search'),
+    ],
+    services: {
+      ...functionalConfig.get('services'),
+      ...services,
+    },
+    pageObjects: functionalConfig.get('pageObjects'),
+    servers: functionalConfig.get('servers'),
+    esTestCluster: functionalConfig.get('esTestCluster'),
+    apps: functionalConfig.get('apps'),
+    esArchiver: {
+      directory: path.resolve(__dirname, '../es_archives')
+    },
+    screenshots: functionalConfig.get('screenshots'),
+    junit: {
+      reportName: 'Example plugin functional tests',
+    },
+    kbnTestServer: {
+      ...functionalConfig.get('kbnTestServer'),
+      serverArgs: [
+        ...functionalConfig.get('kbnTestServer.serverArgs'),
+        '--run-examples',
+        // Required to run examples
+        '--env.name=development',
+      ],
+    },
+  };
+}
diff --git a/test/plugin_functional/test_suites/search/demo_data.ts b/test/examples/search/demo_data.ts
similarity index 100%
rename from test/plugin_functional/test_suites/search/demo_data.ts
rename to test/examples/search/demo_data.ts
diff --git a/test/plugin_functional/test_suites/search/es_search.ts b/test/examples/search/es_search.ts
similarity index 100%
rename from test/plugin_functional/test_suites/search/es_search.ts
rename to test/examples/search/es_search.ts
diff --git a/test/plugin_functional/test_suites/search/index.ts b/test/examples/search/index.ts
similarity index 100%
rename from test/plugin_functional/test_suites/search/index.ts
rename to test/examples/search/index.ts
diff --git a/test/plugin_functional/config.js b/test/plugin_functional/config.js
index a6316c607a7c7..d8ce12d1fc612 100644
--- a/test/plugin_functional/config.js
+++ b/test/plugin_functional/config.js
@@ -33,7 +33,6 @@ export default async function ({ readConfigFile }) {
       require.resolve('./test_suites/app_plugins'),
       require.resolve('./test_suites/custom_visualizations'),
       require.resolve('./test_suites/panel_actions'),
-      require.resolve('./test_suites/search'),
 
       /**
        * @todo Work on re-enabling this test suite after this is merged. These tests pass

From 3e1915d287bb4c78239b1ef71849172009899317 Mon Sep 17 00:00:00 2001
From: spalger <email@spalger.com>
Date: Tue, 10 Dec 2019 21:07:57 -0700
Subject: [PATCH 14/24] fix newlines in kbn-analytics build script

---
 packages/kbn-analytics/scripts/build.js | 190 ++++++++++++------------
 packages/kbn-i18n/scripts/build.js      |   2 +-
 2 files changed, 96 insertions(+), 96 deletions(-)

diff --git a/packages/kbn-analytics/scripts/build.js b/packages/kbn-analytics/scripts/build.js
index 3736ab15260fa..b7fbe629246ec 100644
--- a/packages/kbn-analytics/scripts/build.js
+++ b/packages/kbn-analytics/scripts/build.js
@@ -1,95 +1,95 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-const { resolve } = require('path');
-
-const del = require('del');
-const supportsColor = require('supports-color');
-const { run, withProcRunner } = require('@kbn/dev-utils');
-
-const ROOT_DIR = resolve(__dirname, '..');
-const BUILD_DIR = resolve(ROOT_DIR, 'target');
-
-const padRight = (width, str) =>
-  str.length >= width ? str : `${str}${' '.repeat(width - str.length)}`;
-
-run(
-  async ({ log, flags }) => {
-    await withProcRunner(log, async proc => {
-      log.info('Deleting old output');
-      await del(BUILD_DIR);
-
-      const cwd = ROOT_DIR;
-      const env = { ...process.env };
-      if (supportsColor.stdout) {
-        env.FORCE_COLOR = 'true';
-      }
-
-      log.info(`Starting babel and typescript${flags.watch ? ' in watch mode' : ''}`);
-      await Promise.all([
-        ...['web', 'node'].map(subTask =>
-          proc.run(padRight(10, `babel:${subTask}`), {
-            cmd: 'babel',
-            args: [
-              'src',
-              '--config-file',
-              require.resolve('../babel.config.js'),
-              '--out-dir',
-              resolve(BUILD_DIR, subTask),
-              '--extensions',
-              '.ts,.js,.tsx',
-              ...(flags.watch ? ['--watch'] : ['--quiet']),
-              ...(flags['source-maps'] ? ['--source-map', 'inline'] : []),
-            ],
-            wait: true,
-            env: {
-              ...env,
-              BABEL_ENV: subTask,
-            },
-            cwd,
-          })
-        ),
-
-        proc.run(padRight(10, 'tsc'), {
-          cmd: 'tsc',
-          args: [
-            '--emitDeclarationOnly',
-            ...(flags.watch ? ['--watch', '--preserveWatchOutput', 'true'] : []),
-            ...(flags['source-maps'] ? ['--declarationMap', 'true'] : []),
-          ],
-          wait: true,
-          env,
-          cwd,
-        }),
-      ]);
-
-      log.success('Complete');
-    });
-  },
-  {
-    description: 'Simple build tool for @kbn/analytics package',
-    flags: {
-      boolean: ['watch', 'source-maps'],
-      help: `
-        --watch            Run in watch mode
-        --source-maps      Include sourcemaps
-      `,
-    },
-  }
-);
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+const { resolve } = require('path');
+
+const del = require('del');
+const supportsColor = require('supports-color');
+const { run, withProcRunner } = require('@kbn/dev-utils');
+
+const ROOT_DIR = resolve(__dirname, '..');
+const BUILD_DIR = resolve(ROOT_DIR, 'target');
+
+const padRight = (width, str) =>
+  str.length >= width ? str : `${str}${' '.repeat(width - str.length)}`;
+
+run(
+  async ({ log, flags }) => {
+    await withProcRunner(log, async proc => {
+      log.info('Deleting old output');
+      await del(BUILD_DIR);
+
+      const cwd = ROOT_DIR;
+      const env = { ...process.env };
+      if (supportsColor.stdout) {
+        env.FORCE_COLOR = 'true';
+      }
+
+      log.info(`Starting babel and typescript${flags.watch ? ' in watch mode' : ''}`);
+      await Promise.all([
+        ...['web', 'node'].map(subTask =>
+          proc.run(padRight(10, `babel:${subTask}`), {
+            cmd: 'babel',
+            args: [
+              'src',
+              '--config-file',
+              require.resolve('../babel.config.js'),
+              '--out-dir',
+              resolve(BUILD_DIR, subTask),
+              '--extensions',
+              '.ts,.js,.tsx',
+              ...(flags.watch ? ['--watch'] : ['--quiet']),
+              ...(flags['source-maps'] ? ['--source-maps', 'inline'] : []),
+            ],
+            wait: true,
+            env: {
+              ...env,
+              BABEL_ENV: subTask,
+            },
+            cwd,
+          })
+        ),
+
+        proc.run(padRight(10, 'tsc'), {
+          cmd: 'tsc',
+          args: [
+            '--emitDeclarationOnly',
+            ...(flags.watch ? ['--watch', '--preserveWatchOutput', 'true'] : []),
+            ...(flags['source-maps'] ? ['--declarationMap', 'true'] : []),
+          ],
+          wait: true,
+          env,
+          cwd,
+        }),
+      ]);
+
+      log.success('Complete');
+    });
+  },
+  {
+    description: 'Simple build tool for @kbn/analytics package',
+    flags: {
+      boolean: ['watch', 'source-maps'],
+      help: `
+        --watch            Run in watch mode
+        --source-maps      Include sourcemaps
+      `,
+    },
+  }
+);
diff --git a/packages/kbn-i18n/scripts/build.js b/packages/kbn-i18n/scripts/build.js
index f4260d31d80fb..ccdddc87dbc18 100644
--- a/packages/kbn-i18n/scripts/build.js
+++ b/packages/kbn-i18n/scripts/build.js
@@ -55,7 +55,7 @@ run(
               '--extensions',
               '.ts,.js,.tsx',
               ...(flags.watch ? ['--watch'] : ['--quiet']),
-              ...(flags['source-maps'] ? ['--source-map', 'inline'] : []),
+              ...(flags['source-maps'] ? ['--source-maps', 'inline'] : []),
             ],
             wait: true,
             env: {

From 1013271c858b4c7c6107be551ada20323f989497 Mon Sep 17 00:00:00 2001
From: Alexey Antonov <alexwizp@gmail.com>
Date: Wed, 11 Dec 2019 10:28:54 +0300
Subject: [PATCH 15/24] [ui/public/utils] Move items into ui/vis (#52615)

* [ui/public/utils] Move items into ui/vis

* fix PR comments
---
 .../ui/public/agg_types/buckets/geo_hash.ts   |  2 +-
 src/legacy/ui/public/utils/range.d.ts         | 28 --------
 .../__snapshots__/number_list.test.tsx.snap   |  4 +-
 .../components/number_list/number_row.tsx     |  4 +-
 .../components/number_list/range.test.ts}     | 71 +++++++++----------
 .../controls/components/number_list/range.ts} | 61 ++++++++--------
 .../components/number_list/utils.test.ts      |  4 +-
 .../controls/components/number_list/utils.ts  | 10 +--
 .../ui/public/vis/map/convert_to_geojson.js   |  3 +-
 .../map/decode_geo_hash.test.ts}              | 19 ++---
 .../{utils => vis/map}/decode_geo_hash.ts     |  0
 src/legacy/ui/public/vis/map/kibana_map.js    |  2 +-
 .../map/zoom_to_precision.ts}                 | 45 ++++++------
 13 files changed, 108 insertions(+), 145 deletions(-)
 delete mode 100644 src/legacy/ui/public/utils/range.d.ts
 rename src/legacy/ui/public/{utils/__tests__/range.js => vis/editors/default/controls/components/number_list/range.test.ts} (66%)
 rename src/legacy/ui/public/{utils/range.js => vis/editors/default/controls/components/number_list/range.ts} (59%)
 rename src/legacy/ui/public/{utils/__tests__/decode_geo_hash.test.js => vis/map/decode_geo_hash.test.ts} (75%)
 rename src/legacy/ui/public/{utils => vis/map}/decode_geo_hash.ts (100%)
 rename src/legacy/ui/public/{utils/zoom_to_precision.js => vis/map/zoom_to_precision.ts} (52%)

diff --git a/src/legacy/ui/public/agg_types/buckets/geo_hash.ts b/src/legacy/ui/public/agg_types/buckets/geo_hash.ts
index 700f5a048fce2..0acbaf4aa02a2 100644
--- a/src/legacy/ui/public/agg_types/buckets/geo_hash.ts
+++ b/src/legacy/ui/public/agg_types/buckets/geo_hash.ts
@@ -18,13 +18,13 @@
  */
 
 import { i18n } from '@kbn/i18n';
+import { geohashColumns } from 'ui/vis/map/decode_geo_hash';
 import chrome from '../../chrome';
 import { BucketAggType, IBucketAggConfig } from './_bucket_agg_type';
 import { AutoPrecisionParamEditor } from '../../vis/editors/default/controls/auto_precision';
 import { UseGeocentroidParamEditor } from '../../vis/editors/default/controls/use_geocentroid';
 import { IsFilteredByCollarParamEditor } from '../../vis/editors/default/controls/is_filtered_by_collar';
 import { PrecisionParamEditor } from '../../vis/editors/default/controls/precision';
-import { geohashColumns } from '../../utils/decode_geo_hash';
 import { AggGroupNames } from '../../vis/editors/default/agg_groups';
 import { KBN_FIELD_TYPES } from '../../../../../plugins/data/public';
 
diff --git a/src/legacy/ui/public/utils/range.d.ts b/src/legacy/ui/public/utils/range.d.ts
deleted file mode 100644
index c484c6f43eebb..0000000000000
--- a/src/legacy/ui/public/utils/range.d.ts
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export function parseRange(input: string): Range;
-
-export interface Range {
-  min: number;
-  max: number;
-  minInclusive: boolean;
-  maxInclusive: boolean;
-  within(n: number): boolean;
-}
diff --git a/src/legacy/ui/public/vis/editors/default/controls/components/number_list/__snapshots__/number_list.test.tsx.snap b/src/legacy/ui/public/vis/editors/default/controls/components/number_list/__snapshots__/number_list.test.tsx.snap
index ab192e6fd3cbb..4004f8627a898 100644
--- a/src/legacy/ui/public/vis/editors/default/controls/components/number_list/__snapshots__/number_list.test.tsx.snap
+++ b/src/legacy/ui/public/vis/editors/default/controls/components/number_list/__snapshots__/number_list.test.tsx.snap
@@ -18,7 +18,7 @@ exports[`NumberList should be rendered with default set of props 1`] = `
     onChange={[Function]}
     onDelete={[Function]}
     range={
-      Range {
+      NumberListRange {
         "max": 10,
         "maxInclusive": true,
         "min": 1,
@@ -45,7 +45,7 @@ exports[`NumberList should be rendered with default set of props 1`] = `
     onChange={[Function]}
     onDelete={[Function]}
     range={
-      Range {
+      NumberListRange {
         "max": 10,
         "maxInclusive": true,
         "min": 1,
diff --git a/src/legacy/ui/public/vis/editors/default/controls/components/number_list/number_row.tsx b/src/legacy/ui/public/vis/editors/default/controls/components/number_list/number_row.tsx
index 23e671180e980..777b0a94f0f3d 100644
--- a/src/legacy/ui/public/vis/editors/default/controls/components/number_list/number_row.tsx
+++ b/src/legacy/ui/public/vis/editors/default/controls/components/number_list/number_row.tsx
@@ -21,7 +21,7 @@ import React, { useCallback } from 'react';
 
 import { EuiFieldNumber, EuiFlexGroup, EuiFlexItem, EuiButtonIcon } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
-import { Range } from '../../../../../../utils/range';
+import { NumberListRange } from './range';
 
 export interface NumberRowProps {
   autoFocus: boolean;
@@ -29,7 +29,7 @@ export interface NumberRowProps {
   isInvalid: boolean;
   labelledbyId: string;
   model: NumberRowModel;
-  range: Range;
+  range: NumberListRange;
   onBlur(): void;
   onChange({ id, value }: { id: string; value: string }): void;
   onDelete(index: string): void;
diff --git a/src/legacy/ui/public/utils/__tests__/range.js b/src/legacy/ui/public/vis/editors/default/controls/components/number_list/range.test.ts
similarity index 66%
rename from src/legacy/ui/public/utils/__tests__/range.js
rename to src/legacy/ui/public/vis/editors/default/controls/components/number_list/range.test.ts
index e7947894d3e22..e9090e5b38ef7 100644
--- a/src/legacy/ui/public/utils/__tests__/range.js
+++ b/src/legacy/ui/public/vis/editors/default/controls/components/number_list/range.test.ts
@@ -17,32 +17,30 @@
  * under the License.
  */
 
-import _ from 'lodash';
-import expect from '@kbn/expect';
-import { parseRange } from '../range';
+import { forOwn } from 'lodash';
+import { parseRange } from './range';
 
-describe('Range parsing utility', function () {
-
-  it('throws an error for inputs that are not formatted properly', function () {
-    expect(function () {
+describe('Range parsing utility', () => {
+  test('throws an error for inputs that are not formatted properly', () => {
+    expect(() => {
       parseRange('');
-    }).to.throwException(TypeError);
+    }).toThrowError(TypeError);
 
-    expect(function () {
+    expect(function() {
       parseRange('p10202');
-    }).to.throwException(TypeError);
+    }).toThrowError(TypeError);
 
-    expect(function () {
+    expect(function() {
       parseRange('{0,100}');
-    }).to.throwException(TypeError);
+    }).toThrowError(TypeError);
 
-    expect(function () {
+    expect(function() {
       parseRange('[0,100');
-    }).to.throwException(TypeError);
+    }).toThrowError(TypeError);
 
-    expect(function () {
+    expect(function() {
       parseRange(')0,100(');
-    }).to.throwException(TypeError);
+    }).toThrowError(TypeError);
   });
 
   const tests = {
@@ -51,52 +49,52 @@ describe('Range parsing utility', function () {
         min: 0,
         max: 100,
         minInclusive: true,
-        maxInclusive: true
+        maxInclusive: true,
       },
       within: [
         [0, true],
         [0.0000001, true],
         [1, true],
         [99.99999, true],
-        [100, true]
-      ]
+        [100, true],
+      ],
     },
     '(26.3   ,   42]': {
       props: {
         min: 26.3,
         max: 42,
         minInclusive: false,
-        maxInclusive: true
+        maxInclusive: true,
       },
       within: [
         [26.2999999, false],
         [26.3000001, true],
         [30, true],
         [41, true],
-        [42, true]
-      ]
+        [42, true],
+      ],
     },
     '(-50,50)': {
       props: {
         min: -50,
         max: 50,
         minInclusive: false,
-        maxInclusive: false
+        maxInclusive: false,
       },
       within: [
         [-50, false],
         [-49.99999, true],
         [0, true],
         [49.99999, true],
-        [50, false]
-      ]
+        [50, false],
+      ],
     },
     '(Infinity, -Infinity)': {
       props: {
         min: -Infinity,
         max: Infinity,
         minInclusive: false,
-        maxInclusive: false
+        maxInclusive: false,
       },
       within: [
         [0, true],
@@ -105,25 +103,24 @@ describe('Range parsing utility', function () {
         [-10000000000, true],
         [-Infinity, false],
         [Infinity, false],
-      ]
-    }
+      ],
+    },
   };
 
-  _.forOwn(tests, function (spec, str) {
-
-    describe(str, function () {
+  forOwn(tests, (spec, str: any) => {
+    // eslint-disable-next-line jest/valid-describe
+    describe(str, () => {
       const range = parseRange(str);
 
-      it('creation', function () {
-        expect(range).to.eql(spec.props);
+      it('creation', () => {
+        expect(range).toEqual(spec.props);
       });
 
-      spec.within.forEach(function (tup) {
-        it('#within(' + tup[0] + ')', function () {
-          expect(range.within(tup[0])).to.be(tup[1]);
+      spec.within.forEach((tup: any[]) => {
+        it('#within(' + tup[0] + ')', () => {
+          expect(range.within(tup[0])).toBe(tup[1]);
         });
       });
     });
-
   });
 });
diff --git a/src/legacy/ui/public/utils/range.js b/src/legacy/ui/public/vis/editors/default/controls/components/number_list/range.ts
similarity index 59%
rename from src/legacy/ui/public/utils/range.js
rename to src/legacy/ui/public/vis/editors/default/controls/components/number_list/range.ts
index 54bd1b1903346..da3b7a61aea9d 100644
--- a/src/legacy/ui/public/utils/range.js
+++ b/src/legacy/ui/public/vis/editors/default/controls/components/number_list/range.ts
@@ -17,8 +17,6 @@
  * under the License.
  */
 
-import _ from 'lodash';
-
 /**
  * Regexp portion that matches our number
  *
@@ -44,41 +42,44 @@ const _RE_NUMBER = '(\\-?(?:\\d+(?:\\.\\d+)?|Infinity))';
  *
  * @type {RegExp}
  */
-const RANGE_RE = new RegExp('^\\s*([\\[|\\(])\\s*' + _RE_NUMBER + '\\s*,\\s*' + _RE_NUMBER + '\\s*([\\]|\\)])\\s*$');
+const RANGE_RE = new RegExp(
+  '^\\s*([\\[|\\(])\\s*' + _RE_NUMBER + '\\s*,\\s*' + _RE_NUMBER + '\\s*([\\]|\\)])\\s*$'
+);
+
+export class NumberListRange {
+  constructor(
+    public minInclusive: boolean,
+    public min: number,
+    public max: number,
+    public maxInclusive: boolean
+  ) {}
 
-export function parseRange(input) {
+  within(n: number): boolean {
+    if ((this.min === n && !this.minInclusive) || this.min > n) return false;
+    if ((this.max === n && !this.maxInclusive) || this.max < n) return false;
+
+    return true;
+  }
+}
 
+export function parseRange(input: string): NumberListRange {
   const match = String(input).match(RANGE_RE);
   if (!match) {
     throw new TypeError('expected input to be in interval notation e.g., (100, 200]');
   }
 
-  return new Range(
-    match[1] === '[',
-    parseFloat(match[2]),
-    parseFloat(match[3]),
-    match[4] === ']'
-  );
-}
-
-function Range(/* minIncl, min, max, maxIncl */) {
-  const args = _.toArray(arguments);
-  if (args[1] > args[2]) args.reverse();
+  const args = [match[1] === '[', parseFloat(match[2]), parseFloat(match[3]), match[4] === ']'];
 
-  this.minInclusive = args[0];
-  this.min = args[1];
-  this.max = args[2];
-  this.maxInclusive = args[3];
-}
-
-Range.prototype.within = function (n) {
-  if (this.min === n && !this.minInclusive) return false;
-  if (this.min > n) return false;
-
-  if (this.max === n && !this.maxInclusive) return false;
-  if (this.max < n) return false;
-
-  return true;
-};
+  if (args[1] > args[2]) {
+    args.reverse();
+  }
 
+  const [minInclusive, min, max, maxInclusive] = args;
 
+  return new NumberListRange(
+    minInclusive as boolean,
+    min as number,
+    max as number,
+    maxInclusive as boolean
+  );
+}
diff --git a/src/legacy/ui/public/vis/editors/default/controls/components/number_list/utils.test.ts b/src/legacy/ui/public/vis/editors/default/controls/components/number_list/utils.test.ts
index c6772cc108762..89fb5738db379 100644
--- a/src/legacy/ui/public/vis/editors/default/controls/components/number_list/utils.test.ts
+++ b/src/legacy/ui/public/vis/editors/default/controls/components/number_list/utils.test.ts
@@ -27,12 +27,12 @@ import {
   getNextModel,
   getRange,
 } from './utils';
-import { Range } from '../../../../../../utils/range';
+import { NumberListRange } from './range';
 import { NumberRowModel } from './number_row';
 
 describe('NumberList utils', () => {
   let modelList: NumberRowModel[];
-  let range: Range;
+  let range: NumberListRange;
 
   beforeEach(() => {
     modelList = [
diff --git a/src/legacy/ui/public/vis/editors/default/controls/components/number_list/utils.ts b/src/legacy/ui/public/vis/editors/default/controls/components/number_list/utils.ts
index 563e8f0a6a9b7..399253f27445c 100644
--- a/src/legacy/ui/public/vis/editors/default/controls/components/number_list/utils.ts
+++ b/src/legacy/ui/public/vis/editors/default/controls/components/number_list/utils.ts
@@ -21,7 +21,7 @@ import { last } from 'lodash';
 import { i18n } from '@kbn/i18n';
 import { htmlIdGenerator } from '@elastic/eui';
 
-import { parseRange, Range } from '../../../../../../utils/range';
+import { parseRange, NumberListRange } from './range';
 import { NumberRowModel } from './number_row';
 
 const EMPTY_STRING = '';
@@ -34,7 +34,7 @@ function parse(value: string) {
   return isNaN(parsedValue) ? EMPTY_STRING : parsedValue;
 }
 
-function getRange(range?: string): Range {
+function getRange(range?: string): NumberListRange {
   try {
     return range ? parseRange(range) : defaultRange;
   } catch (e) {
@@ -42,7 +42,7 @@ function getRange(range?: string): Range {
   }
 }
 
-function validateValue(value: number | '', numberRange: Range) {
+function validateValue(value: number | '', numberRange: NumberListRange) {
   const result: { isInvalid: boolean; error?: string } = {
     isInvalid: false,
   };
@@ -76,7 +76,7 @@ function validateOrder(list: Array<number | undefined>) {
   return result;
 }
 
-function getNextModel(list: NumberRowModel[], range: Range): NumberRowModel {
+function getNextModel(list: NumberRowModel[], range: NumberListRange): NumberRowModel {
   const lastValue = last(list).value;
   let next = Number(lastValue) ? Number(lastValue) + 1 : 1;
 
@@ -104,7 +104,7 @@ function getInitModelList(list: Array<number | undefined>): NumberRowModel[] {
 function getUpdatedModels(
   numberList: Array<number | undefined>,
   modelList: NumberRowModel[],
-  numberRange: Range,
+  numberRange: NumberListRange,
   invalidOrderModelIndex?: number
 ): NumberRowModel[] {
   if (!numberList.length) {
diff --git a/src/legacy/ui/public/vis/map/convert_to_geojson.js b/src/legacy/ui/public/vis/map/convert_to_geojson.js
index 77896490678ff..14c282b58beda 100644
--- a/src/legacy/ui/public/vis/map/convert_to_geojson.js
+++ b/src/legacy/ui/public/vis/map/convert_to_geojson.js
@@ -17,10 +17,9 @@
  * under the License.
  */
 
-import { decodeGeoHash } from 'ui/utils/decode_geo_hash';
+import { decodeGeoHash } from './decode_geo_hash';
 import { gridDimensions } from './grid_dimensions';
 
-
 export function convertToGeoJson(tabifiedResponse, { geohash, geocentroid, metric }) {
 
   let features;
diff --git a/src/legacy/ui/public/utils/__tests__/decode_geo_hash.test.js b/src/legacy/ui/public/vis/map/decode_geo_hash.test.ts
similarity index 75%
rename from src/legacy/ui/public/utils/__tests__/decode_geo_hash.test.js
rename to src/legacy/ui/public/vis/map/decode_geo_hash.test.ts
index 1ffe9ca7b4df2..c1ca7e4c80383 100644
--- a/src/legacy/ui/public/utils/__tests__/decode_geo_hash.test.js
+++ b/src/legacy/ui/public/vis/map/decode_geo_hash.test.ts
@@ -17,27 +17,18 @@
  * under the License.
  */
 
-import { geohashColumns, decodeGeoHash } from '../decode_geo_hash';
+import { geohashColumns, decodeGeoHash } from './decode_geo_hash';
 
-test('geohashColumns', function () {
+test('geohashColumns', () => {
   expect(geohashColumns(1)).toBe(8);
   expect(geohashColumns(2)).toBe(8 * 4);
   expect(geohashColumns(3)).toBe(8 * 4 * 8);
   expect(geohashColumns(4)).toBe(8 * 4 * 8 * 4);
 });
 
-test('decodeGeoHash', function () {
+test('decodeGeoHash', () => {
   expect(decodeGeoHash('drm3btev3e86')).toEqual({
-    latitude: [
-      41.119999922811985,
-      41.12000009045005,
-      41.12000000663102,
-    ],
-    longitude: [
-      -71.34000029414892,
-      -71.3399999588728,
-      -71.34000012651086,
-    ],
+    latitude: [41.119999922811985, 41.12000009045005, 41.12000000663102],
+    longitude: [-71.34000029414892, -71.3399999588728, -71.34000012651086],
   });
 });
-
diff --git a/src/legacy/ui/public/utils/decode_geo_hash.ts b/src/legacy/ui/public/vis/map/decode_geo_hash.ts
similarity index 100%
rename from src/legacy/ui/public/utils/decode_geo_hash.ts
rename to src/legacy/ui/public/vis/map/decode_geo_hash.ts
diff --git a/src/legacy/ui/public/vis/map/kibana_map.js b/src/legacy/ui/public/vis/map/kibana_map.js
index dc57809b6570f..cb618444af7ce 100644
--- a/src/legacy/ui/public/vis/map/kibana_map.js
+++ b/src/legacy/ui/public/vis/map/kibana_map.js
@@ -22,7 +22,7 @@ import { createZoomWarningMsg } from './map_messages';
 import L from 'leaflet';
 import $ from 'jquery';
 import _ from 'lodash';
-import { zoomToPrecision } from '../../utils/zoom_to_precision';
+import { zoomToPrecision } from './zoom_to_precision';
 import { i18n } from '@kbn/i18n';
 import { ORIGIN } from '../../../../core_plugins/tile_map/common/origin';
 
diff --git a/src/legacy/ui/public/utils/zoom_to_precision.js b/src/legacy/ui/public/vis/map/zoom_to_precision.ts
similarity index 52%
rename from src/legacy/ui/public/utils/zoom_to_precision.js
rename to src/legacy/ui/public/vis/map/zoom_to_precision.ts
index f5c16b640d127..552c509590286 100644
--- a/src/legacy/ui/public/utils/zoom_to_precision.js
+++ b/src/legacy/ui/public/vis/map/zoom_to_precision.ts
@@ -19,39 +19,42 @@
 
 import { geohashColumns } from './decode_geo_hash';
 
-const maxPrecision = 12;
-/**
- * Map Leaflet zoom levels to geohash precision levels.
- * The size of a geohash column-width on the map should be at least `minGeohashPixels` pixels wide.
- */
-
-
+const defaultMaxPrecision = 12;
+const minGeoHashPixels = 16;
 
-
-const zoomPrecisionMap = {};
-const minGeohashPixels = 16;
-
-function calculateZoomToPrecisionMap(maxZoom) {
+const calculateZoomToPrecisionMap = (maxZoom: number): Map<number, number> => {
+  /**
+   * Map Leaflet zoom levels to geohash precision levels.
+   * The size of a geohash column-width on the map should be at least `minGeohashPixels` pixels wide.
+   */
+  const zoomPrecisionMap = new Map();
 
   for (let zoom = 0; zoom <= maxZoom; zoom += 1) {
-    if (typeof zoomPrecisionMap[zoom] === 'number') {
+    if (typeof zoomPrecisionMap.get(zoom) === 'number') {
       continue;
     }
+
     const worldPixels = 256 * Math.pow(2, zoom);
-    zoomPrecisionMap[zoom] = 1;
-    for (let precision = 2; precision <= maxPrecision; precision += 1) {
+
+    zoomPrecisionMap.set(zoom, 1);
+
+    for (let precision = 2; precision <= defaultMaxPrecision; precision += 1) {
       const columns = geohashColumns(precision);
-      if ((worldPixels / columns) >= minGeohashPixels) {
-        zoomPrecisionMap[zoom] = precision;
+
+      if (worldPixels / columns >= minGeoHashPixels) {
+        zoomPrecisionMap.set(zoom, precision);
       } else {
         break;
       }
     }
   }
-}
 
+  return zoomPrecisionMap;
+};
+
+export function zoomToPrecision(mapZoom: number, maxPrecision: number, maxZoom: number) {
+  const zoomPrecisionMap = calculateZoomToPrecisionMap(typeof maxZoom === 'number' ? maxZoom : 21);
+  const precision = zoomPrecisionMap.get(mapZoom);
 
-export function zoomToPrecision(mapZoom, maxPrecision, maxZoom) {
-  calculateZoomToPrecisionMap(typeof maxZoom === 'number' ? maxZoom : 21);
-  return Math.min(zoomPrecisionMap[mapZoom], maxPrecision);
+  return precision ? Math.min(precision, maxPrecision) : maxPrecision;
 }

From 6a8b2a25c824d1d8eb12178f84a6a16ce92b594b Mon Sep 17 00:00:00 2001
From: Alexey Antonov <alexwizp@gmail.com>
Date: Wed, 11 Dec 2019 10:30:45 +0300
Subject: [PATCH 16/24] [ui/public/utils] Delete unused base_object &
 find_by_param (#52500)

Closes #51854
---
 .../ui/public/state_management/state.js       |  21 +++
 .../ui/public/utils/__tests__/base_object.js  |  57 ------
 .../public/utils/__tests__/simple_emitter.js  | 175 ------------------
 src/legacy/ui/public/utils/base_object.ts     |  47 -----
 src/legacy/ui/public/utils/find_by_param.ts   |  38 ----
 src/legacy/ui/public/utils/simple_emitter.js  |   4 -
 .../ui/public/utils/simple_emitter.test.js    | 173 +++++++++++++++++
 7 files changed, 194 insertions(+), 321 deletions(-)
 delete mode 100644 src/legacy/ui/public/utils/__tests__/base_object.js
 delete mode 100644 src/legacy/ui/public/utils/__tests__/simple_emitter.js
 delete mode 100644 src/legacy/ui/public/utils/base_object.ts
 delete mode 100644 src/legacy/ui/public/utils/find_by_param.ts
 create mode 100644 src/legacy/ui/public/utils/simple_emitter.test.js

diff --git a/src/legacy/ui/public/state_management/state.js b/src/legacy/ui/public/state_management/state.js
index 27186b4249978..e868abb98c852 100644
--- a/src/legacy/ui/public/state_management/state.js
+++ b/src/legacy/ui/public/state_management/state.js
@@ -316,6 +316,27 @@ export function StateProvider(Private, $rootScope, $location, stateManagementCon
     return this._urlParam;
   };
 
+  /**
+   * Returns an object with each property name and value corresponding to the entries in this collection
+   * excluding fields started from '$', '_' and all methods
+   *
+   * @return {object}
+   */
+  State.prototype.toObject = function () {
+    return _.omit(this, (value, key) => {
+      return key.charAt(0) === '$' || key.charAt(0) === '_' || _.isFunction(value);
+    });
+  };
+
+  /** Alias for method 'toObject'
+   *
+   * @obsolete Please use 'toObject' method instead
+   * @return {object}
+   */
+  State.prototype.toJSON = function () {
+    return this.toObject();
+  };
+
   return State;
 
 }
diff --git a/src/legacy/ui/public/utils/__tests__/base_object.js b/src/legacy/ui/public/utils/__tests__/base_object.js
deleted file mode 100644
index dfc5688c7b2f4..0000000000000
--- a/src/legacy/ui/public/utils/__tests__/base_object.js
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import expect from '@kbn/expect';
-import ngMock from 'ng_mock';
-import '../../private';
-
-import { BaseObject } from '../base_object';
-
-describe('Base Object', function () {
-  beforeEach(ngMock.module('kibana'));
-
-  it('should take an inital set of values', function () {
-    const baseObject = new BaseObject({ message: 'test' });
-    expect(baseObject).to.have.property('message', 'test');
-  });
-
-  it('should serialize attributes to RISON', function () {
-    const baseObject = new BaseObject();
-    baseObject.message = 'Testing... 1234';
-    const rison = baseObject.toRISON();
-    expect(rison).to.equal('(message:\'Testing... 1234\')');
-  });
-
-  it('should not serialize $$attributes to RISON', function () {
-    const baseObject = new BaseObject();
-    baseObject.$$attributes = { foo: 'bar' };
-    baseObject.message = 'Testing... 1234';
-    const rison = baseObject.toRISON();
-    expect(rison).to.equal('(message:\'Testing... 1234\')');
-  });
-
-  it('should serialize attributes for JSON', function () {
-    const baseObject = new BaseObject();
-    baseObject.message = 'Testing... 1234';
-    baseObject._private = 'foo';
-    baseObject.$private = 'stuff';
-    const json = JSON.stringify(baseObject);
-    expect(json).to.equal('{"message":"Testing... 1234"}');
-  });
-});
diff --git a/src/legacy/ui/public/utils/__tests__/simple_emitter.js b/src/legacy/ui/public/utils/__tests__/simple_emitter.js
deleted file mode 100644
index 25224a409f8f4..0000000000000
--- a/src/legacy/ui/public/utils/__tests__/simple_emitter.js
+++ /dev/null
@@ -1,175 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { SimpleEmitter } from '../simple_emitter';
-import expect from '@kbn/expect';
-import sinon from 'sinon';
-
-describe('SimpleEmitter class', function () {
-  let emitter;
-
-  beforeEach(function () {
-    emitter = new SimpleEmitter();
-  });
-
-  it('constructs an event emitter', function () {
-    expect(emitter).to.have.property('on');
-    expect(emitter).to.have.property('off');
-    expect(emitter).to.have.property('emit');
-    expect(emitter).to.have.property('listenerCount');
-    expect(emitter).to.have.property('removeAllListeners');
-  });
-
-  describe('#listenerCount', function () {
-    it('counts all event listeners without any arg', function () {
-      expect(emitter.listenerCount()).to.be(0);
-      emitter.on('a', function () {});
-      expect(emitter.listenerCount()).to.be(1);
-      emitter.on('b', function () {});
-      expect(emitter.listenerCount()).to.be(2);
-    });
-
-    it('limits to the event that is passed in', function () {
-      expect(emitter.listenerCount()).to.be(0);
-      emitter.on('a', function () {});
-      expect(emitter.listenerCount('a')).to.be(1);
-      emitter.on('a', function () {});
-      expect(emitter.listenerCount('a')).to.be(2);
-      emitter.on('b', function () {});
-      expect(emitter.listenerCount('a')).to.be(2);
-      expect(emitter.listenerCount('b')).to.be(1);
-      expect(emitter.listenerCount()).to.be(3);
-    });
-  });
-
-  describe('#on', function () {
-    it('registers a handler', function () {
-      const handler = sinon.stub();
-      emitter.on('a', handler);
-      expect(emitter.listenerCount('a')).to.be(1);
-
-      expect(handler.callCount).to.be(0);
-      emitter.emit('a');
-      expect(handler.callCount).to.be(1);
-    });
-
-    it('allows multiple event handlers for the same event', function () {
-      emitter.on('a', function () {});
-      emitter.on('a', function () {});
-      expect(emitter.listenerCount('a')).to.be(2);
-    });
-
-    it('allows the same function to be registered multiple times', function () {
-      const handler = function () {};
-      emitter.on('a', handler);
-      expect(emitter.listenerCount()).to.be(1);
-      emitter.on('a', handler);
-      expect(emitter.listenerCount()).to.be(2);
-    });
-  });
-
-  describe('#off', function () {
-    it('removes a listener if it was registered', function () {
-      const handler = sinon.stub();
-      expect(emitter.listenerCount()).to.be(0);
-      emitter.on('a', handler);
-      expect(emitter.listenerCount('a')).to.be(1);
-      emitter.off('a', handler);
-      expect(emitter.listenerCount('a')).to.be(0);
-    });
-
-    it('clears all listeners if no handler is passed', function () {
-      emitter.on('a', function () {});
-      emitter.on('a', function () {});
-      expect(emitter.listenerCount()).to.be(2);
-      emitter.off('a');
-      expect(emitter.listenerCount()).to.be(0);
-    });
-
-    it('does not mind if the listener is not registered', function () {
-      emitter.off('a', function () {});
-    });
-
-    it('does not mind if the event has no listeners', function () {
-      emitter.off('a');
-    });
-  });
-
-  describe('#emit', function () {
-    it('calls the handlers in the order they were defined', function () {
-      let i = 0;
-      const incr = function () { return ++i; };
-      const one = sinon.spy(incr);
-      const two = sinon.spy(incr);
-      const three = sinon.spy(incr);
-      const four = sinon.spy(incr);
-
-      emitter
-        .on('a', one)
-        .on('a', two)
-        .on('a', three)
-        .on('a', four)
-        .emit('a');
-
-      expect(one).to.have.property('callCount', 1);
-      expect(one.returned(1)).to.be.ok();
-
-      expect(two).to.have.property('callCount', 1);
-      expect(two.returned(2)).to.be.ok();
-
-      expect(three).to.have.property('callCount', 1);
-      expect(three.returned(3)).to.be.ok();
-
-      expect(four).to.have.property('callCount', 1);
-      expect(four.returned(4)).to.be.ok();
-    });
-
-    it('always emits the handlers that were initially registered', function () {
-
-      const destructive = sinon.spy(function () {
-        emitter.removeAllListeners();
-        expect(emitter.listenerCount()).to.be(0);
-      });
-      const stub = sinon.stub();
-
-      emitter.on('run', destructive).on('run', stub).emit('run');
-
-      expect(destructive).to.have.property('callCount', 1);
-      expect(stub).to.have.property('callCount', 1);
-    });
-
-    it('applies all arguments except the first', function () {
-      emitter
-        .on('a', function (a, b, c) {
-          expect(a).to.be('foo');
-          expect(b).to.be('bar');
-          expect(c).to.be('baz');
-        })
-        .emit('a', 'foo', 'bar', 'baz');
-    });
-
-    it('uses the SimpleEmitter as the this context', function () {
-      emitter
-        .on('a', function () {
-          expect(this).to.be(emitter);
-        })
-        .emit('a');
-    });
-  });
-});
diff --git a/src/legacy/ui/public/utils/base_object.ts b/src/legacy/ui/public/utils/base_object.ts
deleted file mode 100644
index 63c7ebf6de5bb..0000000000000
--- a/src/legacy/ui/public/utils/base_object.ts
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import angular from 'angular';
-import _ from 'lodash';
-// @ts-ignore -- awaiting https://github.com/w33ble/rison-node/issues/1
-import rison from 'rison-node';
-
-export class BaseObject {
-  // Set the attributes or default to an empty object
-  constructor(attributes: Record<string, any> = {}) {
-    // Set the attributes or default to an empty object
-    _.assign(this, attributes);
-  }
-
-  public toObject() {
-    // return just the data.
-    return _.omit(this, (value: any, key: string) => {
-      return key.charAt(0) === '$' || key.charAt(0) === '_' || _.isFunction(value);
-    });
-  }
-
-  public toRISON() {
-    // Use Angular to remove the private vars, and JSON.stringify to serialize
-    return rison.encode(JSON.parse(angular.toJson(this)));
-  }
-
-  public toJSON() {
-    return this.toObject();
-  }
-}
diff --git a/src/legacy/ui/public/utils/find_by_param.ts b/src/legacy/ui/public/utils/find_by_param.ts
deleted file mode 100644
index de32fc955a8cd..0000000000000
--- a/src/legacy/ui/public/utils/find_by_param.ts
+++ /dev/null
@@ -1,38 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import _ from 'lodash';
-
-interface AnyObject {
-  [key: string]: any;
-}
-
-// given an object or array of objects, return the value of the passed param
-// if the param is missing, return undefined
-export function findByParam(values: AnyObject | AnyObject[], param: string) {
-  if (Array.isArray(values)) {
-    // point series chart
-    const index = _.findIndex(values, param);
-    if (index === -1) {
-      return;
-    }
-    return values[index][param];
-  }
-  return values[param]; // pie chart
-}
diff --git a/src/legacy/ui/public/utils/simple_emitter.js b/src/legacy/ui/public/utils/simple_emitter.js
index 84397962c286b..503798ba160db 100644
--- a/src/legacy/ui/public/utils/simple_emitter.js
+++ b/src/legacy/ui/public/utils/simple_emitter.js
@@ -18,8 +18,6 @@
  */
 
 import _ from 'lodash';
-import { BaseObject } from './base_object';
-import { createLegacyClass } from './legacy_class';
 
 /**
  * Simple event emitter class used in the vislib. Calls
@@ -27,7 +25,6 @@ import { createLegacyClass } from './legacy_class';
  *
  * @class
  */
-createLegacyClass(SimpleEmitter).inherits(BaseObject);
 export function SimpleEmitter() {
   this._listeners = {};
 }
@@ -134,4 +131,3 @@ SimpleEmitter.prototype.listenerCount = function (name) {
     return count + _.size(handlers);
   }, 0);
 };
-
diff --git a/src/legacy/ui/public/utils/simple_emitter.test.js b/src/legacy/ui/public/utils/simple_emitter.test.js
new file mode 100644
index 0000000000000..ff884a12be7ee
--- /dev/null
+++ b/src/legacy/ui/public/utils/simple_emitter.test.js
@@ -0,0 +1,173 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { SimpleEmitter } from './simple_emitter';
+import sinon from 'sinon';
+
+describe('SimpleEmitter class', () => {
+  let emitter;
+
+  beforeEach(() => {
+    emitter = new SimpleEmitter();
+  });
+
+  it('constructs an event emitter', () => {
+    expect(emitter).toHaveProperty('on');
+    expect(emitter).toHaveProperty('off');
+    expect(emitter).toHaveProperty('emit');
+    expect(emitter).toHaveProperty('listenerCount');
+    expect(emitter).toHaveProperty('removeAllListeners');
+  });
+
+  describe('#listenerCount',  () => {
+    it('counts all event listeners without any arg', () => {
+      expect(emitter.listenerCount()).toBe(0);
+      emitter.on('a', () => {});
+      expect(emitter.listenerCount()).toBe(1);
+      emitter.on('b', () => {});
+      expect(emitter.listenerCount()).toBe(2);
+    });
+
+    it('limits to the event that is passed in', () => {
+      expect(emitter.listenerCount()).toBe(0);
+      emitter.on('a', () => {});
+      expect(emitter.listenerCount('a')).toBe(1);
+      emitter.on('a', () => {});
+      expect(emitter.listenerCount('a')).toBe(2);
+      emitter.on('b', () => {});
+      expect(emitter.listenerCount('a')).toBe(2);
+      expect(emitter.listenerCount('b')).toBe(1);
+      expect(emitter.listenerCount()).toBe(3);
+    });
+  });
+
+  describe('#on', () => {
+    it('registers a handler', () => {
+      const handler = sinon.stub();
+      emitter.on('a', handler);
+      expect(emitter.listenerCount('a')).toBe(1);
+
+      expect(handler.callCount).toBe(0);
+      emitter.emit('a');
+      expect(handler.callCount).toBe(1);
+    });
+
+    it('allows multiple event handlers for the same event', () => {
+      emitter.on('a', () => {});
+      emitter.on('a', () => {});
+      expect(emitter.listenerCount('a')).toBe(2);
+    });
+
+    it('allows the same function to be registered multiple times', () => {
+      const handler = () => {};
+      emitter.on('a', handler);
+      expect(emitter.listenerCount()).toBe(1);
+      emitter.on('a', handler);
+      expect(emitter.listenerCount()).toBe(2);
+    });
+  });
+
+  describe('#off', () => {
+    it('removes a listener if it was registered', () => {
+      const handler = sinon.stub();
+      expect(emitter.listenerCount()).toBe(0);
+      emitter.on('a', handler);
+      expect(emitter.listenerCount('a')).toBe(1);
+      emitter.off('a', handler);
+      expect(emitter.listenerCount('a')).toBe(0);
+    });
+
+    it('clears all listeners if no handler is passed', () => {
+      emitter.on('a', () => {});
+      emitter.on('a', () => {});
+      expect(emitter.listenerCount()).toBe(2);
+      emitter.off('a');
+      expect(emitter.listenerCount()).toBe(0);
+    });
+
+    it('does not mind if the listener is not registered', () => {
+      emitter.off('a', () => {});
+    });
+
+    it('does not mind if the event has no listeners', () => {
+      emitter.off('a');
+    });
+  });
+
+  describe('#emit', () => {
+    it('calls the handlers in the order they were defined',  () => {
+      let i = 0;
+      const incr =  () => ++i;
+      const one = sinon.spy(incr);
+      const two = sinon.spy(incr);
+      const three = sinon.spy(incr);
+      const four = sinon.spy(incr);
+
+      emitter
+        .on('a', one)
+        .on('a', two)
+        .on('a', three)
+        .on('a', four)
+        .emit('a');
+
+      expect(one).toHaveProperty('callCount', 1);
+      expect(one.returned(1)).toBeDefined();
+
+      expect(two).toHaveProperty('callCount', 1);
+      expect(two.returned(2)).toBeDefined();
+
+      expect(three).toHaveProperty('callCount', 1);
+      expect(three.returned(3)).toBeDefined();
+
+      expect(four).toHaveProperty('callCount', 1);
+      expect(four.returned(4)).toBeDefined();
+    });
+
+    it('always emits the handlers that were initially registered',  () => {
+      const destructive = sinon.spy(() => {
+        emitter.removeAllListeners();
+        expect(emitter.listenerCount()).toBe(0);
+      });
+      const stub = sinon.stub();
+
+      emitter.on('run', destructive).on('run', stub).emit('run');
+
+      expect(destructive).toHaveProperty('callCount', 1);
+      expect(stub).toHaveProperty('callCount', 1);
+    });
+
+    it('applies all arguments except the first', () => {
+      emitter
+        .on('a', (a, b, c) => {
+          expect(a).toBe('foo');
+          expect(b).toBe('bar');
+          expect(c).toBe('baz');
+        })
+        .emit('a', 'foo', 'bar', 'baz');
+    });
+
+    it('uses the SimpleEmitter as the this context', () => {
+      emitter
+        .on('a', function () {
+          expect(this).toBe(emitter);
+        })
+        .emit('a');
+    });
+  });
+});

From f0eb4bb675e23bada8f170097e12260bb00803cc Mon Sep 17 00:00:00 2001
From: Dario Gieselaar <dario.gieselaar@elastic.co>
Date: Wed, 11 Dec 2019 08:47:44 +0100
Subject: [PATCH 17/24] [APM] Fix some warnings logged in APM tests (#52487)

* [APM] Fix some warnings logged in APM tests

(Seemingly) since the React upgrade in 439708a6f9, our tests have started logging various warnings/errors to the console. The test suite is still passing but it creates a lot of noise.

Changes:

- use `act` or `wait` when appropriate
- mock useFetcher calls
- cleanup in useDelayedVisbility

* Replace tick() with wait()
---
 .../__jest__/TransactionOverview.test.tsx     |  3 ++
 .../DatePicker/__test__/DatePicker.test.tsx   |  6 +--
 .../useDelayedVisibility/Delayed/index.ts     |  6 +++
 .../useDelayedVisibility/index.test.tsx       | 41 +++++++++++++++----
 .../shared/useDelayedVisibility/index.ts      |  4 ++
 .../__tests__/UrlParamsContext.test.tsx       | 10 ++---
 .../hooks/useFetcher.integration.test.tsx     | 13 +++---
 .../plugins/apm/public/utils/testHelpers.tsx  |  4 --
 8 files changed, 61 insertions(+), 26 deletions(-)

diff --git a/x-pack/legacy/plugins/apm/public/components/app/TransactionOverview/__jest__/TransactionOverview.test.tsx b/x-pack/legacy/plugins/apm/public/components/app/TransactionOverview/__jest__/TransactionOverview.test.tsx
index a5356be72f5e4..91e0ae11a652e 100644
--- a/x-pack/legacy/plugins/apm/public/components/app/TransactionOverview/__jest__/TransactionOverview.test.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/app/TransactionOverview/__jest__/TransactionOverview.test.tsx
@@ -18,6 +18,7 @@ import { history } from '../../../../utils/history';
 import { TransactionOverview } from '..';
 import { IUrlParams } from '../../../../context/UrlParamsContext/types';
 import * as useServiceTransactionTypesHook from '../../../../hooks/useServiceTransactionTypes';
+import * as useFetcherHook from '../../../../hooks/useFetcher';
 import { fromQuery } from '../../../shared/Links/url_helpers';
 import { Router } from 'react-router-dom';
 import { UrlParamsProvider } from '../../../../context/UrlParamsContext';
@@ -51,6 +52,8 @@ function setup({
     .spyOn(useServiceTransactionTypesHook, 'useServiceTransactionTypes')
     .mockReturnValue(serviceTransactionTypes);
 
+  jest.spyOn(useFetcherHook, 'useFetcher').mockReturnValue({} as any);
+
   return render(
     <KibanaCoreContext.Provider value={coreMock}>
       <Router history={history}>
diff --git a/x-pack/legacy/plugins/apm/public/components/shared/DatePicker/__test__/DatePicker.test.tsx b/x-pack/legacy/plugins/apm/public/components/shared/DatePicker/__test__/DatePicker.test.tsx
index 05094c59712a9..32379325c4020 100644
--- a/x-pack/legacy/plugins/apm/public/components/shared/DatePicker/__test__/DatePicker.test.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/shared/DatePicker/__test__/DatePicker.test.tsx
@@ -10,13 +10,13 @@ import {
   UrlParamsContext,
   useUiFilters
 } from '../../../../context/UrlParamsContext';
-import { tick } from '../../../../utils/testHelpers';
 import { DatePicker } from '../index';
 import { IUrlParams } from '../../../../context/UrlParamsContext/types';
 import { history } from '../../../../utils/history';
 import { mount } from 'enzyme';
 import { EuiSuperDatePicker } from '@elastic/eui';
 import { MemoryRouter } from 'react-router-dom';
+import { wait } from '@testing-library/react';
 
 const mockHistoryPush = jest.spyOn(history, 'push');
 const mockRefreshTimeRange = jest.fn();
@@ -84,7 +84,7 @@ describe('DatePicker', () => {
     });
     expect(mockRefreshTimeRange).not.toHaveBeenCalled();
     jest.advanceTimersByTime(1000);
-    await tick();
+    await wait();
     expect(mockRefreshTimeRange).toHaveBeenCalled();
     wrapper.unmount();
   });
@@ -94,7 +94,7 @@ describe('DatePicker', () => {
     mountDatePicker({ refreshPaused: true, refreshInterval: 1000 });
     expect(mockRefreshTimeRange).not.toHaveBeenCalled();
     jest.advanceTimersByTime(1000);
-    await tick();
+    await wait();
     expect(mockRefreshTimeRange).not.toHaveBeenCalled();
   });
 });
diff --git a/x-pack/legacy/plugins/apm/public/components/shared/useDelayedVisibility/Delayed/index.ts b/x-pack/legacy/plugins/apm/public/components/shared/useDelayedVisibility/Delayed/index.ts
index 798e872dbc472..9048afe57153d 100644
--- a/x-pack/legacy/plugins/apm/public/components/shared/useDelayedVisibility/Delayed/index.ts
+++ b/x-pack/legacy/plugins/apm/public/components/shared/useDelayedVisibility/Delayed/index.ts
@@ -57,4 +57,10 @@ export class Delayed {
   public onChange(onChangeCallback: Callback) {
     this.onChangeCallback = onChangeCallback;
   }
+
+  public destroy() {
+    if (this.timeoutId) {
+      window.clearTimeout(this.timeoutId);
+    }
+  }
 }
diff --git a/x-pack/legacy/plugins/apm/public/components/shared/useDelayedVisibility/index.test.tsx b/x-pack/legacy/plugins/apm/public/components/shared/useDelayedVisibility/index.test.tsx
index 57e634df22837..c55c6ab351848 100644
--- a/x-pack/legacy/plugins/apm/public/components/shared/useDelayedVisibility/index.test.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/shared/useDelayedVisibility/index.test.tsx
@@ -4,11 +4,16 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { renderHook } from '@testing-library/react-hooks';
+import {
+  renderHook,
+  act,
+  RenderHookResult
+} from '@testing-library/react-hooks';
 import { useDelayedVisibility } from '.';
 
 describe('useFetcher', () => {
-  let hook;
+  let hook: RenderHookResult<any, any>;
+
   beforeEach(() => {
     jest.useFakeTimers();
   });
@@ -26,9 +31,15 @@ describe('useFetcher', () => {
     });
 
     hook.rerender(true);
-    jest.advanceTimersByTime(10);
+    act(() => {
+      jest.advanceTimersByTime(10);
+    });
+
     expect(hook.result.current).toEqual(false);
-    jest.advanceTimersByTime(50);
+    act(() => {
+      jest.advanceTimersByTime(50);
+    });
+
     expect(hook.result.current).toEqual(true);
   });
 
@@ -38,8 +49,11 @@ describe('useFetcher', () => {
     });
 
     hook.rerender(true);
-    jest.advanceTimersByTime(100);
+    act(() => {
+      jest.advanceTimersByTime(100);
+    });
     hook.rerender(false);
+
     expect(hook.result.current).toEqual(true);
   });
 
@@ -49,11 +63,22 @@ describe('useFetcher', () => {
     });
 
     hook.rerender(true);
-    jest.advanceTimersByTime(100);
+
+    act(() => {
+      jest.advanceTimersByTime(100);
+    });
+
     hook.rerender(false);
-    jest.advanceTimersByTime(900);
+    act(() => {
+      jest.advanceTimersByTime(900);
+    });
+
     expect(hook.result.current).toEqual(true);
-    jest.advanceTimersByTime(100);
+
+    act(() => {
+      jest.advanceTimersByTime(100);
+    });
+
     expect(hook.result.current).toEqual(false);
   });
 });
diff --git a/x-pack/legacy/plugins/apm/public/components/shared/useDelayedVisibility/index.ts b/x-pack/legacy/plugins/apm/public/components/shared/useDelayedVisibility/index.ts
index 5acbbd1d45737..c4465c7b42339 100644
--- a/x-pack/legacy/plugins/apm/public/components/shared/useDelayedVisibility/index.ts
+++ b/x-pack/legacy/plugins/apm/public/components/shared/useDelayedVisibility/index.ts
@@ -26,6 +26,10 @@ export function useDelayedVisibility(
       setIsVisible(visibility);
     });
     delayedRef.current = delayed;
+
+    return () => {
+      delayed.destroy();
+    };
   }, [hideDelayMs, showDelayMs, minimumVisibleDuration]);
 
   useEffect(() => {
diff --git a/x-pack/legacy/plugins/apm/public/context/UrlParamsContext/__tests__/UrlParamsContext.test.tsx b/x-pack/legacy/plugins/apm/public/context/UrlParamsContext/__tests__/UrlParamsContext.test.tsx
index 2604a3a122574..d2d8036e864ae 100644
--- a/x-pack/legacy/plugins/apm/public/context/UrlParamsContext/__tests__/UrlParamsContext.test.tsx
+++ b/x-pack/legacy/plugins/apm/public/context/UrlParamsContext/__tests__/UrlParamsContext.test.tsx
@@ -11,8 +11,8 @@ import { Location, History } from 'history';
 import { MemoryRouter, Router } from 'react-router-dom';
 import moment from 'moment-timezone';
 import { IUrlParams } from '../types';
-import { tick } from '../../../utils/testHelpers';
 import { getParsedDate } from '../helpers';
+import { wait } from '@testing-library/react';
 
 function mountParams(location: Location) {
   return mount(
@@ -143,13 +143,13 @@ describe('UrlParamsContext', () => {
       </Router>
     );
 
-    await tick();
+    await wait();
 
     expect(calls.length).toBe(1);
 
     wrapper.find('button').simulate('click');
 
-    await tick();
+    await wait();
 
     expect(calls.length).toBe(2);
 
@@ -194,11 +194,11 @@ describe('UrlParamsContext', () => {
       </Router>
     );
 
-    await tick();
+    await wait();
 
     wrapper.find('button').simulate('click');
 
-    await tick();
+    await wait();
 
     const params = getDataFromOutput(wrapper);
     expect(params.start).toEqual('2000-06-14T00:00:00.000Z');
diff --git a/x-pack/legacy/plugins/apm/public/hooks/useFetcher.integration.test.tsx b/x-pack/legacy/plugins/apm/public/hooks/useFetcher.integration.test.tsx
index 36a8377c02527..743cf4e01e555 100644
--- a/x-pack/legacy/plugins/apm/public/hooks/useFetcher.integration.test.tsx
+++ b/x-pack/legacy/plugins/apm/public/hooks/useFetcher.integration.test.tsx
@@ -5,8 +5,8 @@
  */
 
 import React from 'react';
-import { render } from '@testing-library/react';
-import { delay, tick } from '../utils/testHelpers';
+import { render, wait } from '@testing-library/react';
+import { delay } from '../utils/testHelpers';
 import { useFetcher } from './useFetcher';
 import { KibanaCoreContext } from '../../../observability/public/context/kibana_core';
 import { LegacyCoreStart } from 'kibana/public';
@@ -76,7 +76,8 @@ describe('when simulating race condition', () => {
 
   it('should render "Hello from Peter" after 200ms', async () => {
     jest.advanceTimersByTime(200);
-    await tick();
+
+    await wait();
 
     expect(renderSpy).lastCalledWith({
       data: 'Hello from Peter',
@@ -87,7 +88,7 @@ describe('when simulating race condition', () => {
 
   it('should render "Hello from Peter" after 600ms', async () => {
     jest.advanceTimersByTime(600);
-    await tick();
+    await wait();
 
     expect(renderSpy).lastCalledWith({
       data: 'Hello from Peter',
@@ -98,7 +99,7 @@ describe('when simulating race condition', () => {
 
   it('should should NOT have rendered "Hello from John" at any point', async () => {
     jest.advanceTimersByTime(600);
-    await tick();
+    await wait();
 
     expect(renderSpy).not.toHaveBeenCalledWith({
       data: 'Hello from John',
@@ -109,7 +110,7 @@ describe('when simulating race condition', () => {
 
   it('should send and receive calls in the right order', async () => {
     jest.advanceTimersByTime(600);
-    await tick();
+    await wait();
 
     expect(requestCallOrder).toEqual([
       ['request', 'John', 500],
diff --git a/x-pack/legacy/plugins/apm/public/utils/testHelpers.tsx b/x-pack/legacy/plugins/apm/public/utils/testHelpers.tsx
index b5cee4a78b01c..9e3c486715a1f 100644
--- a/x-pack/legacy/plugins/apm/public/utils/testHelpers.tsx
+++ b/x-pack/legacy/plugins/apm/public/utils/testHelpers.tsx
@@ -58,7 +58,6 @@ export async function getRenderedHref(Component: React.FC, location: Location) {
     </MemoryRouter>
   );
 
-  await tick();
   await waitForElement(() => el.container.querySelector('a'));
 
   const a = el.container.querySelector('a');
@@ -74,9 +73,6 @@ export function delay(ms: number) {
   return new Promise(resolve => setTimeout(resolve, ms));
 }
 
-// Await this when you need to "flush" promises to immediately resolve or throw in tests
-export const tick = () => new Promise(resolve => setImmediate(resolve, 0));
-
 export function expectTextsNotInDocument(output: any, texts: string[]) {
   texts.forEach(text => {
     try {

From 7e27f0d35f87966499ba9f717d9c5068efe51174 Mon Sep 17 00:00:00 2001
From: Aleh Zasypkin <aleh.zasypkin@gmail.com>
Date: Wed, 11 Dec 2019 08:55:46 +0100
Subject: [PATCH 18/24] Decouple Authorization subsystem from Legacy API.
 (#52638)

---
 x-pack/legacy/plugins/security/index.js          |  1 -
 .../authorization/check_privileges.test.ts       |  6 +++---
 .../server/authorization/check_privileges.ts     | 11 ++++++-----
 .../security/server/authorization/index.mock.ts  |  7 +++++--
 .../security/server/authorization/index.test.ts  |  7 +++----
 .../security/server/authorization/index.ts       | 16 ++++++++--------
 x-pack/plugins/security/server/plugin.ts         | 10 ++++++----
 .../routes/authorization/roles/get.test.ts       |  2 +-
 .../server/routes/authorization/roles/get.ts     |  2 +-
 .../routes/authorization/roles/get_all.test.ts   |  2 +-
 .../server/routes/authorization/roles/get_all.ts |  6 +-----
 .../routes/authorization/roles/put.test.ts       |  2 +-
 .../server/routes/authorization/roles/put.ts     |  2 +-
 13 files changed, 37 insertions(+), 37 deletions(-)

diff --git a/x-pack/legacy/plugins/security/index.js b/x-pack/legacy/plugins/security/index.js
index 1d798a4a2bc40..115dd8b9b8206 100644
--- a/x-pack/legacy/plugins/security/index.js
+++ b/x-pack/legacy/plugins/security/index.js
@@ -132,7 +132,6 @@ export const security = (kibana) => new kibana.Plugin({
         server.plugins.kibana.systemApi
       ),
       cspRules: createCSPRuleString(config.get('csp.rules')),
-      kibanaIndexName: config.get('kibana.index'),
     });
 
     // Legacy xPack Info endpoint returns whatever we return in a callback for `registerLicenseCheckResultsGenerator`
diff --git a/x-pack/plugins/security/server/authorization/check_privileges.test.ts b/x-pack/plugins/security/server/authorization/check_privileges.test.ts
index b1cb78008da00..8c1241937892e 100644
--- a/x-pack/plugins/security/server/authorization/check_privileges.test.ts
+++ b/x-pack/plugins/security/server/authorization/check_privileges.test.ts
@@ -48,7 +48,7 @@ describe('#atSpace', () => {
       const checkPrivilegesWithRequest = checkPrivilegesWithRequestFactory(
         mockActions,
         mockClusterClient,
-        () => application
+        application
       );
       const request = httpServerMock.createKibanaRequest();
       const checkPrivileges = checkPrivilegesWithRequest(request);
@@ -291,7 +291,7 @@ describe('#atSpaces', () => {
       const checkPrivilegesWithRequest = checkPrivilegesWithRequestFactory(
         mockActions,
         mockClusterClient,
-        () => application
+        application
       );
       const request = httpServerMock.createKibanaRequest();
       const checkPrivileges = checkPrivilegesWithRequest(request);
@@ -772,7 +772,7 @@ describe('#globally', () => {
       const checkPrivilegesWithRequest = checkPrivilegesWithRequestFactory(
         mockActions,
         mockClusterClient,
-        () => application
+        application
       );
       const request = httpServerMock.createKibanaRequest();
       const checkPrivileges = checkPrivilegesWithRequest(request);
diff --git a/x-pack/plugins/security/server/authorization/check_privileges.ts b/x-pack/plugins/security/server/authorization/check_privileges.ts
index 5bc3ce075452d..3ef7a8f29a0bf 100644
--- a/x-pack/plugins/security/server/authorization/check_privileges.ts
+++ b/x-pack/plugins/security/server/authorization/check_privileges.ts
@@ -61,7 +61,7 @@ export interface CheckPrivileges {
 export function checkPrivilegesWithRequestFactory(
   actions: CheckPrivilegesActions,
   clusterClient: IClusterClient,
-  getApplicationName: () => string
+  applicationName: string
 ) {
   const hasIncompatibleVersion = (
     applicationPrivilegesResponse: HasPrivilegesResponseApplication
@@ -81,23 +81,24 @@ export function checkPrivilegesWithRequestFactory(
         : [privilegeOrPrivileges];
       const allApplicationPrivileges = uniq([actions.version, actions.login, ...privileges]);
 
-      const application = getApplicationName();
       const hasPrivilegesResponse = (await clusterClient
         .asScoped(request)
         .callAsCurrentUser('shield.hasPrivileges', {
           body: {
-            applications: [{ application, resources, privileges: allApplicationPrivileges }],
+            applications: [
+              { application: applicationName, resources, privileges: allApplicationPrivileges },
+            ],
           },
         })) as HasPrivilegesResponse;
 
       validateEsPrivilegeResponse(
         hasPrivilegesResponse,
-        application,
+        applicationName,
         allApplicationPrivileges,
         resources
       );
 
-      const applicationPrivilegesResponse = hasPrivilegesResponse.application[application];
+      const applicationPrivilegesResponse = hasPrivilegesResponse.application[applicationName];
 
       if (hasIncompatibleVersion(applicationPrivilegesResponse)) {
         throw new Error(
diff --git a/x-pack/plugins/security/server/authorization/index.mock.ts b/x-pack/plugins/security/server/authorization/index.mock.ts
index 2e700745c69dc..930ede4157723 100644
--- a/x-pack/plugins/security/server/authorization/index.mock.ts
+++ b/x-pack/plugins/security/server/authorization/index.mock.ts
@@ -8,12 +8,15 @@ import { Actions } from '.';
 import { AuthorizationMode } from './mode';
 
 export const authorizationMock = {
-  create: ({ version = 'mock-version' }: { version?: string } = {}) => ({
+  create: ({
+    version = 'mock-version',
+    applicationName = 'mock-application',
+  }: { version?: string; applicationName?: string } = {}) => ({
     actions: new Actions(version),
     checkPrivilegesWithRequest: jest.fn(),
     checkPrivilegesDynamicallyWithRequest: jest.fn(),
     checkSavedObjectsPrivilegesWithRequest: jest.fn(),
-    getApplicationName: jest.fn().mockReturnValue('mock-application'),
+    applicationName,
     mode: { useRbacForRequest: jest.fn() } as jest.Mocked<AuthorizationMode>,
     privileges: { get: jest.fn() },
     registerPrivilegesWithCluster: jest.fn(),
diff --git a/x-pack/plugins/security/server/authorization/index.test.ts b/x-pack/plugins/security/server/authorization/index.test.ts
index 24179e062230a..34b9efea77165 100644
--- a/x-pack/plugins/security/server/authorization/index.test.ts
+++ b/x-pack/plugins/security/server/authorization/index.test.ts
@@ -53,7 +53,6 @@ test(`returns exposed services`, () => {
     .fn()
     .mockReturnValue({ getSpaceId: jest.fn(), namespaceToSpaceId: jest.fn() });
   const mockFeaturesService = { getFeatures: () => [] };
-  const mockGetLegacyAPI = () => ({ kibanaIndexName });
   const mockLicense = licenseMock.create();
 
   const authz = setupAuthorization({
@@ -61,20 +60,20 @@ test(`returns exposed services`, () => {
     clusterClient: mockClusterClient,
     license: mockLicense,
     loggers: loggingServiceMock.create(),
-    getLegacyAPI: mockGetLegacyAPI,
+    kibanaIndexName,
     packageVersion: 'some-version',
     featuresService: mockFeaturesService,
     getSpacesService: mockGetSpacesService,
   });
 
   expect(authz.actions.version).toBe('version:some-version');
-  expect(authz.getApplicationName()).toBe(application);
+  expect(authz.applicationName).toBe(application);
 
   expect(authz.checkPrivilegesWithRequest).toBe(mockCheckPrivilegesWithRequest);
   expect(checkPrivilegesWithRequestFactory).toHaveBeenCalledWith(
     authz.actions,
     mockClusterClient,
-    authz.getApplicationName
+    authz.applicationName
   );
 
   expect(authz.checkPrivilegesDynamicallyWithRequest).toBe(
diff --git a/x-pack/plugins/security/server/authorization/index.ts b/x-pack/plugins/security/server/authorization/index.ts
index b5f9efadbd8d0..41e6d12eb8f36 100644
--- a/x-pack/plugins/security/server/authorization/index.ts
+++ b/x-pack/plugins/security/server/authorization/index.ts
@@ -12,7 +12,7 @@ import {
   IClusterClient,
 } from '../../../../../src/core/server';
 
-import { FeaturesService, LegacyAPI, SpacesService } from '../plugin';
+import { FeaturesService, SpacesService } from '../plugin';
 import { Actions } from './actions';
 import { CheckPrivilegesWithRequest, checkPrivilegesWithRequestFactory } from './check_privileges';
 import {
@@ -43,7 +43,7 @@ interface SetupAuthorizationParams {
   license: SecurityLicense;
   loggers: LoggerFactory;
   featuresService: FeaturesService;
-  getLegacyAPI(): Pick<LegacyAPI, 'kibanaIndexName'>;
+  kibanaIndexName: string;
   getSpacesService(): SpacesService | undefined;
 }
 
@@ -52,7 +52,7 @@ export interface Authorization {
   checkPrivilegesWithRequest: CheckPrivilegesWithRequest;
   checkPrivilegesDynamicallyWithRequest: CheckPrivilegesDynamicallyWithRequest;
   checkSavedObjectsPrivilegesWithRequest: CheckSavedObjectsPrivilegesWithRequest;
-  getApplicationName: () => string;
+  applicationName: string;
   mode: AuthorizationMode;
   privileges: PrivilegesService;
   disableUnauthorizedCapabilities: (
@@ -69,23 +69,23 @@ export function setupAuthorization({
   license,
   loggers,
   featuresService,
-  getLegacyAPI,
+  kibanaIndexName,
   getSpacesService,
 }: SetupAuthorizationParams): Authorization {
   const actions = new Actions(packageVersion);
   const mode = authorizationModeFactory(license);
-  const getApplicationName = () => `${APPLICATION_PREFIX}${getLegacyAPI().kibanaIndexName}`;
+  const applicationName = `${APPLICATION_PREFIX}${kibanaIndexName}`;
   const checkPrivilegesWithRequest = checkPrivilegesWithRequestFactory(
     actions,
     clusterClient,
-    getApplicationName
+    applicationName
   );
   const privileges = privilegesFactory(actions, featuresService);
   const logger = loggers.get('authorization');
 
   const authz = {
     actions,
-    getApplicationName,
+    applicationName,
     checkPrivilegesWithRequest,
     checkPrivilegesDynamicallyWithRequest: checkPrivilegesDynamicallyWithRequestFactory(
       checkPrivilegesWithRequest,
@@ -123,7 +123,7 @@ export function setupAuthorization({
     registerPrivilegesWithCluster: async () => {
       validateFeaturePrivileges(actions, featuresService.getFeatures());
 
-      await registerPrivilegesWithCluster(logger, privileges, getApplicationName(), clusterClient);
+      await registerPrivilegesWithCluster(logger, privileges, applicationName, clusterClient);
     },
   };
 
diff --git a/x-pack/plugins/security/server/plugin.ts b/x-pack/plugins/security/server/plugin.ts
index cb197ecaf7e10..84d448331cef2 100644
--- a/x-pack/plugins/security/server/plugin.ts
+++ b/x-pack/plugins/security/server/plugin.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { Subscription } from 'rxjs';
+import { Subscription, combineLatest } from 'rxjs';
 import { first } from 'rxjs/operators';
 import {
   IClusterClient,
@@ -42,7 +42,6 @@ export type FeaturesService = Pick<FeaturesSetupContract, 'getFeatures'>;
  */
 export interface LegacyAPI {
   isSystemAPIRequest: (request: KibanaRequest) => boolean;
-  kibanaIndexName: string;
   cspRules: string;
   savedObjects: SavedObjectsLegacyService<KibanaRequest | LegacyRequest>;
   auditLogger: {
@@ -121,7 +120,10 @@ export class Plugin {
     core: CoreSetup,
     { features, licensing }: PluginSetupDependencies
   ): Promise<RecursiveReadonly<PluginSetupContract>> {
-    const config = await createConfig$(this.initializerContext, core.http.isTlsEnabled)
+    const [config, legacyConfig] = await combineLatest([
+      createConfig$(this.initializerContext, core.http.isTlsEnabled),
+      this.initializerContext.config.legacy.globalConfig$,
+    ])
       .pipe(first())
       .toPromise();
 
@@ -148,7 +150,7 @@ export class Plugin {
       clusterClient: this.clusterClient,
       license,
       loggers: this.initializerContext.logger,
-      getLegacyAPI: this.getLegacyAPI,
+      kibanaIndexName: legacyConfig.kibana.index,
       packageVersion: this.initializerContext.env.packageInfo.version,
       getSpacesService: this.getSpacesService,
       featuresService: features,
diff --git a/x-pack/plugins/security/server/routes/authorization/roles/get.test.ts b/x-pack/plugins/security/server/routes/authorization/roles/get.test.ts
index 1cfc1ae416ae4..447d890605cc9 100644
--- a/x-pack/plugins/security/server/routes/authorization/roles/get.test.ts
+++ b/x-pack/plugins/security/server/routes/authorization/roles/get.test.ts
@@ -36,7 +36,7 @@ describe('GET role', () => {
   ) => {
     test(description, async () => {
       const mockRouteDefinitionParams = routeDefinitionParamsMock.create();
-      mockRouteDefinitionParams.authz.getApplicationName.mockReturnValue(application);
+      mockRouteDefinitionParams.authz.applicationName = application;
 
       const mockScopedClusterClient = elasticsearchServiceMock.createScopedClusterClient();
       mockRouteDefinitionParams.clusterClient.asScoped.mockReturnValue(mockScopedClusterClient);
diff --git a/x-pack/plugins/security/server/routes/authorization/roles/get.ts b/x-pack/plugins/security/server/routes/authorization/roles/get.ts
index be69e222dd093..1173d37cba64f 100644
--- a/x-pack/plugins/security/server/routes/authorization/roles/get.ts
+++ b/x-pack/plugins/security/server/routes/authorization/roles/get.ts
@@ -28,7 +28,7 @@ export function defineGetRolesRoutes({ router, authz, clusterClient }: RouteDefi
             body: transformElasticsearchRoleToRole(
               elasticsearchRole,
               request.params.name,
-              authz.getApplicationName()
+              authz.applicationName
             ),
           });
         }
diff --git a/x-pack/plugins/security/server/routes/authorization/roles/get_all.test.ts b/x-pack/plugins/security/server/routes/authorization/roles/get_all.test.ts
index 76ce6a272e285..3bd85122c95d1 100644
--- a/x-pack/plugins/security/server/routes/authorization/roles/get_all.test.ts
+++ b/x-pack/plugins/security/server/routes/authorization/roles/get_all.test.ts
@@ -31,7 +31,7 @@ describe('GET all roles', () => {
   ) => {
     test(description, async () => {
       const mockRouteDefinitionParams = routeDefinitionParamsMock.create();
-      mockRouteDefinitionParams.authz.getApplicationName.mockReturnValue(application);
+      mockRouteDefinitionParams.authz.applicationName = application;
 
       const mockScopedClusterClient = elasticsearchServiceMock.createScopedClusterClient();
       mockRouteDefinitionParams.clusterClient.asScoped.mockReturnValue(mockScopedClusterClient);
diff --git a/x-pack/plugins/security/server/routes/authorization/roles/get_all.ts b/x-pack/plugins/security/server/routes/authorization/roles/get_all.ts
index f5d2d51280fc4..6ff431f0f8b6a 100644
--- a/x-pack/plugins/security/server/routes/authorization/roles/get_all.ts
+++ b/x-pack/plugins/security/server/routes/authorization/roles/get_all.ts
@@ -22,11 +22,7 @@ export function defineGetAllRolesRoutes({ router, authz, clusterClient }: RouteD
         return response.ok({
           body: Object.entries(elasticsearchRoles)
             .map(([roleName, elasticsearchRole]) =>
-              transformElasticsearchRoleToRole(
-                elasticsearchRole,
-                roleName,
-                authz.getApplicationName()
-              )
+              transformElasticsearchRoleToRole(elasticsearchRole, roleName, authz.applicationName)
             )
             .sort((roleA, roleB) => {
               if (roleA.name < roleB.name) {
diff --git a/x-pack/plugins/security/server/routes/authorization/roles/put.test.ts b/x-pack/plugins/security/server/routes/authorization/roles/put.test.ts
index 31963987c2efb..cb80549df8417 100644
--- a/x-pack/plugins/security/server/routes/authorization/roles/put.test.ts
+++ b/x-pack/plugins/security/server/routes/authorization/roles/put.test.ts
@@ -62,7 +62,7 @@ const putRoleTest = (
 ) => {
   test(description, async () => {
     const mockRouteDefinitionParams = routeDefinitionParamsMock.create();
-    mockRouteDefinitionParams.authz.getApplicationName.mockReturnValue(application);
+    mockRouteDefinitionParams.authz.applicationName = application;
     mockRouteDefinitionParams.authz.privileges.get.mockReturnValue(privilegeMap);
 
     const mockScopedClusterClient = elasticsearchServiceMock.createScopedClusterClient();
diff --git a/x-pack/plugins/security/server/routes/authorization/roles/put.ts b/x-pack/plugins/security/server/routes/authorization/roles/put.ts
index 92c940132e660..e0245e7260446 100644
--- a/x-pack/plugins/security/server/routes/authorization/roles/put.ts
+++ b/x-pack/plugins/security/server/routes/authorization/roles/put.ts
@@ -42,7 +42,7 @@ export function definePutRolesRoutes({ router, authz, clusterClient }: RouteDefi
 
         const body = transformPutPayloadToElasticsearchRole(
           request.body,
-          authz.getApplicationName(),
+          authz.applicationName,
           rawRoles[name] ? rawRoles[name].applications : []
         );
 

From aa31b535d1ff2f732deb9a3fd7d564a8e5f26431 Mon Sep 17 00:00:00 2001
From: Jean-Louis Leysens <jloleysens@gmail.com>
Date: Wed, 11 Dec 2019 09:54:42 +0100
Subject: [PATCH 19/24] [Watcher] New Platform (NP) Migration (#50908)

* First iteration of watch public -> new platform
Still need to switch to np ready version of use_request

* - Switched to using np ready request
- Some updates after API changes

* First attempt at server shim

* Rename file and re-enable react hooks linting

* Fix some public types and react hooks lint rules

* Fix types

* More ES lint react hooks fixes

* Migrated server lib -> ts. Part way done with migrating routes to NP router and TS

* Big subset of routes to TS and NP router - almost there

* Delete legacy error wrappers and moved last set of routes to TS and NP router

* Remove @ts-ignore's and update route registration to use shim with http router

* Added routes validations, fixes for hooks and fixes for types

* Fix more types and finish testing API routes

* Fix usage of feature catalogue and fix time buckets types

* Fix error message shape [skip ci]

* Split legacy from new platform dependencies server-side

* Refactor: Seperate client legacy and NP dependencies

* Add file: added types file

* Fix UISettings client type import

* Update license pre-routing factory spec

* Update variable names, use of I18nContext (use NP) and docs

* Use NP elasticsearchclient

* Simplify is_es_error_factory

* Fix types

* Improve code legibility and remove second use of `useAppContext`

* Use @kbn/config-schema (not validate: false) on routes!

* Fix watch create JSON spec

* Create threshold test working

* Unskip watch_edit.test.ts

* Unskip watch_list.test.ts

* Done re-enabling component integration tests

* TimeBuckets typo + remove unnecessary // @ts-ignore
---
 .eslintrc.js                                  |   7 -
 src/legacy/ui/public/time_buckets/index.d.ts  |  22 +++
 .../public/request/np_ready_request.ts        |   9 +-
 x-pack/dev-tools/jest/create_jest_config.js   |   3 +-
 .../helpers/app_context.mock.tsx              |  50 ++++++
 .../helpers/body_response.ts}                 |   4 +-
 .../helpers/http_requests.ts                  |   2 +-
 .../client_integration/helpers/index.ts       |   2 +-
 .../helpers/setup_environment.ts              |  12 +-
 .../helpers/watch_create_json.helpers.ts      |   7 +-
 .../helpers/watch_create_threshold.helpers.ts |   7 +-
 .../helpers/watch_edit.helpers.ts             |   7 +-
 .../helpers/watch_list.helpers.ts             |   5 +-
 .../helpers/watch_status.helpers.ts           |   5 +-
 .../watch_create_json.test.ts                 |  19 +--
 .../watch_create_threshold.test.tsx           | 130 ++++++----------
 .../client_integration/watch_edit.test.ts     |  33 +---
 .../client_integration/watch_list.test.ts     |   9 +-
 .../client_integration/watch_status.test.ts   |   9 +-
 x-pack/legacy/plugins/watcher/kibana.json     |   9 ++
 .../plugins/watcher/plugin_definition.js      |  46 ------
 .../plugins/watcher/plugin_definition.ts      |  32 ++++
 x-pack/legacy/plugins/watcher/public/app.html |   3 -
 .../legacy/plugins/watcher/public/legacy.ts   | 146 ++++++++++++++++++
 .../documentation_links.ts                    |  24 ---
 ...fecycle.js => manage_angular_lifecycle.ts} |  11 +-
 .../plugins/watcher/public/models/index.d.ts  |  42 -----
 .../{app.js => np_ready/application/app.tsx}  |  79 ++++++----
 .../np_ready/application/app_context.tsx      |  65 ++++++++
 .../public/np_ready/application/boot.tsx      |  35 +++++
 .../components/confirm_watches_modal.tsx      |   0
 .../components/delete_watches_modal.tsx       |   7 +-
 .../application}/components/form_errors.tsx   |   0
 .../application}/components/index.ts          |   0
 .../components/page_error/index.ts            |   0
 .../components/page_error/page_error.tsx      |   0
 .../page_error/page_error_forbidden.tsx       |   0
 .../page_error/page_error_not_exist.tsx       |   0
 .../application}/components/section_error.tsx |  20 ++-
 .../components/section_loading.tsx            |   0
 .../application}/components/watch_status.tsx  |   2 +-
 .../application}/constants/base_path.ts       |   0
 .../application}/constants/index.ts           |   0
 .../{ => np_ready/application}/index.scss     |   0
 .../{ => np_ready/application}/lib/api.ts     |  96 +++++-------
 .../application}/lib/breadcrumbs.ts           |   0
 .../application}/lib/format_date.ts           |   0
 .../application}/lib/get_search_value.ts      |   0
 .../application}/lib/get_time_unit_label.ts   |   2 +-
 .../application}/lib/navigation.ts            |   0
 .../application}/lib/use_request.ts           |   1 +
 .../application}/models/action/action.js      |   2 +-
 .../application}/models/action/base_action.js |   0
 .../models/action/email_action.js             |   0
 .../application}/models/action/index.js       |   0
 .../models/action/index_action.js             |   0
 .../application}/models/action/jira_action.js |   0
 .../models/action/logging_action.js           |   0
 .../models/action/pagerduty_action.js         |   0
 .../models/action/slack_action.js             |   0
 .../models/action/unknown_action.js           |   0
 .../models/action/webhook_action.js           |   0
 .../models/action_status/action_status.js     |   2 +-
 .../models/action_status/index.js             |   0
 .../models/execute_details/execute_details.js |   0
 .../models/execute_details/index.js           |   0
 .../np_ready/application/models/index.d.ts    |  39 +++++
 .../application}/models/settings/index.js     |   0
 .../application}/models/settings/settings.js  |   0
 .../models/visualize_options/index.js         |   0
 .../visualize_options/visualize_options.js    |   0
 .../application}/models/watch/agg_types.ts    |   2 +-
 .../application}/models/watch/base_watch.js   |   0
 .../application}/models/watch/comparators.ts  |   2 +-
 .../models/watch/default_watch.json           |   0
 .../models/watch/group_by_types.ts            |   0
 .../application}/models/watch/index.js        |   0
 .../application}/models/watch/json_watch.js   |   2 +-
 .../check_action_id_collision.js              |   0
 .../lib/check_action_id_collision/index.js    |   0
 .../lib/create_action_id/create_action_id.js  |   0
 .../watch/lib/create_action_id/index.js       |   0
 .../models/watch/monitoring_watch.js          |   2 +-
 .../models/watch/threshold_watch.js           |   2 +-
 .../application}/models/watch/watch.js        |   2 +-
 .../application}/models/watch_errors/index.js |   0
 .../models/watch_errors/watch_errors.js       |   0
 .../models/watch_history_item/index.js        |   0
 .../watch_history_item/watch_history_item.js  |   2 +-
 .../application}/models/watch_status/index.js |   0
 .../models/watch_status/watch_status.js       |   2 +-
 .../components/json_watch_edit/index.ts       |   0
 .../json_watch_edit/json_watch_edit.tsx       |   8 +-
 .../json_watch_edit/json_watch_edit_form.tsx  |  17 +-
 .../json_watch_edit_simulate.tsx              |  13 +-
 .../json_watch_edit_simulate_results.tsx      |   2 +-
 .../components/monitoring_watch_edit/index.ts |   0
 .../monitoring_watch_edit.tsx                 |   0
 .../watch_edit/components/request_flyout.tsx  |   0
 .../action_fields/email_action_fields.tsx     |   2 +-
 .../action_fields/index.ts                    |   0
 .../action_fields/index_action_fields.tsx     |   2 +-
 .../action_fields/jira_action_fields.tsx      |   2 +-
 .../action_fields/logging_action_fields.tsx   |   2 +-
 .../action_fields/pagerduty_action_fields.tsx |   2 +-
 .../action_fields/slack_action_fields.tsx     |   2 +-
 .../action_fields/webhook_action_fields.tsx   |   4 +-
 .../components/threshold_watch_edit/index.ts  |   0
 .../threshold_watch_action_accordion.tsx      |  23 +--
 .../threshold_watch_action_dropdown.tsx       |   4 +-
 .../threshold_watch_action_panel.tsx          |   4 +-
 .../threshold_watch_edit.tsx                  |  66 ++++----
 .../watch_visualization.tsx                   |  83 +++++-----
 .../watch_edit/components/watch_edit.tsx      |  49 +++---
 .../sections/watch_edit/watch_context.ts      |   0
 .../sections/watch_edit/watch_edit_actions.ts |  18 +--
 .../watch_list/components/watch_list.tsx      |  19 ++-
 .../watch_status/components/watch_detail.tsx  |   9 +-
 .../watch_status/components/watch_history.tsx |   8 +-
 .../watch_status/components/watch_status.tsx  |  19 ++-
 .../watch_status/watch_details_context.ts     |   0
 .../application}/shared_imports.ts            |   2 +-
 .../public/{index.js => np_ready/index.ts}    |   4 +-
 .../plugins/watcher/public/np_ready/plugin.ts |  62 ++++++++
 .../np_ready/types.ts}                        |   8 +-
 .../watcher/public/register_feature.js        |  24 ---
 .../watcher/public/register_feature.ts        |  21 +++
 .../public/register_management_sections.js    |  60 -------
 .../plugins/watcher/public/register_route.js  |  68 --------
 .../call_with_internal_user_factory.js        |  18 ---
 .../call_with_request_factory.js              |  21 ---
 .../lib/call_with_request_factory/index.js    |   7 -
 .../lib/elasticsearch_js_plugin/index.js      |   7 -
 .../__tests__/wrap_custom_error.js            |  21 ---
 .../error_wrappers/__tests__/wrap_es_error.js |  39 -----
 .../__tests__/wrap_unknown_error.js           |  19 ---
 .../server/lib/error_wrappers/index.js        |   9 --
 .../lib/error_wrappers/wrap_custom_error.js   |  18 ---
 .../lib/error_wrappers/wrap_es_error.js       |  30 ----
 .../lib/error_wrappers/wrap_unknown_error.js  |  17 --
 .../__tests__/is_es_error_factory.js          |  48 ------
 .../server/lib/is_es_error_factory/index.js   |   7 -
 .../is_es_error_factory.js                    |  18 ---
 .../license_pre_routing_factory.js            |  31 ----
 .../index.js => np_ready/index.ts}            |   4 +-
 .../np_ready/lib/call_with_request_factory.ts |  28 ++++
 .../lib/elasticsearch_js_plugin.ts}           |  98 ++++++------
 .../__tests__/fetch_all_from_scroll.js        |   0
 .../fetch_all_from_scroll.ts}                 |  15 +-
 .../lib/fetch_all_from_scroll/index.ts}       |   0
 .../np_ready/lib/is_es_error}/index.ts        |   2 +-
 .../lib/is_es_error/is_es_error.ts}           |   8 +-
 .../__tests__/license_pre_routing_factory.js  |  23 +--
 .../lib/license_pre_routing_factory/index.ts} |   0
 .../license_pre_routing_factory.ts            |  43 ++++++
 .../lib/normalized_field_types/index.ts}      |   0
 .../normalized_field_types.ts}                |  16 +-
 .../action_status/__tests__/action_status.js  |   2 +-
 .../models/action_status/action_status.js     |   4 +-
 .../models/action_status/index.js             |   0
 .../__tests__/execute_details.js              |   0
 .../models/execute_details/execute_details.js |   0
 .../models/execute_details/index.js           |   0
 .../models/fields/__tests__/fields.js         |   0
 .../{ => np_ready}/models/fields/fields.js    |   0
 .../{ => np_ready}/models/fields/index.js     |   0
 .../models/settings/__tests__/settings.js     |   0
 .../{ => np_ready}/models/settings/index.js   |   0
 .../models/settings/settings.js               |   2 +-
 .../models/visualize_options/index.js         |   0
 .../visualize_options/visualize_options.js    |   0
 .../{ => np_ready}/models/watch/base_watch.js |   2 +-
 .../models/watch/base_watch.test.js           |   0
 .../{ => np_ready}/models/watch/index.js      |   0
 .../{ => np_ready}/models/watch/json_watch.js |   4 +-
 .../models/watch/json_watch.test.js           |   0
 .../lib/get_watch_type/get_watch_type.js      |   2 +-
 .../models/watch/lib/get_watch_type/index.js  |   0
 .../models/watch/monitoring_watch.js          |   2 +-
 .../models/watch/monitoring_watch.test.js     |   0
 .../__tests__/format_visualize_data.js        |   2 +-
 .../threshold_watch/build_visualize_query.js  |   4 +-
 .../threshold_watch/data_samples/count.json   |   0
 .../data_samples/count.query.date.json        |   0
 .../data_samples/count.query.json             |   0
 .../data_samples/count_terms.json             |   0
 .../data_samples/count_terms.query.date.json  |   0
 .../data_samples/count_terms.query.json       |   0
 .../data_samples/non_count.json               |   0
 .../data_samples/non_count.query.date.json    |   0
 .../data_samples/non_count.query.json         |   0
 .../data_samples/non_count_terms.json         |   0
 .../non_count_terms.query.date.json           |   0
 .../data_samples/non_count_terms.query.json   |   0
 .../threshold_watch/format_visualize_data.js  |   2 +-
 .../models/watch/threshold_watch/index.js     |   0
 .../watch/threshold_watch/threshold_watch.js  |   4 +-
 .../threshold_watch/threshold_watch.test.js   |   2 +-
 .../{ => np_ready}/models/watch/watch.js      |   2 +-
 .../{ => np_ready}/models/watch/watch.test.js |   2 +-
 .../models/watch_errors/index.js              |   0
 .../models/watch_errors/watch_errors.js       |   0
 .../models/watch_errors/watch_errors.test.js  |   0
 .../__tests__/watch_history_item.js           |   0
 .../models/watch_history_item/index.js        |   0
 .../watch_history_item/watch_history_item.js  |   2 +-
 .../watch_status/__tests__/watch_status.js    |   2 +-
 .../models/watch_status/index.js              |   0
 .../models/watch_status/watch_status.js       |   4 +-
 .../plugins/watcher/server/np_ready/plugin.ts |  51 ++++++
 .../routes/api/indices/index.ts}              |   0
 .../routes/api/indices/register_get_route.ts  |  92 +++++++++++
 .../api/indices/register_indices_routes.ts}   |   5 +-
 .../routes/api/license/index.ts}              |   0
 .../api/license/register_license_routes.ts}   |   5 +-
 .../api/license/register_refresh_route.ts}    |  25 +--
 .../routes/api/register_list_fields_route.ts  |  65 ++++++++
 .../routes/api/register_load_history_route.ts |  77 +++++++++
 .../routes/api/settings/index.ts}             |   0
 .../api/settings/register_load_route.ts       |  43 ++++++
 .../api/settings/register_settings_routes.ts} |   5 +-
 .../routes/api/watch/action/index.ts}         |   0
 .../action/register_acknowledge_route.ts      |  65 ++++++++
 .../watch/action/register_action_routes.ts}   |   5 +-
 .../routes/api/watch/index.ts}                |   0
 .../api/watch/register_activate_route.ts      |  66 ++++++++
 .../api/watch/register_deactivate_route.ts    |  65 ++++++++
 .../routes/api/watch/register_delete_route.ts |  52 +++++++
 .../api/watch/register_execute_route.ts       |  78 ++++++++++
 .../api/watch/register_history_route.ts       |  97 ++++++++++++
 .../routes/api/watch/register_load_route.ts   |  69 +++++++++
 .../routes/api/watch/register_save_route.ts   | 104 +++++++++++++
 .../api/watch/register_visualize_route.ts     |  70 +++++++++
 .../api/watch/register_watch_routes.ts}       |  21 +--
 .../routes/api/watches/index.ts}              |   0
 .../api/watches/register_delete_route.ts      |  63 ++++++++
 .../routes/api/watches/register_list_route.ts |  86 +++++++++++
 .../api/watches/register_watches_routes.ts}   |   7 +-
 .../plugins/watcher/server/np_ready/types.ts  |  22 +++
 .../routes/api/fields/register_list_route.js  |  60 -------
 .../server/routes/api/history/index.js        |   7 -
 .../routes/api/history/register_load_route.js |  78 ----------
 .../routes/api/indices/register_get_route.js  |  89 -----------
 .../api/settings/register_load_route.js       |  47 ------
 .../action/register_acknowledge_route.js      |  63 --------
 .../api/watch/register_activate_route.js      |  63 --------
 .../api/watch/register_deactivate_route.js    |  63 --------
 .../routes/api/watch/register_delete_route.js |  50 ------
 .../api/watch/register_execute_route.js       |  69 ---------
 .../api/watch/register_history_route.js       |  89 -----------
 .../routes/api/watch/register_load_route.js   |  68 --------
 .../routes/api/watch/register_save_route.js   |  94 -----------
 .../api/watch/register_visualize_route.js     |  62 --------
 .../api/watches/register_delete_route.js      |  58 -------
 .../routes/api/watches/register_list_route.js |  79 ----------
 255 files changed, 2290 insertions(+), 2206 deletions(-)
 create mode 100644 src/legacy/ui/public/time_buckets/index.d.ts
 create mode 100644 x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/app_context.mock.tsx
 rename x-pack/legacy/plugins/watcher/{server/routes/api/fields/index.js => __jest__/client_integration/helpers/body_response.ts} (56%)
 create mode 100644 x-pack/legacy/plugins/watcher/kibana.json
 delete mode 100644 x-pack/legacy/plugins/watcher/plugin_definition.js
 create mode 100644 x-pack/legacy/plugins/watcher/plugin_definition.ts
 delete mode 100644 x-pack/legacy/plugins/watcher/public/app.html
 create mode 100644 x-pack/legacy/plugins/watcher/public/legacy.ts
 delete mode 100644 x-pack/legacy/plugins/watcher/public/lib/documentation_links/documentation_links.ts
 rename x-pack/legacy/plugins/watcher/public/{lib/manage_angular_lifecycle.js => manage_angular_lifecycle.ts} (75%)
 delete mode 100644 x-pack/legacy/plugins/watcher/public/models/index.d.ts
 rename x-pack/legacy/plugins/watcher/public/{app.js => np_ready/application/app.tsx} (60%)
 create mode 100644 x-pack/legacy/plugins/watcher/public/np_ready/application/app_context.tsx
 create mode 100644 x-pack/legacy/plugins/watcher/public/np_ready/application/boot.tsx
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/components/confirm_watches_modal.tsx (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/components/delete_watches_modal.tsx (95%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/components/form_errors.tsx (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/components/index.ts (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/components/page_error/index.ts (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/components/page_error/page_error.tsx (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/components/page_error/page_error_forbidden.tsx (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/components/page_error/page_error_not_exist.tsx (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/components/section_error.tsx (80%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/components/section_loading.tsx (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/components/watch_status.tsx (95%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/constants/base_path.ts (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/constants/index.ts (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/index.scss (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/lib/api.ts (61%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/lib/breadcrumbs.ts (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/lib/format_date.ts (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/lib/get_search_value.ts (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/lib/get_time_unit_label.ts (95%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/lib/navigation.ts (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/lib/use_request.ts (99%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/action/action.js (95%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/action/base_action.js (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/action/email_action.js (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/action/index.js (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/action/index_action.js (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/action/jira_action.js (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/action/logging_action.js (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/action/pagerduty_action.js (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/action/slack_action.js (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/action/unknown_action.js (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/action/webhook_action.js (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/action_status/action_status.js (95%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/action_status/index.js (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/execute_details/execute_details.js (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/execute_details/index.js (100%)
 create mode 100644 x-pack/legacy/plugins/watcher/public/np_ready/application/models/index.d.ts
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/settings/index.js (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/settings/settings.js (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/visualize_options/index.js (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/visualize_options/visualize_options.js (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/watch/agg_types.ts (94%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/watch/base_watch.js (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/watch/comparators.ts (96%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/watch/default_watch.json (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/watch/group_by_types.ts (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/watch/index.js (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/watch/json_watch.js (98%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/watch/lib/check_action_id_collision/check_action_id_collision.js (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/watch/lib/check_action_id_collision/index.js (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/watch/lib/create_action_id/create_action_id.js (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/watch/lib/create_action_id/index.js (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/watch/monitoring_watch.js (92%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/watch/threshold_watch.js (99%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/watch/watch.js (93%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/watch_errors/index.js (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/watch_errors/watch_errors.js (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/watch_history_item/index.js (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/watch_history_item/watch_history_item.js (91%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/watch_status/index.js (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/models/watch_status/watch_status.js (94%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/sections/watch_edit/components/json_watch_edit/index.ts (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/sections/watch_edit/components/json_watch_edit/json_watch_edit.tsx (92%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/sections/watch_edit/components/json_watch_edit/json_watch_edit_form.tsx (94%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/sections/watch_edit/components/json_watch_edit/json_watch_edit_simulate.tsx (96%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/sections/watch_edit/components/json_watch_edit/json_watch_edit_simulate_results.tsx (99%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/sections/watch_edit/components/monitoring_watch_edit/index.ts (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/sections/watch_edit/components/monitoring_watch_edit/monitoring_watch_edit.tsx (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/sections/watch_edit/components/request_flyout.tsx (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/sections/watch_edit/components/threshold_watch_edit/action_fields/email_action_fields.tsx (97%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/sections/watch_edit/components/threshold_watch_edit/action_fields/index.ts (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/sections/watch_edit/components/threshold_watch_edit/action_fields/index_action_fields.tsx (94%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/sections/watch_edit/components/threshold_watch_edit/action_fields/jira_action_fields.tsx (97%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/sections/watch_edit/components/threshold_watch_edit/action_fields/logging_action_fields.tsx (94%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/sections/watch_edit/components/threshold_watch_edit/action_fields/pagerduty_action_fields.tsx (95%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/sections/watch_edit/components/threshold_watch_edit/action_fields/slack_action_fields.tsx (96%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/sections/watch_edit/components/threshold_watch_edit/action_fields/webhook_action_fields.tsx (98%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/sections/watch_edit/components/threshold_watch_edit/index.ts (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/sections/watch_edit/components/threshold_watch_edit/threshold_watch_action_accordion.tsx (91%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/sections/watch_edit/components/threshold_watch_edit/threshold_watch_action_dropdown.tsx (96%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/sections/watch_edit/components/threshold_watch_edit/threshold_watch_action_panel.tsx (93%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/sections/watch_edit/components/threshold_watch_edit/threshold_watch_edit.tsx (95%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/sections/watch_edit/components/threshold_watch_edit/watch_visualization.tsx (83%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/sections/watch_edit/components/watch_edit.tsx (82%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/sections/watch_edit/watch_context.ts (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/sections/watch_edit/watch_edit_actions.ts (86%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/sections/watch_list/components/watch_list.tsx (97%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/sections/watch_status/components/watch_detail.tsx (96%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/sections/watch_status/components/watch_history.tsx (97%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/sections/watch_status/components/watch_status.tsx (94%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/sections/watch_status/watch_details_context.ts (100%)
 rename x-pack/legacy/plugins/watcher/public/{ => np_ready/application}/shared_imports.ts (79%)
 rename x-pack/legacy/plugins/watcher/public/{index.js => np_ready/index.ts} (71%)
 create mode 100644 x-pack/legacy/plugins/watcher/public/np_ready/plugin.ts
 rename x-pack/legacy/plugins/watcher/{server/routes/api/fields/register_fields_routes.js => public/np_ready/types.ts} (63%)
 delete mode 100644 x-pack/legacy/plugins/watcher/public/register_feature.js
 create mode 100644 x-pack/legacy/plugins/watcher/public/register_feature.ts
 delete mode 100644 x-pack/legacy/plugins/watcher/public/register_management_sections.js
 delete mode 100644 x-pack/legacy/plugins/watcher/public/register_route.js
 delete mode 100644 x-pack/legacy/plugins/watcher/server/lib/call_with_internal_user_factory/call_with_internal_user_factory.js
 delete mode 100644 x-pack/legacy/plugins/watcher/server/lib/call_with_request_factory/call_with_request_factory.js
 delete mode 100644 x-pack/legacy/plugins/watcher/server/lib/call_with_request_factory/index.js
 delete mode 100644 x-pack/legacy/plugins/watcher/server/lib/elasticsearch_js_plugin/index.js
 delete mode 100644 x-pack/legacy/plugins/watcher/server/lib/error_wrappers/__tests__/wrap_custom_error.js
 delete mode 100644 x-pack/legacy/plugins/watcher/server/lib/error_wrappers/__tests__/wrap_es_error.js
 delete mode 100644 x-pack/legacy/plugins/watcher/server/lib/error_wrappers/__tests__/wrap_unknown_error.js
 delete mode 100644 x-pack/legacy/plugins/watcher/server/lib/error_wrappers/index.js
 delete mode 100644 x-pack/legacy/plugins/watcher/server/lib/error_wrappers/wrap_custom_error.js
 delete mode 100644 x-pack/legacy/plugins/watcher/server/lib/error_wrappers/wrap_es_error.js
 delete mode 100644 x-pack/legacy/plugins/watcher/server/lib/error_wrappers/wrap_unknown_error.js
 delete mode 100644 x-pack/legacy/plugins/watcher/server/lib/is_es_error_factory/__tests__/is_es_error_factory.js
 delete mode 100644 x-pack/legacy/plugins/watcher/server/lib/is_es_error_factory/index.js
 delete mode 100644 x-pack/legacy/plugins/watcher/server/lib/is_es_error_factory/is_es_error_factory.js
 delete mode 100644 x-pack/legacy/plugins/watcher/server/lib/license_pre_routing_factory/license_pre_routing_factory.js
 rename x-pack/legacy/plugins/watcher/server/{lib/call_with_internal_user_factory/index.js => np_ready/index.ts} (55%)
 create mode 100644 x-pack/legacy/plugins/watcher/server/np_ready/lib/call_with_request_factory.ts
 rename x-pack/legacy/plugins/watcher/server/{lib/elasticsearch_js_plugin/elasticsearch_js_plugin.js => np_ready/lib/elasticsearch_js_plugin.ts} (84%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/lib/fetch_all_from_scroll/__tests__/fetch_all_from_scroll.js (100%)
 rename x-pack/legacy/plugins/watcher/server/{lib/fetch_all_from_scroll/fetch_all_from_scroll.js => np_ready/lib/fetch_all_from_scroll/fetch_all_from_scroll.ts} (64%)
 rename x-pack/legacy/plugins/watcher/server/{lib/fetch_all_from_scroll/index.js => np_ready/lib/fetch_all_from_scroll/index.ts} (100%)
 rename x-pack/legacy/plugins/watcher/{public/lib/documentation_links => server/np_ready/lib/is_es_error}/index.ts (84%)
 rename x-pack/legacy/plugins/watcher/server/{routes/api/history/register_history_routes.js => np_ready/lib/is_es_error/is_es_error.ts} (55%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/lib/license_pre_routing_factory/__tests__/license_pre_routing_factory.js (71%)
 rename x-pack/legacy/plugins/watcher/server/{lib/license_pre_routing_factory/index.js => np_ready/lib/license_pre_routing_factory/index.ts} (100%)
 create mode 100644 x-pack/legacy/plugins/watcher/server/np_ready/lib/license_pre_routing_factory/license_pre_routing_factory.ts
 rename x-pack/legacy/plugins/watcher/server/{lib/normalized_field_types/index.js => np_ready/lib/normalized_field_types/index.ts} (100%)
 rename x-pack/legacy/plugins/watcher/server/{lib/normalized_field_types/normalized_field_types.js => np_ready/lib/normalized_field_types/normalized_field_types.ts} (61%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/action_status/__tests__/action_status.js (99%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/action_status/action_status.js (97%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/action_status/index.js (100%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/execute_details/__tests__/execute_details.js (100%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/execute_details/execute_details.js (100%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/execute_details/index.js (100%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/fields/__tests__/fields.js (100%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/fields/fields.js (100%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/fields/index.js (100%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/settings/__tests__/settings.js (100%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/settings/index.js (100%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/settings/settings.js (97%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/visualize_options/index.js (100%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/visualize_options/visualize_options.js (100%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/watch/base_watch.js (98%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/watch/base_watch.test.js (100%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/watch/index.js (100%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/watch/json_watch.js (93%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/watch/json_watch.test.js (100%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/watch/lib/get_watch_type/get_watch_type.js (88%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/watch/lib/get_watch_type/index.js (100%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/watch/monitoring_watch.js (97%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/watch/monitoring_watch.test.js (100%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/watch/threshold_watch/__tests__/format_visualize_data.js (99%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/watch/threshold_watch/build_visualize_query.js (95%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/watch/threshold_watch/data_samples/count.json (100%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/watch/threshold_watch/data_samples/count.query.date.json (100%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/watch/threshold_watch/data_samples/count.query.json (100%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/watch/threshold_watch/data_samples/count_terms.json (100%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/watch/threshold_watch/data_samples/count_terms.query.date.json (100%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/watch/threshold_watch/data_samples/count_terms.query.json (100%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/watch/threshold_watch/data_samples/non_count.json (100%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/watch/threshold_watch/data_samples/non_count.query.date.json (100%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/watch/threshold_watch/data_samples/non_count.query.json (100%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/watch/threshold_watch/data_samples/non_count_terms.json (100%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/watch/threshold_watch/data_samples/non_count_terms.query.date.json (100%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/watch/threshold_watch/data_samples/non_count_terms.query.json (100%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/watch/threshold_watch/format_visualize_data.js (97%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/watch/threshold_watch/index.js (100%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/watch/threshold_watch/threshold_watch.js (97%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/watch/threshold_watch/threshold_watch.test.js (99%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/watch/watch.js (97%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/watch/watch.test.js (98%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/watch_errors/index.js (100%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/watch_errors/watch_errors.js (100%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/watch_errors/watch_errors.test.js (100%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/watch_history_item/__tests__/watch_history_item.js (100%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/watch_history_item/index.js (100%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/watch_history_item/watch_history_item.js (97%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/watch_status/__tests__/watch_status.js (99%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/watch_status/index.js (100%)
 rename x-pack/legacy/plugins/watcher/server/{ => np_ready}/models/watch_status/watch_status.js (98%)
 create mode 100644 x-pack/legacy/plugins/watcher/server/np_ready/plugin.ts
 rename x-pack/legacy/plugins/watcher/server/{routes/api/indices/index.js => np_ready/routes/api/indices/index.ts} (100%)
 create mode 100644 x-pack/legacy/plugins/watcher/server/np_ready/routes/api/indices/register_get_route.ts
 rename x-pack/legacy/plugins/watcher/server/{routes/api/indices/register_indices_routes.js => np_ready/routes/api/indices/register_indices_routes.ts} (62%)
 rename x-pack/legacy/plugins/watcher/server/{routes/api/license/index.js => np_ready/routes/api/license/index.ts} (100%)
 rename x-pack/legacy/plugins/watcher/server/{routes/api/license/register_license_routes.js => np_ready/routes/api/license/register_license_routes.ts} (62%)
 rename x-pack/legacy/plugins/watcher/server/{routes/api/license/register_refresh_route.js => np_ready/routes/api/license/register_refresh_route.ts} (50%)
 create mode 100644 x-pack/legacy/plugins/watcher/server/np_ready/routes/api/register_list_fields_route.ts
 create mode 100644 x-pack/legacy/plugins/watcher/server/np_ready/routes/api/register_load_history_route.ts
 rename x-pack/legacy/plugins/watcher/server/{routes/api/settings/index.js => np_ready/routes/api/settings/index.ts} (100%)
 create mode 100644 x-pack/legacy/plugins/watcher/server/np_ready/routes/api/settings/register_load_route.ts
 rename x-pack/legacy/plugins/watcher/server/{routes/api/settings/register_settings_routes.js => np_ready/routes/api/settings/register_settings_routes.ts} (62%)
 rename x-pack/legacy/plugins/watcher/server/{routes/api/watch/action/index.js => np_ready/routes/api/watch/action/index.ts} (100%)
 create mode 100644 x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/action/register_acknowledge_route.ts
 rename x-pack/legacy/plugins/watcher/server/{routes/api/watch/action/register_action_routes.js => np_ready/routes/api/watch/action/register_action_routes.ts} (61%)
 rename x-pack/legacy/plugins/watcher/server/{routes/api/watch/index.js => np_ready/routes/api/watch/index.ts} (100%)
 create mode 100644 x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_activate_route.ts
 create mode 100644 x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_deactivate_route.ts
 create mode 100644 x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_delete_route.ts
 create mode 100644 x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_execute_route.ts
 create mode 100644 x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_history_route.ts
 create mode 100644 x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_load_route.ts
 create mode 100644 x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_save_route.ts
 create mode 100644 x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_visualize_route.ts
 rename x-pack/legacy/plugins/watcher/server/{routes/api/watch/register_watch_routes.js => np_ready/routes/api/watch/register_watch_routes.ts} (62%)
 rename x-pack/legacy/plugins/watcher/server/{routes/api/watches/index.js => np_ready/routes/api/watches/index.ts} (100%)
 create mode 100644 x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watches/register_delete_route.ts
 create mode 100644 x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watches/register_list_route.ts
 rename x-pack/legacy/plugins/watcher/server/{routes/api/watches/register_watches_routes.js => np_ready/routes/api/watches/register_watches_routes.ts} (62%)
 create mode 100644 x-pack/legacy/plugins/watcher/server/np_ready/types.ts
 delete mode 100644 x-pack/legacy/plugins/watcher/server/routes/api/fields/register_list_route.js
 delete mode 100644 x-pack/legacy/plugins/watcher/server/routes/api/history/index.js
 delete mode 100644 x-pack/legacy/plugins/watcher/server/routes/api/history/register_load_route.js
 delete mode 100644 x-pack/legacy/plugins/watcher/server/routes/api/indices/register_get_route.js
 delete mode 100644 x-pack/legacy/plugins/watcher/server/routes/api/settings/register_load_route.js
 delete mode 100644 x-pack/legacy/plugins/watcher/server/routes/api/watch/action/register_acknowledge_route.js
 delete mode 100644 x-pack/legacy/plugins/watcher/server/routes/api/watch/register_activate_route.js
 delete mode 100644 x-pack/legacy/plugins/watcher/server/routes/api/watch/register_deactivate_route.js
 delete mode 100644 x-pack/legacy/plugins/watcher/server/routes/api/watch/register_delete_route.js
 delete mode 100644 x-pack/legacy/plugins/watcher/server/routes/api/watch/register_execute_route.js
 delete mode 100644 x-pack/legacy/plugins/watcher/server/routes/api/watch/register_history_route.js
 delete mode 100644 x-pack/legacy/plugins/watcher/server/routes/api/watch/register_load_route.js
 delete mode 100644 x-pack/legacy/plugins/watcher/server/routes/api/watch/register_save_route.js
 delete mode 100644 x-pack/legacy/plugins/watcher/server/routes/api/watch/register_visualize_route.js
 delete mode 100644 x-pack/legacy/plugins/watcher/server/routes/api/watches/register_delete_route.js
 delete mode 100644 x-pack/legacy/plugins/watcher/server/routes/api/watches/register_list_route.js

diff --git a/.eslintrc.js b/.eslintrc.js
index 106724c323d30..e01632815bc68 100644
--- a/.eslintrc.js
+++ b/.eslintrc.js
@@ -209,13 +209,6 @@ module.exports = {
         'react-hooks/rules-of-hooks': 'off',
       },
     },
-    {
-      files: ['x-pack/legacy/plugins/watcher/**/*.{js,ts,tsx}'],
-      rules: {
-        'react-hooks/rules-of-hooks': 'off',
-        'react-hooks/exhaustive-deps': 'off',
-      },
-    },
 
     /**
      * Prettier
diff --git a/src/legacy/ui/public/time_buckets/index.d.ts b/src/legacy/ui/public/time_buckets/index.d.ts
new file mode 100644
index 0000000000000..70b9495b81f0e
--- /dev/null
+++ b/src/legacy/ui/public/time_buckets/index.d.ts
@@ -0,0 +1,22 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+declare module 'ui/time_buckets' {
+  export const TimeBuckets: any;
+}
diff --git a/src/plugins/es_ui_shared/public/request/np_ready_request.ts b/src/plugins/es_ui_shared/public/request/np_ready_request.ts
index 48c7904661e51..5a3f28ed76486 100644
--- a/src/plugins/es_ui_shared/public/request/np_ready_request.ts
+++ b/src/plugins/es_ui_shared/public/request/np_ready_request.ts
@@ -19,11 +19,12 @@
 
 import { useEffect, useState, useRef } from 'react';
 
-import { HttpServiceBase } from '../../../../../src/core/public';
+import { HttpServiceBase, HttpFetchQuery } from '../../../../../src/core/public';
 
 export interface SendRequestConfig {
   path: string;
   method: 'get' | 'post' | 'put' | 'delete' | 'patch' | 'head';
+  query?: HttpFetchQuery;
   body?: any;
 }
 
@@ -48,10 +49,10 @@ export interface UseRequestResponse {
 
 export const sendRequest = async (
   httpClient: HttpServiceBase,
-  { path, method, body }: SendRequestConfig
+  { path, method, body, query }: SendRequestConfig
 ): Promise<SendRequestResponse> => {
   try {
-    const response = await httpClient[method](path, { body });
+    const response = await httpClient[method](path, { body, query });
 
     return {
       data: response.data ? response.data : response,
@@ -70,6 +71,7 @@ export const useRequest = (
   {
     path,
     method,
+    query,
     body,
     pollIntervalMs,
     initialData,
@@ -112,6 +114,7 @@ export const useRequest = (
     const requestBody = {
       path,
       method,
+      query,
       body,
     };
 
diff --git a/x-pack/dev-tools/jest/create_jest_config.js b/x-pack/dev-tools/jest/create_jest_config.js
index 199232262773d..f8d07668d0aae 100644
--- a/x-pack/dev-tools/jest/create_jest_config.js
+++ b/x-pack/dev-tools/jest/create_jest_config.js
@@ -20,7 +20,8 @@ export function createJestConfig({ kibanaDirectory, xPackKibanaDirectory }) {
       'uiExports/(.*)': fileMockPath,
       '^src/core/(.*)': `${kibanaDirectory}/src/core/$1`,
       '^src/legacy/(.*)': `${kibanaDirectory}/src/legacy/$1`,
-      '^plugins/watcher/models/(.*)': `${xPackKibanaDirectory}/legacy/plugins/watcher/public/models/$1`,
+      '^plugins/watcher/np_ready/application/models/(.*)':
+        `${xPackKibanaDirectory}/legacy/plugins/watcher/public/np_ready/application/models/$1`,
       '^plugins/([^/.]*)(.*)': `${kibanaDirectory}/src/legacy/core_plugins/$1/public$2`,
       '^legacy/plugins/xpack_main/(.*);': `${xPackKibanaDirectory}/legacy/plugins/xpack_main/public/$1`,
       '\\.(jpg|jpeg|png|gif|eot|otf|webp|svg|ttf|woff|woff2|mp4|webm|wav|mp3|m4a|aac|oga)$': fileMockPath,
diff --git a/x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/app_context.mock.tsx b/x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/app_context.mock.tsx
new file mode 100644
index 0000000000000..de285ee15b59d
--- /dev/null
+++ b/x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/app_context.mock.tsx
@@ -0,0 +1,50 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { ComponentType } from 'enzyme';
+import {
+  chromeServiceMock,
+  docLinksServiceMock,
+  uiSettingsServiceMock,
+  notificationServiceMock,
+  httpServiceMock,
+} from '../../../../../../../src/core/public/mocks';
+import { AppContextProvider } from '../../../public/np_ready/application/app_context';
+
+export const mockContextValue = {
+  docLinks: docLinksServiceMock.createStartContract(),
+  chrome: chromeServiceMock.createStartContract(),
+  legacy: {
+    TimeBuckets: class MockTimeBuckets {
+      setBounds(_domain: any) {
+        return {};
+      }
+      getInterval() {
+        return {
+          expression: {},
+        };
+      }
+    },
+    MANAGEMENT_BREADCRUMB: { text: 'test' },
+    licenseStatus: {},
+  },
+  uiSettings: uiSettingsServiceMock.createSetupContract(),
+  toasts: notificationServiceMock.createSetupContract().toasts,
+  euiUtils: {
+    useChartsTheme: jest.fn(),
+  },
+  // For our test harness, we don't use this mocked out http service
+  http: httpServiceMock.createSetupContract(),
+};
+
+export const withAppContext = (Component: ComponentType<any>) => (props: any) => {
+  return (
+    <AppContextProvider value={mockContextValue}>
+      <Component {...props} />
+    </AppContextProvider>
+  );
+};
diff --git a/x-pack/legacy/plugins/watcher/server/routes/api/fields/index.js b/x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/body_response.ts
similarity index 56%
rename from x-pack/legacy/plugins/watcher/server/routes/api/fields/index.js
rename to x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/body_response.ts
index 8474f8a614bfb..3b3df5fd6f879 100644
--- a/x-pack/legacy/plugins/watcher/server/routes/api/fields/index.js
+++ b/x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/body_response.ts
@@ -4,4 +4,6 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export { registerFieldsRoutes } from './register_fields_routes';
+export const wrapBodyResponse = (obj: object) => JSON.stringify({ body: JSON.stringify(obj) });
+
+export const unwrapBodyResponse = (string: string) => JSON.parse(JSON.parse(string).body);
diff --git a/x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/http_requests.ts b/x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/http_requests.ts
index 2170559dace5a..7d9c1e4163d7b 100644
--- a/x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/http_requests.ts
+++ b/x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/http_requests.ts
@@ -34,7 +34,7 @@ const registerHttpRequestMockHelpers = (server: SinonFakeServer) => {
     const defaultResponse = { watchHistoryItems: [] };
     server.respondWith(
       'GET',
-      `${API_ROOT}/watch/:id/history?startTime=*`,
+      `${API_ROOT}/watch/:id/history`,
       mockResponse(defaultResponse, response)
     );
   };
diff --git a/x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/index.ts b/x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/index.ts
index ad005078db0a8..814028fe599ff 100644
--- a/x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/index.ts
+++ b/x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/index.ts
@@ -11,7 +11,7 @@ import { setup as watchCreateThresholdSetup } from './watch_create_threshold.hel
 import { setup as watchEditSetup } from './watch_edit.helpers';
 
 export { nextTick, getRandomString, findTestSubject, TestBed } from '../../../../../../test_utils';
-
+export { wrapBodyResponse, unwrapBodyResponse } from './body_response';
 export { setupEnvironment } from './setup_environment';
 
 export const pageHelpers = {
diff --git a/x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/setup_environment.ts b/x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/setup_environment.ts
index 806840a7821fd..7e748073c1c6b 100644
--- a/x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/setup_environment.ts
+++ b/x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/setup_environment.ts
@@ -7,9 +7,17 @@
 import axios from 'axios';
 import axiosXhrAdapter from 'axios/lib/adapters/xhr';
 import { init as initHttpRequests } from './http_requests';
-import { setHttpClient, setSavedObjectsClient } from '../../../public/lib/api';
+import { setHttpClient, setSavedObjectsClient } from '../../../public/np_ready/application/lib/api';
 
 const mockHttpClient = axios.create({ adapter: axiosXhrAdapter });
+mockHttpClient.interceptors.response.use(
+  res => {
+    return res.data;
+  },
+  rej => {
+    return Promise.reject(rej);
+  }
+);
 
 const mockSavedObjectsClient = () => {
   return {
@@ -23,7 +31,7 @@ export const setupEnvironment = () => {
   // @ts-ignore
   setHttpClient(mockHttpClient);
 
-  setSavedObjectsClient(mockSavedObjectsClient());
+  setSavedObjectsClient(mockSavedObjectsClient() as any);
 
   return {
     server,
diff --git a/x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/watch_create_json.helpers.ts b/x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/watch_create_json.helpers.ts
index bea215281a4bc..dafcf3a7070d2 100644
--- a/x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/watch_create_json.helpers.ts
+++ b/x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/watch_create_json.helpers.ts
@@ -3,10 +3,11 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
+import { withAppContext } from './app_context.mock';
 import { registerTestBed, TestBed, TestBedConfig } from '../../../../../../test_utils';
-import { WatchEdit } from '../../../public/sections/watch_edit/components/watch_edit';
+import { WatchEdit } from '../../../public/np_ready/application/sections/watch_edit/components/watch_edit';
 import { ROUTES, WATCH_TYPES } from '../../../common/constants';
-import { registerRouter } from '../../../public/lib/navigation';
+import { registerRouter } from '../../../public/np_ready/application/lib/navigation';
 
 const testBedConfig: TestBedConfig = {
   memoryRouter: {
@@ -17,7 +18,7 @@ const testBedConfig: TestBedConfig = {
   doMountAsync: true,
 };
 
-const initTestBed = registerTestBed(WatchEdit, testBedConfig);
+const initTestBed = registerTestBed(withAppContext(WatchEdit), testBedConfig);
 
 export interface WatchCreateJsonTestBed extends TestBed<WatchCreateJsonTestSubjects> {
   actions: {
diff --git a/x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/watch_create_threshold.helpers.ts b/x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/watch_create_threshold.helpers.ts
index e33ae02036224..8cebe8ce26229 100644
--- a/x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/watch_create_threshold.helpers.ts
+++ b/x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/watch_create_threshold.helpers.ts
@@ -4,9 +4,10 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import { registerTestBed, TestBed, TestBedConfig } from '../../../../../../test_utils';
-import { WatchEdit } from '../../../public/sections/watch_edit/components/watch_edit';
+import { WatchEdit } from '../../../public/np_ready/application/sections/watch_edit/components/watch_edit';
 import { ROUTES, WATCH_TYPES } from '../../../common/constants';
-import { registerRouter } from '../../../public/lib/navigation';
+import { registerRouter } from '../../../public/np_ready/application/lib/navigation';
+import { withAppContext } from './app_context.mock';
 
 const testBedConfig: TestBedConfig = {
   memoryRouter: {
@@ -17,7 +18,7 @@ const testBedConfig: TestBedConfig = {
   doMountAsync: true,
 };
 
-const initTestBed = registerTestBed(WatchEdit, testBedConfig);
+const initTestBed = registerTestBed(withAppContext(WatchEdit), testBedConfig);
 
 export interface WatchCreateThresholdTestBed extends TestBed<WatchCreateThresholdTestSubjects> {
   actions: {
diff --git a/x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/watch_edit.helpers.ts b/x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/watch_edit.helpers.ts
index d0b458e30c70e..187f4dcaa0a76 100644
--- a/x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/watch_edit.helpers.ts
+++ b/x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/watch_edit.helpers.ts
@@ -4,10 +4,11 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import { registerTestBed, TestBed, TestBedConfig } from '../../../../../../test_utils';
-import { WatchEdit } from '../../../public/sections/watch_edit/components/watch_edit';
+import { WatchEdit } from '../../../public/np_ready/application/sections/watch_edit/components/watch_edit';
 import { ROUTES } from '../../../common/constants';
-import { registerRouter } from '../../../public/lib/navigation';
+import { registerRouter } from '../../../public/np_ready/application/lib/navigation';
 import { WATCH_ID } from './constants';
+import { withAppContext } from './app_context.mock';
 
 const testBedConfig: TestBedConfig = {
   memoryRouter: {
@@ -18,7 +19,7 @@ const testBedConfig: TestBedConfig = {
   doMountAsync: true,
 };
 
-const initTestBed = registerTestBed(WatchEdit, testBedConfig);
+const initTestBed = registerTestBed(withAppContext(WatchEdit), testBedConfig);
 
 export interface WatchEditTestBed extends TestBed<WatchEditSubjects> {
   actions: {
diff --git a/x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/watch_list.helpers.ts b/x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/watch_list.helpers.ts
index 0d3ecaa7a2b9a..e33327ea42ffe 100644
--- a/x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/watch_list.helpers.ts
+++ b/x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/watch_list.helpers.ts
@@ -13,8 +13,9 @@ import {
   TestBedConfig,
   nextTick,
 } from '../../../../../../test_utils';
-import { WatchList } from '../../../public/sections/watch_list/components/watch_list';
+import { WatchList } from '../../../public/np_ready/application/sections/watch_list/components/watch_list';
 import { ROUTES } from '../../../common/constants';
+import { withAppContext } from './app_context.mock';
 
 const testBedConfig: TestBedConfig = {
   memoryRouter: {
@@ -23,7 +24,7 @@ const testBedConfig: TestBedConfig = {
   doMountAsync: true,
 };
 
-const initTestBed = registerTestBed(WatchList, testBedConfig);
+const initTestBed = registerTestBed(withAppContext(WatchList), testBedConfig);
 
 export interface WatchListTestBed extends TestBed<WatchListTestSubjects> {
   actions: {
diff --git a/x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/watch_status.helpers.ts b/x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/watch_status.helpers.ts
index 22d57f255ebe6..e7bffe8924e31 100644
--- a/x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/watch_status.helpers.ts
+++ b/x-pack/legacy/plugins/watcher/__jest__/client_integration/helpers/watch_status.helpers.ts
@@ -13,9 +13,10 @@ import {
   TestBedConfig,
   nextTick,
 } from '../../../../../../test_utils';
-import { WatchStatus } from '../../../public/sections/watch_status/components/watch_status';
+import { WatchStatus } from '../../../public/np_ready/application/sections/watch_status/components/watch_status';
 import { ROUTES } from '../../../common/constants';
 import { WATCH_ID } from './constants';
+import { withAppContext } from './app_context.mock';
 
 const testBedConfig: TestBedConfig = {
   memoryRouter: {
@@ -25,7 +26,7 @@ const testBedConfig: TestBedConfig = {
   doMountAsync: true,
 };
 
-const initTestBed = registerTestBed(WatchStatus, testBedConfig);
+const initTestBed = registerTestBed(withAppContext(WatchStatus), testBedConfig);
 
 export interface WatchStatusTestBed extends TestBed<WatchStatusTestSubjects> {
   actions: {
diff --git a/x-pack/legacy/plugins/watcher/__jest__/client_integration/watch_create_json.test.ts b/x-pack/legacy/plugins/watcher/__jest__/client_integration/watch_create_json.test.ts
index f45dbe156723b..4c893978ee5cb 100644
--- a/x-pack/legacy/plugins/watcher/__jest__/client_integration/watch_create_json.test.ts
+++ b/x-pack/legacy/plugins/watcher/__jest__/client_integration/watch_create_json.test.ts
@@ -4,22 +4,15 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import { act } from 'react-dom/test-utils';
-import { setupEnvironment, pageHelpers, nextTick } from './helpers';
+import { setupEnvironment, pageHelpers, nextTick, wrapBodyResponse } from './helpers';
 import { WatchCreateJsonTestBed } from './helpers/watch_create_json.helpers';
 import { WATCH } from './helpers/constants';
-import defaultWatchJson from '../../public/models/watch/default_watch.json';
+import defaultWatchJson from '../../public/np_ready/application/models/watch/default_watch.json';
 import { getExecuteDetails } from '../../test/fixtures';
 
-jest.mock('ui/chrome', () => ({
-  breadcrumbs: { set: () => {} },
-  addBasePath: (path: string) => path || '/api/watcher',
-}));
-
-jest.mock('ui/time_buckets', () => {});
-
 const { setup } = pageHelpers.watchCreateJson;
 
-describe.skip('<JsonWatchEdit /> create route', () => {
+describe('<JsonWatchEdit /> create route', () => {
   const { server, httpRequestsMockHelpers } = setupEnvironment();
   let testBed: WatchCreateJsonTestBed;
 
@@ -107,7 +100,7 @@ describe.skip('<JsonWatchEdit /> create route', () => {
             'There are {{ctx.payload.hits.total}} documents in your index. Threshold is 10.';
 
           expect(latestRequest.requestBody).toEqual(
-            JSON.stringify({
+            wrapBodyResponse({
               id: watch.id,
               name: watch.name,
               type: watch.type,
@@ -194,7 +187,7 @@ describe.skip('<JsonWatchEdit /> create route', () => {
           };
 
           expect(latestRequest.requestBody).toEqual(
-            JSON.stringify({
+            wrapBodyResponse({
               executeDetails: getExecuteDetails({
                 actionModes,
               }),
@@ -258,7 +251,7 @@ describe.skip('<JsonWatchEdit /> create route', () => {
           const scheduledTime = `now+${SCHEDULED_TIME}s`;
 
           expect(latestRequest.requestBody).toEqual(
-            JSON.stringify({
+            wrapBodyResponse({
               executeDetails: getExecuteDetails({
                 triggerData: {
                   triggeredTime,
diff --git a/x-pack/legacy/plugins/watcher/__jest__/client_integration/watch_create_threshold.test.tsx b/x-pack/legacy/plugins/watcher/__jest__/client_integration/watch_create_threshold.test.tsx
index 62cfd92182091..36a5c150eead7 100644
--- a/x-pack/legacy/plugins/watcher/__jest__/client_integration/watch_create_threshold.test.tsx
+++ b/x-pack/legacy/plugins/watcher/__jest__/client_integration/watch_create_threshold.test.tsx
@@ -7,7 +7,13 @@ import React from 'react';
 import { act } from 'react-dom/test-utils';
 import axiosXhrAdapter from 'axios/lib/adapters/xhr';
 import axios from 'axios';
-import { setupEnvironment, pageHelpers, nextTick } from './helpers';
+import {
+  setupEnvironment,
+  pageHelpers,
+  nextTick,
+  wrapBodyResponse,
+  unwrapBodyResponse,
+} from './helpers';
 import { WatchCreateThresholdTestBed } from './helpers/watch_create_threshold.helpers';
 import { getExecuteDetails } from '../../test/fixtures';
 import { WATCH_TYPES } from '../../common/constants';
@@ -42,31 +48,8 @@ const WATCH_VISUALIZE_DATA = {
 
 const mockHttpClient = axios.create({ adapter: axiosXhrAdapter });
 
-jest.mock('ui/chrome', () => ({
-  breadcrumbs: { set: () => {} },
-  addBasePath: (path: string) => path || '/api/watcher',
-  getUiSettingsClient: () => ({
-    get: () => {},
-    isDefault: () => true,
-  }),
-}));
-
-jest.mock('ui/time_buckets', () => {
-  class MockTimeBuckets {
-    setBounds(_domain: any) {
-      return {};
-    }
-    getInterval() {
-      return {
-        expression: {},
-      };
-    }
-  }
-  return { TimeBuckets: MockTimeBuckets };
-});
-
-jest.mock('../../public/lib/api', () => ({
-  ...jest.requireActual('../../public/lib/api'),
+jest.mock('../../public/np_ready/application/lib/api', () => ({
+  ...jest.requireActual('../../public/np_ready/application/lib/api'),
   loadIndexPatterns: async () => {
     const INDEX_PATTERNS = [
       { attributes: { title: 'index1' } },
@@ -85,7 +68,7 @@ jest.mock('@elastic/eui', () => ({
   EuiComboBox: (props: any) => (
     <input
       data-test-subj="mockComboBox"
-      onChange={async (syntheticEvent: any) => {
+      onChange={(syntheticEvent: any) => {
         props.onChange([syntheticEvent['0']]);
       }}
     />
@@ -94,7 +77,7 @@ jest.mock('@elastic/eui', () => ({
 
 const { setup } = pageHelpers.watchCreateThreshold;
 
-describe.skip('<ThresholdWatchEdit /> create route', () => {
+describe('<ThresholdWatchEdit /> create route', () => {
   const { server, httpRequestsMockHelpers } = setupEnvironment();
   let testBed: WatchCreateThresholdTestBed;
 
@@ -105,12 +88,9 @@ describe.skip('<ThresholdWatchEdit /> create route', () => {
   describe('on component mount', () => {
     beforeEach(async () => {
       testBed = await setup();
-
-      await act(async () => {
-        const { component } = testBed;
-        await nextTick();
-        component.update();
-      });
+      const { component } = testBed;
+      await nextTick();
+      component.update();
     });
 
     test('should set the correct page title', () => {
@@ -125,13 +105,6 @@ describe.skip('<ThresholdWatchEdit /> create route', () => {
         httpRequestsMockHelpers.setLoadEsFieldsResponse({ fields: ES_FIELDS });
         httpRequestsMockHelpers.setLoadSettingsResponse(SETTINGS);
         httpRequestsMockHelpers.setLoadWatchVisualizeResponse(WATCH_VISUALIZE_DATA);
-
-        testBed = await setup();
-
-        await act(async () => {
-          await nextTick();
-          testBed.component.update();
-        });
       });
 
       describe('form validation', () => {
@@ -173,7 +146,7 @@ describe.skip('<ThresholdWatchEdit /> create route', () => {
           expect(find('saveWatchButton').props().disabled).toEqual(true);
         });
 
-        test('it should enable the Create button and render additonal content with valid fields', async () => {
+        test('it should enable the Create button and render additional content with valid fields', async () => {
           const { form, find, component, exists } = testBed;
 
           form.setInputValue('nameInput', 'my_test_watch');
@@ -192,39 +165,30 @@ describe.skip('<ThresholdWatchEdit /> create route', () => {
           expect(exists('watchActionsPanel')).toBe(true);
         });
 
-        describe('watch conditions', () => {
-          beforeEach(async () => {
-            const { form, find, component } = testBed;
+        // Looks like there is an issue with using 'mockComboBox'.
+        describe.skip('watch conditions', () => {
+          beforeEach(() => {
+            const { form, find } = testBed;
 
             // Name, index and time fields are required before the watch condition expression renders
             form.setInputValue('nameInput', 'my_test_watch');
-            find('mockComboBox').simulate('change', [{ label: 'index1', value: 'index1' }]); // Using mocked EuiComboBox
-            form.setInputValue('watchTimeFieldSelect', '@timestamp');
-
-            await act(async () => {
-              await nextTick();
-              component.update();
+            act(() => {
+              find('mockComboBox').simulate('change', [{ label: 'index1', value: 'index1' }]); // Using mocked EuiComboBox
             });
+            form.setInputValue('watchTimeFieldSelect', '@timestamp');
           });
 
-          test('should require a threshold value', async () => {
-            const { form, find, component } = testBed;
-
-            find('watchThresholdButton').simulate('click');
+          test('should require a threshold value', () => {
+            const { form, find } = testBed;
 
-            // Provide invalid value
-            form.setInputValue('watchThresholdInput', '');
-
-            expect(form.getErrorsMessages()).toContain('A value is required.');
-
-            // Provide valid value
-            form.setInputValue('watchThresholdInput', '0');
-
-            await act(async () => {
-              await nextTick();
-              component.update();
+            act(() => {
+              find('watchThresholdButton').simulate('click');
+              // Provide invalid value
+              form.setInputValue('watchThresholdInput', '');
+              // Provide valid value
+              form.setInputValue('watchThresholdInput', '0');
             });
-
+            expect(form.getErrorsMessages()).toContain('A value is required.');
             expect(form.getErrorsMessages().length).toEqual(0);
           });
         });
@@ -273,7 +237,7 @@ describe.skip('<ThresholdWatchEdit /> create route', () => {
           const latestRequest = server.requests[server.requests.length - 1];
 
           const thresholdWatch = {
-            id: JSON.parse(latestRequest.requestBody).watch.id, // watch ID is created dynamically
+            id: unwrapBodyResponse(latestRequest.requestBody).watch.id, // watch ID is created dynamically
             name: WATCH_NAME,
             type: WATCH_TYPES.THRESHOLD,
             isNew: true,
@@ -300,7 +264,7 @@ describe.skip('<ThresholdWatchEdit /> create route', () => {
           };
 
           expect(latestRequest.requestBody).toEqual(
-            JSON.stringify({
+            wrapBodyResponse({
               executeDetails: getExecuteDetails({
                 actionModes: {
                   logging_1: 'force_execute',
@@ -341,7 +305,7 @@ describe.skip('<ThresholdWatchEdit /> create route', () => {
           const latestRequest = server.requests[server.requests.length - 1];
 
           const thresholdWatch = {
-            id: JSON.parse(latestRequest.requestBody).watch.id, // watch ID is created dynamically
+            id: unwrapBodyResponse(latestRequest.requestBody).watch.id, // watch ID is created dynamically
             name: WATCH_NAME,
             type: WATCH_TYPES.THRESHOLD,
             isNew: true,
@@ -367,7 +331,7 @@ describe.skip('<ThresholdWatchEdit /> create route', () => {
           };
 
           expect(latestRequest.requestBody).toEqual(
-            JSON.stringify({
+            wrapBodyResponse({
               executeDetails: getExecuteDetails({
                 actionModes: {
                   index_1: 'force_execute',
@@ -401,7 +365,7 @@ describe.skip('<ThresholdWatchEdit /> create route', () => {
           const latestRequest = server.requests[server.requests.length - 1];
 
           const thresholdWatch = {
-            id: JSON.parse(latestRequest.requestBody).watch.id, // watch ID is created dynamically
+            id: unwrapBodyResponse(latestRequest.requestBody).watch.id, // watch ID is created dynamically
             name: WATCH_NAME,
             type: WATCH_TYPES.THRESHOLD,
             isNew: true,
@@ -430,7 +394,7 @@ describe.skip('<ThresholdWatchEdit /> create route', () => {
           };
 
           expect(latestRequest.requestBody).toEqual(
-            JSON.stringify({
+            wrapBodyResponse({
               executeDetails: getExecuteDetails({
                 actionModes: {
                   slack_1: 'force_execute',
@@ -471,7 +435,7 @@ describe.skip('<ThresholdWatchEdit /> create route', () => {
           const latestRequest = server.requests[server.requests.length - 1];
 
           const thresholdWatch = {
-            id: JSON.parse(latestRequest.requestBody).watch.id, // watch ID is created dynamically
+            id: unwrapBodyResponse(latestRequest.requestBody).watch.id, // watch ID is created dynamically
             name: WATCH_NAME,
             type: WATCH_TYPES.THRESHOLD,
             isNew: true,
@@ -504,7 +468,7 @@ describe.skip('<ThresholdWatchEdit /> create route', () => {
           };
 
           expect(latestRequest.requestBody).toEqual(
-            JSON.stringify({
+            wrapBodyResponse({
               executeDetails: getExecuteDetails({
                 actionModes: {
                   email_1: 'force_execute',
@@ -559,7 +523,7 @@ describe.skip('<ThresholdWatchEdit /> create route', () => {
           const latestRequest = server.requests[server.requests.length - 1];
 
           const thresholdWatch = {
-            id: JSON.parse(latestRequest.requestBody).watch.id, // watch ID is created dynamically
+            id: unwrapBodyResponse(latestRequest.requestBody).watch.id, // watch ID is created dynamically
             name: WATCH_NAME,
             type: WATCH_TYPES.THRESHOLD,
             isNew: true,
@@ -594,7 +558,7 @@ describe.skip('<ThresholdWatchEdit /> create route', () => {
           };
 
           expect(latestRequest.requestBody).toEqual(
-            JSON.stringify({
+            wrapBodyResponse({
               executeDetails: getExecuteDetails({
                 actionModes: {
                   webhook_1: 'force_execute',
@@ -645,7 +609,7 @@ describe.skip('<ThresholdWatchEdit /> create route', () => {
           const latestRequest = server.requests[server.requests.length - 1];
 
           const thresholdWatch = {
-            id: JSON.parse(latestRequest.requestBody).watch.id, // watch ID is created dynamically
+            id: unwrapBodyResponse(latestRequest.requestBody).watch.id, // watch ID is created dynamically
             name: WATCH_NAME,
             type: WATCH_TYPES.THRESHOLD,
             isNew: true,
@@ -682,7 +646,7 @@ describe.skip('<ThresholdWatchEdit /> create route', () => {
           };
 
           expect(latestRequest.requestBody).toEqual(
-            JSON.stringify({
+            wrapBodyResponse({
               executeDetails: getExecuteDetails({
                 actionModes: {
                   jira_1: 'force_execute',
@@ -723,7 +687,7 @@ describe.skip('<ThresholdWatchEdit /> create route', () => {
           const latestRequest = server.requests[server.requests.length - 1];
 
           const thresholdWatch = {
-            id: JSON.parse(latestRequest.requestBody).watch.id, // watch ID is created dynamically
+            id: unwrapBodyResponse(latestRequest.requestBody).watch.id, // watch ID is created dynamically
             name: WATCH_NAME,
             type: WATCH_TYPES.THRESHOLD,
             isNew: true,
@@ -750,7 +714,7 @@ describe.skip('<ThresholdWatchEdit /> create route', () => {
           };
 
           expect(latestRequest.requestBody).toEqual(
-            JSON.stringify({
+            wrapBodyResponse({
               executeDetails: getExecuteDetails({
                 actionModes: {
                   pagerduty_1: 'force_execute',
@@ -784,7 +748,7 @@ describe.skip('<ThresholdWatchEdit /> create route', () => {
           const latestRequest = server.requests[server.requests.length - 1];
 
           const thresholdWatch = {
-            id: JSON.parse(latestRequest.requestBody).id, // watch ID is created dynamically
+            id: unwrapBodyResponse(latestRequest.requestBody).id, // watch ID is created dynamically
             name: WATCH_NAME,
             type: WATCH_TYPES.THRESHOLD,
             isNew: true,
@@ -801,7 +765,7 @@ describe.skip('<ThresholdWatchEdit /> create route', () => {
             threshold: 1000,
           };
 
-          expect(latestRequest.requestBody).toEqual(JSON.stringify(thresholdWatch));
+          expect(latestRequest.requestBody).toEqual(wrapBodyResponse(thresholdWatch));
         });
       });
     });
diff --git a/x-pack/legacy/plugins/watcher/__jest__/client_integration/watch_edit.test.ts b/x-pack/legacy/plugins/watcher/__jest__/client_integration/watch_edit.test.ts
index fb9ad934249e9..1eee3d3b7e6ee 100644
--- a/x-pack/legacy/plugins/watcher/__jest__/client_integration/watch_edit.test.ts
+++ b/x-pack/legacy/plugins/watcher/__jest__/client_integration/watch_edit.test.ts
@@ -6,36 +6,17 @@
 import { act } from 'react-dom/test-utils';
 import axiosXhrAdapter from 'axios/lib/adapters/xhr';
 import axios from 'axios';
-import { setupEnvironment, pageHelpers, nextTick } from './helpers';
+import { setupEnvironment, pageHelpers, nextTick, wrapBodyResponse } from './helpers';
 import { WatchEditTestBed } from './helpers/watch_edit.helpers';
 import { WATCH } from './helpers/constants';
-import defaultWatchJson from '../../public/models/watch/default_watch.json';
+import defaultWatchJson from '../../public/np_ready/application/models/watch/default_watch.json';
 import { getWatch } from '../../test/fixtures';
 import { getRandomString } from '../../../../../test_utils';
 
 const mockHttpClient = axios.create({ adapter: axiosXhrAdapter });
 
-jest.mock('ui/chrome', () => ({
-  breadcrumbs: { set: () => {} },
-  addBasePath: (path: string) => path || '/api/watcher',
-}));
-
-jest.mock('ui/time_buckets', () => {
-  class MockTimeBuckets {
-    setBounds(_domain: any) {
-      return {};
-    }
-    getInterval() {
-      return {
-        expression: {},
-      };
-    }
-  }
-  return { TimeBuckets: MockTimeBuckets };
-});
-
-jest.mock('../../public/lib/api', () => ({
-  ...jest.requireActual('../../public/lib/api'),
+jest.mock('../../public/np_ready/application/lib/api', () => ({
+  ...jest.requireActual('../../public/np_ready/application/lib/api'),
   loadIndexPatterns: async () => {
     const INDEX_PATTERNS = [
       { attributes: { title: 'index1' } },
@@ -49,7 +30,7 @@ jest.mock('../../public/lib/api', () => ({
 
 const { setup } = pageHelpers.watchEdit;
 
-describe.skip('<WatchEdit />', () => {
+describe('<WatchEdit />', () => {
   const { server, httpRequestsMockHelpers } = setupEnvironment();
   let testBed: WatchEditTestBed;
 
@@ -110,7 +91,7 @@ describe.skip('<WatchEdit />', () => {
           'There are {{ctx.payload.hits.total}} documents in your index. Threshold is 10.';
 
         expect(latestRequest.requestBody).toEqual(
-          JSON.stringify({
+          wrapBodyResponse({
             id: watch.id,
             name: EDITED_WATCH_NAME,
             type: watch.type,
@@ -202,7 +183,7 @@ describe.skip('<WatchEdit />', () => {
         } = watch;
 
         expect(latestRequest.requestBody).toEqual(
-          JSON.stringify({
+          wrapBodyResponse({
             id,
             name: EDITED_WATCH_NAME,
             type,
diff --git a/x-pack/legacy/plugins/watcher/__jest__/client_integration/watch_list.test.ts b/x-pack/legacy/plugins/watcher/__jest__/client_integration/watch_list.test.ts
index bc2eadb7d9be9..a0327c6dfa1db 100644
--- a/x-pack/legacy/plugins/watcher/__jest__/client_integration/watch_list.test.ts
+++ b/x-pack/legacy/plugins/watcher/__jest__/client_integration/watch_list.test.ts
@@ -18,16 +18,9 @@ import { ROUTES } from '../../common/constants';
 
 const { API_ROOT } = ROUTES;
 
-jest.mock('ui/chrome', () => ({
-  breadcrumbs: { set: () => {} },
-  addBasePath: (path: string) => path || '/api/watcher',
-}));
-
-jest.mock('ui/time_buckets', () => {});
-
 const { setup } = pageHelpers.watchList;
 
-describe.skip('<WatchList />', () => {
+describe('<WatchList />', () => {
   const { server, httpRequestsMockHelpers } = setupEnvironment();
   let testBed: WatchListTestBed;
 
diff --git a/x-pack/legacy/plugins/watcher/__jest__/client_integration/watch_status.test.ts b/x-pack/legacy/plugins/watcher/__jest__/client_integration/watch_status.test.ts
index e12acd2e32ccf..973c14893f342 100644
--- a/x-pack/legacy/plugins/watcher/__jest__/client_integration/watch_status.test.ts
+++ b/x-pack/legacy/plugins/watcher/__jest__/client_integration/watch_status.test.ts
@@ -14,13 +14,6 @@ import { WATCH_STATES, ACTION_STATES } from '../../common/constants';
 
 const { API_ROOT } = ROUTES;
 
-jest.mock('ui/chrome', () => ({
-  breadcrumbs: { set: () => {} },
-  addBasePath: (path: string) => path || '/api/watcher',
-}));
-
-jest.mock('ui/time_buckets', () => {});
-
 const { setup } = pageHelpers.watchStatus;
 
 const watchHistory1 = getWatchHistory({ startTime: '2019-06-04T01:11:11.294' });
@@ -45,7 +38,7 @@ const watch = {
   },
 };
 
-describe.skip('<WatchStatus />', () => {
+describe('<WatchStatus />', () => {
   const { server, httpRequestsMockHelpers } = setupEnvironment();
   let testBed: WatchStatusTestBed;
 
diff --git a/x-pack/legacy/plugins/watcher/kibana.json b/x-pack/legacy/plugins/watcher/kibana.json
new file mode 100644
index 0000000000000..ccec8a1b77683
--- /dev/null
+++ b/x-pack/legacy/plugins/watcher/kibana.json
@@ -0,0 +1,9 @@
+{
+  "id": "watcher",
+  "version": "kibana",
+  "requiredPlugins": [
+    "home"
+  ],
+  "server": true,
+  "ui": true
+}
diff --git a/x-pack/legacy/plugins/watcher/plugin_definition.js b/x-pack/legacy/plugins/watcher/plugin_definition.js
deleted file mode 100644
index 4a5946cc4974d..0000000000000
--- a/x-pack/legacy/plugins/watcher/plugin_definition.js
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { resolve } from 'path';
-import { i18n } from '@kbn/i18n';
-import { registerFieldsRoutes } from './server/routes/api/fields';
-import { registerSettingsRoutes } from './server/routes/api/settings';
-import { registerHistoryRoutes } from './server/routes/api/history';
-import { registerIndicesRoutes } from './server/routes/api/indices';
-import { registerLicenseRoutes } from './server/routes/api/license';
-import { registerWatchesRoutes } from './server/routes/api/watches';
-import { registerWatchRoutes } from './server/routes/api/watch';
-import { registerLicenseChecker } from '../../server/lib/register_license_checker';
-import { PLUGIN } from './common/constants';
-
-export const pluginDefinition = {
-  id: PLUGIN.ID,
-  configPrefix: 'xpack.watcher',
-  publicDir: resolve(__dirname, 'public'),
-  require: ['kibana', 'elasticsearch', 'xpack_main'],
-  uiExports: {
-    styleSheetPaths: resolve(__dirname, 'public/index.scss'),
-    managementSections: ['plugins/watcher'],
-    home: ['plugins/watcher/register_feature'],
-  },
-  init: function (server) {
-    // Register license checker
-    registerLicenseChecker(
-      server,
-      PLUGIN.ID,
-      PLUGIN.getI18nName(i18n),
-      PLUGIN.MINIMUM_LICENSE_REQUIRED
-    );
-
-    registerFieldsRoutes(server);
-    registerHistoryRoutes(server);
-    registerIndicesRoutes(server);
-    registerLicenseRoutes(server);
-    registerSettingsRoutes(server);
-    registerWatchesRoutes(server);
-    registerWatchRoutes(server);
-  },
-};
diff --git a/x-pack/legacy/plugins/watcher/plugin_definition.ts b/x-pack/legacy/plugins/watcher/plugin_definition.ts
new file mode 100644
index 0000000000000..2da05253fdb32
--- /dev/null
+++ b/x-pack/legacy/plugins/watcher/plugin_definition.ts
@@ -0,0 +1,32 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { resolve } from 'path';
+import { plugin } from './server/np_ready';
+import { PLUGIN } from './common/constants';
+
+export const pluginDefinition = {
+  id: PLUGIN.ID,
+  configPrefix: 'xpack.watcher',
+  publicDir: resolve(__dirname, 'public'),
+  require: ['kibana', 'elasticsearch', 'xpack_main'],
+  uiExports: {
+    styleSheetPaths: resolve(__dirname, 'public/np_ready/application/index.scss'),
+    managementSections: ['plugins/watcher/legacy'],
+    home: ['plugins/watcher/register_feature'],
+  },
+  init(server: any) {
+    plugin({} as any).setup(server.newPlatform.setup.core, {
+      __LEGACY: {
+        route: server.route.bind(server),
+        plugins: {
+          watcher: server.plugins[PLUGIN.ID],
+          xpack_main: server.plugins.xpack_main,
+        },
+      },
+    });
+  },
+};
diff --git a/x-pack/legacy/plugins/watcher/public/app.html b/x-pack/legacy/plugins/watcher/public/app.html
deleted file mode 100644
index 8c7c3eb946aef..0000000000000
--- a/x-pack/legacy/plugins/watcher/public/app.html
+++ /dev/null
@@ -1,3 +0,0 @@
-<kbn-management-app section="elasticsearch/watcher">
-  <div id="watchReactRoot"></div>
-</kbn-management-app>
\ No newline at end of file
diff --git a/x-pack/legacy/plugins/watcher/public/legacy.ts b/x-pack/legacy/plugins/watcher/public/legacy.ts
new file mode 100644
index 0000000000000..d7b85ccfeb7b4
--- /dev/null
+++ b/x-pack/legacy/plugins/watcher/public/legacy.ts
@@ -0,0 +1,146 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { CoreSetup, App, AppUnmount } from 'src/core/public';
+import { i18n } from '@kbn/i18n';
+
+/* Legacy UI imports */
+import { npSetup, npStart } from 'ui/new_platform';
+import routes from 'ui/routes';
+import { management, MANAGEMENT_BREADCRUMB } from 'ui/management';
+import { TimeBuckets } from 'ui/time_buckets';
+// @ts-ignore
+import { xpackInfo } from 'plugins/xpack_main/services/xpack_info';
+/* Legacy UI imports */
+
+import { plugin } from './np_ready';
+import { PLUGIN } from '../common/constants';
+import { LICENSE_STATUS_INVALID, LICENSE_STATUS_UNAVAILABLE } from '../../../common/constants';
+import { manageAngularLifecycle } from './manage_angular_lifecycle';
+
+const template = `<kbn-management-app section="elasticsearch/watcher">
+  <div id="watchReactRoot"></div>
+</kbn-management-app>`;
+
+let elem: HTMLElement;
+let mountApp: () => AppUnmount | Promise<AppUnmount>;
+let unmountApp: AppUnmount | Promise<AppUnmount>;
+routes.when('/management/elasticsearch/watcher/:param1?/:param2?/:param3?/:param4?', {
+  template,
+  controller: class WatcherController {
+    constructor($injector: any, $scope: any) {
+      const $route = $injector.get('$route');
+      const licenseStatus = xpackInfo.get(`features.${PLUGIN.ID}`);
+      const shimCore: CoreSetup = {
+        ...npSetup.core,
+        application: {
+          ...npSetup.core.application,
+          register(app: App): void {
+            mountApp = () =>
+              app.mount(npStart as any, {
+                element: elem,
+                appBasePath: '/management/elasticsearch/watcher/',
+              });
+          },
+        },
+      };
+
+      // clean up previously rendered React app if one exists
+      // this happens because of React Router redirects
+      if (elem) {
+        ((unmountApp as unknown) as AppUnmount)();
+      }
+
+      $scope.$$postDigest(() => {
+        elem = document.getElementById('watchReactRoot')!;
+        const instance = plugin();
+        instance.setup(shimCore, {
+          ...(npSetup.plugins as typeof npSetup.plugins & { eui_utils: any }),
+          __LEGACY: {
+            MANAGEMENT_BREADCRUMB,
+            TimeBuckets,
+            licenseStatus,
+          },
+        });
+
+        instance.start(npStart.core, npStart.plugins);
+
+        (mountApp() as Promise<AppUnmount>).then(fn => (unmountApp = fn));
+
+        manageAngularLifecycle($scope, $route, elem);
+      });
+    }
+  } as any,
+  // @ts-ignore
+  controllerAs: 'watchRoute',
+});
+
+routes.defaults(/\/management/, {
+  resolve: {
+    watcherManagementSection: () => {
+      const watchesSection = management.getSection('elasticsearch/watcher');
+      const licenseStatus = xpackInfo.get(`features.${PLUGIN.ID}`);
+      const { status } = licenseStatus;
+
+      if (status === LICENSE_STATUS_INVALID || status === LICENSE_STATUS_UNAVAILABLE) {
+        return watchesSection.hide();
+      }
+
+      watchesSection.show();
+    },
+  },
+});
+
+management.getSection('elasticsearch').register('watcher', {
+  display: i18n.translate('xpack.watcher.sections.watchList.managementSection.watcherDisplayName', {
+    defaultMessage: 'Watcher',
+  }),
+  order: 6,
+  url: '#/management/elasticsearch/watcher/',
+} as any);
+
+management.getSection('elasticsearch/watcher').register('watches', {
+  display: i18n.translate('xpack.watcher.sections.watchList.managementSection.watchesDisplayName', {
+    defaultMessage: 'Watches',
+  }),
+  order: 1,
+} as any);
+
+management.getSection('elasticsearch/watcher').register('watch', {
+  visible: false,
+} as any);
+
+management.getSection('elasticsearch/watcher/watch').register('status', {
+  display: i18n.translate('xpack.watcher.sections.watchList.managementSection.statusDisplayName', {
+    defaultMessage: 'Status',
+  }),
+  order: 1,
+  visible: false,
+} as any);
+
+management.getSection('elasticsearch/watcher/watch').register('edit', {
+  display: i18n.translate('xpack.watcher.sections.watchList.managementSection.editDisplayName', {
+    defaultMessage: 'Edit',
+  }),
+  order: 2,
+  visible: false,
+} as any);
+
+management.getSection('elasticsearch/watcher/watch').register('new', {
+  display: i18n.translate(
+    'xpack.watcher.sections.watchList.managementSection.newWatchDisplayName',
+    {
+      defaultMessage: 'New Watch',
+    }
+  ),
+  order: 1,
+  visible: false,
+} as any);
+
+management.getSection('elasticsearch/watcher/watch').register('history-item', {
+  order: 1,
+  visible: false,
+} as any);
diff --git a/x-pack/legacy/plugins/watcher/public/lib/documentation_links/documentation_links.ts b/x-pack/legacy/plugins/watcher/public/lib/documentation_links/documentation_links.ts
deleted file mode 100644
index 88f23465d33e8..0000000000000
--- a/x-pack/legacy/plugins/watcher/public/lib/documentation_links/documentation_links.ts
+++ /dev/null
@@ -1,24 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { ELASTIC_WEBSITE_URL, DOC_LINK_VERSION } from 'ui/documentation_links';
-import { ACTION_TYPES } from '../../../common/constants';
-
-const elasticDocLinkBase = `${ELASTIC_WEBSITE_URL}guide/en/`;
-
-const esBase = `${elasticDocLinkBase}elasticsearch/reference/${DOC_LINK_VERSION}`;
-const esStackBase = `${elasticDocLinkBase}elastic-stack-overview/${DOC_LINK_VERSION}`;
-const kibanaBase = `${elasticDocLinkBase}kibana/${DOC_LINK_VERSION}`;
-
-export const putWatchApiUrl = `${esBase}/watcher-api-put-watch.html`;
-export const executeWatchApiUrl = `${esBase}/watcher-api-execute-watch.html#watcher-api-execute-watch-action-mode`;
-export const watcherGettingStartedUrl = `${kibanaBase}/watcher-ui.html`;
-
-export const watchActionsConfigurationMap = {
-  [ACTION_TYPES.SLACK]: `${esStackBase}/actions-slack.html#configuring-slack`,
-  [ACTION_TYPES.PAGERDUTY]: `${esStackBase}/actions-pagerduty.html#configuring-pagerduty`,
-  [ACTION_TYPES.JIRA]: `${esStackBase}/actions-jira.html#configuring-jira`,
-};
diff --git a/x-pack/legacy/plugins/watcher/public/lib/manage_angular_lifecycle.js b/x-pack/legacy/plugins/watcher/public/manage_angular_lifecycle.ts
similarity index 75%
rename from x-pack/legacy/plugins/watcher/public/lib/manage_angular_lifecycle.js
rename to x-pack/legacy/plugins/watcher/public/manage_angular_lifecycle.ts
index 3813e632a0a73..efd40eaf83daa 100644
--- a/x-pack/legacy/plugins/watcher/public/lib/manage_angular_lifecycle.js
+++ b/x-pack/legacy/plugins/watcher/public/manage_angular_lifecycle.ts
@@ -6,7 +6,7 @@
 
 import { unmountComponentAtNode } from 'react-dom';
 
-export const manageAngularLifecycle = ($scope, $route, elem) => {
+export const manageAngularLifecycle = ($scope: any, $route: any, elem: HTMLElement) => {
   const lastRoute = $route.current;
 
   const deregister = $scope.$on('$locationChangeSuccess', () => {
@@ -17,7 +17,12 @@ export const manageAngularLifecycle = ($scope, $route, elem) => {
   });
 
   $scope.$on('$destroy', () => {
-    deregister && deregister();
-    elem && unmountComponentAtNode(elem);
+    if (deregister) {
+      deregister();
+    }
+
+    if (elem) {
+      unmountComponentAtNode(elem);
+    }
   });
 };
diff --git a/x-pack/legacy/plugins/watcher/public/models/index.d.ts b/x-pack/legacy/plugins/watcher/public/models/index.d.ts
deleted file mode 100644
index d96d8d192e166..0000000000000
--- a/x-pack/legacy/plugins/watcher/public/models/index.d.ts
+++ /dev/null
@@ -1,42 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-declare module 'plugins/watcher/models/visualize_options' {
-  export const VisualizeOptions: any;
-}
-
-declare module 'plugins/watcher/models/watch' {
-  export const Watch: any;
-}
-
-declare module 'plugins/watcher/models/watch/threshold_watch' {
-  export const ThresholdWatch: any;
-}
-
-declare module 'plugins/watcher/models/watch/json_watch' {
-  export const JsonWatch: any;
-}
-
-declare module 'plugins/watcher/models/execute_details/execute_details' {
-  export const ExecuteDetails: any;
-}
-
-declare module 'plugins/watcher/models/watch_history_item' {
-  export const WatchHistoryItem: any;
-}
-
-declare module 'plugins/watcher/models/watch_status' {
-  export const WatchStatus: any;
-}
-
-declare module 'plugins/watcher/models/settings' {
-  export const Settings: any;
-}
-declare module 'plugins/watcher/models/action' {
-  export const Action: any;
-}
-declare module 'ui/time_buckets' {
-  export const TimeBuckets: any;
-}
diff --git a/x-pack/legacy/plugins/watcher/public/app.js b/x-pack/legacy/plugins/watcher/public/np_ready/application/app.tsx
similarity index 60%
rename from x-pack/legacy/plugins/watcher/public/app.js
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/app.tsx
index b206348547966..36fa1cce9d6dd 100644
--- a/x-pack/legacy/plugins/watcher/public/app.js
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/app.tsx
@@ -4,54 +4,61 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React, { Component } from 'react';
-import PropTypes from 'prop-types';
-import { HashRouter, Switch, Route, Redirect } from 'react-router-dom';
+import React from 'react';
+import {
+  ChromeStart,
+  DocLinksStart,
+  HttpSetup,
+  ToastsSetup,
+  IUiSettingsClient,
+} from 'src/core/public';
+
+import { EuiCallOut, EuiLink } from '@elastic/eui';
+import {
+  HashRouter,
+  Switch,
+  Route,
+  Redirect,
+  withRouter,
+  RouteComponentProps,
+} from 'react-router-dom';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { WatchStatus } from './sections/watch_status/components/watch_status';
 import { WatchEdit } from './sections/watch_edit/components/watch_edit';
 import { WatchList } from './sections/watch_list/components/watch_list';
 import { registerRouter } from './lib/navigation';
 import { BASE_PATH } from './constants';
-import { LICENSE_STATUS_VALID } from '../../../common/constants';
-import { EuiCallOut, EuiLink } from '@elastic/eui';
+import { LICENSE_STATUS_VALID } from '../../../../../common/constants';
+import { AppContextProvider } from './app_context';
+import { LegacyDependencies } from '../types';
 
-class ShareRouter extends Component {
-  static contextTypes = {
-    router: PropTypes.shape({
-      history: PropTypes.shape({
-        push: PropTypes.func.isRequired,
-        createHref: PropTypes.func.isRequired
-      }).isRequired
-    }).isRequired
-  }
-  constructor(...args) {
-    super(...args);
-    this.registerRouter();
-  }
+const ShareRouter = withRouter(({ children, history }: RouteComponentProps & { children: any }) => {
+  registerRouter({ history });
+  return children;
+});
 
-  registerRouter() {
-    // Share the router with the app without requiring React or context.
-    const { router } = this.context;
-    registerRouter(router);
-  }
-
-  render() {
-    return this.props.children;
-  }
+export interface AppDeps {
+  chrome: ChromeStart;
+  docLinks: DocLinksStart;
+  toasts: ToastsSetup;
+  http: HttpSetup;
+  uiSettings: IUiSettingsClient;
+  legacy: LegacyDependencies;
+  euiUtils: any;
 }
-export const App = ({ licenseStatus }) => {
-  const { status, message } = licenseStatus;
+
+export const App = (deps: AppDeps) => {
+  const { status, message } = deps.legacy.licenseStatus;
 
   if (status !== LICENSE_STATUS_VALID) {
     return (
       <EuiCallOut
-        title={(
+        title={
           <FormattedMessage
             id="xpack.watcher.app.licenseErrorTitle"
             defaultMessage="License error"
           />
-        )}
+        }
         color="warning"
         iconType="help"
       >
@@ -69,7 +76,9 @@ export const App = ({ licenseStatus }) => {
   return (
     <HashRouter>
       <ShareRouter>
-        <AppWithoutRouter />
+        <AppContextProvider value={deps}>
+          <AppWithoutRouter />
+        </AppContextProvider>
       </ShareRouter>
     </HashRouter>
   );
@@ -81,7 +90,11 @@ export const AppWithoutRouter = () => (
     <Route exact path={`${BASE_PATH}watches`} component={WatchList} />
     <Route exact path={`${BASE_PATH}watches/watch/:id/status`} component={WatchStatus} />
     <Route exact path={`${BASE_PATH}watches/watch/:id/edit`} component={WatchEdit} />
-    <Route exact path={`${BASE_PATH}watches/new-watch/:type(json|threshold)`} component={WatchEdit} />
+    <Route
+      exact
+      path={`${BASE_PATH}watches/new-watch/:type(json|threshold)`}
+      component={WatchEdit}
+    />
     <Redirect from={BASE_PATH} to={`${BASE_PATH}watches`} />
   </Switch>
 );
diff --git a/x-pack/legacy/plugins/watcher/public/np_ready/application/app_context.tsx b/x-pack/legacy/plugins/watcher/public/np_ready/application/app_context.tsx
new file mode 100644
index 0000000000000..5696ab3cb91ba
--- /dev/null
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/app_context.tsx
@@ -0,0 +1,65 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { createContext, useContext } from 'react';
+import { DocLinksStart } from 'src/core/public';
+import { ACTION_TYPES } from '../../../common/constants';
+import { AppDeps } from './app';
+
+interface ContextValue extends Omit<AppDeps, 'docLinks'> {
+  links: ReturnType<typeof generateDocLinks>;
+}
+
+const AppContext = createContext<ContextValue>(null as any);
+
+const generateDocLinks = ({ ELASTIC_WEBSITE_URL, DOC_LINK_VERSION }: DocLinksStart) => {
+  const elasticDocLinkBase = `${ELASTIC_WEBSITE_URL}guide/en/`;
+  const esBase = `${elasticDocLinkBase}elasticsearch/reference/${DOC_LINK_VERSION}`;
+  const kibanaBase = `${elasticDocLinkBase}kibana/${DOC_LINK_VERSION}`;
+  const putWatchApiUrl = `${esBase}/watcher-api-put-watch.html`;
+  const executeWatchApiUrl = `${esBase}/watcher-api-execute-watch.html#watcher-api-execute-watch-action-mode`;
+  const watcherGettingStartedUrl = `${kibanaBase}/watcher-ui.html`;
+  const watchActionsConfigurationMap = {
+    [ACTION_TYPES.SLACK]: `${esBase}/actions-slack.html#configuring-slack`,
+    [ACTION_TYPES.PAGERDUTY]: `${esBase}/actions-pagerduty.html#configuring-pagerduty`,
+    [ACTION_TYPES.JIRA]: `${esBase}/actions-jira.html#configuring-jira`,
+  };
+
+  return {
+    putWatchApiUrl,
+    executeWatchApiUrl,
+    watcherGettingStartedUrl,
+    watchActionsConfigurationMap,
+  };
+};
+
+export const AppContextProvider = ({
+  children,
+  value,
+}: {
+  value: AppDeps;
+  children: React.ReactNode;
+}) => {
+  const { docLinks, ...rest } = value;
+  return (
+    <AppContext.Provider
+      value={Object.freeze({
+        ...rest,
+        links: generateDocLinks(docLinks),
+      })}
+    >
+      {children}
+    </AppContext.Provider>
+  );
+};
+
+export const useAppContext = () => {
+  const ctx = useContext(AppContext);
+  if (!ctx) {
+    throw new Error('"useAppContext" can only be called inside of AppContext.Provider!');
+  }
+  return ctx;
+};
diff --git a/x-pack/legacy/plugins/watcher/public/np_ready/application/boot.tsx b/x-pack/legacy/plugins/watcher/public/np_ready/application/boot.tsx
new file mode 100644
index 0000000000000..3f2a10f004649
--- /dev/null
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/boot.tsx
@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { render, unmountComponentAtNode } from 'react-dom';
+import { SavedObjectsClientContract } from 'src/core/public';
+
+import { App, AppDeps } from './app';
+import { setHttpClient, setSavedObjectsClient } from './lib/api';
+import { LegacyDependencies } from '../types';
+
+interface BootDeps extends AppDeps {
+  element: HTMLElement;
+  savedObjects: SavedObjectsClientContract;
+  I18nContext: any;
+  legacy: LegacyDependencies;
+}
+
+export const boot = (bootDeps: BootDeps) => {
+  const { I18nContext, element, legacy, savedObjects, ...appDeps } = bootDeps;
+
+  setHttpClient(appDeps.http);
+  setSavedObjectsClient(savedObjects);
+
+  render(
+    <I18nContext>
+      <App {...appDeps} legacy={legacy} />
+    </I18nContext>,
+    element
+  );
+  return () => unmountComponentAtNode(element);
+};
diff --git a/x-pack/legacy/plugins/watcher/public/components/confirm_watches_modal.tsx b/x-pack/legacy/plugins/watcher/public/np_ready/application/components/confirm_watches_modal.tsx
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/components/confirm_watches_modal.tsx
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/components/confirm_watches_modal.tsx
diff --git a/x-pack/legacy/plugins/watcher/public/components/delete_watches_modal.tsx b/x-pack/legacy/plugins/watcher/public/np_ready/application/components/delete_watches_modal.tsx
similarity index 95%
rename from x-pack/legacy/plugins/watcher/public/components/delete_watches_modal.tsx
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/components/delete_watches_modal.tsx
index 6d75495cbfc20..363185f3457d8 100644
--- a/x-pack/legacy/plugins/watcher/public/components/delete_watches_modal.tsx
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/components/delete_watches_modal.tsx
@@ -6,8 +6,8 @@
 import { EuiConfirmModal, EuiOverlayMask } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import React from 'react';
-import { toastNotifications } from 'ui/notify';
 import { deleteWatches } from '../lib/api';
+import { useAppContext } from '../app_context';
 
 export const DeleteWatchesModal = ({
   watchesToDelete,
@@ -16,6 +16,7 @@ export const DeleteWatchesModal = ({
   watchesToDelete: string[];
   callback: (deleted?: string[]) => void;
 }) => {
+  const { toasts } = useAppContext();
   const numWatchesToDelete = watchesToDelete.length;
   if (!numWatchesToDelete) {
     return null;
@@ -54,7 +55,7 @@ export const DeleteWatchesModal = ({
           const numErrors = errors.length;
           callback(successes);
           if (numSuccesses > 0) {
-            toastNotifications.addSuccess(
+            toasts.addSuccess(
               i18n.translate(
                 'xpack.watcher.sections.watchList.deleteSelectedWatchesSuccessNotification.descriptionText',
                 {
@@ -67,7 +68,7 @@ export const DeleteWatchesModal = ({
           }
 
           if (numErrors > 0) {
-            toastNotifications.addDanger(
+            toasts.addDanger(
               i18n.translate(
                 'xpack.watcher.sections.watchList.deleteSelectedWatchesErrorNotification.descriptionText',
                 {
diff --git a/x-pack/legacy/plugins/watcher/public/components/form_errors.tsx b/x-pack/legacy/plugins/watcher/public/np_ready/application/components/form_errors.tsx
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/components/form_errors.tsx
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/components/form_errors.tsx
diff --git a/x-pack/legacy/plugins/watcher/public/components/index.ts b/x-pack/legacy/plugins/watcher/public/np_ready/application/components/index.ts
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/components/index.ts
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/components/index.ts
diff --git a/x-pack/legacy/plugins/watcher/public/components/page_error/index.ts b/x-pack/legacy/plugins/watcher/public/np_ready/application/components/page_error/index.ts
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/components/page_error/index.ts
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/components/page_error/index.ts
diff --git a/x-pack/legacy/plugins/watcher/public/components/page_error/page_error.tsx b/x-pack/legacy/plugins/watcher/public/np_ready/application/components/page_error/page_error.tsx
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/components/page_error/page_error.tsx
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/components/page_error/page_error.tsx
diff --git a/x-pack/legacy/plugins/watcher/public/components/page_error/page_error_forbidden.tsx b/x-pack/legacy/plugins/watcher/public/np_ready/application/components/page_error/page_error_forbidden.tsx
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/components/page_error/page_error_forbidden.tsx
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/components/page_error/page_error_forbidden.tsx
diff --git a/x-pack/legacy/plugins/watcher/public/components/page_error/page_error_not_exist.tsx b/x-pack/legacy/plugins/watcher/public/np_ready/application/components/page_error/page_error_not_exist.tsx
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/components/page_error/page_error_not_exist.tsx
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/components/page_error/page_error_not_exist.tsx
diff --git a/x-pack/legacy/plugins/watcher/public/components/section_error.tsx b/x-pack/legacy/plugins/watcher/public/np_ready/application/components/section_error.tsx
similarity index 80%
rename from x-pack/legacy/plugins/watcher/public/components/section_error.tsx
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/components/section_error.tsx
index 8951b95b75078..1c77cf2b49ae2 100644
--- a/x-pack/legacy/plugins/watcher/public/components/section_error.tsx
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/components/section_error.tsx
@@ -8,6 +8,18 @@ import { EuiCallOut, EuiSpacer } from '@elastic/eui';
 import React, { Fragment } from 'react';
 
 export interface Error {
+  error: string;
+
+  /**
+   * wrapEsError() on the server adds a "cause" array
+   */
+  cause?: string[];
+
+  message?: string;
+
+  /**
+   * @deprecated
+   */
   data: {
     error: string;
     cause?: string[];
@@ -21,11 +33,9 @@ interface Props {
 }
 
 export const SectionError: React.FunctionComponent<Props> = ({ title, error, ...rest }) => {
-  const {
-    error: errorString,
-    cause, // wrapEsError() on the server adds a "cause" array
-    message,
-  } = error.data;
+  const data = error.data || error;
+
+  const { error: errorString, cause, message } = data;
 
   return (
     <EuiCallOut title={title} color="danger" iconType="alert" {...rest}>
diff --git a/x-pack/legacy/plugins/watcher/public/components/section_loading.tsx b/x-pack/legacy/plugins/watcher/public/np_ready/application/components/section_loading.tsx
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/components/section_loading.tsx
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/components/section_loading.tsx
diff --git a/x-pack/legacy/plugins/watcher/public/components/watch_status.tsx b/x-pack/legacy/plugins/watcher/public/np_ready/application/components/watch_status.tsx
similarity index 95%
rename from x-pack/legacy/plugins/watcher/public/components/watch_status.tsx
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/components/watch_status.tsx
index 39e6a5247b4a6..8afd174f8561e 100644
--- a/x-pack/legacy/plugins/watcher/public/components/watch_status.tsx
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/components/watch_status.tsx
@@ -6,7 +6,7 @@
 
 import React from 'react';
 import { EuiIcon, EuiFlexGroup, EuiFlexItem, EuiText } from '@elastic/eui';
-import { ACTION_STATES, WATCH_STATES } from '../../common/constants';
+import { ACTION_STATES, WATCH_STATES } from '../../../../common/constants';
 
 function StatusIcon({ status }: { status: string }) {
   switch (status) {
diff --git a/x-pack/legacy/plugins/watcher/public/constants/base_path.ts b/x-pack/legacy/plugins/watcher/public/np_ready/application/constants/base_path.ts
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/constants/base_path.ts
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/constants/base_path.ts
diff --git a/x-pack/legacy/plugins/watcher/public/constants/index.ts b/x-pack/legacy/plugins/watcher/public/np_ready/application/constants/index.ts
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/constants/index.ts
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/constants/index.ts
diff --git a/x-pack/legacy/plugins/watcher/public/index.scss b/x-pack/legacy/plugins/watcher/public/np_ready/application/index.scss
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/index.scss
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/index.scss
diff --git a/x-pack/legacy/plugins/watcher/public/lib/api.ts b/x-pack/legacy/plugins/watcher/public/np_ready/application/lib/api.ts
similarity index 61%
rename from x-pack/legacy/plugins/watcher/public/lib/api.ts
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/lib/api.ts
index d5c430f9244c4..c08545904e351 100644
--- a/x-pack/legacy/plugins/watcher/public/lib/api.ts
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/lib/api.ts
@@ -3,20 +3,20 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import { Settings } from 'plugins/watcher/models/settings';
-import { Watch } from 'plugins/watcher/models/watch';
-import { WatchHistoryItem } from 'plugins/watcher/models/watch_history_item';
-import { WatchStatus } from 'plugins/watcher/models/watch_status';
-
-import { __await } from 'tslib';
-import chrome from 'ui/chrome';
-import { ROUTES } from '../../common/constants';
-import { BaseWatch, ExecutedWatchDetails } from '../../common/types/watch_types';
+import { HttpSetup, SavedObjectsClientContract } from 'src/core/public';
+import { Settings } from 'plugins/watcher/np_ready/application/models/settings';
+import { Watch } from 'plugins/watcher/np_ready/application/models/watch';
+import { WatchHistoryItem } from 'plugins/watcher/np_ready/application/models/watch_history_item';
+import { WatchStatus } from 'plugins/watcher/np_ready/application/models/watch_status';
+
+import { BaseWatch, ExecutedWatchDetails } from '../../../../common/types/watch_types';
 import { useRequest, sendRequest } from './use_request';
 
-let httpClient: ng.IHttpService;
+import { ROUTES } from '../../../../common/constants';
+
+let httpClient: HttpSetup;
 
-export const setHttpClient = (anHttpClient: ng.IHttpService) => {
+export const setHttpClient = (anHttpClient: HttpSetup) => {
   httpClient = anHttpClient;
 };
 
@@ -24,19 +24,17 @@ export const getHttpClient = () => {
   return httpClient;
 };
 
-let savedObjectsClient: any;
+let savedObjectsClient: SavedObjectsClientContract;
 
-export const setSavedObjectsClient = (aSavedObjectsClient: any) => {
+export const setSavedObjectsClient = (aSavedObjectsClient: SavedObjectsClientContract) => {
   savedObjectsClient = aSavedObjectsClient;
 };
 
-export const getSavedObjectsClient = () => {
-  return savedObjectsClient;
-};
+export const getSavedObjectsClient = () => savedObjectsClient;
 
-const basePath = chrome.addBasePath(ROUTES.API_ROOT);
+const basePath = ROUTES.API_ROOT;
 
-export const loadWatches = (pollIntervalMs: number) => {
+export const useLoadWatches = (pollIntervalMs: number) => {
   return useRequest({
     path: `${basePath}/watches`,
     method: 'get',
@@ -47,7 +45,7 @@ export const loadWatches = (pollIntervalMs: number) => {
   });
 };
 
-export const loadWatchDetail = (id: string) => {
+export const useLoadWatchDetail = (id: string) => {
   return useRequest({
     path: `${basePath}/watch/${id}`,
     method: 'get',
@@ -55,15 +53,10 @@ export const loadWatchDetail = (id: string) => {
   });
 };
 
-export const loadWatchHistory = (id: string, startTime: string) => {
-  let path = `${basePath}/watch/${id}/history`;
-
-  if (startTime) {
-    path += `?startTime=${startTime}`;
-  }
-
+export const useLoadWatchHistory = (id: string, startTime: string) => {
   return useRequest({
-    path,
+    query: startTime ? { startTime } : undefined,
+    path: `${basePath}/watch/${id}/history`,
     method: 'get',
     deserializer: ({ watchHistoryItems = [] }: { watchHistoryItems: any }) => {
       return watchHistoryItems.map((historyItem: any) =>
@@ -73,7 +66,7 @@ export const loadWatchHistory = (id: string, startTime: string) => {
   });
 };
 
-export const loadWatchHistoryDetail = (id: string | undefined) => {
+export const useLoadWatchHistoryDetail = (id: string | undefined) => {
   return useRequest({
     path: !id ? '' : `${basePath}/history/${id}`,
     method: 'get',
@@ -83,12 +76,10 @@ export const loadWatchHistoryDetail = (id: string | undefined) => {
 };
 
 export const deleteWatches = async (watchIds: string[]) => {
-  const body = {
+  const body = JSON.stringify({
     watchIds,
-  };
-  const {
-    data: { results },
-  } = await getHttpClient().post(`${basePath}/watches/delete`, body);
+  });
+  const { results } = await getHttpClient().post(`${basePath}/watches/delete`, { body });
   return results;
 };
 
@@ -107,8 +98,8 @@ export const activateWatch = async (id: string) => {
 };
 
 export const loadWatch = async (id: string) => {
-  const { data: watch } = await getHttpClient().get(`${basePath}/watch/${id}`);
-  return Watch.fromUpstreamJson(watch.watch);
+  const { watch } = await getHttpClient().get(`${basePath}/watch/${id}`);
+  return Watch.fromUpstreamJson(watch);
 };
 
 export const getMatchingIndices = async (pattern: string) => {
@@ -118,32 +109,32 @@ export const getMatchingIndices = async (pattern: string) => {
   if (!pattern.endsWith('*')) {
     pattern = `${pattern}*`;
   }
-  const {
-    data: { indices },
-  } = await getHttpClient().post(`${basePath}/indices`, { pattern });
+  const body = JSON.stringify({ pattern });
+  const { indices } = await getHttpClient().post(`${basePath}/indices`, { body });
   return indices;
 };
 
 export const fetchFields = async (indexes: string[]) => {
-  const {
-    data: { fields },
-  } = await getHttpClient().post(`${basePath}/fields`, { indexes });
+  const { fields } = await getHttpClient().post(`${basePath}/fields`, {
+    body: JSON.stringify({ indexes }),
+  });
   return fields;
 };
 
 export const createWatch = async (watch: BaseWatch) => {
-  const { data } = await getHttpClient().put(`${basePath}/watch/${watch.id}`, watch.upstreamJson);
-  return data;
+  return await getHttpClient().put(`${basePath}/watch/${watch.id}`, {
+    body: JSON.stringify(watch.upstreamJson),
+  });
 };
 
 export const executeWatch = async (executeWatchDetails: ExecutedWatchDetails, watch: BaseWatch) => {
   return sendRequest({
     path: `${basePath}/watch/execute`,
     method: 'put',
-    body: {
+    body: JSON.stringify({
       executeDetails: executeWatchDetails.upstreamJson,
       watch: watch.upstreamJson,
-    },
+    }),
   });
 };
 
@@ -156,19 +147,19 @@ export const loadIndexPatterns = async () => {
   return savedObjects;
 };
 
-export const getWatchVisualizationData = (watchModel: BaseWatch, visualizeOptions: any) => {
+export const useGetWatchVisualizationData = (watchModel: BaseWatch, visualizeOptions: any) => {
   return useRequest({
     path: `${basePath}/watch/visualize`,
     method: 'post',
-    body: {
+    body: JSON.stringify({
       watch: watchModel.upstreamJson,
       options: visualizeOptions.upstreamJson,
-    },
+    }),
     deserializer: ({ visualizeData }: { visualizeData: any }) => visualizeData,
   });
 };
 
-export const loadSettings = () => {
+export const useLoadSettings = () => {
   return useRequest({
     path: `${basePath}/settings`,
     method: 'get',
@@ -183,11 +174,8 @@ export const loadSettings = () => {
 };
 
 export const ackWatchAction = async (watchId: string, actionId: string) => {
-  const {
-    data: { watchStatus },
-  } = await getHttpClient().put(
-    `${basePath}/watch/${watchId}/action/${actionId}/acknowledge`,
-    null
+  const { watchStatus } = await getHttpClient().put(
+    `${basePath}/watch/${watchId}/action/${actionId}/acknowledge`
   );
   return WatchStatus.fromUpstreamJson(watchStatus);
 };
diff --git a/x-pack/legacy/plugins/watcher/public/lib/breadcrumbs.ts b/x-pack/legacy/plugins/watcher/public/np_ready/application/lib/breadcrumbs.ts
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/lib/breadcrumbs.ts
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/lib/breadcrumbs.ts
diff --git a/x-pack/legacy/plugins/watcher/public/lib/format_date.ts b/x-pack/legacy/plugins/watcher/public/np_ready/application/lib/format_date.ts
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/lib/format_date.ts
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/lib/format_date.ts
diff --git a/x-pack/legacy/plugins/watcher/public/lib/get_search_value.ts b/x-pack/legacy/plugins/watcher/public/np_ready/application/lib/get_search_value.ts
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/lib/get_search_value.ts
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/lib/get_search_value.ts
diff --git a/x-pack/legacy/plugins/watcher/public/lib/get_time_unit_label.ts b/x-pack/legacy/plugins/watcher/public/np_ready/application/lib/get_time_unit_label.ts
similarity index 95%
rename from x-pack/legacy/plugins/watcher/public/lib/get_time_unit_label.ts
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/lib/get_time_unit_label.ts
index 35bd19e7007c6..ce3b96ac17def 100644
--- a/x-pack/legacy/plugins/watcher/public/lib/get_time_unit_label.ts
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/lib/get_time_unit_label.ts
@@ -5,7 +5,7 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { TIME_UNITS } from '../../common/constants';
+import { TIME_UNITS } from '../../../../common/constants';
 
 export function getTimeUnitLabel(timeUnit = TIME_UNITS.SECOND, timeValue = '0') {
   switch (timeUnit) {
diff --git a/x-pack/legacy/plugins/watcher/public/lib/navigation.ts b/x-pack/legacy/plugins/watcher/public/np_ready/application/lib/navigation.ts
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/lib/navigation.ts
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/lib/navigation.ts
diff --git a/x-pack/legacy/plugins/watcher/public/lib/use_request.ts b/x-pack/legacy/plugins/watcher/public/np_ready/application/lib/use_request.ts
similarity index 99%
rename from x-pack/legacy/plugins/watcher/public/lib/use_request.ts
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/lib/use_request.ts
index 4788b655d9e88..572403b14b9df 100644
--- a/x-pack/legacy/plugins/watcher/public/lib/use_request.ts
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/lib/use_request.ts
@@ -11,6 +11,7 @@ import {
   sendRequest as _sendRequest,
   useRequest as _useRequest,
 } from '../shared_imports';
+
 import { getHttpClient } from './api';
 
 export const sendRequest = (config: SendRequestConfig): Promise<SendRequestResponse> => {
diff --git a/x-pack/legacy/plugins/watcher/public/models/action/action.js b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/action/action.js
similarity index 95%
rename from x-pack/legacy/plugins/watcher/public/models/action/action.js
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/action/action.js
index 2f1850c3a434c..4e6ec21703b96 100644
--- a/x-pack/legacy/plugins/watcher/public/models/action/action.js
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/action/action.js
@@ -5,7 +5,7 @@
  */
 
 import { get, set } from 'lodash';
-import { ACTION_TYPES } from '../../../common/constants';
+import { ACTION_TYPES } from '../../../../../common/constants';
 import { EmailAction } from './email_action';
 import { LoggingAction } from './logging_action';
 import { SlackAction } from './slack_action';
diff --git a/x-pack/legacy/plugins/watcher/public/models/action/base_action.js b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/action/base_action.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/models/action/base_action.js
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/action/base_action.js
diff --git a/x-pack/legacy/plugins/watcher/public/models/action/email_action.js b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/action/email_action.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/models/action/email_action.js
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/action/email_action.js
diff --git a/x-pack/legacy/plugins/watcher/public/models/action/index.js b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/action/index.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/models/action/index.js
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/action/index.js
diff --git a/x-pack/legacy/plugins/watcher/public/models/action/index_action.js b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/action/index_action.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/models/action/index_action.js
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/action/index_action.js
diff --git a/x-pack/legacy/plugins/watcher/public/models/action/jira_action.js b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/action/jira_action.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/models/action/jira_action.js
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/action/jira_action.js
diff --git a/x-pack/legacy/plugins/watcher/public/models/action/logging_action.js b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/action/logging_action.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/models/action/logging_action.js
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/action/logging_action.js
diff --git a/x-pack/legacy/plugins/watcher/public/models/action/pagerduty_action.js b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/action/pagerduty_action.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/models/action/pagerduty_action.js
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/action/pagerduty_action.js
diff --git a/x-pack/legacy/plugins/watcher/public/models/action/slack_action.js b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/action/slack_action.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/models/action/slack_action.js
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/action/slack_action.js
diff --git a/x-pack/legacy/plugins/watcher/public/models/action/unknown_action.js b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/action/unknown_action.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/models/action/unknown_action.js
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/action/unknown_action.js
diff --git a/x-pack/legacy/plugins/watcher/public/models/action/webhook_action.js b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/action/webhook_action.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/models/action/webhook_action.js
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/action/webhook_action.js
diff --git a/x-pack/legacy/plugins/watcher/public/models/action_status/action_status.js b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/action_status/action_status.js
similarity index 95%
rename from x-pack/legacy/plugins/watcher/public/models/action_status/action_status.js
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/action_status/action_status.js
index fa9e056554ab0..b177eb5bb2291 100644
--- a/x-pack/legacy/plugins/watcher/public/models/action_status/action_status.js
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/action_status/action_status.js
@@ -5,7 +5,7 @@
  */
 
 import { get } from 'lodash';
-import { getMoment } from '../../../common/lib/get_moment';
+import { getMoment } from '../../../../../common/lib/get_moment';
 
 export class ActionStatus {
   constructor(props = {}) {
diff --git a/x-pack/legacy/plugins/watcher/public/models/action_status/index.js b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/action_status/index.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/models/action_status/index.js
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/action_status/index.js
diff --git a/x-pack/legacy/plugins/watcher/public/models/execute_details/execute_details.js b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/execute_details/execute_details.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/models/execute_details/execute_details.js
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/execute_details/execute_details.js
diff --git a/x-pack/legacy/plugins/watcher/public/models/execute_details/index.js b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/execute_details/index.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/models/execute_details/index.js
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/execute_details/index.js
diff --git a/x-pack/legacy/plugins/watcher/public/np_ready/application/models/index.d.ts b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/index.d.ts
new file mode 100644
index 0000000000000..a8ddb6ca2b76d
--- /dev/null
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/index.d.ts
@@ -0,0 +1,39 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+declare module 'plugins/watcher/np_ready/application/models/visualize_options' {
+  export const VisualizeOptions: any;
+}
+
+declare module 'plugins/watcher/np_ready/application/models/watch' {
+  export const Watch: any;
+}
+
+declare module 'plugins/watcher/np_ready/application/models/watch/threshold_watch' {
+  export const ThresholdWatch: any;
+}
+
+declare module 'plugins/watcher/np_ready/application/models/watch/json_watch' {
+  export const JsonWatch: any;
+}
+
+declare module 'plugins/watcher/np_ready/application/models/execute_details/execute_details' {
+  export const ExecuteDetails: any;
+}
+
+declare module 'plugins/watcher/np_ready/application/models/watch_history_item' {
+  export const WatchHistoryItem: any;
+}
+
+declare module 'plugins/watcher/np_ready/application/models/watch_status' {
+  export const WatchStatus: any;
+}
+
+declare module 'plugins/watcher/np_ready/application/models/settings' {
+  export const Settings: any;
+}
+declare module 'plugins/watcher/np_ready/application/models/action' {
+  export const Action: any;
+}
diff --git a/x-pack/legacy/plugins/watcher/public/models/settings/index.js b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/settings/index.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/models/settings/index.js
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/settings/index.js
diff --git a/x-pack/legacy/plugins/watcher/public/models/settings/settings.js b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/settings/settings.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/models/settings/settings.js
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/settings/settings.js
diff --git a/x-pack/legacy/plugins/watcher/public/models/visualize_options/index.js b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/visualize_options/index.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/models/visualize_options/index.js
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/visualize_options/index.js
diff --git a/x-pack/legacy/plugins/watcher/public/models/visualize_options/visualize_options.js b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/visualize_options/visualize_options.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/models/visualize_options/visualize_options.js
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/visualize_options/visualize_options.js
diff --git a/x-pack/legacy/plugins/watcher/public/models/watch/agg_types.ts b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch/agg_types.ts
similarity index 94%
rename from x-pack/legacy/plugins/watcher/public/models/watch/agg_types.ts
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch/agg_types.ts
index 65ab537889ea4..cefaaa3b1abd3 100644
--- a/x-pack/legacy/plugins/watcher/public/models/watch/agg_types.ts
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch/agg_types.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { AGG_TYPES } from '../../../common/constants';
+import { AGG_TYPES } from '../../../../../common/constants';
 
 export interface AggType {
   text: string;
diff --git a/x-pack/legacy/plugins/watcher/public/models/watch/base_watch.js b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch/base_watch.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/models/watch/base_watch.js
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch/base_watch.js
diff --git a/x-pack/legacy/plugins/watcher/public/models/watch/comparators.ts b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch/comparators.ts
similarity index 96%
rename from x-pack/legacy/plugins/watcher/public/models/watch/comparators.ts
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch/comparators.ts
index b636cdaf14c18..edc3a03c25227 100644
--- a/x-pack/legacy/plugins/watcher/public/models/watch/comparators.ts
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch/comparators.ts
@@ -6,7 +6,7 @@
 
 import { i18n } from '@kbn/i18n';
 
-import { COMPARATORS } from '../../../common/constants';
+import { COMPARATORS } from '../../../../../common/constants';
 
 export interface Comparator {
   text: string;
diff --git a/x-pack/legacy/plugins/watcher/public/models/watch/default_watch.json b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch/default_watch.json
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/models/watch/default_watch.json
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch/default_watch.json
diff --git a/x-pack/legacy/plugins/watcher/public/models/watch/group_by_types.ts b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch/group_by_types.ts
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/models/watch/group_by_types.ts
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch/group_by_types.ts
diff --git a/x-pack/legacy/plugins/watcher/public/models/watch/index.js b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch/index.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/models/watch/index.js
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch/index.js
diff --git a/x-pack/legacy/plugins/watcher/public/models/watch/json_watch.js b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch/json_watch.js
similarity index 98%
rename from x-pack/legacy/plugins/watcher/public/models/watch/json_watch.js
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch/json_watch.js
index 3dd7af759970e..2e2ee47640cf0 100644
--- a/x-pack/legacy/plugins/watcher/public/models/watch/json_watch.js
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch/json_watch.js
@@ -7,7 +7,7 @@
 import uuid from 'uuid';
 import { get } from 'lodash';
 import { BaseWatch } from './base_watch';
-import { ACTION_TYPES, WATCH_TYPES } from '../../../common/constants';
+import { ACTION_TYPES, WATCH_TYPES } from '../../../../../common/constants';
 import defaultWatchJson from './default_watch.json';
 import { i18n } from '@kbn/i18n';
 
diff --git a/x-pack/legacy/plugins/watcher/public/models/watch/lib/check_action_id_collision/check_action_id_collision.js b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch/lib/check_action_id_collision/check_action_id_collision.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/models/watch/lib/check_action_id_collision/check_action_id_collision.js
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch/lib/check_action_id_collision/check_action_id_collision.js
diff --git a/x-pack/legacy/plugins/watcher/public/models/watch/lib/check_action_id_collision/index.js b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch/lib/check_action_id_collision/index.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/models/watch/lib/check_action_id_collision/index.js
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch/lib/check_action_id_collision/index.js
diff --git a/x-pack/legacy/plugins/watcher/public/models/watch/lib/create_action_id/create_action_id.js b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch/lib/create_action_id/create_action_id.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/models/watch/lib/create_action_id/create_action_id.js
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch/lib/create_action_id/create_action_id.js
diff --git a/x-pack/legacy/plugins/watcher/public/models/watch/lib/create_action_id/index.js b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch/lib/create_action_id/index.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/models/watch/lib/create_action_id/index.js
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch/lib/create_action_id/index.js
diff --git a/x-pack/legacy/plugins/watcher/public/models/watch/monitoring_watch.js b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch/monitoring_watch.js
similarity index 92%
rename from x-pack/legacy/plugins/watcher/public/models/watch/monitoring_watch.js
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch/monitoring_watch.js
index a0873934e1759..3269fcbe459d2 100644
--- a/x-pack/legacy/plugins/watcher/public/models/watch/monitoring_watch.js
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch/monitoring_watch.js
@@ -5,7 +5,7 @@
  */
 
 import { BaseWatch } from './base_watch';
-import { WATCH_TYPES } from '../../../common/constants';
+import { WATCH_TYPES } from '../../../../../common/constants';
 
 /**
  * {@code MonitoringWatch} system defined watches created by the Monitoring plugin.
diff --git a/x-pack/legacy/plugins/watcher/public/models/watch/threshold_watch.js b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch/threshold_watch.js
similarity index 99%
rename from x-pack/legacy/plugins/watcher/public/models/watch/threshold_watch.js
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch/threshold_watch.js
index af995d6594a38..02fa99e7f3e16 100644
--- a/x-pack/legacy/plugins/watcher/public/models/watch/threshold_watch.js
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch/threshold_watch.js
@@ -6,7 +6,7 @@
 
 import { BaseWatch } from './base_watch';
 import uuid from 'uuid';
-import { WATCH_TYPES, SORT_ORDERS, COMPARATORS } from '../../../common/constants';
+import { WATCH_TYPES, SORT_ORDERS, COMPARATORS } from '../../../../../common/constants';
 import { getTimeUnitLabel } from '../../lib/get_time_unit_label';
 import { i18n } from '@kbn/i18n';
 import { aggTypes } from './agg_types';
diff --git a/x-pack/legacy/plugins/watcher/public/models/watch/watch.js b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch/watch.js
similarity index 93%
rename from x-pack/legacy/plugins/watcher/public/models/watch/watch.js
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch/watch.js
index d58a7799c6516..2723fed920675 100644
--- a/x-pack/legacy/plugins/watcher/public/models/watch/watch.js
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch/watch.js
@@ -5,7 +5,7 @@
  */
 
 import { get, set } from 'lodash';
-import { WATCH_TYPES } from '../../../common/constants';
+import { WATCH_TYPES } from '../../../../../common/constants';
 import { JsonWatch } from './json_watch';
 import { ThresholdWatch } from './threshold_watch';
 import { MonitoringWatch } from './monitoring_watch';
diff --git a/x-pack/legacy/plugins/watcher/public/models/watch_errors/index.js b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch_errors/index.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/models/watch_errors/index.js
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch_errors/index.js
diff --git a/x-pack/legacy/plugins/watcher/public/models/watch_errors/watch_errors.js b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch_errors/watch_errors.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/models/watch_errors/watch_errors.js
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch_errors/watch_errors.js
diff --git a/x-pack/legacy/plugins/watcher/public/models/watch_history_item/index.js b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch_history_item/index.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/models/watch_history_item/index.js
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch_history_item/index.js
diff --git a/x-pack/legacy/plugins/watcher/public/models/watch_history_item/watch_history_item.js b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch_history_item/watch_history_item.js
similarity index 91%
rename from x-pack/legacy/plugins/watcher/public/models/watch_history_item/watch_history_item.js
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch_history_item/watch_history_item.js
index a5918cec2764b..785f9d19b23dd 100644
--- a/x-pack/legacy/plugins/watcher/public/models/watch_history_item/watch_history_item.js
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch_history_item/watch_history_item.js
@@ -6,7 +6,7 @@
 
 import 'moment-duration-format';
 import { get } from 'lodash';
-import { getMoment } from '../../../common/lib/get_moment';
+import { getMoment } from '../../../../../common/lib/get_moment';
 import { WatchStatus } from '../watch_status';
 
 export class WatchHistoryItem {
diff --git a/x-pack/legacy/plugins/watcher/public/models/watch_status/index.js b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch_status/index.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/models/watch_status/index.js
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch_status/index.js
diff --git a/x-pack/legacy/plugins/watcher/public/models/watch_status/watch_status.js b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch_status/watch_status.js
similarity index 94%
rename from x-pack/legacy/plugins/watcher/public/models/watch_status/watch_status.js
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch_status/watch_status.js
index f213032a93c27..77007ea190386 100644
--- a/x-pack/legacy/plugins/watcher/public/models/watch_status/watch_status.js
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/models/watch_status/watch_status.js
@@ -5,7 +5,7 @@
  */
 
 import { get } from 'lodash';
-import { getMoment } from '../../../common/lib/get_moment';
+import { getMoment } from '../../../../../common/lib/get_moment';
 import { ActionStatus } from '../action_status';
 
 export class WatchStatus {
diff --git a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/json_watch_edit/index.ts b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/json_watch_edit/index.ts
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/json_watch_edit/index.ts
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/json_watch_edit/index.ts
diff --git a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/json_watch_edit/json_watch_edit.tsx b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/json_watch_edit/json_watch_edit.tsx
similarity index 92%
rename from x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/json_watch_edit/json_watch_edit.tsx
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/json_watch_edit/json_watch_edit.tsx
index 9c4b16e301b38..010e430c0719a 100644
--- a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/json_watch_edit/json_watch_edit.tsx
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/json_watch_edit/json_watch_edit.tsx
@@ -16,10 +16,10 @@ import {
   EuiTitle,
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
-import { ExecuteDetails } from 'plugins/watcher/models/execute_details/execute_details';
-import { getActionType } from '../../../../../common/lib/get_action_type';
-import { BaseWatch, ExecutedWatchDetails } from '../../../../../common/types/watch_types';
-import { ACTION_MODES, TIME_UNITS } from '../../../../../common/constants';
+import { ExecuteDetails } from 'plugins/watcher/np_ready/application/models/execute_details/execute_details';
+import { getActionType } from '../../../../../../../common/lib/get_action_type';
+import { BaseWatch, ExecutedWatchDetails } from '../../../../../../../common/types/watch_types';
+import { ACTION_MODES, TIME_UNITS } from '../../../../../../../common/constants';
 import { JsonWatchEditForm } from './json_watch_edit_form';
 import { JsonWatchEditSimulate } from './json_watch_edit_simulate';
 import { WatchContext } from '../../watch_context';
diff --git a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/json_watch_edit/json_watch_edit_form.tsx b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/json_watch_edit/json_watch_edit_form.tsx
similarity index 94%
rename from x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/json_watch_edit/json_watch_edit_form.tsx
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/json_watch_edit/json_watch_edit_form.tsx
index 02a54fc9b9279..376aeb205b855 100644
--- a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/json_watch_edit/json_watch_edit_form.tsx
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/json_watch_edit/json_watch_edit_form.tsx
@@ -20,15 +20,20 @@ import {
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { serializeJsonWatch } from '../../../../../common/lib/serialization';
-import { ErrableFormRow, SectionError } from '../../../../components';
-import { putWatchApiUrl } from '../../../../lib/documentation_links';
+import { serializeJsonWatch } from '../../../../../../../common/lib/serialization';
+import { ErrableFormRow, SectionError, Error as ServerError } from '../../../../components';
 import { onWatchSave } from '../../watch_edit_actions';
 import { WatchContext } from '../../watch_context';
 import { goToWatchList } from '../../../../lib/navigation';
 import { RequestFlyout } from '../request_flyout';
+import { useAppContext } from '../../../../app_context';
 
 export const JsonWatchEditForm = () => {
+  const {
+    links: { putWatchApiUrl },
+    toasts,
+  } = useAppContext();
+
   const { watch, setWatchProperty } = useContext(WatchContext);
 
   const { errors } = watch.validate();
@@ -37,9 +42,7 @@ export const JsonWatchEditForm = () => {
   const [validationError, setValidationError] = useState<string | null>(null);
   const [isRequestVisible, setIsRequestVisible] = useState<boolean>(false);
 
-  const [serverError, setServerError] = useState<{
-    data: { nessage: string; error: string };
-  } | null>(null);
+  const [serverError, setServerError] = useState<ServerError | null>(null);
 
   const [isSaving, setIsSaving] = useState<boolean>(false);
 
@@ -192,7 +195,7 @@ export const JsonWatchEditForm = () => {
                 isDisabled={hasErrors}
                 onClick={async () => {
                   setIsSaving(true);
-                  const savedWatch = await onWatchSave(watch);
+                  const savedWatch = await onWatchSave(watch, toasts);
                   if (savedWatch && savedWatch.error) {
                     const { data } = savedWatch.error;
                     setIsSaving(false);
diff --git a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/json_watch_edit/json_watch_edit_simulate.tsx b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/json_watch_edit/json_watch_edit_simulate.tsx
similarity index 96%
rename from x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/json_watch_edit/json_watch_edit_simulate.tsx
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/json_watch_edit/json_watch_edit_simulate.tsx
index e57a875aa4356..7c5de3d8e9298 100644
--- a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/json_watch_edit/json_watch_edit_simulate.tsx
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/json_watch_edit/json_watch_edit_simulate.tsx
@@ -24,19 +24,19 @@ import {
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { ExecuteDetails } from 'plugins/watcher/models/execute_details/execute_details';
-import { WatchHistoryItem } from 'plugins/watcher/models/watch_history_item';
-import { ACTION_MODES, TIME_UNITS } from '../../../../../common/constants';
+import { ExecuteDetails } from 'plugins/watcher/np_ready/application/models/execute_details/execute_details';
+import { WatchHistoryItem } from 'plugins/watcher/np_ready/application/models/watch_history_item';
+import { ACTION_MODES, TIME_UNITS } from '../../../../../../../common/constants';
 import {
   ExecutedWatchDetails,
   ExecutedWatchResults,
-} from '../../../../../common/types/watch_types';
+} from '../../../../../../../common/types/watch_types';
 import { ErrableFormRow } from '../../../../components/form_errors';
 import { executeWatch } from '../../../../lib/api';
-import { executeWatchApiUrl } from '../../../../lib/documentation_links';
 import { WatchContext } from '../../watch_context';
 import { JsonWatchEditSimulateResults } from './json_watch_edit_simulate_results';
 import { getTimeUnitLabel } from '../../../../lib/get_time_unit_label';
+import { useAppContext } from '../../../../app_context';
 
 const actionModeOptions = Object.keys(ACTION_MODES).map(mode => ({
   text: ACTION_MODES[mode],
@@ -70,6 +70,9 @@ export const JsonWatchEditSimulate = ({
     type: string;
   }>;
 }) => {
+  const {
+    links: { executeWatchApiUrl },
+  } = useAppContext();
   const { watch } = useContext(WatchContext);
 
   // hooks
diff --git a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/json_watch_edit/json_watch_edit_simulate_results.tsx b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/json_watch_edit/json_watch_edit_simulate_results.tsx
similarity index 99%
rename from x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/json_watch_edit/json_watch_edit_simulate_results.tsx
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/json_watch_edit/json_watch_edit_simulate_results.tsx
index 1b2b4ab935e8c..4b630f5bc81b4 100644
--- a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/json_watch_edit/json_watch_edit_simulate_results.tsx
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/json_watch_edit/json_watch_edit_simulate_results.tsx
@@ -21,7 +21,7 @@ import { FormattedMessage } from '@kbn/i18n/react';
 import {
   ExecutedWatchDetails,
   ExecutedWatchResults,
-} from '../../../../../common/types/watch_types';
+} from '../../../../../../../common/types/watch_types';
 import { getTypeFromAction } from '../../watch_edit_actions';
 import { WatchContext } from '../../watch_context';
 import { WatchStatus, SectionError } from '../../../../components';
diff --git a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/monitoring_watch_edit/index.ts b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/monitoring_watch_edit/index.ts
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/monitoring_watch_edit/index.ts
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/monitoring_watch_edit/index.ts
diff --git a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/monitoring_watch_edit/monitoring_watch_edit.tsx b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/monitoring_watch_edit/monitoring_watch_edit.tsx
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/monitoring_watch_edit/monitoring_watch_edit.tsx
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/monitoring_watch_edit/monitoring_watch_edit.tsx
diff --git a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/request_flyout.tsx b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/request_flyout.tsx
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/request_flyout.tsx
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/request_flyout.tsx
diff --git a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/action_fields/email_action_fields.tsx b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/action_fields/email_action_fields.tsx
similarity index 97%
rename from x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/action_fields/email_action_fields.tsx
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/action_fields/email_action_fields.tsx
index aebe8baaee417..3e70e49f42350 100644
--- a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/action_fields/email_action_fields.tsx
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/action_fields/email_action_fields.tsx
@@ -8,7 +8,7 @@ import React, { Fragment } from 'react';
 import { EuiComboBox, EuiFieldText, EuiFormRow, EuiTextArea } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { ErrableFormRow } from '../../../../../components/form_errors';
-import { EmailAction } from '../../../../../../common/types/action_types';
+import { EmailAction } from '../../../../../../../../common/types/action_types';
 
 interface Props {
   action: EmailAction;
diff --git a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/action_fields/index.ts b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/action_fields/index.ts
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/action_fields/index.ts
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/action_fields/index.ts
diff --git a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/action_fields/index_action_fields.tsx b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/action_fields/index_action_fields.tsx
similarity index 94%
rename from x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/action_fields/index_action_fields.tsx
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/action_fields/index_action_fields.tsx
index 1cafb08ca4060..b7ab76d9890bc 100644
--- a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/action_fields/index_action_fields.tsx
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/action_fields/index_action_fields.tsx
@@ -7,7 +7,7 @@ import React from 'react';
 import { EuiFieldText } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { ErrableFormRow } from '../../../../../components/form_errors';
-import { IndexAction } from '../../../../../../common/types/action_types';
+import { IndexAction } from '../../../../../../../../common/types/action_types';
 
 interface Props {
   action: IndexAction;
diff --git a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/action_fields/jira_action_fields.tsx b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/action_fields/jira_action_fields.tsx
similarity index 97%
rename from x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/action_fields/jira_action_fields.tsx
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/action_fields/jira_action_fields.tsx
index b8bdeaff90821..c09b3c44fde65 100644
--- a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/action_fields/jira_action_fields.tsx
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/action_fields/jira_action_fields.tsx
@@ -8,7 +8,7 @@ import React, { Fragment } from 'react';
 import { EuiFieldText } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { ErrableFormRow } from '../../../../../components/form_errors';
-import { JiraAction } from '../../../../../../common/types/action_types';
+import { JiraAction } from '../../../../../../../../common/types/action_types';
 
 interface Props {
   action: JiraAction;
diff --git a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/action_fields/logging_action_fields.tsx b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/action_fields/logging_action_fields.tsx
similarity index 94%
rename from x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/action_fields/logging_action_fields.tsx
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/action_fields/logging_action_fields.tsx
index b70e504519ae5..7da2a22ecd6c4 100644
--- a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/action_fields/logging_action_fields.tsx
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/action_fields/logging_action_fields.tsx
@@ -7,7 +7,7 @@ import React from 'react';
 import { EuiFieldText } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { ErrableFormRow } from '../../../../../components/form_errors';
-import { LoggingAction } from '../../../../../../common/types/action_types';
+import { LoggingAction } from '../../../../../../../../common/types/action_types';
 
 interface Props {
   action: LoggingAction;
diff --git a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/action_fields/pagerduty_action_fields.tsx b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/action_fields/pagerduty_action_fields.tsx
similarity index 95%
rename from x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/action_fields/pagerduty_action_fields.tsx
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/action_fields/pagerduty_action_fields.tsx
index b2b670bf6b91f..3287bdefa08aa 100644
--- a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/action_fields/pagerduty_action_fields.tsx
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/action_fields/pagerduty_action_fields.tsx
@@ -7,7 +7,7 @@ import React, { Fragment } from 'react';
 import { EuiFieldText } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { ErrableFormRow } from '../../../../../components/form_errors';
-import { PagerDutyAction } from '../../../../../../common/types/action_types';
+import { PagerDutyAction } from '../../../../../../../../common/types/action_types';
 
 interface Props {
   action: PagerDutyAction;
diff --git a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/action_fields/slack_action_fields.tsx b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/action_fields/slack_action_fields.tsx
similarity index 96%
rename from x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/action_fields/slack_action_fields.tsx
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/action_fields/slack_action_fields.tsx
index 7b5a598c97eb7..a72cf232d8d09 100644
--- a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/action_fields/slack_action_fields.tsx
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/action_fields/slack_action_fields.tsx
@@ -6,7 +6,7 @@
 import React, { Fragment } from 'react';
 import { EuiComboBox, EuiTextArea, EuiFormRow } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
-import { SlackAction } from '../../../../../../common/types/action_types';
+import { SlackAction } from '../../../../../../../../common/types/action_types';
 
 interface Props {
   action: SlackAction;
diff --git a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/action_fields/webhook_action_fields.tsx b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/action_fields/webhook_action_fields.tsx
similarity index 98%
rename from x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/action_fields/webhook_action_fields.tsx
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/action_fields/webhook_action_fields.tsx
index c3784e1ca5516..bdc6f0bcbb717 100644
--- a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/action_fields/webhook_action_fields.tsx
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/action_fields/webhook_action_fields.tsx
@@ -18,7 +18,7 @@ import {
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { ErrableFormRow } from '../../../../../components/form_errors';
-import { WebhookAction } from '../../../../../../common/types/action_types';
+import { WebhookAction } from '../../../../../../../../common/types/action_types';
 
 interface Props {
   action: WebhookAction;
@@ -39,7 +39,7 @@ export const WebhookActionFields: React.FunctionComponent<Props> = ({
 
   useEffect(() => {
     editAction({ key: 'contentType', value: 'application/json' }); // set content-type for threshold watch to json by default
-  }, []);
+  }, [editAction]);
 
   return (
     <Fragment>
diff --git a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/index.ts b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/index.ts
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/index.ts
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/index.ts
diff --git a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/threshold_watch_action_accordion.tsx b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/threshold_watch_action_accordion.tsx
similarity index 91%
rename from x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/threshold_watch_action_accordion.tsx
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/threshold_watch_action_accordion.tsx
index 8b72eb7f19456..4fca772a18217 100644
--- a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/threshold_watch_action_accordion.tsx
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/threshold_watch_action_accordion.tsx
@@ -21,13 +21,12 @@ import {
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { ExecuteDetails } from 'plugins/watcher/models/execute_details/execute_details';
-import { Action } from 'plugins/watcher/models/action';
-import { toastNotifications } from 'ui/notify';
-import { WatchHistoryItem } from 'plugins/watcher/models/watch_history_item';
-import { ThresholdWatch } from 'plugins/watcher/models/watch/threshold_watch';
-import { ActionType } from '../../../../../common/types/action_types';
-import { ACTION_TYPES, ACTION_MODES } from '../../../../../common/constants';
+import { ExecuteDetails } from 'plugins/watcher/np_ready/application/models/execute_details/execute_details';
+import { Action } from 'plugins/watcher/np_ready/application/models/action';
+import { WatchHistoryItem } from 'plugins/watcher/np_ready/application/models/watch_history_item';
+import { ThresholdWatch } from 'plugins/watcher/np_ready/application/models/watch/threshold_watch';
+import { ActionType } from '../../../../../../../common/types/action_types';
+import { ACTION_TYPES, ACTION_MODES } from '../../../../../../../common/constants';
 import { WatchContext } from '../../watch_context';
 import {
   WebhookActionFields,
@@ -39,8 +38,8 @@ import {
   JiraActionFields,
 } from './action_fields';
 import { executeWatch } from '../../../../lib/api';
-import { watchActionsConfigurationMap } from '../../../../lib/documentation_links';
 import { SectionError } from '../../../../components';
+import { useAppContext } from '../../../../app_context';
 
 const actionFieldsComponentMap = {
   [ACTION_TYPES.LOGGING]: LoggingActionFields,
@@ -71,6 +70,10 @@ export const WatchActionsAccordion: React.FunctionComponent<Props> = ({
   settings,
   actionErrors,
 }) => {
+  const {
+    links: { watchActionsConfigurationMap },
+    toasts,
+  } = useAppContext();
   const { watch, setWatchProperty } = useContext(WatchContext);
   const { actions } = watch;
 
@@ -238,9 +241,9 @@ export const WatchActionsAccordion: React.FunctionComponent<Props> = ({
 
                 if (actionStatus && actionStatus.lastExecutionSuccessful === false) {
                   const message = actionStatus.lastExecutionReason || action.simulateFailMessage;
-                  return toastNotifications.addDanger(message);
+                  return toasts.addDanger(message);
                 }
-                return toastNotifications.addSuccess(action.simulateMessage);
+                return toasts.addSuccess(action.simulateMessage);
               }}
             >
               {action.simulatePrompt}
diff --git a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/threshold_watch_action_dropdown.tsx b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/threshold_watch_action_dropdown.tsx
similarity index 96%
rename from x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/threshold_watch_action_dropdown.tsx
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/threshold_watch_action_dropdown.tsx
index 82f3352b4e023..d92cccfa00f14 100644
--- a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/threshold_watch_action_dropdown.tsx
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/threshold_watch_action_dropdown.tsx
@@ -16,9 +16,9 @@ import {
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import React, { useContext, useState } from 'react';
-import { Action } from 'plugins/watcher/models/action';
+import { Action } from 'plugins/watcher/np_ready/application/models/action';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { ACTION_TYPES } from '../../../../../common/constants';
+import { ACTION_TYPES } from '../../../../../../../common/constants';
 import { WatchContext } from '../../watch_context';
 
 const disabledMessage = i18n.translate(
diff --git a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/threshold_watch_action_panel.tsx b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/threshold_watch_action_panel.tsx
similarity index 93%
rename from x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/threshold_watch_action_panel.tsx
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/threshold_watch_action_panel.tsx
index a2e46652429ea..6072f93e53cf6 100644
--- a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/threshold_watch_action_panel.tsx
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/threshold_watch_action_panel.tsx
@@ -6,7 +6,7 @@
 import { EuiFlexGroup, EuiFlexItem, EuiTitle, EuiSpacer } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import React, { useContext } from 'react';
-import { loadSettings } from '../../../../lib/api';
+import { useLoadSettings } from '../../../../lib/api';
 import { WatchActionsDropdown } from './threshold_watch_action_dropdown';
 import { WatchActionsAccordion } from './threshold_watch_action_accordion';
 import { WatchContext } from '../../watch_context';
@@ -22,7 +22,7 @@ interface Props {
 export const WatchActionsPanel: React.FunctionComponent<Props> = ({ actionErrors }) => {
   const { watch } = useContext(WatchContext);
 
-  const { data: settings, isLoading } = loadSettings();
+  const { data: settings, isLoading } = useLoadSettings();
 
   return (
     <div data-test-subj="watchActionsPanel">
diff --git a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/threshold_watch_edit.tsx b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/threshold_watch_edit.tsx
similarity index 95%
rename from x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/threshold_watch_edit.tsx
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/threshold_watch_edit.tsx
index 910d4f1e0b15c..f1b5d2c9eab7b 100644
--- a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/threshold_watch_edit.tsx
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/threshold_watch_edit.tsx
@@ -26,9 +26,9 @@ import {
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { TIME_UNITS } from '../../../../../common/constants';
-import { serializeThresholdWatch } from '../../../../../common/lib/serialization';
-import { ErrableFormRow, SectionError } from '../../../../components';
+import { TIME_UNITS } from '../../../../../../../common/constants';
+import { serializeThresholdWatch } from '../../../../../../../common/lib/serialization';
+import { ErrableFormRow, SectionError, Error as ServerError } from '../../../../components';
 import { fetchFields, getMatchingIndices, loadIndexPatterns } from '../../../../lib/api';
 import { aggTypes } from '../../../../models/watch/agg_types';
 import { groupByTypes } from '../../../../models/watch/group_by_types';
@@ -40,6 +40,7 @@ import { WatchActionsPanel } from './threshold_watch_action_panel';
 import { getTimeUnitLabel } from '../../../../lib/get_time_unit_label';
 import { goToWatchList } from '../../../../lib/navigation';
 import { RequestFlyout } from '../request_flyout';
+import { useAppContext } from '../../../../app_context';
 
 const expressionFieldsWithValidation = [
   'aggField',
@@ -104,7 +105,7 @@ const getTimeFieldOptions = (fields: any) => {
 };
 interface IOption {
   label: string;
-  options: Array<{ value: string; label: string }>;
+  options: Array<{ value: string; label: string; key?: string }>;
 }
 
 const getIndexOptions = async (patternString: string, indexPatterns: string[]) => {
@@ -129,12 +130,14 @@ const getIndexOptions = async (patternString: string, indexPatterns: string[]) =
           defaultMessage: 'Based on your indices and index patterns',
         }
       ),
-      options: matchingOptions.map(match => {
-        return {
-          label: match,
-          value: match,
-        };
-      }),
+      options: matchingOptions
+        .map(match => {
+          return {
+            label: match,
+            value: match,
+          };
+        })
+        .sort((a, b) => String(a.label).localeCompare(b.label)),
     });
   }
 
@@ -144,6 +147,7 @@ const getIndexOptions = async (patternString: string, indexPatterns: string[]) =
     }),
     options: [
       {
+        key: 'UNIQUE_CHOOSE_KEY',
         value: patternString,
         label: patternString,
       },
@@ -155,7 +159,8 @@ const getIndexOptions = async (patternString: string, indexPatterns: string[]) =
 
 export const ThresholdWatchEdit = ({ pageTitle }: { pageTitle: string }) => {
   // hooks
-  const [indexPatterns, setIndexPatterns] = useState([]);
+  const { toasts } = useAppContext();
+  const [indexPatterns, setIndexPatterns] = useState<any[]>([]);
   const [esFields, setEsFields] = useState([]);
   const [indexOptions, setIndexOptions] = useState<IOption[]>([]);
   const [timeFieldOptions, setTimeFieldOptions] = useState([firstFieldOption]);
@@ -165,34 +170,33 @@ export const ThresholdWatchEdit = ({ pageTitle }: { pageTitle: string }) => {
   const [watchThresholdPopoverOpen, setWatchThresholdPopoverOpen] = useState(false);
   const [watchDurationPopoverOpen, setWatchDurationPopoverOpen] = useState(false);
   const [aggTypePopoverOpen, setAggTypePopoverOpen] = useState(false);
-  const [serverError, setServerError] = useState<{
-    data: { nessage: string; error: string };
-  } | null>(null);
+  const [serverError, setServerError] = useState<ServerError | null>(null);
   const [isSaving, setIsSaving] = useState<boolean>(false);
   const [isIndiciesLoading, setIsIndiciesLoading] = useState<boolean>(false);
   const [isRequestVisible, setIsRequestVisible] = useState<boolean>(false);
 
   const { watch, setWatchProperty } = useContext(WatchContext);
 
-  const getIndexPatterns = async () => {
-    const indexPatternObjects = await loadIndexPatterns();
-    const titles = indexPatternObjects.map((indexPattern: any) => indexPattern.attributes.title);
-    setIndexPatterns(titles);
-  };
+  useEffect(() => {
+    const getIndexPatterns = async () => {
+      const indexPatternObjects = await loadIndexPatterns();
+      const titles = indexPatternObjects.map((indexPattern: any) => indexPattern.attributes.title);
+      setIndexPatterns(titles);
+    };
 
-  const loadData = async () => {
-    if (watch.index && watch.index.length > 0) {
-      const allEsFields = await getFields(watch.index);
-      const timeFields = getTimeFieldOptions(allEsFields);
-      setEsFields(allEsFields);
-      setTimeFieldOptions(timeFields);
-      setWatchProperty('timeFields', timeFields);
-    }
-    getIndexPatterns();
-  };
+    const loadData = async () => {
+      if (watch.index && watch.index.length > 0) {
+        const allEsFields = await getFields(watch.index);
+        const timeFields = getTimeFieldOptions(allEsFields);
+        setEsFields(allEsFields);
+        setTimeFieldOptions(timeFields);
+        setWatchProperty('timeFields', timeFields);
+      }
+      getIndexPatterns();
+    };
 
-  useEffect(() => {
     loadData();
+    // eslint-disable-next-line react-hooks/exhaustive-deps
   }, []);
 
   const { errors } = watch.validate();
@@ -899,7 +903,7 @@ export const ThresholdWatchEdit = ({ pageTitle }: { pageTitle: string }) => {
                   isLoading={isSaving}
                   onClick={async () => {
                     setIsSaving(true);
-                    const savedWatch = await onWatchSave(watch);
+                    const savedWatch = await onWatchSave(watch, toasts);
                     if (savedWatch && savedWatch.error) {
                       setIsSaving(false);
                       return setServerError(savedWatch.error);
diff --git a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/watch_visualization.tsx b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/watch_visualization.tsx
similarity index 83%
rename from x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/watch_visualization.tsx
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/watch_visualization.tsx
index 772f3cc024fe8..a3da7d14c8886 100644
--- a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/threshold_watch_edit/watch_visualization.tsx
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/threshold_watch_edit/watch_visualization.tsx
@@ -18,20 +18,20 @@ import {
   ScaleType,
   Settings,
 } from '@elastic/charts';
-import { TimeBuckets } from 'ui/time_buckets';
 import dateMath from '@elastic/datemath';
-import chrome from 'ui/chrome';
 import moment from 'moment-timezone';
+import { IUiSettingsClient } from 'src/core/public';
 import { EuiCallOut, EuiLoadingChart, EuiSpacer, EuiEmptyPrompt, EuiText } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { VisualizeOptions } from 'plugins/watcher/models/visualize_options';
-import { ThresholdWatch } from 'plugins/watcher/models/watch/threshold_watch';
-import { npStart } from 'ui/new_platform';
-import { getWatchVisualizationData } from '../../../../lib/api';
+import { VisualizeOptions } from 'plugins/watcher/np_ready/application/models/visualize_options';
+import { ThresholdWatch } from 'plugins/watcher/np_ready/application/models/watch/threshold_watch';
+
+import { useGetWatchVisualizationData } from '../../../../lib/api';
 import { WatchContext } from '../../watch_context';
 import { aggTypes } from '../../../../models/watch/agg_types';
 import { comparators } from '../../../../models/watch/comparators';
 import { SectionError, Error } from '../../../../components';
+import { useAppContext } from '../../../../app_context';
 
 const customTheme = () => {
   return {
@@ -46,8 +46,7 @@ const customTheme = () => {
   };
 };
 
-const getTimezone = () => {
-  const config = chrome.getUiSettingsClient();
+const getTimezone = (config: IUiSettingsClient) => {
   const DATE_FORMAT_CONFIG_KEY = 'dateFormat:tz';
   const isCustomTimezone = !config.isDefault(DATE_FORMAT_CONFIG_KEY);
   if (isCustomTimezone) {
@@ -59,8 +58,7 @@ const getTimezone = () => {
     return detectedTimezone;
   }
   // default to UTC if we can't figure out the timezone
-  const tzOffset = moment().format('Z');
-  return tzOffset;
+  return moment().format('Z');
 };
 
 const getDomain = (watch: any) => {
@@ -83,16 +81,20 @@ const getThreshold = (watch: any) => {
   return watch.threshold.slice(0, comparators[watch.thresholdComparator].requiredValues);
 };
 
-const getTimeBuckets = (watch: any) => {
+const getTimeBuckets = (watch: any, timeBuckets: any) => {
   const domain = getDomain(watch);
-  const timeBuckets = new TimeBuckets();
   timeBuckets.setBounds(domain);
   return timeBuckets;
 };
 
 export const WatchVisualization = () => {
+  const {
+    legacy: { TimeBuckets },
+    euiUtils,
+    uiSettings,
+  } = useAppContext();
   const { watch } = useContext(WatchContext);
-  const chartsTheme = npStart.plugins.eui_utils.useChartsTheme();
+  const chartsTheme = euiUtils.useChartsTheme();
   const {
     index,
     timeField,
@@ -117,7 +119,7 @@ export const WatchVisualization = () => {
     rangeFrom: domain.min,
     rangeTo: domain.max,
     interval,
-    timezone: getTimezone(),
+    timezone: getTimezone(uiSettings),
   });
 
   // Fetching visualization data is independent of watch actions
@@ -129,30 +131,33 @@ export const WatchVisualization = () => {
     data: watchVisualizationData,
     error,
     sendRequest: reload,
-  } = getWatchVisualizationData(watchWithoutActions, visualizeOptions);
+  } = useGetWatchVisualizationData(watchWithoutActions, visualizeOptions);
 
-  useEffect(() => {
-    // Prevent sending a second request on initial render.
-    if (isInitialRequest) {
-      return;
-    }
-
-    reload();
-  }, [
-    index,
-    timeField,
-    triggerIntervalSize,
-    triggerIntervalUnit,
-    aggType,
-    aggField,
-    termSize,
-    termField,
-    thresholdComparator,
-    timeWindowSize,
-    timeWindowUnit,
-    groupBy,
-    threshold,
-  ]);
+  useEffect(
+    () => {
+      // Prevent sending a second request on initial render.
+      if (isInitialRequest) {
+        return;
+      }
+      reload();
+    },
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+    [
+      index,
+      timeField,
+      triggerIntervalSize,
+      triggerIntervalUnit,
+      aggType,
+      aggField,
+      termSize,
+      termField,
+      thresholdComparator,
+      timeWindowSize,
+      timeWindowUnit,
+      groupBy,
+      threshold,
+    ]
+  );
 
   if (isInitialRequest && isLoading) {
     return (
@@ -190,7 +195,7 @@ export const WatchVisualization = () => {
 
   if (watchVisualizationData) {
     const watchVisualizationDataKeys = Object.keys(watchVisualizationData);
-    const timezone = getTimezone();
+    const timezone = getTimezone(uiSettings);
     const actualThreshold = getThreshold(watch);
     let maxY = actualThreshold[actualThreshold.length - 1];
 
@@ -204,7 +209,7 @@ export const WatchVisualization = () => {
     const dateFormatter = (d: number) => {
       return moment(d)
         .tz(timezone)
-        .format(getTimeBuckets(watch).getScaledDateFormat());
+        .format(getTimeBuckets(watch, new TimeBuckets()).getScaledDateFormat());
     };
     const aggLabel = aggTypes[watch.aggType].text;
     return (
diff --git a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/watch_edit.tsx b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/watch_edit.tsx
similarity index 82%
rename from x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/watch_edit.tsx
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/watch_edit.tsx
index 25daf190dc1b1..9f252d3e542e0 100644
--- a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/components/watch_edit.tsx
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/components/watch_edit.tsx
@@ -9,13 +9,11 @@ import { isEqual } from 'lodash';
 
 import { EuiPageContent } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
-import chrome from 'ui/chrome';
-import { MANAGEMENT_BREADCRUMB } from 'ui/management';
 
-import { Watch } from 'plugins/watcher/models/watch';
+import { Watch } from 'plugins/watcher/np_ready/application/models/watch';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { WATCH_TYPES } from '../../../../common/constants';
-import { BaseWatch } from '../../../../common/types/watch_types';
+import { WATCH_TYPES } from '../../../../../../common/constants';
+import { BaseWatch } from '../../../../../../common/types/watch_types';
 import { getPageErrorCode, PageError, SectionLoading, SectionError } from '../../../components';
 import { loadWatch } from '../../../lib/api';
 import { listBreadcrumb, editBreadcrumb, createBreadcrumb } from '../../../lib/breadcrumbs';
@@ -23,6 +21,7 @@ import { JsonWatchEdit } from './json_watch_edit';
 import { ThresholdWatchEdit } from './threshold_watch_edit';
 import { MonitoringWatchEdit } from './monitoring_watch_edit';
 import { WatchContext } from '../watch_context';
+import { useAppContext } from '../../../app_context';
 
 const getTitle = (watch: BaseWatch) => {
   if (watch.isNew) {
@@ -97,6 +96,10 @@ export const WatchEdit = ({
   };
 }) => {
   // hooks
+  const {
+    legacy: { MANAGEMENT_BREADCRUMB },
+    chrome,
+  } = useAppContext();
   const [{ watch, loadError }, dispatch] = useReducer(watchReducer, { watch: null });
 
   const setWatchProperty = (property: string, value: any) => {
@@ -107,33 +110,33 @@ export const WatchEdit = ({
     dispatch({ command: 'addAction', payload: action });
   };
 
-  const getWatch = async () => {
-    if (id) {
-      try {
-        const loadedWatch = await loadWatch(id);
-        dispatch({ command: 'setWatch', payload: loadedWatch });
-      } catch (error) {
-        dispatch({ command: 'setError', payload: error });
-      }
-    } else if (type) {
-      const WatchType = Watch.getWatchTypes()[type];
-      if (WatchType) {
-        dispatch({ command: 'setWatch', payload: new WatchType() });
+  useEffect(() => {
+    const getWatch = async () => {
+      if (id) {
+        try {
+          const loadedWatch = await loadWatch(id);
+          dispatch({ command: 'setWatch', payload: loadedWatch });
+        } catch (error) {
+          dispatch({ command: 'setError', payload: error });
+        }
+      } else if (type) {
+        const WatchType = Watch.getWatchTypes()[type];
+        if (WatchType) {
+          dispatch({ command: 'setWatch', payload: new WatchType() });
+        }
       }
-    }
-  };
+    };
 
-  useEffect(() => {
     getWatch();
-  }, []);
+  }, [id, type]);
 
   useEffect(() => {
-    chrome.breadcrumbs.set([
+    chrome.setBreadcrumbs([
       MANAGEMENT_BREADCRUMB,
       listBreadcrumb,
       id ? editBreadcrumb : createBreadcrumb,
     ]);
-  }, [id]);
+  }, [id, chrome, MANAGEMENT_BREADCRUMB]);
 
   const errorCode = getPageErrorCode(loadError);
   if (errorCode) {
diff --git a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/watch_context.ts b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/watch_context.ts
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/sections/watch_edit/watch_context.ts
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/watch_context.ts
diff --git a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/watch_edit_actions.ts b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/watch_edit_actions.ts
similarity index 86%
rename from x-pack/legacy/plugins/watcher/public/sections/watch_edit/watch_edit_actions.ts
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/watch_edit_actions.ts
index 320ba59e0589e..b93c2c510047d 100644
--- a/x-pack/legacy/plugins/watcher/public/sections/watch_edit/watch_edit_actions.ts
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_edit/watch_edit_actions.ts
@@ -4,11 +4,11 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { ToastsSetup } from 'src/core/public';
 import { i18n } from '@kbn/i18n';
-import { toastNotifications } from 'ui/notify';
 import { get } from 'lodash';
-import { ACTION_TYPES, WATCH_TYPES } from '../../../common/constants';
-import { BaseWatch } from '../../../common/types/watch_types';
+import { ACTION_TYPES, WATCH_TYPES } from '../../../../../common/constants';
+import { BaseWatch } from '../../../../../common/types/watch_types';
 import { createWatch } from '../../lib/api';
 import { goToWatchList } from '../../lib/navigation';
 
@@ -62,10 +62,10 @@ function createActionsForWatch(watchInstance: BaseWatch) {
   return watchInstance;
 }
 
-export async function saveWatch(watch: BaseWatch): Promise<any> {
+export async function saveWatch(watch: BaseWatch, toasts: ToastsSetup): Promise<any> {
   try {
     await createWatch(watch);
-    toastNotifications.addSuccess(
+    toasts.addSuccess(
       i18n.translate('xpack.watcher.sections.watchEdit.json.saveSuccessNotificationText', {
         defaultMessage: "Saved '{watchDisplayName}'",
         values: {
@@ -75,11 +75,11 @@ export async function saveWatch(watch: BaseWatch): Promise<any> {
     );
     goToWatchList();
   } catch (error) {
-    return error.response ? { error: error.response } : { error };
+    return { error: error?.response.data ?? (error.body || error) };
   }
 }
 
-export async function onWatchSave(watch: BaseWatch): Promise<any> {
+export async function onWatchSave(watch: BaseWatch, toasts: ToastsSetup): Promise<any> {
   const watchActions = watch.watch && watch.watch.actions;
   const watchData = watchActions ? createActionsForWatch(watch) : watch;
 
@@ -109,7 +109,7 @@ export async function onWatchSave(watch: BaseWatch): Promise<any> {
         },
       };
     }
-    return saveWatch(watchData);
+    return saveWatch(watchData, toasts);
   }
-  return saveWatch(watchData);
+  return saveWatch(watchData, toasts);
 }
diff --git a/x-pack/legacy/plugins/watcher/public/sections/watch_list/components/watch_list.tsx b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_list/components/watch_list.tsx
similarity index 97%
rename from x-pack/legacy/plugins/watcher/public/sections/watch_list/components/watch_list.tsx
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_list/components/watch_list.tsx
index d5191c56643c2..b2afc0b92509b 100644
--- a/x-pack/legacy/plugins/watcher/public/sections/watch_list/components/watch_list.tsx
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_list/components/watch_list.tsx
@@ -27,10 +27,8 @@ import {
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { Moment } from 'moment';
-import chrome from 'ui/chrome';
-import { MANAGEMENT_BREADCRUMB } from 'ui/management';
 
-import { REFRESH_INTERVALS, PAGINATION, WATCH_TYPES } from '../../../../common/constants';
+import { REFRESH_INTERVALS, PAGINATION, WATCH_TYPES } from '../../../../../../common/constants';
 import { listBreadcrumb } from '../../../lib/breadcrumbs';
 import {
   getPageErrorCode,
@@ -41,12 +39,17 @@ import {
   SectionLoading,
   Error,
 } from '../../../components';
-import { loadWatches } from '../../../lib/api';
-import { watcherGettingStartedUrl } from '../../../lib/documentation_links';
+import { useLoadWatches } from '../../../lib/api';
 import { goToCreateThresholdAlert, goToCreateAdvancedWatch } from '../../../lib/navigation';
+import { useAppContext } from '../../../app_context';
 
 export const WatchList = () => {
   // hooks
+  const {
+    chrome,
+    legacy: { MANAGEMENT_BREADCRUMB },
+    links: { watcherGettingStartedUrl },
+  } = useAppContext();
   const [selection, setSelection] = useState([]);
   const [watchesToDelete, setWatchesToDelete] = useState<string[]>([]);
   // Filter out deleted watches on the client, because the API will return 200 even though some watches
@@ -54,10 +57,10 @@ export const WatchList = () => {
   const [deletedWatches, setDeletedWatches] = useState<string[]>([]);
 
   useEffect(() => {
-    chrome.breadcrumbs.set([MANAGEMENT_BREADCRUMB, listBreadcrumb]);
-  }, []);
+    chrome.setBreadcrumbs([MANAGEMENT_BREADCRUMB, listBreadcrumb]);
+  }, [chrome, MANAGEMENT_BREADCRUMB]);
 
-  const { isLoading: isWatchesLoading, data: watches, error } = loadWatches(
+  const { isLoading: isWatchesLoading, data: watches, error } = useLoadWatches(
     REFRESH_INTERVALS.WATCH_LIST
   );
 
diff --git a/x-pack/legacy/plugins/watcher/public/sections/watch_status/components/watch_detail.tsx b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_status/components/watch_detail.tsx
similarity index 96%
rename from x-pack/legacy/plugins/watcher/public/sections/watch_status/components/watch_detail.tsx
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_status/components/watch_detail.tsx
index aba4fd0c52a2e..197342bba4180 100644
--- a/x-pack/legacy/plugins/watcher/public/sections/watch_status/components/watch_detail.tsx
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_status/components/watch_detail.tsx
@@ -7,7 +7,6 @@
 import React, { Fragment, useState, useEffect, useContext } from 'react';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { toastNotifications } from 'ui/notify';
 
 import {
   EuiInMemoryTable,
@@ -21,8 +20,9 @@ import {
 } from '@elastic/eui';
 import { ackWatchAction } from '../../../lib/api';
 import { WatchStatus } from '../../../components';
-import { PAGINATION } from '../../../../common/constants';
+import { PAGINATION } from '../../../../../../common/constants';
 import { WatchDetailsContext } from '../watch_details_context';
+import { useAppContext } from '../../../app_context';
 
 interface ActionError {
   code: string;
@@ -36,6 +36,7 @@ interface ActionStatus {
 }
 
 export const WatchDetail = () => {
+  const { toasts } = useAppContext();
   const { watchDetail } = useContext(WatchDetailsContext);
 
   const [actionStatuses, setActionStatuses] = useState<ActionStatus[]>([]);
@@ -60,7 +61,7 @@ export const WatchDetail = () => {
         };
       });
     setActionStatuses(actionStatusesWithErrors);
-  }, [watchDetail]);
+  }, [watchDetail, actionErrors, currentActionStatuses]);
 
   const baseColumns = [
     {
@@ -144,7 +145,7 @@ export const WatchDetail = () => {
                     return setActionStatuses(newActionStatusesWithErrors);
                   } catch (e) {
                     setIsActionStatusLoading(false);
-                    toastNotifications.addDanger(
+                    toasts.addDanger(
                       i18n.translate(
                         'xpack.watcher.sections.watchDetail.watchTable.ackActionErrorMessage',
                         {
diff --git a/x-pack/legacy/plugins/watcher/public/sections/watch_status/components/watch_history.tsx b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_status/components/watch_history.tsx
similarity index 97%
rename from x-pack/legacy/plugins/watcher/public/sections/watch_status/components/watch_history.tsx
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_status/components/watch_history.tsx
index bf6ca0c6c43a0..2bc1a0cbace18 100644
--- a/x-pack/legacy/plugins/watcher/public/sections/watch_status/components/watch_history.tsx
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_status/components/watch_history.tsx
@@ -23,9 +23,9 @@ import {
   EuiTitle,
 } from '@elastic/eui';
 
-import { PAGINATION } from '../../../../common/constants';
+import { PAGINATION } from '../../../../../../common/constants';
 import { WatchStatus, SectionError, Error } from '../../../components';
-import { loadWatchHistory, loadWatchHistoryDetail } from '../../../lib/api';
+import { useLoadWatchHistory, useLoadWatchHistoryDetail } from '../../../lib/api';
 import { WatchDetailsContext } from '../watch_details_context';
 
 const watchHistoryTimeSpanOptions = [
@@ -83,12 +83,12 @@ export const WatchHistory = () => {
     setIsActivated(isActive);
   }
 
-  const { error: historyError, data: history, isLoading } = loadWatchHistory(
+  const { error: historyError, data: history, isLoading } = useLoadWatchHistory(
     loadedWatch.id,
     watchHistoryTimeSpan
   );
 
-  const { error: watchHistoryDetailsError, data: watchHistoryDetails } = loadWatchHistoryDetail(
+  const { error: watchHistoryDetailsError, data: watchHistoryDetails } = useLoadWatchHistoryDetail(
     detailWatchId
   );
 
diff --git a/x-pack/legacy/plugins/watcher/public/sections/watch_status/components/watch_status.tsx b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_status/components/watch_status.tsx
similarity index 94%
rename from x-pack/legacy/plugins/watcher/public/sections/watch_status/components/watch_status.tsx
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_status/components/watch_status.tsx
index 413e8f638887b..53817c23e72eb 100644
--- a/x-pack/legacy/plugins/watcher/public/sections/watch_status/components/watch_status.tsx
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_status/components/watch_status.tsx
@@ -17,15 +17,12 @@ import {
   EuiBadge,
   EuiButtonEmpty,
 } from '@elastic/eui';
-import chrome from 'ui/chrome';
-import { MANAGEMENT_BREADCRUMB } from 'ui/management';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { toastNotifications } from 'ui/notify';
 import { WatchDetail } from './watch_detail';
 import { WatchHistory } from './watch_history';
 import { listBreadcrumb, statusBreadcrumb } from '../../../lib/breadcrumbs';
-import { loadWatchDetail, deactivateWatch, activateWatch } from '../../../lib/api';
+import { useLoadWatchDetail, deactivateWatch, activateWatch } from '../../../lib/api';
 import { WatchDetailsContext } from '../watch_details_context';
 import {
   getPageErrorCode,
@@ -34,6 +31,7 @@ import {
   DeleteWatchesModal,
 } from '../../../components';
 import { goToWatchList } from '../../../lib/navigation';
+import { useAppContext } from '../../../app_context';
 
 interface WatchStatusTab {
   id: string;
@@ -69,11 +67,16 @@ export const WatchStatus = ({
     };
   };
 }) => {
+  const {
+    chrome,
+    legacy: { MANAGEMENT_BREADCRUMB },
+    toasts,
+  } = useAppContext();
   const {
     error: watchDetailError,
     data: watchDetail,
     isLoading: isWatchDetailLoading,
-  } = loadWatchDetail(id);
+  } = useLoadWatchDetail(id);
 
   const [selectedTab, setSelectedTab] = useState<string>(WATCH_EXECUTION_HISTORY_TAB);
   const [isActivated, setIsActivated] = useState<boolean | undefined>(undefined);
@@ -81,8 +84,8 @@ export const WatchStatus = ({
   const [isTogglingActivation, setIsTogglingActivation] = useState<boolean>(false);
 
   useEffect(() => {
-    chrome.breadcrumbs.set([MANAGEMENT_BREADCRUMB, listBreadcrumb, statusBreadcrumb]);
-  }, [id]);
+    chrome.setBreadcrumbs([MANAGEMENT_BREADCRUMB, listBreadcrumb, statusBreadcrumb]);
+  }, [id, chrome, MANAGEMENT_BREADCRUMB]);
 
   const errorCode = getPageErrorCode(watchDetailError);
 
@@ -148,7 +151,7 @@ export const WatchStatus = ({
                 defaultMessage: "Couldn't activate watch",
               }
             );
-        return toastNotifications.addDanger(message);
+        return toasts.addDanger(message);
       }
 
       setIsActivated(!isActivated);
diff --git a/x-pack/legacy/plugins/watcher/public/sections/watch_status/watch_details_context.ts b/x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_status/watch_details_context.ts
similarity index 100%
rename from x-pack/legacy/plugins/watcher/public/sections/watch_status/watch_details_context.ts
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/sections/watch_status/watch_details_context.ts
diff --git a/x-pack/legacy/plugins/watcher/public/shared_imports.ts b/x-pack/legacy/plugins/watcher/public/np_ready/application/shared_imports.ts
similarity index 79%
rename from x-pack/legacy/plugins/watcher/public/shared_imports.ts
rename to x-pack/legacy/plugins/watcher/public/np_ready/application/shared_imports.ts
index 3d93b882733ab..60445b00c0985 100644
--- a/x-pack/legacy/plugins/watcher/public/shared_imports.ts
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/application/shared_imports.ts
@@ -10,4 +10,4 @@ export {
   UseRequestConfig,
   sendRequest,
   useRequest,
-} from '../../../../../src/plugins/es_ui_shared/public/request';
+} from '../../../../../../../src/plugins/es_ui_shared/public/request/np_ready_request';
diff --git a/x-pack/legacy/plugins/watcher/public/index.js b/x-pack/legacy/plugins/watcher/public/np_ready/index.ts
similarity index 71%
rename from x-pack/legacy/plugins/watcher/public/index.js
rename to x-pack/legacy/plugins/watcher/public/np_ready/index.ts
index c1b84e76d0008..ff635579316e5 100644
--- a/x-pack/legacy/plugins/watcher/public/index.js
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/index.ts
@@ -3,6 +3,6 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
+import { WatcherUIPlugin } from './plugin';
 
-import './register_route';
-import './register_management_sections';
+export const plugin = () => new WatcherUIPlugin();
diff --git a/x-pack/legacy/plugins/watcher/public/np_ready/plugin.ts b/x-pack/legacy/plugins/watcher/public/np_ready/plugin.ts
new file mode 100644
index 0000000000000..161de9b5fc060
--- /dev/null
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/plugin.ts
@@ -0,0 +1,62 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Plugin, CoreSetup, CoreStart } from 'src/core/public';
+
+import { LegacyDependencies } from './types';
+
+interface LegacyPlugins {
+  __LEGACY: LegacyDependencies;
+}
+
+export class WatcherUIPlugin implements Plugin<void, void, LegacyPlugins, any> {
+  /* TODO: Remove this in future. We need this at mount (setup) but it's only available on start plugins. */
+  euiUtils: any = null;
+
+  setup({ application, notifications, http, uiSettings }: CoreSetup, { __LEGACY }: LegacyPlugins) {
+    application.register({
+      id: 'watcher',
+      title: 'Watcher',
+      mount: async (
+        {
+          core: {
+            docLinks,
+            chrome,
+            // Waiting for types to be updated.
+            // @ts-ignore
+            savedObjects,
+            i18n: { Context: I18nContext },
+          },
+        },
+        { element }
+      ) => {
+        const euiUtils = this.euiUtils!;
+        const { boot } = await import('./application/boot');
+        return boot({
+          element,
+          toasts: notifications.toasts,
+          http,
+          uiSettings,
+          docLinks,
+          chrome,
+          euiUtils,
+          savedObjects: savedObjects.client,
+          I18nContext,
+          legacy: {
+            ...__LEGACY,
+          },
+        });
+      },
+    });
+  }
+
+  start(core: CoreStart, { eui_utils }: any) {
+    // eslint-disable-next-line @typescript-eslint/camelcase
+    this.euiUtils = eui_utils;
+  }
+
+  stop() {}
+}
diff --git a/x-pack/legacy/plugins/watcher/server/routes/api/fields/register_fields_routes.js b/x-pack/legacy/plugins/watcher/public/np_ready/types.ts
similarity index 63%
rename from x-pack/legacy/plugins/watcher/server/routes/api/fields/register_fields_routes.js
rename to x-pack/legacy/plugins/watcher/public/np_ready/types.ts
index 64b9a14f9c438..22109f99c2c48 100644
--- a/x-pack/legacy/plugins/watcher/server/routes/api/fields/register_fields_routes.js
+++ b/x-pack/legacy/plugins/watcher/public/np_ready/types.ts
@@ -4,8 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { registerListRoute } from './register_list_route';
-
-export function registerFieldsRoutes(server) {
-  registerListRoute(server);
+export interface LegacyDependencies {
+  MANAGEMENT_BREADCRUMB: { text: string; href?: string };
+  TimeBuckets: any;
+  licenseStatus: any;
 }
diff --git a/x-pack/legacy/plugins/watcher/public/register_feature.js b/x-pack/legacy/plugins/watcher/public/register_feature.js
deleted file mode 100644
index 5dd4f28f03bc5..0000000000000
--- a/x-pack/legacy/plugins/watcher/public/register_feature.js
+++ /dev/null
@@ -1,24 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-
-
-import { FeatureCatalogueRegistryProvider, FeatureCatalogueCategory } from 'ui/registry/feature_catalogue';
-import { i18n } from '@kbn/i18n';
-
-FeatureCatalogueRegistryProvider.register(() => {
-  return {
-    id: 'watcher',
-    title: 'Watcher', // This is a product name so we don't translate it.
-    description: i18n.translate('xpack.watcher.watcherDescription', {
-      defaultMessage: 'Detect changes in your data by creating, managing, and monitoring alerts.'
-    }),
-    icon: 'watchesApp',
-    path: '/app/kibana#/management/elasticsearch/watcher/watches',
-    showOnHomePage: true,
-    category: FeatureCatalogueCategory.ADMIN
-  };
-});
diff --git a/x-pack/legacy/plugins/watcher/public/register_feature.ts b/x-pack/legacy/plugins/watcher/public/register_feature.ts
new file mode 100644
index 0000000000000..0de41e09f788e
--- /dev/null
+++ b/x-pack/legacy/plugins/watcher/public/register_feature.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+import { npSetup } from 'ui/new_platform';
+import { FeatureCatalogueCategory } from 'ui/registry/feature_catalogue';
+
+npSetup.plugins.home.featureCatalogue.register({
+  id: 'watcher',
+  title: 'Watcher', // This is a product name so we don't translate it.
+  category: FeatureCatalogueCategory.ADMIN,
+  description: i18n.translate('xpack.watcher.watcherDescription', {
+    defaultMessage: 'Detect changes in your data by creating, managing, and monitoring alerts.',
+  }),
+  icon: 'watchesApp',
+  path: '/app/kibana#/management/elasticsearch/watcher/watches',
+  showOnHomePage: true,
+});
diff --git a/x-pack/legacy/plugins/watcher/public/register_management_sections.js b/x-pack/legacy/plugins/watcher/public/register_management_sections.js
deleted file mode 100644
index 886ac7d28db64..0000000000000
--- a/x-pack/legacy/plugins/watcher/public/register_management_sections.js
+++ /dev/null
@@ -1,60 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-
-import { management } from 'ui/management';
-import { i18n } from '@kbn/i18n';
-
-management.getSection('elasticsearch').register('watcher', {
-  display: i18n.translate('xpack.watcher.sections.watchList.managementSection.watcherDisplayName', {
-    defaultMessage: 'Watcher',
-  }),
-  order: 6,
-  url: '#/management/elasticsearch/watcher/',
-});
-
-management.getSection('elasticsearch/watcher').register('watches', {
-  display: i18n.translate('xpack.watcher.sections.watchList.managementSection.watchesDisplayName', {
-    defaultMessage: 'Watches',
-  }),
-  order: 1,
-});
-
-management.getSection('elasticsearch/watcher').register('watch', {
-  visible: false,
-});
-
-management.getSection('elasticsearch/watcher/watch').register('status', {
-  display: i18n.translate('xpack.watcher.sections.watchList.managementSection.statusDisplayName', {
-    defaultMessage: 'Status',
-  }),
-  order: 1,
-  visible: false,
-});
-
-management.getSection('elasticsearch/watcher/watch').register('edit', {
-  display: i18n.translate('xpack.watcher.sections.watchList.managementSection.editDisplayName', {
-    defaultMessage: 'Edit',
-  }),
-  order: 2,
-  visible: false,
-});
-
-management.getSection('elasticsearch/watcher/watch').register('new', {
-  display: i18n.translate(
-    'xpack.watcher.sections.watchList.managementSection.newWatchDisplayName',
-    {
-      defaultMessage: 'New Watch',
-    }
-  ),
-  order: 1,
-  visible: false,
-});
-
-management.getSection('elasticsearch/watcher/watch').register('history-item', {
-  order: 1,
-  visible: false,
-});
diff --git a/x-pack/legacy/plugins/watcher/public/register_route.js b/x-pack/legacy/plugins/watcher/public/register_route.js
deleted file mode 100644
index c58be17bc6e75..0000000000000
--- a/x-pack/legacy/plugins/watcher/public/register_route.js
+++ /dev/null
@@ -1,68 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-import React from 'react';
-import { render, unmountComponentAtNode } from 'react-dom';
-import { SavedObjectsClientProvider } from 'ui/saved_objects';
-import routes from 'ui/routes';
-import { management } from 'ui/management';
-import { xpackInfo } from 'plugins/xpack_main/services/xpack_info';
-import template from './app.html';
-import { App } from './app';
-import { setHttpClient, setSavedObjectsClient } from './lib/api';
-import { I18nContext } from 'ui/i18n';
-import { manageAngularLifecycle } from './lib/manage_angular_lifecycle';
-import { PLUGIN } from '../common/constants';
-import { LICENSE_STATUS_UNAVAILABLE, LICENSE_STATUS_INVALID } from '../../../common/constants';
-
-let elem;
-const renderReact = async (elem, licenseStatus) => {
-  render(
-    <I18nContext>
-      <App licenseStatus={licenseStatus}/>
-    </I18nContext>,
-    elem
-  );
-};
-routes.when('/management/elasticsearch/watcher/:param1?/:param2?/:param3?/:param4?', {
-  template,
-  controller: class WatcherController {
-    constructor($injector, $scope, $http, Private) {
-      const $route = $injector.get('$route');
-      const licenseStatus = xpackInfo.get(`features.${PLUGIN.ID}`);
-
-      // clean up previously rendered React app if one exists
-      // this happens because of React Router redirects
-      elem && unmountComponentAtNode(elem);
-      setSavedObjectsClient(Private(SavedObjectsClientProvider));
-      // NOTE: We depend upon Angular's $http service because it's decorated with interceptors,
-      // e.g. to check license status per request.
-      setHttpClient($http);
-      $scope.$$postDigest(() => {
-        elem = document.getElementById('watchReactRoot');
-        renderReact(elem, licenseStatus);
-        manageAngularLifecycle($scope, $route, elem);
-      });
-    }
-  },
-  controllerAs: 'watchRoute',
-});
-
-routes.defaults(/\/management/, {
-  resolve: {
-    watcherManagementSection: () => {
-      const watchesSection = management.getSection('elasticsearch/watcher');
-      const licenseStatus = xpackInfo.get(`features.${PLUGIN.ID}`);
-      const { status } = licenseStatus;
-
-      if (status === LICENSE_STATUS_INVALID || status === LICENSE_STATUS_UNAVAILABLE) {
-        return watchesSection.hide();
-      }
-
-      watchesSection.show();
-
-    },
-  },
-});
diff --git a/x-pack/legacy/plugins/watcher/server/lib/call_with_internal_user_factory/call_with_internal_user_factory.js b/x-pack/legacy/plugins/watcher/server/lib/call_with_internal_user_factory/call_with_internal_user_factory.js
deleted file mode 100644
index b0ca090601062..0000000000000
--- a/x-pack/legacy/plugins/watcher/server/lib/call_with_internal_user_factory/call_with_internal_user_factory.js
+++ /dev/null
@@ -1,18 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { once } from 'lodash';
-
-const _callWithInternalUser = once((server) => {
-  const { callWithInternalUser } = server.plugins.elasticsearch.getCluster('admin');
-  return callWithInternalUser;
-});
-
-export const callWithInternalUserFactory = (server) => {
-  return (...args) => {
-    return _callWithInternalUser(server)(...args);
-  };
-};
diff --git a/x-pack/legacy/plugins/watcher/server/lib/call_with_request_factory/call_with_request_factory.js b/x-pack/legacy/plugins/watcher/server/lib/call_with_request_factory/call_with_request_factory.js
deleted file mode 100644
index f60f825b98004..0000000000000
--- a/x-pack/legacy/plugins/watcher/server/lib/call_with_request_factory/call_with_request_factory.js
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { once } from 'lodash';
-import { elasticsearchJsPlugin } from '../elasticsearch_js_plugin';
-
-const callWithRequest = once((server) => {
-  const config = { plugins: [ elasticsearchJsPlugin ] };
-  const cluster = server.plugins.elasticsearch.createCluster('watcher', config);
-
-  return cluster.callWithRequest;
-});
-
-export const callWithRequestFactory = (server, request) => {
-  return (...args) => {
-    return callWithRequest(server)(request, ...args);
-  };
-};
diff --git a/x-pack/legacy/plugins/watcher/server/lib/call_with_request_factory/index.js b/x-pack/legacy/plugins/watcher/server/lib/call_with_request_factory/index.js
deleted file mode 100644
index 787814d87dff9..0000000000000
--- a/x-pack/legacy/plugins/watcher/server/lib/call_with_request_factory/index.js
+++ /dev/null
@@ -1,7 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-export { callWithRequestFactory } from './call_with_request_factory';
diff --git a/x-pack/legacy/plugins/watcher/server/lib/elasticsearch_js_plugin/index.js b/x-pack/legacy/plugins/watcher/server/lib/elasticsearch_js_plugin/index.js
deleted file mode 100644
index 87b5ff5426c9d..0000000000000
--- a/x-pack/legacy/plugins/watcher/server/lib/elasticsearch_js_plugin/index.js
+++ /dev/null
@@ -1,7 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-export { elasticsearchJsPlugin } from './elasticsearch_js_plugin';
diff --git a/x-pack/legacy/plugins/watcher/server/lib/error_wrappers/__tests__/wrap_custom_error.js b/x-pack/legacy/plugins/watcher/server/lib/error_wrappers/__tests__/wrap_custom_error.js
deleted file mode 100644
index f9c102be7a1ff..0000000000000
--- a/x-pack/legacy/plugins/watcher/server/lib/error_wrappers/__tests__/wrap_custom_error.js
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import expect from '@kbn/expect';
-import { wrapCustomError } from '../wrap_custom_error';
-
-describe('wrap_custom_error', () => {
-  describe('#wrapCustomError', () => {
-    it('should return a Boom object', () => {
-      const originalError = new Error('I am an error');
-      const statusCode = 404;
-      const wrappedError = wrapCustomError(originalError, statusCode);
-
-      expect(wrappedError.isBoom).to.be(true);
-      expect(wrappedError.output.statusCode).to.equal(statusCode);
-    });
-  });
-});
diff --git a/x-pack/legacy/plugins/watcher/server/lib/error_wrappers/__tests__/wrap_es_error.js b/x-pack/legacy/plugins/watcher/server/lib/error_wrappers/__tests__/wrap_es_error.js
deleted file mode 100644
index 467cc4fcdae1f..0000000000000
--- a/x-pack/legacy/plugins/watcher/server/lib/error_wrappers/__tests__/wrap_es_error.js
+++ /dev/null
@@ -1,39 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import expect from '@kbn/expect';
-import { wrapEsError } from '../wrap_es_error';
-
-describe('wrap_es_error', () => {
-  describe('#wrapEsError', () => {
-
-    let originalError;
-    beforeEach(() => {
-      originalError = new Error('I am an error');
-      originalError.statusCode = 404;
-    });
-
-    it('should return a Boom object', () => {
-      const wrappedError = wrapEsError(originalError);
-
-      expect(wrappedError.isBoom).to.be(true);
-    });
-
-    it('should return the correct Boom object', () => {
-      const wrappedError = wrapEsError(originalError);
-
-      expect(wrappedError.output.statusCode).to.be(originalError.statusCode);
-      expect(wrappedError.output.payload.message).to.be(originalError.message);
-    });
-
-    it('should return the correct Boom object with custom message', () => {
-      const wrappedError = wrapEsError(originalError, { 404: 'No encontrado!' });
-
-      expect(wrappedError.output.statusCode).to.be(originalError.statusCode);
-      expect(wrappedError.output.payload.message).to.be('No encontrado!');
-    });
-  });
-});
diff --git a/x-pack/legacy/plugins/watcher/server/lib/error_wrappers/__tests__/wrap_unknown_error.js b/x-pack/legacy/plugins/watcher/server/lib/error_wrappers/__tests__/wrap_unknown_error.js
deleted file mode 100644
index 85e0b2b3033ad..0000000000000
--- a/x-pack/legacy/plugins/watcher/server/lib/error_wrappers/__tests__/wrap_unknown_error.js
+++ /dev/null
@@ -1,19 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import expect from '@kbn/expect';
-import { wrapUnknownError } from '../wrap_unknown_error';
-
-describe('wrap_unknown_error', () => {
-  describe('#wrapUnknownError', () => {
-    it('should return a Boom object', () => {
-      const originalError = new Error('I am an error');
-      const wrappedError = wrapUnknownError(originalError);
-
-      expect(wrappedError.isBoom).to.be(true);
-    });
-  });
-});
diff --git a/x-pack/legacy/plugins/watcher/server/lib/error_wrappers/index.js b/x-pack/legacy/plugins/watcher/server/lib/error_wrappers/index.js
deleted file mode 100644
index f275f15637091..0000000000000
--- a/x-pack/legacy/plugins/watcher/server/lib/error_wrappers/index.js
+++ /dev/null
@@ -1,9 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-export { wrapCustomError } from './wrap_custom_error';
-export { wrapEsError } from './wrap_es_error';
-export { wrapUnknownError } from './wrap_unknown_error';
diff --git a/x-pack/legacy/plugins/watcher/server/lib/error_wrappers/wrap_custom_error.js b/x-pack/legacy/plugins/watcher/server/lib/error_wrappers/wrap_custom_error.js
deleted file mode 100644
index 3295113d38ee5..0000000000000
--- a/x-pack/legacy/plugins/watcher/server/lib/error_wrappers/wrap_custom_error.js
+++ /dev/null
@@ -1,18 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import Boom from 'boom';
-
-/**
- * Wraps a custom error into a Boom error response and returns it
- *
- * @param err Object error
- * @param statusCode Error status code
- * @return Object Boom error response
- */
-export function wrapCustomError(err, statusCode) {
-  return Boom.boomify(err, { statusCode });
-}
diff --git a/x-pack/legacy/plugins/watcher/server/lib/error_wrappers/wrap_es_error.js b/x-pack/legacy/plugins/watcher/server/lib/error_wrappers/wrap_es_error.js
deleted file mode 100644
index 2df2e4b802e1a..0000000000000
--- a/x-pack/legacy/plugins/watcher/server/lib/error_wrappers/wrap_es_error.js
+++ /dev/null
@@ -1,30 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import Boom from 'boom';
-
-/**
- * Wraps an error thrown by the ES JS client into a Boom error response and returns it
- *
- * @param err Object Error thrown by ES JS client
- * @param statusCodeToMessageMap Object Optional map of HTTP status codes => error messages
- * @return Object Boom error response
- */
-export function wrapEsError(err, statusCodeToMessageMap = {}) {
-
-  const statusCode = err.statusCode;
-
-  // If no custom message if specified for the error's status code, just
-  // wrap the error as a Boom error response and return it
-  if (!statusCodeToMessageMap[statusCode]) {
-    return Boom.boomify(err, { statusCode });
-  }
-
-  // Otherwise, use the custom message to create a Boom error response and
-  // return it
-  const message = statusCodeToMessageMap[statusCode];
-  return new Boom(message, { statusCode });
-}
diff --git a/x-pack/legacy/plugins/watcher/server/lib/error_wrappers/wrap_unknown_error.js b/x-pack/legacy/plugins/watcher/server/lib/error_wrappers/wrap_unknown_error.js
deleted file mode 100644
index ffd915c513362..0000000000000
--- a/x-pack/legacy/plugins/watcher/server/lib/error_wrappers/wrap_unknown_error.js
+++ /dev/null
@@ -1,17 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import Boom from 'boom';
-
-/**
- * Wraps an unknown error into a Boom error response and returns it
- *
- * @param err Object Unknown error
- * @return Object Boom error response
- */
-export function wrapUnknownError(err) {
-  return Boom.boomify(err);
-}
diff --git a/x-pack/legacy/plugins/watcher/server/lib/is_es_error_factory/__tests__/is_es_error_factory.js b/x-pack/legacy/plugins/watcher/server/lib/is_es_error_factory/__tests__/is_es_error_factory.js
deleted file mode 100644
index 76fdf7b36c3d0..0000000000000
--- a/x-pack/legacy/plugins/watcher/server/lib/is_es_error_factory/__tests__/is_es_error_factory.js
+++ /dev/null
@@ -1,48 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import expect from '@kbn/expect';
-import { isEsErrorFactory } from '../is_es_error_factory';
-import { set } from 'lodash';
-
-class MockAbstractEsError {}
-
-describe('is_es_error_factory', () => {
-
-  let mockServer;
-  let isEsError;
-
-  beforeEach(() => {
-    const mockEsErrors = {
-      _Abstract: MockAbstractEsError
-    };
-    mockServer = {};
-    set(mockServer, 'plugins.elasticsearch.getCluster', () => ({ errors: mockEsErrors }));
-
-    isEsError = isEsErrorFactory(mockServer);
-  });
-
-  describe('#isEsErrorFactory', () => {
-
-    it('should return a function', () => {
-      expect(isEsError).to.be.a(Function);
-    });
-
-    describe('returned function', () => {
-
-      it('should return true if passed-in err is a known esError', () => {
-        const knownEsError = new MockAbstractEsError();
-        expect(isEsError(knownEsError)).to.be(true);
-      });
-
-      it('should return false if passed-in err is not a known esError', () => {
-        const unknownEsError = {};
-        expect(isEsError(unknownEsError)).to.be(false);
-
-      });
-    });
-  });
-});
diff --git a/x-pack/legacy/plugins/watcher/server/lib/is_es_error_factory/index.js b/x-pack/legacy/plugins/watcher/server/lib/is_es_error_factory/index.js
deleted file mode 100644
index 441648a8701e0..0000000000000
--- a/x-pack/legacy/plugins/watcher/server/lib/is_es_error_factory/index.js
+++ /dev/null
@@ -1,7 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-export { isEsErrorFactory } from './is_es_error_factory';
diff --git a/x-pack/legacy/plugins/watcher/server/lib/is_es_error_factory/is_es_error_factory.js b/x-pack/legacy/plugins/watcher/server/lib/is_es_error_factory/is_es_error_factory.js
deleted file mode 100644
index 80daac5bd496d..0000000000000
--- a/x-pack/legacy/plugins/watcher/server/lib/is_es_error_factory/is_es_error_factory.js
+++ /dev/null
@@ -1,18 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { memoize } from 'lodash';
-
-const esErrorsFactory = memoize((server) => {
-  return server.plugins.elasticsearch.getCluster('admin').errors;
-});
-
-export function isEsErrorFactory(server) {
-  const esErrors = esErrorsFactory(server);
-  return function isEsError(err) {
-    return err instanceof esErrors._Abstract;
-  };
-}
diff --git a/x-pack/legacy/plugins/watcher/server/lib/license_pre_routing_factory/license_pre_routing_factory.js b/x-pack/legacy/plugins/watcher/server/lib/license_pre_routing_factory/license_pre_routing_factory.js
deleted file mode 100644
index 5b34108c9c1c0..0000000000000
--- a/x-pack/legacy/plugins/watcher/server/lib/license_pre_routing_factory/license_pre_routing_factory.js
+++ /dev/null
@@ -1,31 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { once } from 'lodash';
-import { wrapCustomError } from '../error_wrappers';
-import { PLUGIN } from '../../../common/constants';
-import { LICENSE_STATUS_VALID } from '../../../../../common/constants/license_status';
-
-export const licensePreRoutingFactory = once((server) => {
-  const xpackMainPlugin = server.plugins.xpack_main;
-
-  // License checking and enable/disable logic
-  function licensePreRouting() {
-    const licenseCheckResults = xpackMainPlugin.info.feature(PLUGIN.ID).getLicenseCheckResults();
-    const { status } = licenseCheckResults;
-
-    if (status !== LICENSE_STATUS_VALID) {
-      const error = new Error(licenseCheckResults.message);
-      const statusCode = 403;
-      throw wrapCustomError(error, statusCode);
-    }
-
-    return null;
-  }
-
-  return licensePreRouting;
-});
-
diff --git a/x-pack/legacy/plugins/watcher/server/lib/call_with_internal_user_factory/index.js b/x-pack/legacy/plugins/watcher/server/np_ready/index.ts
similarity index 55%
rename from x-pack/legacy/plugins/watcher/server/lib/call_with_internal_user_factory/index.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/index.ts
index a56a50e2864a5..3f5e1a91209ea 100644
--- a/x-pack/legacy/plugins/watcher/server/lib/call_with_internal_user_factory/index.js
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/index.ts
@@ -3,5 +3,7 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
+import { PluginInitializerContext } from 'src/core/server';
+import { WatcherServerPlugin } from './plugin';
 
-export { callWithInternalUserFactory } from './call_with_internal_user_factory';
+export const plugin = (ctx: PluginInitializerContext) => new WatcherServerPlugin();
diff --git a/x-pack/legacy/plugins/watcher/server/np_ready/lib/call_with_request_factory.ts b/x-pack/legacy/plugins/watcher/server/np_ready/lib/call_with_request_factory.ts
new file mode 100644
index 0000000000000..eaec9cd91b23c
--- /dev/null
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/lib/call_with_request_factory.ts
@@ -0,0 +1,28 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { ElasticsearchServiceSetup } from 'src/core/server';
+import { once } from 'lodash';
+import { elasticsearchJsPlugin } from './elasticsearch_js_plugin';
+
+const callWithRequest = once((elasticsearchService: ElasticsearchServiceSetup) => {
+  const config = { plugins: [elasticsearchJsPlugin] };
+  return elasticsearchService.createClient('watcher', config);
+});
+
+export const callWithRequestFactory = (
+  elasticsearchService: ElasticsearchServiceSetup,
+  request: any
+) => {
+  return (...args: any[]) => {
+    return (
+      callWithRequest(elasticsearchService)
+        .asScoped(request)
+        // @ts-ignore
+        .callAsCurrentUser(...args)
+    );
+  };
+};
diff --git a/x-pack/legacy/plugins/watcher/server/lib/elasticsearch_js_plugin/elasticsearch_js_plugin.js b/x-pack/legacy/plugins/watcher/server/np_ready/lib/elasticsearch_js_plugin.ts
similarity index 84%
rename from x-pack/legacy/plugins/watcher/server/lib/elasticsearch_js_plugin/elasticsearch_js_plugin.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/lib/elasticsearch_js_plugin.ts
index ad42388beea1e..240e93e160fe0 100644
--- a/x-pack/legacy/plugins/watcher/server/lib/elasticsearch_js_plugin/elasticsearch_js_plugin.js
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/lib/elasticsearch_js_plugin.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export const elasticsearchJsPlugin = (Client, config, components) => {
+export const elasticsearchJsPlugin = (Client: any, config: any, components: any) => {
   const ca = components.clientAction.factory;
 
   Client.prototype.watcher = components.clientAction.namespaceFactory();
@@ -21,19 +21,19 @@ export const elasticsearchJsPlugin = (Client, config, components) => {
     params: {
       masterTimeout: {
         name: 'master_timeout',
-        type: 'duration'
-      }
+        type: 'duration',
+      },
     },
     url: {
       fmt: '/_watcher/watch/<%=id%>/_deactivate',
       req: {
         id: {
           type: 'string',
-          required: true
-        }
-      }
+          required: true,
+        },
+      },
     },
-    method: 'PUT'
+    method: 'PUT',
   });
 
   /**
@@ -47,19 +47,19 @@ export const elasticsearchJsPlugin = (Client, config, components) => {
     params: {
       masterTimeout: {
         name: 'master_timeout',
-        type: 'duration'
-      }
+        type: 'duration',
+      },
     },
     url: {
       fmt: '/_watcher/watch/<%=id%>/_activate',
       req: {
         id: {
           type: 'string',
-          required: true
-        }
-      }
+          required: true,
+        },
+      },
     },
-    method: 'PUT'
+    method: 'PUT',
   });
 
   /**
@@ -74,23 +74,23 @@ export const elasticsearchJsPlugin = (Client, config, components) => {
     params: {
       masterTimeout: {
         name: 'master_timeout',
-        type: 'duration'
-      }
+        type: 'duration',
+      },
     },
     url: {
       fmt: '/_watcher/watch/<%=id%>/_ack/<%=action%>',
       req: {
         id: {
           type: 'string',
-          required: true
+          required: true,
         },
         action: {
           type: 'string',
-          required: true
-        }
-      }
+          required: true,
+        },
+      },
     },
-    method: 'POST'
+    method: 'POST',
   });
 
   /**
@@ -105,22 +105,22 @@ export const elasticsearchJsPlugin = (Client, config, components) => {
     params: {
       masterTimeout: {
         name: 'master_timeout',
-        type: 'duration'
+        type: 'duration',
       },
       force: {
-        type: 'boolean'
-      }
+        type: 'boolean',
+      },
     },
     url: {
       fmt: '/_watcher/watch/<%=id%>',
       req: {
         id: {
           type: 'string',
-          required: true
-        }
-      }
+          required: true,
+        },
+      },
     },
-    method: 'DELETE'
+    method: 'DELETE',
   });
 
   /**
@@ -132,14 +132,14 @@ export const elasticsearchJsPlugin = (Client, config, components) => {
     params: {
       masterTimeout: {
         name: 'master_timeout',
-        type: 'duration'
-      }
+        type: 'duration',
+      },
     },
     url: {
-      fmt: '/_watcher/watch/_execute'
+      fmt: '/_watcher/watch/_execute',
     },
     needBody: true,
-    method: 'POST'
+    method: 'POST',
   });
 
   /**
@@ -155,10 +155,10 @@ export const elasticsearchJsPlugin = (Client, config, components) => {
       req: {
         id: {
           type: 'string',
-          required: true
-        }
-      }
-    }
+          required: true,
+        },
+      },
+    },
   });
 
   /**
@@ -172,20 +172,20 @@ export const elasticsearchJsPlugin = (Client, config, components) => {
     params: {
       masterTimeout: {
         name: 'master_timeout',
-        type: 'duration'
-      }
+        type: 'duration',
+      },
     },
     url: {
       fmt: '/_watcher/watch/<%=id%>',
       req: {
         id: {
           type: 'string',
-          required: true
-        }
-      }
+          required: true,
+        },
+      },
     },
     needBody: true,
-    method: 'PUT'
+    method: 'PUT',
   });
 
   /**
@@ -196,9 +196,9 @@ export const elasticsearchJsPlugin = (Client, config, components) => {
   watcher.restart = ca({
     params: {},
     url: {
-      fmt: '/_watcher/_restart'
+      fmt: '/_watcher/_restart',
     },
-    method: 'PUT'
+    method: 'PUT',
   });
 
   /**
@@ -209,9 +209,9 @@ export const elasticsearchJsPlugin = (Client, config, components) => {
   watcher.start = ca({
     params: {},
     url: {
-      fmt: '/_watcher/_start'
+      fmt: '/_watcher/_start',
     },
-    method: 'PUT'
+    method: 'PUT',
   });
 
   /**
@@ -222,8 +222,8 @@ export const elasticsearchJsPlugin = (Client, config, components) => {
   watcher.stats = ca({
     params: {},
     url: {
-      fmt: '/_watcher/stats'
-    }
+      fmt: '/_watcher/stats',
+    },
   });
 
   /**
@@ -234,8 +234,8 @@ export const elasticsearchJsPlugin = (Client, config, components) => {
   watcher.stop = ca({
     params: {},
     url: {
-      fmt: '/_watcher/_stop'
+      fmt: '/_watcher/_stop',
     },
-    method: 'PUT'
+    method: 'PUT',
   });
 };
diff --git a/x-pack/legacy/plugins/watcher/server/lib/fetch_all_from_scroll/__tests__/fetch_all_from_scroll.js b/x-pack/legacy/plugins/watcher/server/np_ready/lib/fetch_all_from_scroll/__tests__/fetch_all_from_scroll.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/lib/fetch_all_from_scroll/__tests__/fetch_all_from_scroll.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/lib/fetch_all_from_scroll/__tests__/fetch_all_from_scroll.js
diff --git a/x-pack/legacy/plugins/watcher/server/lib/fetch_all_from_scroll/fetch_all_from_scroll.js b/x-pack/legacy/plugins/watcher/server/np_ready/lib/fetch_all_from_scroll/fetch_all_from_scroll.ts
similarity index 64%
rename from x-pack/legacy/plugins/watcher/server/lib/fetch_all_from_scroll/fetch_all_from_scroll.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/lib/fetch_all_from_scroll/fetch_all_from_scroll.ts
index eb76d5d3731cf..d762b05f01d79 100644
--- a/x-pack/legacy/plugins/watcher/server/lib/fetch_all_from_scroll/fetch_all_from_scroll.js
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/lib/fetch_all_from_scroll/fetch_all_from_scroll.ts
@@ -5,9 +5,9 @@
  */
 
 import { get } from 'lodash';
-import { ES_SCROLL_SETTINGS } from '../../../common/constants';
+import { ES_SCROLL_SETTINGS } from '../../../../common/constants';
 
-export function fetchAllFromScroll(response, callWithRequest, hits = []) {
+export function fetchAllFromScroll(response: any, callWithRequest: any, hits: any[] = []) {
   const newHits = get(response, 'hits.hits', []);
   const scrollId = get(response, '_scroll_id');
 
@@ -17,12 +17,11 @@ export function fetchAllFromScroll(response, callWithRequest, hits = []) {
     return callWithRequest('scroll', {
       body: {
         scroll: ES_SCROLL_SETTINGS.KEEPALIVE,
-        scroll_id: scrollId
-      }
-    })
-      .then(innerResponse => {
-        return fetchAllFromScroll(innerResponse, callWithRequest, hits);
-      });
+        scroll_id: scrollId,
+      },
+    }).then((innerResponse: any) => {
+      return fetchAllFromScroll(innerResponse, callWithRequest, hits);
+    });
   }
 
   return Promise.resolve(hits);
diff --git a/x-pack/legacy/plugins/watcher/server/lib/fetch_all_from_scroll/index.js b/x-pack/legacy/plugins/watcher/server/np_ready/lib/fetch_all_from_scroll/index.ts
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/lib/fetch_all_from_scroll/index.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/lib/fetch_all_from_scroll/index.ts
diff --git a/x-pack/legacy/plugins/watcher/public/lib/documentation_links/index.ts b/x-pack/legacy/plugins/watcher/server/np_ready/lib/is_es_error/index.ts
similarity index 84%
rename from x-pack/legacy/plugins/watcher/public/lib/documentation_links/index.ts
rename to x-pack/legacy/plugins/watcher/server/np_ready/lib/is_es_error/index.ts
index 81e0c494e28b3..a9a3c61472d8c 100644
--- a/x-pack/legacy/plugins/watcher/public/lib/documentation_links/index.ts
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/lib/is_es_error/index.ts
@@ -4,4 +4,4 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export * from './documentation_links';
+export { isEsError } from './is_es_error';
diff --git a/x-pack/legacy/plugins/watcher/server/routes/api/history/register_history_routes.js b/x-pack/legacy/plugins/watcher/server/np_ready/lib/is_es_error/is_es_error.ts
similarity index 55%
rename from x-pack/legacy/plugins/watcher/server/routes/api/history/register_history_routes.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/lib/is_es_error/is_es_error.ts
index bef26fbb9b267..4137293cf39c0 100644
--- a/x-pack/legacy/plugins/watcher/server/routes/api/history/register_history_routes.js
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/lib/is_es_error/is_es_error.ts
@@ -4,8 +4,10 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { registerLoadRoute } from './register_load_route';
+import * as legacyElasticsearch from 'elasticsearch';
 
-export function registerHistoryRoutes(server) {
-  registerLoadRoute(server);
+const esErrorsParent = legacyElasticsearch.errors._Abstract;
+
+export function isEsError(err: Error) {
+  return err instanceof esErrorsParent;
 }
diff --git a/x-pack/legacy/plugins/watcher/server/lib/license_pre_routing_factory/__tests__/license_pre_routing_factory.js b/x-pack/legacy/plugins/watcher/server/np_ready/lib/license_pre_routing_factory/__tests__/license_pre_routing_factory.js
similarity index 71%
rename from x-pack/legacy/plugins/watcher/server/lib/license_pre_routing_factory/__tests__/license_pre_routing_factory.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/lib/license_pre_routing_factory/__tests__/license_pre_routing_factory.js
index ed4a51a11b7cd..fc01e42e6fdf2 100644
--- a/x-pack/legacy/plugins/watcher/server/lib/license_pre_routing_factory/__tests__/license_pre_routing_factory.js
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/lib/license_pre_routing_factory/__tests__/license_pre_routing_factory.js
@@ -5,8 +5,9 @@
  */
 
 import expect from '@kbn/expect';
+import { kibanaResponseFactory } from '../../../../../../../../../src/core/server';
 import { licensePreRoutingFactory } from '../license_pre_routing_factory';
-import { LICENSE_STATUS_VALID, LICENSE_STATUS_EXPIRED } from '../../../../../../common/constants/license_status';
+import { LICENSE_STATUS_VALID, LICENSE_STATUS_EXPIRED } from '../../../../../../../common/constants/license_status';
 
 describe('license_pre_routing_factory', () => {
   describe('#reportingFeaturePreRoutingFactory', () => {
@@ -27,13 +28,6 @@ describe('license_pre_routing_factory', () => {
       };
     });
 
-    it('only instantiates one instance per server', () => {
-      const firstInstance = licensePreRoutingFactory(mockServer);
-      const secondInstance = licensePreRoutingFactory(mockServer);
-
-      expect(firstInstance).to.be(secondInstance);
-    });
-
     describe('status is not valid', () => {
       beforeEach(() => {
         mockLicenseCheckResults = {
@@ -42,13 +36,10 @@ describe('license_pre_routing_factory', () => {
       });
 
       it ('replies with 403', () => {
-        const licensePreRouting = licensePreRoutingFactory(mockServer);
+        const licensePreRouting = licensePreRoutingFactory(mockServer, () => {});
         const stubRequest = {};
-        expect(() => licensePreRouting(stubRequest)).to.throwException((response) => {
-          expect(response).to.be.an(Error);
-          expect(response.isBoom).to.be(true);
-          expect(response.output.statusCode).to.be(403);
-        });
+        const response = licensePreRouting({}, stubRequest, kibanaResponseFactory);
+        expect(response.status).to.be(403);
       });
     });
 
@@ -60,9 +51,9 @@ describe('license_pre_routing_factory', () => {
       });
 
       it ('replies with nothing', () => {
-        const licensePreRouting = licensePreRoutingFactory(mockServer);
+        const licensePreRouting = licensePreRoutingFactory(mockServer, () => null);
         const stubRequest = {};
-        const response = licensePreRouting(stubRequest);
+        const response = licensePreRouting({}, stubRequest, kibanaResponseFactory);
         expect(response).to.be(null);
       });
     });
diff --git a/x-pack/legacy/plugins/watcher/server/lib/license_pre_routing_factory/index.js b/x-pack/legacy/plugins/watcher/server/np_ready/lib/license_pre_routing_factory/index.ts
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/lib/license_pre_routing_factory/index.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/lib/license_pre_routing_factory/index.ts
diff --git a/x-pack/legacy/plugins/watcher/server/np_ready/lib/license_pre_routing_factory/license_pre_routing_factory.ts b/x-pack/legacy/plugins/watcher/server/np_ready/lib/license_pre_routing_factory/license_pre_routing_factory.ts
new file mode 100644
index 0000000000000..d2f4967246104
--- /dev/null
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/lib/license_pre_routing_factory/license_pre_routing_factory.ts
@@ -0,0 +1,43 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  KibanaRequest,
+  KibanaResponseFactory,
+  RequestHandler,
+  RequestHandlerContext,
+} from 'src/core/server';
+import { PLUGIN } from '../../../../common/constants';
+import { LICENSE_STATUS_VALID } from '../../../../../../common/constants/license_status';
+import { ServerShim } from '../../types';
+
+export const licensePreRoutingFactory = (
+  server: ServerShim,
+  handler: RequestHandler<any, any, any>
+): RequestHandler<any, any, any> => {
+  const xpackMainPlugin = server.plugins.xpack_main;
+
+  // License checking and enable/disable logic
+  return function licensePreRouting(
+    ctx: RequestHandlerContext,
+    request: KibanaRequest,
+    response: KibanaResponseFactory
+  ) {
+    const licenseCheckResults = xpackMainPlugin.info.feature(PLUGIN.ID).getLicenseCheckResults();
+    const { status } = licenseCheckResults;
+
+    if (status !== LICENSE_STATUS_VALID) {
+      return response.customError({
+        body: {
+          message: licenseCheckResults.messsage,
+        },
+        statusCode: 403,
+      });
+    }
+
+    return handler(ctx, request, response);
+  };
+};
diff --git a/x-pack/legacy/plugins/watcher/server/lib/normalized_field_types/index.js b/x-pack/legacy/plugins/watcher/server/np_ready/lib/normalized_field_types/index.ts
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/lib/normalized_field_types/index.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/lib/normalized_field_types/index.ts
diff --git a/x-pack/legacy/plugins/watcher/server/lib/normalized_field_types/normalized_field_types.js b/x-pack/legacy/plugins/watcher/server/np_ready/lib/normalized_field_types/normalized_field_types.ts
similarity index 61%
rename from x-pack/legacy/plugins/watcher/server/lib/normalized_field_types/normalized_field_types.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/lib/normalized_field_types/normalized_field_types.ts
index 65f2867662bdd..39e82e7db8964 100644
--- a/x-pack/legacy/plugins/watcher/server/lib/normalized_field_types/normalized_field_types.js
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/lib/normalized_field_types/normalized_field_types.ts
@@ -5,12 +5,12 @@
  */
 
 export const normalizedFieldTypes = {
-  'long': 'number',
-  'integer': 'number',
-  'short': 'number',
-  'byte': 'number',
-  'double': 'number',
-  'float': 'number',
-  'half_float': 'number',
-  'scaled_float': 'number'
+  long: 'number',
+  integer: 'number',
+  short: 'number',
+  byte: 'number',
+  double: 'number',
+  float: 'number',
+  half_float: 'number',
+  scaled_float: 'number',
 };
diff --git a/x-pack/legacy/plugins/watcher/server/models/action_status/__tests__/action_status.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/action_status/__tests__/action_status.js
similarity index 99%
rename from x-pack/legacy/plugins/watcher/server/models/action_status/__tests__/action_status.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/action_status/__tests__/action_status.js
index 456768c8c02ec..430669ab26c50 100644
--- a/x-pack/legacy/plugins/watcher/server/models/action_status/__tests__/action_status.js
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/models/action_status/__tests__/action_status.js
@@ -6,7 +6,7 @@
 
 import expect from '@kbn/expect';
 import { ActionStatus } from '../action_status';
-import { ACTION_STATES } from '../../../../common/constants';
+import { ACTION_STATES } from '../../../../../common/constants';
 import moment from 'moment';
 
 describe('action_status', () => {
diff --git a/x-pack/legacy/plugins/watcher/server/models/action_status/action_status.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/action_status/action_status.js
similarity index 97%
rename from x-pack/legacy/plugins/watcher/server/models/action_status/action_status.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/action_status/action_status.js
index eeedf9aefe5f6..7f724cf68211f 100644
--- a/x-pack/legacy/plugins/watcher/server/models/action_status/action_status.js
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/models/action_status/action_status.js
@@ -6,8 +6,8 @@
 
 import { get } from 'lodash';
 import { badImplementation, badRequest } from 'boom';
-import { getMoment } from '../../../common/lib/get_moment';
-import { ACTION_STATES } from '../../../common/constants';
+import { getMoment } from '../../../../common/lib/get_moment';
+import { ACTION_STATES } from '../../../../common/constants';
 import { i18n } from '@kbn/i18n';
 
 export class ActionStatus {
diff --git a/x-pack/legacy/plugins/watcher/server/models/action_status/index.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/action_status/index.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/models/action_status/index.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/action_status/index.js
diff --git a/x-pack/legacy/plugins/watcher/server/models/execute_details/__tests__/execute_details.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/execute_details/__tests__/execute_details.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/models/execute_details/__tests__/execute_details.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/execute_details/__tests__/execute_details.js
diff --git a/x-pack/legacy/plugins/watcher/server/models/execute_details/execute_details.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/execute_details/execute_details.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/models/execute_details/execute_details.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/execute_details/execute_details.js
diff --git a/x-pack/legacy/plugins/watcher/server/models/execute_details/index.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/execute_details/index.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/models/execute_details/index.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/execute_details/index.js
diff --git a/x-pack/legacy/plugins/watcher/server/models/fields/__tests__/fields.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/fields/__tests__/fields.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/models/fields/__tests__/fields.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/fields/__tests__/fields.js
diff --git a/x-pack/legacy/plugins/watcher/server/models/fields/fields.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/fields/fields.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/models/fields/fields.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/fields/fields.js
diff --git a/x-pack/legacy/plugins/watcher/server/models/fields/index.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/fields/index.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/models/fields/index.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/fields/index.js
diff --git a/x-pack/legacy/plugins/watcher/server/models/settings/__tests__/settings.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/settings/__tests__/settings.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/models/settings/__tests__/settings.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/settings/__tests__/settings.js
diff --git a/x-pack/legacy/plugins/watcher/server/models/settings/index.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/settings/index.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/models/settings/index.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/settings/index.js
diff --git a/x-pack/legacy/plugins/watcher/server/models/settings/settings.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/settings/settings.js
similarity index 97%
rename from x-pack/legacy/plugins/watcher/server/models/settings/settings.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/settings/settings.js
index 95a1db7533f41..55622117efedf 100644
--- a/x-pack/legacy/plugins/watcher/server/models/settings/settings.js
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/models/settings/settings.js
@@ -5,7 +5,7 @@
  */
 
 import { merge } from 'lodash';
-import { ACTION_TYPES } from '../../../common/constants';
+import { ACTION_TYPES } from '../../../../common/constants';
 
 function isEnabledByDefault(actionType) {
   switch (actionType) {
diff --git a/x-pack/legacy/plugins/watcher/server/models/visualize_options/index.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/visualize_options/index.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/models/visualize_options/index.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/visualize_options/index.js
diff --git a/x-pack/legacy/plugins/watcher/server/models/visualize_options/visualize_options.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/visualize_options/visualize_options.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/models/visualize_options/visualize_options.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/visualize_options/visualize_options.js
diff --git a/x-pack/legacy/plugins/watcher/server/models/watch/base_watch.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/base_watch.js
similarity index 98%
rename from x-pack/legacy/plugins/watcher/server/models/watch/base_watch.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/watch/base_watch.js
index f96274594872a..6a6df7d6f7f74 100644
--- a/x-pack/legacy/plugins/watcher/server/models/watch/base_watch.js
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/base_watch.js
@@ -6,7 +6,7 @@
 
 import { get, map, pick } from 'lodash';
 import { badRequest } from 'boom';
-import { Action } from '../../../common/models/action';
+import { Action } from '../../../../common/models/action';
 import { WatchStatus } from '../watch_status';
 import { i18n } from '@kbn/i18n';
 import { WatchErrors } from '../watch_errors';
diff --git a/x-pack/legacy/plugins/watcher/server/models/watch/base_watch.test.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/base_watch.test.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/models/watch/base_watch.test.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/watch/base_watch.test.js
diff --git a/x-pack/legacy/plugins/watcher/server/models/watch/index.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/index.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/models/watch/index.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/watch/index.js
diff --git a/x-pack/legacy/plugins/watcher/server/models/watch/json_watch.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/json_watch.js
similarity index 93%
rename from x-pack/legacy/plugins/watcher/server/models/watch/json_watch.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/watch/json_watch.js
index e319cc1bc277b..0b011ca33a76b 100644
--- a/x-pack/legacy/plugins/watcher/server/models/watch/json_watch.js
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/json_watch.js
@@ -6,8 +6,8 @@
 
 import { isEmpty, cloneDeep, has, merge } from 'lodash';
 import { BaseWatch } from './base_watch';
-import { WATCH_TYPES } from '../../../common/constants';
-import { serializeJsonWatch } from '../../../common/lib/serialization';
+import { WATCH_TYPES } from '../../../../common/constants';
+import { serializeJsonWatch } from '../../../../common/lib/serialization';
 
 export class JsonWatch extends BaseWatch {
   // This constructor should not be used directly.
diff --git a/x-pack/legacy/plugins/watcher/server/models/watch/json_watch.test.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/json_watch.test.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/models/watch/json_watch.test.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/watch/json_watch.test.js
diff --git a/x-pack/legacy/plugins/watcher/server/models/watch/lib/get_watch_type/get_watch_type.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/lib/get_watch_type/get_watch_type.js
similarity index 88%
rename from x-pack/legacy/plugins/watcher/server/models/watch/lib/get_watch_type/get_watch_type.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/watch/lib/get_watch_type/get_watch_type.js
index 2bdd03e23c6dc..72c725eda2bd1 100644
--- a/x-pack/legacy/plugins/watcher/server/models/watch/lib/get_watch_type/get_watch_type.js
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/lib/get_watch_type/get_watch_type.js
@@ -5,7 +5,7 @@
  */
 
 import { get, contains, values } from 'lodash';
-import { WATCH_TYPES } from '../../../../../common/constants';
+import { WATCH_TYPES } from '../../../../../../common/constants';
 
 export function getWatchType(watchJson) {
   const type = get(watchJson, 'metadata.xpack.type');
diff --git a/x-pack/legacy/plugins/watcher/server/models/watch/lib/get_watch_type/index.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/lib/get_watch_type/index.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/models/watch/lib/get_watch_type/index.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/watch/lib/get_watch_type/index.js
diff --git a/x-pack/legacy/plugins/watcher/server/models/watch/monitoring_watch.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/monitoring_watch.js
similarity index 97%
rename from x-pack/legacy/plugins/watcher/server/models/watch/monitoring_watch.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/watch/monitoring_watch.js
index 977c62726a038..7f29d41b20fb3 100644
--- a/x-pack/legacy/plugins/watcher/server/models/watch/monitoring_watch.js
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/monitoring_watch.js
@@ -7,7 +7,7 @@
 import { merge } from 'lodash';
 import { badRequest } from 'boom';
 import { BaseWatch } from './base_watch';
-import { WATCH_TYPES } from '../../../common/constants';
+import { WATCH_TYPES } from '../../../../common/constants';
 import { i18n } from '@kbn/i18n';
 
 export class MonitoringWatch extends BaseWatch {
diff --git a/x-pack/legacy/plugins/watcher/server/models/watch/monitoring_watch.test.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/monitoring_watch.test.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/models/watch/monitoring_watch.test.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/watch/monitoring_watch.test.js
diff --git a/x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/__tests__/format_visualize_data.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/__tests__/format_visualize_data.js
similarity index 99%
rename from x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/__tests__/format_visualize_data.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/__tests__/format_visualize_data.js
index 04239ab6e1b5f..a7524bcc7c4db 100644
--- a/x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/__tests__/format_visualize_data.js
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/__tests__/format_visualize_data.js
@@ -5,7 +5,7 @@
  */
 
 import expect from '@kbn/expect';
-import { AGG_TYPES } from '../../../../../common/constants';
+import { AGG_TYPES } from '../../../../../../common/constants';
 import { formatVisualizeData } from '../format_visualize_data';
 
 describe('watch', () => {
diff --git a/x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/build_visualize_query.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/build_visualize_query.js
similarity index 95%
rename from x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/build_visualize_query.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/build_visualize_query.js
index ab9daf6f636a1..c3b73d23d96b1 100644
--- a/x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/build_visualize_query.js
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/build_visualize_query.js
@@ -5,8 +5,8 @@
  */
 
 import { cloneDeep } from 'lodash';
-import { buildInput } from '../../../../common/lib/serialization';
-import { AGG_TYPES } from '../../../../common/constants';
+import { buildInput } from '../../../../../common/lib/serialization';
+import { AGG_TYPES } from '../../../../../common/constants';
 
 /*
 input.search.request.body.query.bool.filter.range
diff --git a/x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/data_samples/count.json b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/data_samples/count.json
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/data_samples/count.json
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/data_samples/count.json
diff --git a/x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/data_samples/count.query.date.json b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/data_samples/count.query.date.json
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/data_samples/count.query.date.json
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/data_samples/count.query.date.json
diff --git a/x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/data_samples/count.query.json b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/data_samples/count.query.json
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/data_samples/count.query.json
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/data_samples/count.query.json
diff --git a/x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/data_samples/count_terms.json b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/data_samples/count_terms.json
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/data_samples/count_terms.json
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/data_samples/count_terms.json
diff --git a/x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/data_samples/count_terms.query.date.json b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/data_samples/count_terms.query.date.json
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/data_samples/count_terms.query.date.json
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/data_samples/count_terms.query.date.json
diff --git a/x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/data_samples/count_terms.query.json b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/data_samples/count_terms.query.json
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/data_samples/count_terms.query.json
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/data_samples/count_terms.query.json
diff --git a/x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/data_samples/non_count.json b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/data_samples/non_count.json
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/data_samples/non_count.json
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/data_samples/non_count.json
diff --git a/x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/data_samples/non_count.query.date.json b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/data_samples/non_count.query.date.json
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/data_samples/non_count.query.date.json
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/data_samples/non_count.query.date.json
diff --git a/x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/data_samples/non_count.query.json b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/data_samples/non_count.query.json
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/data_samples/non_count.query.json
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/data_samples/non_count.query.json
diff --git a/x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/data_samples/non_count_terms.json b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/data_samples/non_count_terms.json
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/data_samples/non_count_terms.json
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/data_samples/non_count_terms.json
diff --git a/x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/data_samples/non_count_terms.query.date.json b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/data_samples/non_count_terms.query.date.json
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/data_samples/non_count_terms.query.date.json
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/data_samples/non_count_terms.query.date.json
diff --git a/x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/data_samples/non_count_terms.query.json b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/data_samples/non_count_terms.query.json
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/data_samples/non_count_terms.query.json
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/data_samples/non_count_terms.query.json
diff --git a/x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/format_visualize_data.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/format_visualize_data.js
similarity index 97%
rename from x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/format_visualize_data.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/format_visualize_data.js
index 90cdc9464e8c5..19d41d2491cf5 100644
--- a/x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/format_visualize_data.js
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/format_visualize_data.js
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { AGG_TYPES } from '../../../../common/constants';
+import { AGG_TYPES } from '../../../../../common/constants';
 
 export function formatVisualizeData({ aggType, termField }, results) {
   if (aggType === AGG_TYPES.COUNT && !Boolean(termField)) {
diff --git a/x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/index.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/index.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/index.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/index.js
diff --git a/x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/threshold_watch.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/threshold_watch.js
similarity index 97%
rename from x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/threshold_watch.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/threshold_watch.js
index cb40c46ac6435..db662902d0f4d 100644
--- a/x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/threshold_watch.js
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/threshold_watch.js
@@ -6,8 +6,8 @@
 
 import { merge } from 'lodash';
 import { BaseWatch } from '../base_watch';
-import { WATCH_TYPES, COMPARATORS, SORT_ORDERS } from '../../../../common/constants';
-import { serializeThresholdWatch } from '../../../../common/lib/serialization';
+import { WATCH_TYPES, COMPARATORS, SORT_ORDERS } from '../../../../../common/constants';
+import { serializeThresholdWatch } from '../../../../../common/lib/serialization';
 
 import { buildVisualizeQuery } from './build_visualize_query';
 import { formatVisualizeData } from './format_visualize_data';
diff --git a/x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/threshold_watch.test.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/threshold_watch.test.js
similarity index 99%
rename from x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/threshold_watch.test.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/threshold_watch.test.js
index 4a0b7b657bbc6..6226a702d7f3c 100644
--- a/x-pack/legacy/plugins/watcher/server/models/watch/threshold_watch/threshold_watch.test.js
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/threshold_watch/threshold_watch.test.js
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { COMPARATORS, SORT_ORDERS } from '../../../../common/constants';
+import { COMPARATORS, SORT_ORDERS } from '../../../../../common/constants';
 import { WatchErrors } from '../../watch_errors';
 import { ThresholdWatch } from './threshold_watch';
 
diff --git a/x-pack/legacy/plugins/watcher/server/models/watch/watch.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/watch.js
similarity index 97%
rename from x-pack/legacy/plugins/watcher/server/models/watch/watch.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/watch/watch.js
index c75afc62c4c4b..10b021dcbedf6 100644
--- a/x-pack/legacy/plugins/watcher/server/models/watch/watch.js
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/watch.js
@@ -6,7 +6,7 @@
 
 import { set } from 'lodash';
 import { badRequest } from 'boom';
-import { WATCH_TYPES } from '../../../common/constants';
+import { WATCH_TYPES } from '../../../../common/constants';
 import { JsonWatch } from './json_watch';
 import { MonitoringWatch } from './monitoring_watch';
 import { ThresholdWatch } from './threshold_watch';
diff --git a/x-pack/legacy/plugins/watcher/server/models/watch/watch.test.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/watch.test.js
similarity index 98%
rename from x-pack/legacy/plugins/watcher/server/models/watch/watch.test.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/watch/watch.test.js
index 2895c23083def..c419c28561730 100644
--- a/x-pack/legacy/plugins/watcher/server/models/watch/watch.test.js
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch/watch.test.js
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { WATCH_TYPES } from '../../../common/constants';
+import { WATCH_TYPES } from '../../../../common/constants';
 import { Watch } from './watch';
 import { JsonWatch } from './json_watch';
 import { MonitoringWatch } from './monitoring_watch';
diff --git a/x-pack/legacy/plugins/watcher/server/models/watch_errors/index.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch_errors/index.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/models/watch_errors/index.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/watch_errors/index.js
diff --git a/x-pack/legacy/plugins/watcher/server/models/watch_errors/watch_errors.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch_errors/watch_errors.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/models/watch_errors/watch_errors.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/watch_errors/watch_errors.js
diff --git a/x-pack/legacy/plugins/watcher/server/models/watch_errors/watch_errors.test.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch_errors/watch_errors.test.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/models/watch_errors/watch_errors.test.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/watch_errors/watch_errors.test.js
diff --git a/x-pack/legacy/plugins/watcher/server/models/watch_history_item/__tests__/watch_history_item.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch_history_item/__tests__/watch_history_item.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/models/watch_history_item/__tests__/watch_history_item.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/watch_history_item/__tests__/watch_history_item.js
diff --git a/x-pack/legacy/plugins/watcher/server/models/watch_history_item/index.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch_history_item/index.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/models/watch_history_item/index.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/watch_history_item/index.js
diff --git a/x-pack/legacy/plugins/watcher/server/models/watch_history_item/watch_history_item.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch_history_item/watch_history_item.js
similarity index 97%
rename from x-pack/legacy/plugins/watcher/server/models/watch_history_item/watch_history_item.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/watch_history_item/watch_history_item.js
index 617f758571742..5172e590fc63e 100644
--- a/x-pack/legacy/plugins/watcher/server/models/watch_history_item/watch_history_item.js
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch_history_item/watch_history_item.js
@@ -5,7 +5,7 @@
  */
 
 import { badRequest } from 'boom';
-import { getMoment } from '../../../common/lib/get_moment';
+import { getMoment } from '../../../../common/lib/get_moment';
 import { get, cloneDeep } from 'lodash';
 import { WatchStatus } from '../watch_status';
 import { i18n } from '@kbn/i18n';
diff --git a/x-pack/legacy/plugins/watcher/server/models/watch_status/__tests__/watch_status.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch_status/__tests__/watch_status.js
similarity index 99%
rename from x-pack/legacy/plugins/watcher/server/models/watch_status/__tests__/watch_status.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/watch_status/__tests__/watch_status.js
index e29c8dd2a529e..9a045fa4b5a7f 100644
--- a/x-pack/legacy/plugins/watcher/server/models/watch_status/__tests__/watch_status.js
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch_status/__tests__/watch_status.js
@@ -6,7 +6,7 @@
 
 import expect from '@kbn/expect';
 import { WatchStatus } from '../watch_status';
-import { ACTION_STATES, WATCH_STATES, WATCH_STATE_COMMENTS } from '../../../../common/constants';
+import { ACTION_STATES, WATCH_STATES, WATCH_STATE_COMMENTS } from '../../../../../common/constants';
 import moment from 'moment';
 
 describe('watch_status', () => {
diff --git a/x-pack/legacy/plugins/watcher/server/models/watch_status/index.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch_status/index.js
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/models/watch_status/index.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/watch_status/index.js
diff --git a/x-pack/legacy/plugins/watcher/server/models/watch_status/watch_status.js b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch_status/watch_status.js
similarity index 98%
rename from x-pack/legacy/plugins/watcher/server/models/watch_status/watch_status.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/models/watch_status/watch_status.js
index b7cffe16ca0bc..1e3d1d3064cb4 100644
--- a/x-pack/legacy/plugins/watcher/server/models/watch_status/watch_status.js
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/models/watch_status/watch_status.js
@@ -6,9 +6,9 @@
 
 import { get, map, forEach, max } from 'lodash';
 import { badRequest } from 'boom';
-import { getMoment } from '../../../common/lib/get_moment';
+import { getMoment } from '../../../../common/lib/get_moment';
 import { ActionStatus } from '../action_status';
-import { ACTION_STATES, WATCH_STATES, WATCH_STATE_COMMENTS } from '../../../common/constants';
+import { ACTION_STATES, WATCH_STATES, WATCH_STATE_COMMENTS } from '../../../../common/constants';
 import { i18n } from '@kbn/i18n';
 
 function getActionStatusTotals(watchStatus) {
diff --git a/x-pack/legacy/plugins/watcher/server/np_ready/plugin.ts b/x-pack/legacy/plugins/watcher/server/np_ready/plugin.ts
new file mode 100644
index 0000000000000..2e8c81efa19c0
--- /dev/null
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/plugin.ts
@@ -0,0 +1,51 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { first } from 'rxjs/operators';
+import { Plugin, CoreSetup } from 'src/core/server';
+import { i18n } from '@kbn/i18n';
+import { PLUGIN } from '../../common/constants';
+import { ServerShim, RouteDependencies } from './types';
+
+import { registerLicenseChecker } from '../../../../server/lib/register_license_checker';
+import { registerSettingsRoutes } from './routes/api/settings';
+import { registerIndicesRoutes } from './routes/api/indices';
+import { registerLicenseRoutes } from './routes/api/license';
+import { registerWatchesRoutes } from './routes/api/watches';
+import { registerWatchRoutes } from './routes/api/watch';
+import { registerListFieldsRoute } from './routes/api/register_list_fields_route';
+import { registerLoadHistoryRoute } from './routes/api/register_load_history_route';
+
+export class WatcherServerPlugin implements Plugin<void, void, any, any> {
+  async setup(
+    { http, elasticsearch: elasticsearchService }: CoreSetup,
+    { __LEGACY: serverShim }: { __LEGACY: ServerShim }
+  ) {
+    const elasticsearch = await elasticsearchService.adminClient$.pipe(first()).toPromise();
+    const router = http.createRouter();
+    const routeDependencies: RouteDependencies = {
+      elasticsearch,
+      elasticsearchService,
+      router,
+    };
+    // Register license checker
+    registerLicenseChecker(
+      serverShim as any,
+      PLUGIN.ID,
+      PLUGIN.getI18nName(i18n),
+      PLUGIN.MINIMUM_LICENSE_REQUIRED
+    );
+
+    registerListFieldsRoute(routeDependencies, serverShim);
+    registerLoadHistoryRoute(routeDependencies, serverShim);
+    registerIndicesRoutes(routeDependencies, serverShim);
+    registerLicenseRoutes(routeDependencies, serverShim);
+    registerSettingsRoutes(routeDependencies, serverShim);
+    registerWatchesRoutes(routeDependencies, serverShim);
+    registerWatchRoutes(routeDependencies, serverShim);
+  }
+  start() {}
+  stop() {}
+}
diff --git a/x-pack/legacy/plugins/watcher/server/routes/api/indices/index.js b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/indices/index.ts
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/routes/api/indices/index.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/routes/api/indices/index.ts
diff --git a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/indices/register_get_route.ts b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/indices/register_get_route.ts
new file mode 100644
index 0000000000000..6b6b643dc4adf
--- /dev/null
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/indices/register_get_route.ts
@@ -0,0 +1,92 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { schema } from '@kbn/config-schema';
+import { RequestHandler } from 'src/core/server';
+import { reduce, size } from 'lodash';
+import { callWithRequestFactory } from '../../../lib/call_with_request_factory';
+import { isEsError } from '../../../lib/is_es_error';
+import { licensePreRoutingFactory } from '../../../lib/license_pre_routing_factory';
+import { RouteDependencies, ServerShim } from '../../../types';
+
+function getIndexNamesFromAliasesResponse(json: Record<string, any>) {
+  return reduce(
+    json,
+    (list, { aliases }, indexName) => {
+      list.push(indexName);
+      if (size(aliases) > 0) {
+        list.push(...Object.keys(aliases));
+      }
+      return list;
+    },
+    [] as string[]
+  );
+}
+
+function getIndices(callWithRequest: any, pattern: string, limit = 10) {
+  return callWithRequest('indices.getAlias', {
+    index: pattern,
+    ignore: [404],
+  }).then((aliasResult: any) => {
+    if (aliasResult.status !== 404) {
+      const indicesFromAliasResponse = getIndexNamesFromAliasesResponse(aliasResult);
+      return indicesFromAliasResponse.slice(0, limit);
+    }
+
+    const params = {
+      index: pattern,
+      ignore: [404],
+      body: {
+        size: 0, // no hits
+        aggs: {
+          indices: {
+            terms: {
+              field: '_index',
+              size: limit,
+            },
+          },
+        },
+      },
+    };
+
+    return callWithRequest('search', params).then((response: any) => {
+      if (response.status === 404 || !response.aggregations) {
+        return [];
+      }
+      return response.aggregations.indices.buckets.map((bucket: any) => bucket.key);
+    });
+  });
+}
+
+export function registerGetRoute(deps: RouteDependencies, legacy: ServerShim) {
+  const handler: RequestHandler<any, any, any> = async (ctx, request, response) => {
+    const callWithRequest = callWithRequestFactory(deps.elasticsearchService, request);
+    const { pattern } = request.body;
+
+    try {
+      const indices = await getIndices(callWithRequest, pattern);
+      return response.ok({ body: { indices } });
+    } catch (e) {
+      // Case: Error from Elasticsearch JS client
+      if (isEsError(e)) {
+        return response.customError({ statusCode: e.statusCode, body: e });
+      }
+
+      // Case: default
+      return response.internalError({ body: e });
+    }
+  };
+
+  deps.router.post(
+    {
+      path: '/api/watcher/indices',
+      validate: {
+        body: schema.object({}, { allowUnknowns: true }),
+      },
+    },
+    licensePreRoutingFactory(legacy, handler)
+  );
+}
diff --git a/x-pack/legacy/plugins/watcher/server/routes/api/indices/register_indices_routes.js b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/indices/register_indices_routes.ts
similarity index 62%
rename from x-pack/legacy/plugins/watcher/server/routes/api/indices/register_indices_routes.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/routes/api/indices/register_indices_routes.ts
index 41b2f8dba7a1f..647a85c311532 100644
--- a/x-pack/legacy/plugins/watcher/server/routes/api/indices/register_indices_routes.js
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/indices/register_indices_routes.ts
@@ -5,7 +5,8 @@
  */
 
 import { registerGetRoute } from './register_get_route';
+import { RouteDependencies, ServerShim } from '../../../types';
 
-export function registerIndicesRoutes(server) {
-  registerGetRoute(server);
+export function registerIndicesRoutes(deps: RouteDependencies, legacy: ServerShim) {
+  registerGetRoute(deps, legacy);
 }
diff --git a/x-pack/legacy/plugins/watcher/server/routes/api/license/index.js b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/license/index.ts
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/routes/api/license/index.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/routes/api/license/index.ts
diff --git a/x-pack/legacy/plugins/watcher/server/routes/api/license/register_license_routes.js b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/license/register_license_routes.ts
similarity index 62%
rename from x-pack/legacy/plugins/watcher/server/routes/api/license/register_license_routes.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/routes/api/license/register_license_routes.ts
index fe890719a0a7d..c5965d9315b01 100644
--- a/x-pack/legacy/plugins/watcher/server/routes/api/license/register_license_routes.js
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/license/register_license_routes.ts
@@ -5,7 +5,8 @@
  */
 
 import { registerRefreshRoute } from './register_refresh_route';
+import { RouteDependencies, ServerShim } from '../../../types';
 
-export function registerLicenseRoutes(server) {
-  registerRefreshRoute(server);
+export function registerLicenseRoutes(deps: RouteDependencies, legacy: ServerShim) {
+  registerRefreshRoute(deps, legacy);
 }
diff --git a/x-pack/legacy/plugins/watcher/server/routes/api/license/register_refresh_route.js b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/license/register_refresh_route.ts
similarity index 50%
rename from x-pack/legacy/plugins/watcher/server/routes/api/license/register_refresh_route.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/routes/api/license/register_refresh_route.ts
index cbd5dc7f6631f..08f1f26a84a4f 100644
--- a/x-pack/legacy/plugins/watcher/server/routes/api/license/register_refresh_route.js
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/license/register_refresh_route.ts
@@ -4,7 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { licensePreRoutingFactory } from'../../../lib/license_pre_routing_factory';
+import { RequestHandler } from 'src/core/server';
+import { licensePreRoutingFactory } from '../../../lib/license_pre_routing_factory';
+import { RouteDependencies, ServerShim } from '../../../types';
 
 /*
 In order for the client to have the most up-to-date snapshot of the current license,
@@ -12,17 +14,16 @@ it needs to make a round-trip to the kibana server. This refresh endpoint is pro
 for when the client needs to check the license, but doesn't need to pull data from the
 server for any reason, i.e., when adding a new watch.
 */
-export function registerRefreshRoute(server) {
-  const licensePreRouting = licensePreRoutingFactory(server);
+export function registerRefreshRoute(deps: RouteDependencies, legacy: ServerShim) {
+  const handler: RequestHandler<any, any, any> = (ctx, request, response) => {
+    return response.ok({ body: { success: true } });
+  };
 
-  server.route({
-    path: '/api/watcher/license/refresh',
-    method: 'GET',
-    handler: () => {
-      return { success: true };
+  deps.router.get(
+    {
+      path: '/api/watcher/license/refresh',
+      validate: false,
     },
-    config: {
-      pre: [ licensePreRouting ]
-    }
-  });
+    licensePreRoutingFactory(legacy, handler)
+  );
 }
diff --git a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/register_list_fields_route.ts b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/register_list_fields_route.ts
new file mode 100644
index 0000000000000..f3222d24f0adf
--- /dev/null
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/register_list_fields_route.ts
@@ -0,0 +1,65 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { schema } from '@kbn/config-schema';
+import { RequestHandler } from 'src/core/server';
+import { callWithRequestFactory } from '../../lib/call_with_request_factory';
+import { isEsError } from '../../lib/is_es_error';
+import { licensePreRoutingFactory } from '../../lib/license_pre_routing_factory';
+// @ts-ignore
+import { Fields } from '../../models/fields';
+import { RouteDependencies, ServerShim } from '../../types';
+
+function fetchFields(callWithRequest: any, indexes: string[]) {
+  const params = {
+    index: indexes,
+    fields: ['*'],
+    ignoreUnavailable: true,
+    allowNoIndices: true,
+    ignore: 404,
+  };
+
+  return callWithRequest('fieldCaps', params);
+}
+
+export function registerListFieldsRoute(deps: RouteDependencies, legacy: ServerShim) {
+  const handler: RequestHandler<any, any, any> = async (ctx, request, response) => {
+    const callWithRequest = callWithRequestFactory(deps.elasticsearchService, request);
+    const { indexes } = request.body;
+
+    try {
+      const fieldsResponse = await fetchFields(callWithRequest, indexes);
+      const json = fieldsResponse.status === 404 ? { fields: [] } : fieldsResponse;
+      const fields = Fields.fromUpstreamJson(json);
+      return response.ok({ body: fields.downstreamJson });
+    } catch (e) {
+      // Case: Error from Elasticsearch JS client
+      if (isEsError(e)) {
+        return response.customError({
+          statusCode: e.statusCode,
+          body: {
+            message: e.message,
+          },
+        });
+      }
+
+      // Case: default
+      return response.internalError({ body: e });
+    }
+  };
+
+  deps.router.post(
+    {
+      path: '/api/watcher/fields',
+      validate: {
+        body: schema.object({
+          indexes: schema.arrayOf(schema.string()),
+        }),
+      },
+    },
+    licensePreRoutingFactory(legacy, handler)
+  );
+}
diff --git a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/register_load_history_route.ts b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/register_load_history_route.ts
new file mode 100644
index 0000000000000..d62e4f48c5629
--- /dev/null
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/register_load_history_route.ts
@@ -0,0 +1,77 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { schema } from '@kbn/config-schema';
+import { get } from 'lodash';
+import { RequestHandler } from 'src/core/server';
+import { callWithRequestFactory } from '../../lib/call_with_request_factory';
+import { isEsError } from '../../lib/is_es_error';
+import { INDEX_NAMES } from '../../../../common/constants';
+import { licensePreRoutingFactory } from '../../lib/license_pre_routing_factory';
+import { RouteDependencies, ServerShim } from '../../types';
+// @ts-ignore
+import { WatchHistoryItem } from '../../models/watch_history_item';
+
+function fetchHistoryItem(callWithRequest: any, watchHistoryItemId: string) {
+  return callWithRequest('search', {
+    index: INDEX_NAMES.WATCHER_HISTORY,
+    body: {
+      query: {
+        bool: {
+          must: [{ term: { _id: watchHistoryItemId } }],
+        },
+      },
+    },
+  });
+}
+
+export function registerLoadHistoryRoute(deps: RouteDependencies, legacy: ServerShim) {
+  const handler: RequestHandler<any, any, any> = async (ctx, request, response) => {
+    const callWithRequest = callWithRequestFactory(deps.elasticsearchService, request);
+    const id = request.params.id;
+
+    try {
+      const responseFromES = await fetchHistoryItem(callWithRequest, id);
+      const hit = get(responseFromES, 'hits.hits[0]');
+      if (!hit) {
+        return response.notFound({ body: `Watch History Item with id = ${id} not found` });
+      }
+      const watchHistoryItemJson = get(hit, '_source');
+      const watchId = get(hit, '_source.watch_id');
+      const json = {
+        id,
+        watchId,
+        watchHistoryItemJson,
+        includeDetails: true,
+      };
+
+      const watchHistoryItem = WatchHistoryItem.fromUpstreamJson(json);
+      return response.ok({
+        body: { watchHistoryItem: watchHistoryItem.downstreamJson },
+      });
+    } catch (e) {
+      // Case: Error from Elasticsearch JS client
+      if (isEsError(e)) {
+        return response.customError({ statusCode: e.statusCode, body: e });
+      }
+
+      // Case: default
+      return response.internalError({ body: e });
+    }
+  };
+
+  deps.router.get(
+    {
+      path: '/api/watcher/history/{id}',
+      validate: {
+        params: schema.object({
+          id: schema.string(),
+        }),
+      },
+    },
+    licensePreRoutingFactory(legacy, handler)
+  );
+}
diff --git a/x-pack/legacy/plugins/watcher/server/routes/api/settings/index.js b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/settings/index.ts
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/routes/api/settings/index.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/routes/api/settings/index.ts
diff --git a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/settings/register_load_route.ts b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/settings/register_load_route.ts
new file mode 100644
index 0000000000000..710d079d810da
--- /dev/null
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/settings/register_load_route.ts
@@ -0,0 +1,43 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IClusterClient, RequestHandler } from 'src/core/server';
+import { isEsError } from '../../../lib/is_es_error';
+import { licensePreRoutingFactory } from '../../../lib/license_pre_routing_factory';
+// @ts-ignore
+import { Settings } from '../../../models/settings';
+import { RouteDependencies, ServerShim } from '../../../types';
+
+function fetchClusterSettings(client: IClusterClient) {
+  return client.callAsInternalUser('cluster.getSettings', {
+    includeDefaults: true,
+    filterPath: '**.xpack.notification',
+  });
+}
+
+export function registerLoadRoute(deps: RouteDependencies, legacy: ServerShim) {
+  const handler: RequestHandler<any, any, any> = async (ctx, request, response) => {
+    try {
+      const settings = await fetchClusterSettings(deps.elasticsearch);
+      return response.ok({ body: Settings.fromUpstreamJson(settings).downstreamJson });
+    } catch (e) {
+      // Case: Error from Elasticsearch JS client
+      if (isEsError(e)) {
+        return response.customError({ statusCode: e.statusCode, body: e });
+      }
+
+      // Case: default
+      return response.internalError({ body: e });
+    }
+  };
+  deps.router.get(
+    {
+      path: '/api/watcher/settings',
+      validate: false,
+    },
+    licensePreRoutingFactory(legacy, handler)
+  );
+}
diff --git a/x-pack/legacy/plugins/watcher/server/routes/api/settings/register_settings_routes.js b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/settings/register_settings_routes.ts
similarity index 62%
rename from x-pack/legacy/plugins/watcher/server/routes/api/settings/register_settings_routes.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/routes/api/settings/register_settings_routes.ts
index eefb320e9b1d9..0b24ec0e90bd4 100644
--- a/x-pack/legacy/plugins/watcher/server/routes/api/settings/register_settings_routes.js
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/settings/register_settings_routes.ts
@@ -5,7 +5,8 @@
  */
 
 import { registerLoadRoute } from './register_load_route';
+import { RouteDependencies, ServerShim } from '../../../types';
 
-export function registerSettingsRoutes(server) {
-  registerLoadRoute(server);
+export function registerSettingsRoutes(deps: RouteDependencies, legacy: ServerShim) {
+  registerLoadRoute(deps, legacy);
 }
diff --git a/x-pack/legacy/plugins/watcher/server/routes/api/watch/action/index.js b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/action/index.ts
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/routes/api/watch/action/index.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/action/index.ts
diff --git a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/action/register_acknowledge_route.ts b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/action/register_acknowledge_route.ts
new file mode 100644
index 0000000000000..d0cc0a27e87ff
--- /dev/null
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/action/register_acknowledge_route.ts
@@ -0,0 +1,65 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { schema } from '@kbn/config-schema';
+import { get } from 'lodash';
+import { RequestHandler } from 'src/core/server';
+import { callWithRequestFactory } from '../../../../lib/call_with_request_factory';
+import { isEsError } from '../../../../lib/is_es_error';
+import { licensePreRoutingFactory } from '../../../../lib/license_pre_routing_factory';
+// @ts-ignore
+import { WatchStatus } from '../../../../models/watch_status';
+import { RouteDependencies, ServerShim } from '../../../../types';
+
+function acknowledgeAction(callWithRequest: any, watchId: string, actionId: string) {
+  return callWithRequest('watcher.ackWatch', {
+    id: watchId,
+    action: actionId,
+  });
+}
+
+export function registerAcknowledgeRoute(deps: RouteDependencies, legacy: ServerShim) {
+  const handler: RequestHandler<any, any, any> = async (ctx, request, response) => {
+    const callWithRequest = callWithRequestFactory(deps.elasticsearchService, request);
+    const { watchId, actionId } = request.params;
+
+    try {
+      const hit = await acknowledgeAction(callWithRequest, watchId, actionId);
+      const watchStatusJson = get(hit, 'status');
+      const json = {
+        id: watchId,
+        watchStatusJson,
+      };
+
+      const watchStatus = WatchStatus.fromUpstreamJson(json);
+      return response.ok({
+        body: { watchStatus: watchStatus.downstreamJson },
+      });
+    } catch (e) {
+      // Case: Error from Elasticsearch JS client
+      if (isEsError(e)) {
+        const body = e.statusCode === 404 ? `Watch with id = ${watchId} not found` : e;
+        return response.customError({ statusCode: e.statusCode, body });
+      }
+
+      // Case: default
+      return response.internalError({ body: e });
+    }
+  };
+
+  deps.router.put(
+    {
+      path: '/api/watcher/watch/{watchId}/action/{actionId}/acknowledge',
+      validate: {
+        params: schema.object({
+          watchId: schema.string(),
+          actionId: schema.string(),
+        }),
+      },
+    },
+    licensePreRoutingFactory(legacy, handler)
+  );
+}
diff --git a/x-pack/legacy/plugins/watcher/server/routes/api/watch/action/register_action_routes.js b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/action/register_action_routes.ts
similarity index 61%
rename from x-pack/legacy/plugins/watcher/server/routes/api/watch/action/register_action_routes.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/action/register_action_routes.ts
index 6f2c86664420b..022c844867938 100644
--- a/x-pack/legacy/plugins/watcher/server/routes/api/watch/action/register_action_routes.js
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/action/register_action_routes.ts
@@ -5,7 +5,8 @@
  */
 
 import { registerAcknowledgeRoute } from './register_acknowledge_route';
+import { RouteDependencies, ServerShim } from '../../../../types';
 
-export function registerActionRoutes(server) {
-  registerAcknowledgeRoute(server);
+export function registerActionRoutes(server: RouteDependencies, legacy: ServerShim) {
+  registerAcknowledgeRoute(server, legacy);
 }
diff --git a/x-pack/legacy/plugins/watcher/server/routes/api/watch/index.js b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/index.ts
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/routes/api/watch/index.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/index.ts
diff --git a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_activate_route.ts b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_activate_route.ts
new file mode 100644
index 0000000000000..28c482124aaee
--- /dev/null
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_activate_route.ts
@@ -0,0 +1,66 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { schema } from '@kbn/config-schema';
+import { RequestHandler } from 'src/core/server';
+import { get } from 'lodash';
+import { callWithRequestFactory } from '../../../lib/call_with_request_factory';
+import { isEsError } from '../../../lib/is_es_error';
+import { licensePreRoutingFactory } from '../../../lib/license_pre_routing_factory';
+import { RouteDependencies, ServerShim } from '../../../types';
+// @ts-ignore
+import { WatchStatus } from '../../../models/watch_status';
+
+function activateWatch(callWithRequest: any, watchId: string) {
+  return callWithRequest('watcher.activateWatch', {
+    id: watchId,
+  });
+}
+
+export function registerActivateRoute(deps: RouteDependencies, legacy: ServerShim) {
+  const handler: RequestHandler<any, any, any> = async (ctx, request, response) => {
+    const callWithRequest = callWithRequestFactory(deps.elasticsearchService, request);
+
+    const { watchId } = request.params;
+
+    try {
+      const hit = await activateWatch(callWithRequest, watchId);
+      const watchStatusJson = get(hit, 'status');
+      const json = {
+        id: watchId,
+        watchStatusJson,
+      };
+
+      const watchStatus = WatchStatus.fromUpstreamJson(json);
+      return response.ok({
+        body: {
+          watchStatus: watchStatus.downstreamJson,
+        },
+      });
+    } catch (e) {
+      // Case: Error from Elasticsearch JS client
+      if (isEsError(e)) {
+        const body = e.statusCode === 404 ? `Watch with id = ${watchId} not found` : e;
+        return response.customError({ statusCode: e.statusCode, body });
+      }
+
+      // Case: default
+      return response.internalError({ body: e });
+    }
+  };
+
+  deps.router.put(
+    {
+      path: '/api/watcher/watch/{watchId}/activate',
+      validate: {
+        params: schema.object({
+          watchId: schema.string(),
+        }),
+      },
+    },
+    licensePreRoutingFactory(legacy, handler)
+  );
+}
diff --git a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_deactivate_route.ts b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_deactivate_route.ts
new file mode 100644
index 0000000000000..ac87066379a20
--- /dev/null
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_deactivate_route.ts
@@ -0,0 +1,65 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { schema } from '@kbn/config-schema';
+import { RequestHandler } from 'src/core/server';
+import { get } from 'lodash';
+import { callWithRequestFactory } from '../../../lib/call_with_request_factory';
+import { isEsError } from '../../../lib/is_es_error';
+import { licensePreRoutingFactory } from '../../../lib/license_pre_routing_factory';
+import { RouteDependencies, ServerShim } from '../../../types';
+// @ts-ignore
+import { WatchStatus } from '../../../models/watch_status';
+
+function deactivateWatch(callWithRequest: any, watchId: string) {
+  return callWithRequest('watcher.deactivateWatch', {
+    id: watchId,
+  });
+}
+
+export function registerDeactivateRoute(deps: RouteDependencies, legacy: ServerShim) {
+  const handler: RequestHandler<any, any, any> = async (ctx, request, response) => {
+    const callWithRequest = callWithRequestFactory(deps.elasticsearchService, request);
+
+    const { watchId } = request.params;
+
+    try {
+      const hit = await deactivateWatch(callWithRequest, watchId);
+      const watchStatusJson = get(hit, 'status');
+      const json = {
+        id: watchId,
+        watchStatusJson,
+      };
+
+      const watchStatus = WatchStatus.fromUpstreamJson(json);
+      return response.ok({
+        body: {
+          watchStatus: watchStatus.downstreamJson,
+        },
+      });
+    } catch (e) {
+      // Case: Error from Elasticsearch JS client
+      if (isEsError(e)) {
+        const body = e.statusCode === 404 ? `Watch with id = ${watchId} not found` : e;
+        return response.customError({ statusCode: e.statusCode, body });
+      }
+
+      // Case: default
+      return response.internalError({ body: e });
+    }
+  };
+
+  deps.router.put(
+    {
+      path: '/api/watcher/watch/{watchId}/deactivate',
+      validate: {
+        params: schema.object({
+          watchId: schema.string(),
+        }),
+      },
+    },
+    licensePreRoutingFactory(legacy, handler)
+  );
+}
diff --git a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_delete_route.ts b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_delete_route.ts
new file mode 100644
index 0000000000000..3402cc283dba0
--- /dev/null
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_delete_route.ts
@@ -0,0 +1,52 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { schema } from '@kbn/config-schema';
+import { RequestHandler } from 'src/core/server';
+import { callWithRequestFactory } from '../../../lib/call_with_request_factory';
+import { isEsError } from '../../../lib/is_es_error';
+import { licensePreRoutingFactory } from '../../../lib/license_pre_routing_factory';
+import { RouteDependencies, ServerShim } from '../../../types';
+
+function deleteWatch(callWithRequest: any, watchId: string) {
+  return callWithRequest('watcher.deleteWatch', {
+    id: watchId,
+  });
+}
+
+export function registerDeleteRoute(deps: RouteDependencies, legacy: ServerShim) {
+  const handler: RequestHandler<any, any, any> = async (ctx, request, response) => {
+    const callWithRequest = callWithRequestFactory(deps.elasticsearchService, request);
+
+    const { watchId } = request.params;
+
+    try {
+      await deleteWatch(callWithRequest, watchId);
+      return response.noContent();
+    } catch (e) {
+      // Case: Error from Elasticsearch JS client
+      if (isEsError(e)) {
+        const body = e.statusCode === 404 ? `Watch with id = ${watchId} not found` : e;
+        return response.customError({ statusCode: e.statusCode, body });
+      }
+
+      // Case: default
+      return response.internalError({ body: e });
+    }
+  };
+
+  deps.router.delete(
+    {
+      path: '/api/watcher/watch/{watchId}',
+      validate: {
+        params: schema.object({
+          watchId: schema.string(),
+        }),
+      },
+    },
+    licensePreRoutingFactory(legacy, handler)
+  );
+}
diff --git a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_execute_route.ts b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_execute_route.ts
new file mode 100644
index 0000000000000..f3bce228653fe
--- /dev/null
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_execute_route.ts
@@ -0,0 +1,78 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { schema } from '@kbn/config-schema';
+import { RequestHandler } from 'src/core/server';
+import { get } from 'lodash';
+import { callWithRequestFactory } from '../../../lib/call_with_request_factory';
+import { isEsError } from '../../../lib/is_es_error';
+import { licensePreRoutingFactory } from '../../../lib/license_pre_routing_factory';
+
+import { RouteDependencies, ServerShim } from '../../../types';
+// @ts-ignore
+import { ExecuteDetails } from '../../../models/execute_details';
+// @ts-ignore
+import { Watch } from '../../../models/watch';
+// @ts-ignore
+import { WatchHistoryItem } from '../../../models/watch_history_item';
+
+function executeWatch(callWithRequest: any, executeDetails: any, watchJson: any) {
+  const body = executeDetails;
+  body.watch = watchJson;
+
+  return callWithRequest('watcher.executeWatch', {
+    body,
+  });
+}
+
+export function registerExecuteRoute(deps: RouteDependencies, legacy: ServerShim) {
+  const handler: RequestHandler<any, any, any> = async (ctx, request, response) => {
+    const callWithRequest = callWithRequestFactory(deps.elasticsearchService, request);
+    const executeDetails = ExecuteDetails.fromDownstreamJson(request.body.executeDetails);
+    const watch = Watch.fromDownstreamJson(request.body.watch);
+
+    try {
+      const hit = await executeWatch(callWithRequest, executeDetails.upstreamJson, watch.watchJson);
+      const id = get(hit, '_id');
+      const watchHistoryItemJson = get(hit, 'watch_record');
+      const watchId = get(hit, 'watch_record.watch_id');
+      const json = {
+        id,
+        watchId,
+        watchHistoryItemJson,
+        includeDetails: true,
+      };
+
+      const watchHistoryItem = WatchHistoryItem.fromUpstreamJson(json);
+      return response.ok({
+        body: {
+          watchHistoryItem: watchHistoryItem.downstreamJson,
+        },
+      });
+    } catch (e) {
+      // Case: Error from Elasticsearch JS client
+      if (isEsError(e)) {
+        return response.customError({ statusCode: e.statusCode, body: e });
+      }
+
+      // Case: default
+      return response.internalError({ body: e });
+    }
+  };
+
+  deps.router.put(
+    {
+      path: '/api/watcher/watch/execute',
+      validate: {
+        body: schema.object({
+          executeDetails: schema.object({}, { allowUnknowns: true }),
+          watch: schema.object({}, { allowUnknowns: true }),
+        }),
+      },
+    },
+    licensePreRoutingFactory(legacy, handler)
+  );
+}
diff --git a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_history_route.ts b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_history_route.ts
new file mode 100644
index 0000000000000..e236d7dd642a3
--- /dev/null
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_history_route.ts
@@ -0,0 +1,97 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { schema } from '@kbn/config-schema';
+import { RequestHandler } from 'src/core/server';
+import { get } from 'lodash';
+import { callWithRequestFactory } from '../../../lib/call_with_request_factory';
+import { fetchAllFromScroll } from '../../../lib/fetch_all_from_scroll';
+import { INDEX_NAMES, ES_SCROLL_SETTINGS } from '../../../../../common/constants';
+import { isEsError } from '../../../lib/is_es_error';
+import { licensePreRoutingFactory } from '../../../lib/license_pre_routing_factory';
+import { RouteDependencies, ServerShim } from '../../../types';
+// @ts-ignore
+import { WatchHistoryItem } from '../../../models/watch_history_item';
+
+function fetchHistoryItems(callWithRequest: any, watchId: any, startTime: any) {
+  const params: any = {
+    index: INDEX_NAMES.WATCHER_HISTORY,
+    scroll: ES_SCROLL_SETTINGS.KEEPALIVE,
+    body: {
+      size: ES_SCROLL_SETTINGS.PAGE_SIZE,
+      sort: [{ 'result.execution_time': 'desc' }],
+      query: {
+        bool: {
+          must: [{ term: { watch_id: watchId } }],
+        },
+      },
+    },
+  };
+
+  // Add time range clause to query if startTime is specified
+  if (startTime !== 'all') {
+    const timeRangeQuery = { range: { 'result.execution_time': { gte: startTime } } };
+    params.body.query.bool.must.push(timeRangeQuery);
+  }
+
+  return callWithRequest('search', params).then((response: any) =>
+    fetchAllFromScroll(response, callWithRequest)
+  );
+}
+
+export function registerHistoryRoute(deps: RouteDependencies, legacy: ServerShim) {
+  const handler: RequestHandler<any, any, any> = async (ctx, request, response) => {
+    const callWithRequest = callWithRequestFactory(deps.elasticsearchService, request);
+    const { watchId } = request.params;
+    const { startTime } = request.query;
+
+    try {
+      const hits = await fetchHistoryItems(callWithRequest, watchId, startTime);
+      const watchHistoryItems = hits.map((hit: any) => {
+        const id = get(hit, '_id');
+        const watchHistoryItemJson = get(hit, '_source');
+
+        const opts = { includeDetails: false };
+        return WatchHistoryItem.fromUpstreamJson(
+          {
+            id,
+            watchId,
+            watchHistoryItemJson,
+          },
+          opts
+        );
+      });
+
+      return response.ok({
+        body: {
+          watchHistoryItems: watchHistoryItems.map(
+            (watchHistoryItem: any) => watchHistoryItem.downstreamJson
+          ),
+        },
+      });
+    } catch (e) {
+      // Case: Error from Elasticsearch JS client
+      if (isEsError(e)) {
+        return response.customError({ statusCode: e.statusCode, body: e });
+      }
+
+      // Case: default
+      return response.internalError({ body: e });
+    }
+  };
+
+  deps.router.get(
+    {
+      path: '/api/watcher/watch/{watchId}/history',
+      validate: {
+        params: schema.object({
+          watchId: schema.string(),
+        }),
+      },
+    },
+    licensePreRoutingFactory(legacy, handler)
+  );
+}
diff --git a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_load_route.ts b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_load_route.ts
new file mode 100644
index 0000000000000..7311ad08f73a6
--- /dev/null
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_load_route.ts
@@ -0,0 +1,69 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { schema } from '@kbn/config-schema';
+import { RequestHandler } from 'src/core/server';
+import { get } from 'lodash';
+import { callWithRequestFactory } from '../../../lib/call_with_request_factory';
+import { isEsError } from '../../../lib/is_es_error';
+import { licensePreRoutingFactory } from '../../../lib/license_pre_routing_factory';
+// @ts-ignore
+import { Watch } from '../../../models/watch';
+import { RouteDependencies, ServerShim } from '../../../types';
+
+function fetchWatch(callWithRequest: any, watchId: string) {
+  return callWithRequest('watcher.getWatch', {
+    id: watchId,
+  });
+}
+
+export function registerLoadRoute(deps: RouteDependencies, legacy: ServerShim) {
+  const handler: RequestHandler<any, any, any> = async (ctx, request, response) => {
+    const callWithRequest = callWithRequestFactory(deps.elasticsearchService, request);
+
+    const id = request.params.id;
+
+    try {
+      const hit = await fetchWatch(callWithRequest, id);
+      const watchJson = get(hit, 'watch');
+      const watchStatusJson = get(hit, 'status');
+      const json = {
+        id,
+        watchJson,
+        watchStatusJson,
+      };
+
+      const watch = Watch.fromUpstreamJson(json, {
+        throwExceptions: {
+          Action: false,
+        },
+      });
+      return response.ok({
+        body: { watch: watch.downstreamJson },
+      });
+    } catch (e) {
+      // Case: Error from Elasticsearch JS client
+      if (isEsError(e)) {
+        const body = e.statusCode === 404 ? `Watch with id = ${id} not found` : e;
+        return response.customError({ statusCode: e.statusCode, body });
+      }
+
+      // Case: default
+      return response.internalError({ body: e });
+    }
+  };
+  deps.router.get(
+    {
+      path: '/api/watcher/watch/{id}',
+      validate: {
+        params: schema.object({
+          id: schema.string(),
+        }),
+      },
+    },
+    licensePreRoutingFactory(legacy, handler)
+  );
+}
diff --git a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_save_route.ts b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_save_route.ts
new file mode 100644
index 0000000000000..5d22392d49ed8
--- /dev/null
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_save_route.ts
@@ -0,0 +1,104 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { schema } from '@kbn/config-schema';
+import { RequestHandler } from 'src/core/server';
+import { i18n } from '@kbn/i18n';
+import { WATCH_TYPES } from '../../../../../common/constants';
+import {
+  serializeJsonWatch,
+  serializeThresholdWatch,
+} from '../../../../../common/lib/serialization';
+import { callWithRequestFactory } from '../../../lib/call_with_request_factory';
+import { isEsError } from '../../../lib/is_es_error';
+import { licensePreRoutingFactory } from '../../../lib/license_pre_routing_factory';
+import { RouteDependencies, ServerShim } from '../../../types';
+
+function fetchWatch(callWithRequest: any, watchId: string) {
+  return callWithRequest('watcher.getWatch', {
+    id: watchId,
+  });
+}
+
+function saveWatch(callWithRequest: any, id: string, body: any) {
+  return callWithRequest('watcher.putWatch', {
+    id,
+    body,
+  });
+}
+
+export function registerSaveRoute(deps: RouteDependencies, legacy: ServerShim) {
+  const handler: RequestHandler<any, any, any> = async (ctx, request, response) => {
+    const callWithRequest = callWithRequestFactory(deps.elasticsearchService, request);
+    const { id } = request.params;
+    const { type, isNew, ...watchConfig } = request.body;
+
+    // For new watches, verify watch with the same ID doesn't already exist
+    if (isNew) {
+      try {
+        const existingWatch = await fetchWatch(callWithRequest, id);
+        if (existingWatch.found) {
+          return response.conflict({
+            body: {
+              message: i18n.translate('xpack.watcher.saveRoute.duplicateWatchIdErrorMessage', {
+                defaultMessage: "There is already a watch with ID '{watchId}'.",
+                values: {
+                  watchId: id,
+                },
+              }),
+            },
+          });
+        }
+      } catch (e) {
+        const es404 = isEsError(e) && e.statusCode === 404;
+        if (!es404) {
+          return response.internalError({ body: e });
+        }
+        // Else continue...
+      }
+    }
+
+    let serializedWatch;
+
+    switch (type) {
+      case WATCH_TYPES.JSON:
+        const { name, watch } = watchConfig;
+        serializedWatch = serializeJsonWatch(name, watch);
+        break;
+
+      case WATCH_TYPES.THRESHOLD:
+        serializedWatch = serializeThresholdWatch(watchConfig);
+        break;
+    }
+
+    try {
+      // Create new watch
+      await saveWatch(callWithRequest, id, serializedWatch);
+      return response.noContent();
+    } catch (e) {
+      // Case: Error from Elasticsearch JS client
+      if (isEsError(e)) {
+        return response.customError({ statusCode: e.statusCode, body: e });
+      }
+
+      // Case: default
+      return response.internalError({ body: e });
+    }
+  };
+
+  deps.router.put(
+    {
+      path: '/api/watcher/watch/{id}',
+      validate: {
+        params: schema.object({
+          id: schema.string(),
+        }),
+        body: schema.object({}, { allowUnknowns: true }),
+      },
+    },
+    licensePreRoutingFactory(legacy, handler)
+  );
+}
diff --git a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_visualize_route.ts b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_visualize_route.ts
new file mode 100644
index 0000000000000..d07a264b0b2b1
--- /dev/null
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_visualize_route.ts
@@ -0,0 +1,70 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { schema } from '@kbn/config-schema';
+import { RequestHandler } from 'src/core/server';
+import { callWithRequestFactory } from '../../../lib/call_with_request_factory';
+import { isEsError } from '../../../lib/is_es_error';
+import { licensePreRoutingFactory } from '../../../lib/license_pre_routing_factory';
+import { RouteDependencies, ServerShim } from '../../../types';
+
+// @ts-ignore
+import { Watch } from '../../../models/watch';
+// @ts-ignore
+import { VisualizeOptions } from '../../../models/visualize_options';
+
+function fetchVisualizeData(callWithRequest: any, index: any, body: any) {
+  const params = {
+    index,
+    body,
+    ignoreUnavailable: true,
+    allowNoIndices: true,
+    ignore: [404],
+  };
+
+  return callWithRequest('search', params);
+}
+
+export function registerVisualizeRoute(deps: RouteDependencies, legacy: ServerShim) {
+  const handler: RequestHandler<any, any, any> = async (ctx, request, response) => {
+    const callWithRequest = callWithRequestFactory(deps.elasticsearchService, request);
+    const watch = Watch.fromDownstreamJson(request.body.watch);
+    const options = VisualizeOptions.fromDownstreamJson(request.body.options);
+    const body = watch.getVisualizeQuery(options);
+
+    try {
+      const hits = await fetchVisualizeData(callWithRequest, watch.index, body);
+      const visualizeData = watch.formatVisualizeData(hits);
+
+      return response.ok({
+        body: {
+          visualizeData,
+        },
+      });
+    } catch (e) {
+      // Case: Error from Elasticsearch JS client
+      if (isEsError(e)) {
+        return response.customError({ statusCode: e.statusCode, body: e });
+      }
+
+      // Case: default
+      return response.internalError({ body: e });
+    }
+  };
+
+  deps.router.post(
+    {
+      path: '/api/watcher/watch/visualize',
+      validate: {
+        body: schema.object({
+          watch: schema.object({}, { allowUnknowns: true }),
+          options: schema.object({}, { allowUnknowns: true }),
+        }),
+      },
+    },
+    licensePreRoutingFactory(legacy, handler)
+  );
+}
diff --git a/x-pack/legacy/plugins/watcher/server/routes/api/watch/register_watch_routes.js b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_watch_routes.ts
similarity index 62%
rename from x-pack/legacy/plugins/watcher/server/routes/api/watch/register_watch_routes.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_watch_routes.ts
index 8419f6db7f659..5ecbf3e0d2b46 100644
--- a/x-pack/legacy/plugins/watcher/server/routes/api/watch/register_watch_routes.js
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watch/register_watch_routes.ts
@@ -13,15 +13,16 @@ import { registerActivateRoute } from './register_activate_route';
 import { registerDeactivateRoute } from './register_deactivate_route';
 import { registerVisualizeRoute } from './register_visualize_route';
 import { registerActionRoutes } from './action';
+import { RouteDependencies, ServerShim } from '../../../types';
 
-export function registerWatchRoutes(server) {
-  registerDeleteRoute(server);
-  registerExecuteRoute(server);
-  registerLoadRoute(server);
-  registerSaveRoute(server);
-  registerHistoryRoute(server);
-  registerActivateRoute(server);
-  registerDeactivateRoute(server);
-  registerActionRoutes(server);
-  registerVisualizeRoute(server);
+export function registerWatchRoutes(deps: RouteDependencies, legacy: ServerShim) {
+  registerDeleteRoute(deps, legacy);
+  registerExecuteRoute(deps, legacy);
+  registerLoadRoute(deps, legacy);
+  registerSaveRoute(deps, legacy);
+  registerHistoryRoute(deps, legacy);
+  registerActivateRoute(deps, legacy);
+  registerDeactivateRoute(deps, legacy);
+  registerActionRoutes(deps, legacy);
+  registerVisualizeRoute(deps, legacy);
 }
diff --git a/x-pack/legacy/plugins/watcher/server/routes/api/watches/index.js b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watches/index.ts
similarity index 100%
rename from x-pack/legacy/plugins/watcher/server/routes/api/watches/index.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watches/index.ts
diff --git a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watches/register_delete_route.ts b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watches/register_delete_route.ts
new file mode 100644
index 0000000000000..29c539a0de138
--- /dev/null
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watches/register_delete_route.ts
@@ -0,0 +1,63 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { schema } from '@kbn/config-schema';
+import { RequestHandler } from 'src/core/server';
+import { callWithRequestFactory } from '../../../lib/call_with_request_factory';
+import { licensePreRoutingFactory } from '../../../lib/license_pre_routing_factory';
+import { RouteDependencies, ServerShim } from '../../../types';
+
+function deleteWatches(callWithRequest: any, watchIds: string[]) {
+  const deletePromises = watchIds.map(watchId => {
+    return callWithRequest('watcher.deleteWatch', {
+      id: watchId,
+    })
+      .then((success: Array<{ _id: string }>) => ({ success }))
+      .catch((error: Array<{ _id: string }>) => ({ error }));
+  });
+
+  return Promise.all(deletePromises).then(results => {
+    const errors: Error[] = [];
+    const successes: boolean[] = [];
+    results.forEach(({ success, error }) => {
+      if (success) {
+        successes.push(success._id);
+      } else if (error) {
+        errors.push(error._id);
+      }
+    });
+
+    return {
+      successes,
+      errors,
+    };
+  });
+}
+
+export function registerDeleteRoute(deps: RouteDependencies, legacy: ServerShim) {
+  const handler: RequestHandler<any, any, any> = async (ctx, request, response) => {
+    const callWithRequest = callWithRequestFactory(deps.elasticsearchService, request);
+
+    try {
+      const results = await deleteWatches(callWithRequest, request.body.watchIds);
+      return response.ok({ body: { results } });
+    } catch (e) {
+      return response.internalError({ body: e });
+    }
+  };
+
+  deps.router.post(
+    {
+      path: '/api/watcher/watches/delete',
+      validate: {
+        body: schema.object({
+          watchIds: schema.arrayOf(schema.string()),
+        }),
+      },
+    },
+    licensePreRoutingFactory(legacy, handler)
+  );
+}
diff --git a/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watches/register_list_route.ts b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watches/register_list_route.ts
new file mode 100644
index 0000000000000..b94c29e0f9892
--- /dev/null
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watches/register_list_route.ts
@@ -0,0 +1,86 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { RequestHandler } from 'src/core/server';
+import { get } from 'lodash';
+import { callWithRequestFactory } from '../../../lib/call_with_request_factory';
+import { fetchAllFromScroll } from '../../../lib/fetch_all_from_scroll';
+import { INDEX_NAMES, ES_SCROLL_SETTINGS } from '../../../../../common/constants';
+import { isEsError } from '../../../lib/is_es_error';
+import { licensePreRoutingFactory } from '../../../lib/license_pre_routing_factory';
+import { RouteDependencies, ServerShim } from '../../../types';
+// @ts-ignore
+import { Watch } from '../../../models/watch';
+
+function fetchWatches(callWithRequest: any) {
+  const params = {
+    index: INDEX_NAMES.WATCHES,
+    scroll: ES_SCROLL_SETTINGS.KEEPALIVE,
+    body: {
+      size: ES_SCROLL_SETTINGS.PAGE_SIZE,
+    },
+    ignore: [404],
+  };
+
+  return callWithRequest('search', params).then((response: any) =>
+    fetchAllFromScroll(response, callWithRequest)
+  );
+}
+
+export function registerListRoute(deps: RouteDependencies, legacy: ServerShim) {
+  const handler: RequestHandler<any, any, any> = async (ctx, request, response) => {
+    const callWithRequest = callWithRequestFactory(deps.elasticsearchService, request);
+
+    try {
+      const hits = await fetchWatches(callWithRequest);
+      const watches = hits.map((hit: any) => {
+        const id = get(hit, '_id');
+        const watchJson = get(hit, '_source');
+        const watchStatusJson = get(hit, '_source.status');
+
+        return Watch.fromUpstreamJson(
+          {
+            id,
+            watchJson,
+            watchStatusJson,
+          },
+          {
+            throwExceptions: {
+              Action: false,
+            },
+          }
+        );
+      });
+
+      return response.ok({
+        body: {
+          watches: watches.map((watch: any) => watch.downstreamJson),
+        },
+      });
+    } catch (e) {
+      // Case: Error from Elasticsearch JS client
+      if (isEsError(e)) {
+        return response.customError({
+          statusCode: e.statusCode,
+          body: {
+            message: e.message,
+          },
+        });
+      }
+
+      // Case: default
+      return response.internalError({ body: e });
+    }
+  };
+
+  deps.router.get(
+    {
+      path: '/api/watcher/watches',
+      validate: false,
+    },
+    licensePreRoutingFactory(legacy, handler)
+  );
+}
diff --git a/x-pack/legacy/plugins/watcher/server/routes/api/watches/register_watches_routes.js b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watches/register_watches_routes.ts
similarity index 62%
rename from x-pack/legacy/plugins/watcher/server/routes/api/watches/register_watches_routes.js
rename to x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watches/register_watches_routes.ts
index 5f7ae6a5935bd..dd5f55078e591 100644
--- a/x-pack/legacy/plugins/watcher/server/routes/api/watches/register_watches_routes.js
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/routes/api/watches/register_watches_routes.ts
@@ -6,8 +6,9 @@
 
 import { registerListRoute } from './register_list_route';
 import { registerDeleteRoute } from './register_delete_route';
+import { RouteDependencies, ServerShim } from '../../../types';
 
-export function registerWatchesRoutes(server) {
-  registerListRoute(server);
-  registerDeleteRoute(server);
+export function registerWatchesRoutes(deps: RouteDependencies, legacy: ServerShim) {
+  registerListRoute(deps, legacy);
+  registerDeleteRoute(deps, legacy);
 }
diff --git a/x-pack/legacy/plugins/watcher/server/np_ready/types.ts b/x-pack/legacy/plugins/watcher/server/np_ready/types.ts
new file mode 100644
index 0000000000000..1b566332befdf
--- /dev/null
+++ b/x-pack/legacy/plugins/watcher/server/np_ready/types.ts
@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IRouter, ElasticsearchServiceSetup, IClusterClient } from 'src/core/server';
+import { XPackMainPlugin } from '../../../xpack_main/xpack_main';
+
+export interface ServerShim {
+  route: any;
+  plugins: {
+    xpack_main: XPackMainPlugin;
+    watcher: any;
+  };
+}
+
+export interface RouteDependencies {
+  router: IRouter;
+  elasticsearchService: ElasticsearchServiceSetup;
+  elasticsearch: IClusterClient;
+}
diff --git a/x-pack/legacy/plugins/watcher/server/routes/api/fields/register_list_route.js b/x-pack/legacy/plugins/watcher/server/routes/api/fields/register_list_route.js
deleted file mode 100644
index 7d45d3a2aa60b..0000000000000
--- a/x-pack/legacy/plugins/watcher/server/routes/api/fields/register_list_route.js
+++ /dev/null
@@ -1,60 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { callWithRequestFactory } from '../../../lib/call_with_request_factory';
-import { isEsErrorFactory } from '../../../lib/is_es_error_factory';
-import { wrapEsError, wrapUnknownError } from '../../../lib/error_wrappers';
-import { licensePreRoutingFactory } from '../../../lib/license_pre_routing_factory';
-import { Fields } from '../../../models/fields';
-
-function fetchFields(callWithRequest, indexes) {
-  const params = {
-    index: indexes,
-    fields: ['*'],
-    ignoreUnavailable: true,
-    allowNoIndices: true,
-    ignore: 404
-  };
-
-  return callWithRequest('fieldCaps', params);
-}
-
-export function registerListRoute(server) {
-  const isEsError = isEsErrorFactory(server);
-  const licensePreRouting = licensePreRoutingFactory(server);
-
-  server.route({
-    path: '/api/watcher/fields',
-    method: 'POST',
-    handler: (request) => {
-      const callWithRequest = callWithRequestFactory(server, request);
-      const { indexes } = request.payload;
-
-      return fetchFields(callWithRequest, indexes)
-        .then(response => {
-          const json = (response.status === 404)
-            ? { fields: [] }
-            : response;
-
-          const fields = Fields.fromUpstreamJson(json);
-
-          return fields.downstreamJson;
-        })
-        .catch(err => {
-          // Case: Error from Elasticsearch JS client
-          if (isEsError(err)) {
-            throw wrapEsError(err);
-          }
-
-          // Case: default
-          throw wrapUnknownError(err);
-        });
-    },
-    config: {
-      pre: [ licensePreRouting ]
-    }
-  });
-}
diff --git a/x-pack/legacy/plugins/watcher/server/routes/api/history/index.js b/x-pack/legacy/plugins/watcher/server/routes/api/history/index.js
deleted file mode 100644
index 9a66353c742bc..0000000000000
--- a/x-pack/legacy/plugins/watcher/server/routes/api/history/index.js
+++ /dev/null
@@ -1,7 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-export { registerHistoryRoutes } from './register_history_routes';
diff --git a/x-pack/legacy/plugins/watcher/server/routes/api/history/register_load_route.js b/x-pack/legacy/plugins/watcher/server/routes/api/history/register_load_route.js
deleted file mode 100644
index 1d34be56fcefc..0000000000000
--- a/x-pack/legacy/plugins/watcher/server/routes/api/history/register_load_route.js
+++ /dev/null
@@ -1,78 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { get } from 'lodash';
-import { callWithRequestFactory } from '../../../lib/call_with_request_factory';
-import { WatchHistoryItem } from '../../../models/watch_history_item';
-import { isEsErrorFactory } from '../../../lib/is_es_error_factory';
-import { wrapEsError, wrapUnknownError, wrapCustomError } from '../../../lib/error_wrappers';
-import { INDEX_NAMES } from '../../../../common/constants';
-import { licensePreRoutingFactory } from'../../../lib/license_pre_routing_factory';
-
-function fetchHistoryItem(callWithRequest, watchHistoryItemId) {
-  return callWithRequest('search', {
-    index: INDEX_NAMES.WATCHER_HISTORY,
-    body: {
-      query: {
-        bool: {
-          must: [
-            { term: { '_id': watchHistoryItemId } },
-          ]
-        }
-      }
-    }
-  });
-}
-
-export function registerLoadRoute(server) {
-  const isEsError = isEsErrorFactory(server);
-  const licensePreRouting = licensePreRoutingFactory(server);
-
-  server.route({
-    path: '/api/watcher/history/{id}',
-    method: 'GET',
-    handler: (request) => {
-      const callWithRequest = callWithRequestFactory(server, request);
-      const id = request.params.id;
-
-      return fetchHistoryItem(callWithRequest, id)
-        .then((responseFromES) => {
-          const hit = get(responseFromES, 'hits.hits[0]');
-          if (!hit) {
-            throw wrapCustomError(
-              new Error(`Watch History Item with id = ${id} not found`), 404
-            );
-          }
-
-          const watchHistoryItemJson = get(hit, '_source');
-          const watchId = get(hit, '_source.watch_id');
-          const json = {
-            id,
-            watchId,
-            watchHistoryItemJson,
-            includeDetails: true
-          };
-
-          const watchHistoryItem = WatchHistoryItem.fromUpstreamJson(json);
-          return {
-            watchHistoryItem: watchHistoryItem.downstreamJson
-          };
-        })
-        .catch(err => {
-          // Case: Error from Elasticsearch JS client
-          if (isEsError(err)) {
-            throw wrapEsError(err);
-          }
-
-          // Case: default
-          throw wrapUnknownError(err);
-        });
-    },
-    config: {
-      pre: [ licensePreRouting ]
-    }
-  });
-}
diff --git a/x-pack/legacy/plugins/watcher/server/routes/api/indices/register_get_route.js b/x-pack/legacy/plugins/watcher/server/routes/api/indices/register_get_route.js
deleted file mode 100644
index 86de6f3da7ad5..0000000000000
--- a/x-pack/legacy/plugins/watcher/server/routes/api/indices/register_get_route.js
+++ /dev/null
@@ -1,89 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { reduce, size } from 'lodash';
-import { callWithRequestFactory } from '../../../lib/call_with_request_factory';
-import { isEsErrorFactory } from '../../../lib/is_es_error_factory';
-import { wrapEsError, wrapUnknownError } from '../../../lib/error_wrappers';
-import { licensePreRoutingFactory } from'../../../lib/license_pre_routing_factory';
-
-function getIndexNamesFromAliasesResponse(json) {
-  return reduce(json, (list, { aliases }, indexName) => {
-    list.push(indexName);
-    if (size(aliases) > 0) {
-      list.push(...Object.keys(aliases));
-    }
-    return list;
-  }, []);
-}
-
-function getIndices(callWithRequest, pattern, limit = 10) {
-  return callWithRequest('indices.getAlias', {
-    index: pattern,
-    ignore: [404]
-  })
-    .then(aliasResult => {
-      if (aliasResult.status !== 404) {
-        const indicesFromAliasResponse = getIndexNamesFromAliasesResponse(aliasResult);
-        return indicesFromAliasResponse.slice(0, limit);
-      }
-
-      const params = {
-        index: pattern,
-        ignore: [404],
-        body: {
-          size: 0, // no hits
-          aggs: {
-            indices: {
-              terms: {
-                field: '_index',
-                size: limit,
-              }
-            }
-          }
-        }
-      };
-
-      return callWithRequest('search', params)
-        .then(response => {
-          if (response.status === 404 || !response.aggregations) {
-            return [];
-          }
-          return response.aggregations.indices.buckets.map(bucket => bucket.key);
-        });
-    });
-}
-
-export function registerGetRoute(server) {
-  const isEsError = isEsErrorFactory(server);
-  const licensePreRouting = licensePreRoutingFactory(server);
-
-  server.route({
-    path: '/api/watcher/indices',
-    method: 'POST',
-    handler: (request) => {
-      const callWithRequest = callWithRequestFactory(server, request);
-      const { pattern } = request.payload;
-
-      return getIndices(callWithRequest, pattern)
-        .then(indices => {
-          return { indices };
-        })
-        .catch(err => {
-          // Case: Error from Elasticsearch JS client
-          if (isEsError(err)) {
-            throw wrapEsError(err);
-          }
-
-          // Case: default
-          throw wrapUnknownError(err);
-        });
-    },
-    config: {
-      pre: [ licensePreRouting ]
-    }
-  });
-}
diff --git a/x-pack/legacy/plugins/watcher/server/routes/api/settings/register_load_route.js b/x-pack/legacy/plugins/watcher/server/routes/api/settings/register_load_route.js
deleted file mode 100644
index 65c961c8c82f2..0000000000000
--- a/x-pack/legacy/plugins/watcher/server/routes/api/settings/register_load_route.js
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { callWithInternalUserFactory } from '../../../lib/call_with_internal_user_factory';
-import { isEsErrorFactory } from '../../../lib/is_es_error_factory';
-import { wrapEsError, wrapUnknownError } from '../../../lib/error_wrappers';
-import { licensePreRoutingFactory } from'../../../lib/license_pre_routing_factory';
-import { Settings } from '../../../models/settings';
-
-function fetchClusterSettings(callWithInternalUser) {
-  return callWithInternalUser('cluster.getSettings', {
-    includeDefaults: true,
-    filterPath: '**.xpack.notification'
-  });
-}
-
-export function registerLoadRoute(server) {
-  const isEsError = isEsErrorFactory(server);
-  const licensePreRouting = licensePreRoutingFactory(server);
-  const callWithInternalUser = callWithInternalUserFactory(server);
-
-  server.route({
-    path: '/api/watcher/settings',
-    method: 'GET',
-    handler: () => {
-      return fetchClusterSettings(callWithInternalUser)
-        .then((settings) => {
-          return Settings.fromUpstreamJson(settings).downstreamJson;
-        })
-        .catch(err => {
-          // Case: Error from Elasticsearch JS client
-          if (isEsError(err)) {
-            throw wrapEsError(err);
-          }
-
-          // Case: default
-          throw wrapUnknownError(err);
-        });
-    },
-    config: {
-      pre: [ licensePreRouting ]
-    }
-  });
-}
diff --git a/x-pack/legacy/plugins/watcher/server/routes/api/watch/action/register_acknowledge_route.js b/x-pack/legacy/plugins/watcher/server/routes/api/watch/action/register_acknowledge_route.js
deleted file mode 100644
index ffecebf805cf6..0000000000000
--- a/x-pack/legacy/plugins/watcher/server/routes/api/watch/action/register_acknowledge_route.js
+++ /dev/null
@@ -1,63 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { get } from 'lodash';
-import { callWithRequestFactory } from '../../../../lib/call_with_request_factory';
-import { isEsErrorFactory } from '../../../../lib/is_es_error_factory';
-import { wrapEsError, wrapUnknownError } from '../../../../lib/error_wrappers';
-import { WatchStatus } from '../../../../models/watch_status';
-import { licensePreRoutingFactory } from'../../../../lib/license_pre_routing_factory';
-
-export function registerAcknowledgeRoute(server) {
-
-  const isEsError = isEsErrorFactory(server);
-  const licensePreRouting = licensePreRoutingFactory(server);
-
-  server.route({
-    path: '/api/watcher/watch/{watchId}/action/{actionId}/acknowledge',
-    method: 'PUT',
-    handler: (request) => {
-      const callWithRequest = callWithRequestFactory(server, request);
-      const { watchId, actionId } = request.params;
-
-      return acknowledgeAction(callWithRequest, watchId, actionId)
-        .then(hit => {
-          const watchStatusJson = get(hit, 'status');
-          const json = {
-            id: watchId,
-            watchStatusJson: watchStatusJson
-          };
-
-          const watchStatus = WatchStatus.fromUpstreamJson(json);
-          return {
-            watchStatus: watchStatus.downstreamJson
-          };
-        })
-        .catch(err => {
-          // Case: Error from Elasticsearch JS client
-          if (isEsError(err)) {
-            const statusCodeToMessageMap = {
-              404: `Watch with id = ${watchId} not found`
-            };
-            throw wrapEsError(err, statusCodeToMessageMap);
-          }
-
-          // Case: default
-          throw wrapUnknownError(err);
-        });
-    },
-    config: {
-      pre: [ licensePreRouting ]
-    }
-  });
-}
-
-function acknowledgeAction(callWithRequest, watchId, actionId) {
-  return callWithRequest('watcher.ackWatch', {
-    id: watchId,
-    action: actionId
-  });
-}
diff --git a/x-pack/legacy/plugins/watcher/server/routes/api/watch/register_activate_route.js b/x-pack/legacy/plugins/watcher/server/routes/api/watch/register_activate_route.js
deleted file mode 100644
index ea669a16a0172..0000000000000
--- a/x-pack/legacy/plugins/watcher/server/routes/api/watch/register_activate_route.js
+++ /dev/null
@@ -1,63 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { get } from 'lodash';
-import { callWithRequestFactory } from '../../../lib/call_with_request_factory';
-import { isEsErrorFactory } from '../../../lib/is_es_error_factory';
-import { wrapEsError, wrapUnknownError } from '../../../lib/error_wrappers';
-import { licensePreRoutingFactory } from'../../../lib/license_pre_routing_factory';
-import { WatchStatus } from '../../../models/watch_status';
-
-function activateWatch(callWithRequest, watchId) {
-  return callWithRequest('watcher.activateWatch', {
-    id: watchId
-  });
-}
-
-export function registerActivateRoute(server) {
-
-  const isEsError = isEsErrorFactory(server);
-  const licensePreRouting = licensePreRoutingFactory(server);
-
-  server.route({
-    path: '/api/watcher/watch/{watchId}/activate',
-    method: 'PUT',
-    handler: (request) => {
-      const callWithRequest = callWithRequestFactory(server, request);
-
-      const { watchId } = request.params;
-
-      return activateWatch(callWithRequest, watchId)
-        .then(hit => {
-          const watchStatusJson = get(hit, 'status');
-          const json = {
-            id: watchId,
-            watchStatusJson: watchStatusJson
-          };
-
-          const watchStatus = WatchStatus.fromUpstreamJson(json);
-          return {
-            watchStatus: watchStatus.downstreamJson
-          };
-        })
-        .catch(err => {
-          // Case: Error from Elasticsearch JS client
-          if (isEsError(err)) {
-            const statusCodeToMessageMap = {
-              404: `Watch with id = ${watchId} not found`
-            };
-            throw wrapEsError(err, statusCodeToMessageMap);
-          }
-
-          // Case: default
-          throw wrapUnknownError(err);
-        });
-    },
-    config: {
-      pre: [ licensePreRouting ]
-    }
-  });
-}
diff --git a/x-pack/legacy/plugins/watcher/server/routes/api/watch/register_deactivate_route.js b/x-pack/legacy/plugins/watcher/server/routes/api/watch/register_deactivate_route.js
deleted file mode 100644
index 2411290e2034a..0000000000000
--- a/x-pack/legacy/plugins/watcher/server/routes/api/watch/register_deactivate_route.js
+++ /dev/null
@@ -1,63 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { get } from 'lodash';
-import { callWithRequestFactory } from '../../../lib/call_with_request_factory';
-import { isEsErrorFactory } from '../../../lib/is_es_error_factory';
-import { wrapEsError, wrapUnknownError } from '../../../lib/error_wrappers';
-import { licensePreRoutingFactory } from'../../../lib/license_pre_routing_factory';
-import { WatchStatus } from '../../../models/watch_status';
-
-function deactivateWatch(callWithRequest, watchId) {
-  return callWithRequest('watcher.deactivateWatch', {
-    id: watchId
-  });
-}
-
-export function registerDeactivateRoute(server) {
-
-  const isEsError = isEsErrorFactory(server);
-  const licensePreRouting = licensePreRoutingFactory(server);
-
-  server.route({
-    path: '/api/watcher/watch/{watchId}/deactivate',
-    method: 'PUT',
-    handler: (request) => {
-      const callWithRequest = callWithRequestFactory(server, request);
-
-      const { watchId } = request.params;
-
-      return deactivateWatch(callWithRequest, watchId)
-        .then(hit => {
-          const watchStatusJson = get(hit, 'status');
-          const json = {
-            id: watchId,
-            watchStatusJson: watchStatusJson
-          };
-
-          const watchStatus = WatchStatus.fromUpstreamJson(json);
-          return {
-            watchStatus: watchStatus.downstreamJson
-          };
-        })
-        .catch(err => {
-          // Case: Error from Elasticsearch JS client
-          if (isEsError(err)) {
-            const statusCodeToMessageMap = {
-              404: `Watch with id = ${watchId} not found`
-            };
-            throw wrapEsError(err, statusCodeToMessageMap);
-          }
-
-          // Case: default
-          throw wrapUnknownError(err);
-        });
-    },
-    config: {
-      pre: [ licensePreRouting ]
-    }
-  });
-}
diff --git a/x-pack/legacy/plugins/watcher/server/routes/api/watch/register_delete_route.js b/x-pack/legacy/plugins/watcher/server/routes/api/watch/register_delete_route.js
deleted file mode 100644
index dc3b015dffa90..0000000000000
--- a/x-pack/legacy/plugins/watcher/server/routes/api/watch/register_delete_route.js
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { callWithRequestFactory } from '../../../lib/call_with_request_factory';
-import { isEsErrorFactory } from '../../../lib/is_es_error_factory';
-import { wrapEsError, wrapUnknownError } from '../../../lib/error_wrappers';
-import { licensePreRoutingFactory } from'../../../lib/license_pre_routing_factory';
-
-function deleteWatch(callWithRequest, watchId) {
-  return callWithRequest('watcher.deleteWatch', {
-    id: watchId
-  });
-}
-
-export function registerDeleteRoute(server) {
-
-  const isEsError = isEsErrorFactory(server);
-  const licensePreRouting = licensePreRoutingFactory(server);
-
-  server.route({
-    path: '/api/watcher/watch/{watchId}',
-    method: 'DELETE',
-    handler: (request, h) => {
-      const callWithRequest = callWithRequestFactory(server, request);
-
-      const { watchId } = request.params;
-
-      return deleteWatch(callWithRequest, watchId)
-        .then(() => h.response().code(204))
-        .catch(err => {
-          // Case: Error from Elasticsearch JS client
-          if (isEsError(err)) {
-            const statusCodeToMessageMap = {
-              404: `Watch with id = ${watchId} not found`
-            };
-            throw wrapEsError(err, statusCodeToMessageMap);
-          }
-
-          // Case: default
-          throw wrapUnknownError(err);
-        });
-    },
-    config: {
-      pre: [ licensePreRouting ]
-    }
-  });
-}
diff --git a/x-pack/legacy/plugins/watcher/server/routes/api/watch/register_execute_route.js b/x-pack/legacy/plugins/watcher/server/routes/api/watch/register_execute_route.js
deleted file mode 100644
index f378829147280..0000000000000
--- a/x-pack/legacy/plugins/watcher/server/routes/api/watch/register_execute_route.js
+++ /dev/null
@@ -1,69 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { get } from 'lodash';
-import { callWithRequestFactory } from '../../../lib/call_with_request_factory';
-import { ExecuteDetails } from '../../../models/execute_details';
-import { Watch } from '../../../models/watch';
-import { WatchHistoryItem } from '../../../models/watch_history_item';
-import { isEsErrorFactory } from '../../../lib/is_es_error_factory';
-import { wrapEsError, wrapUnknownError } from '../../../lib/error_wrappers';
-import { licensePreRoutingFactory } from'../../../lib/license_pre_routing_factory';
-
-function executeWatch(callWithRequest, executeDetails, watchJson) {
-  const body = executeDetails;
-  body.watch = watchJson;
-
-  return callWithRequest('watcher.executeWatch', {
-    body
-  });
-}
-
-export function registerExecuteRoute(server) {
-  const isEsError = isEsErrorFactory(server);
-  const licensePreRouting = licensePreRoutingFactory(server);
-
-  server.route({
-    path: '/api/watcher/watch/execute',
-    method: 'PUT',
-    handler: (request) => {
-      const callWithRequest = callWithRequestFactory(server, request);
-      const executeDetails = ExecuteDetails.fromDownstreamJson(request.payload.executeDetails);
-      const watch = Watch.fromDownstreamJson(request.payload.watch);
-
-      return executeWatch(callWithRequest, executeDetails.upstreamJson, watch.watchJson)
-        .then((hit) => {
-          const id = get(hit, '_id');
-          const watchHistoryItemJson = get(hit, 'watch_record');
-          const watchId = get(hit, 'watch_record.watch_id');
-          const json = {
-            id,
-            watchId,
-            watchHistoryItemJson,
-            includeDetails: true
-          };
-
-          const watchHistoryItem = WatchHistoryItem.fromUpstreamJson(json);
-          return {
-            watchHistoryItem: watchHistoryItem.downstreamJson
-          };
-        })
-        .catch(err => {
-
-          // Case: Error from Elasticsearch JS client
-          if (isEsError(err)) {
-            throw wrapEsError(err);
-          }
-
-          // Case: default
-          throw wrapUnknownError(err);
-        });
-    },
-    config: {
-      pre: [ licensePreRouting ]
-    }
-  });
-}
diff --git a/x-pack/legacy/plugins/watcher/server/routes/api/watch/register_history_route.js b/x-pack/legacy/plugins/watcher/server/routes/api/watch/register_history_route.js
deleted file mode 100644
index 702cf8a2b64e2..0000000000000
--- a/x-pack/legacy/plugins/watcher/server/routes/api/watch/register_history_route.js
+++ /dev/null
@@ -1,89 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { get } from 'lodash';
-import { callWithRequestFactory } from '../../../lib/call_with_request_factory';
-import { fetchAllFromScroll } from '../../../lib/fetch_all_from_scroll';
-import { INDEX_NAMES, ES_SCROLL_SETTINGS } from '../../../../common/constants';
-import { WatchHistoryItem } from '../../../models/watch_history_item';
-import { isEsErrorFactory } from '../../../lib/is_es_error_factory';
-import { wrapEsError, wrapUnknownError } from '../../../lib/error_wrappers';
-import { licensePreRoutingFactory } from'../../../lib/license_pre_routing_factory';
-
-function fetchHistoryItems(callWithRequest, watchId, startTime) {
-  const params = {
-    index: INDEX_NAMES.WATCHER_HISTORY,
-    scroll: ES_SCROLL_SETTINGS.KEEPALIVE,
-    body: {
-      size: ES_SCROLL_SETTINGS.PAGE_SIZE,
-      sort: [
-        { 'result.execution_time': 'desc' }
-      ],
-      query: {
-        bool: {
-          must: [
-            { term: { 'watch_id': watchId } },
-          ]
-        }
-      }
-    }
-  };
-
-  // Add time range clause to query if startTime is specified
-  if (startTime !== 'all') {
-    const timeRangeQuery = { range: { 'result.execution_time': { gte: startTime } } };
-    params.body.query.bool.must.push(timeRangeQuery);
-  }
-
-  return callWithRequest('search', params)
-    .then(response => fetchAllFromScroll(response, callWithRequest));
-}
-
-export function registerHistoryRoute(server) {
-  const isEsError = isEsErrorFactory(server);
-  const licensePreRouting = licensePreRoutingFactory(server);
-
-  server.route({
-    path: '/api/watcher/watch/{watchId}/history',
-    method: 'GET',
-    handler: (request) => {
-      const callWithRequest = callWithRequestFactory(server, request);
-      const { watchId } = request.params;
-      const { startTime } = request.query;
-
-      return fetchHistoryItems(callWithRequest, watchId, startTime)
-        .then(hits => {
-          const watchHistoryItems = hits.map(hit => {
-            const id = get(hit, '_id');
-            const watchHistoryItemJson = get(hit, '_source');
-
-            const opts = { includeDetails: false };
-            return WatchHistoryItem.fromUpstreamJson({
-              id,
-              watchId,
-              watchHistoryItemJson
-            }, opts);
-          });
-
-          return {
-            watchHistoryItems: watchHistoryItems.map(watchHistoryItem => watchHistoryItem.downstreamJson)
-          };
-        })
-        .catch(err => {
-          // Case: Error from Elasticsearch JS client
-          if (isEsError(err)) {
-            throw wrapEsError(err);
-          }
-
-          // Case: default
-          throw wrapUnknownError(err);
-        });
-    },
-    config: {
-      pre: [ licensePreRouting ]
-    }
-  });
-}
diff --git a/x-pack/legacy/plugins/watcher/server/routes/api/watch/register_load_route.js b/x-pack/legacy/plugins/watcher/server/routes/api/watch/register_load_route.js
deleted file mode 100644
index e5210dbff3567..0000000000000
--- a/x-pack/legacy/plugins/watcher/server/routes/api/watch/register_load_route.js
+++ /dev/null
@@ -1,68 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { callWithRequestFactory } from '../../../lib/call_with_request_factory';
-import { get } from 'lodash';
-import { Watch } from '../../../models/watch';
-import { isEsErrorFactory } from '../../../lib/is_es_error_factory';
-import { wrapEsError, wrapUnknownError } from '../../../lib/error_wrappers';
-import { licensePreRoutingFactory } from'../../../lib/license_pre_routing_factory';
-
-function fetchWatch(callWithRequest, watchId) {
-  return callWithRequest('watcher.getWatch', {
-    id: watchId
-  });
-}
-
-export function registerLoadRoute(server) {
-  const isEsError = isEsErrorFactory(server);
-  const licensePreRouting = licensePreRoutingFactory(server);
-
-  server.route({
-    path: '/api/watcher/watch/{id}',
-    method: 'GET',
-    handler: (request) => {
-      const callWithRequest = callWithRequestFactory(server, request);
-
-      const id = request.params.id;
-
-      return fetchWatch(callWithRequest, id)
-        .then(hit => {
-          const watchJson = get(hit, 'watch');
-          const watchStatusJson = get(hit, 'status');
-          const json = {
-            id,
-            watchJson,
-            watchStatusJson,
-          };
-
-          const watch = Watch.fromUpstreamJson(json, {
-            throwExceptions: {
-              Action: false,
-            },
-          });
-          return {
-            watch: watch.downstreamJson
-          };
-        })
-        .catch(err => {
-          // Case: Error from Elasticsearch JS client
-          if (isEsError(err)) {
-            const statusCodeToMessageMap = {
-              404: `Watch with id = ${id} not found`,
-            };
-            throw wrapEsError(err, statusCodeToMessageMap);
-          }
-
-          // Case: default
-          throw wrapUnknownError(err);
-        });
-    },
-    config: {
-      pre: [ licensePreRouting ]
-    }
-  });
-}
diff --git a/x-pack/legacy/plugins/watcher/server/routes/api/watch/register_save_route.js b/x-pack/legacy/plugins/watcher/server/routes/api/watch/register_save_route.js
deleted file mode 100644
index 3cbb0a4e1cc47..0000000000000
--- a/x-pack/legacy/plugins/watcher/server/routes/api/watch/register_save_route.js
+++ /dev/null
@@ -1,94 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { WATCH_TYPES } from '../../../../common/constants';
-import { serializeJsonWatch, serializeThresholdWatch } from '../../../../common/lib/serialization';
-import { callWithRequestFactory } from '../../../lib/call_with_request_factory';
-import { isEsErrorFactory } from '../../../lib/is_es_error_factory';
-import { wrapEsError, wrapUnknownError, wrapCustomError } from '../../../lib/error_wrappers';
-import { licensePreRoutingFactory } from'../../../lib/license_pre_routing_factory';
-import { i18n } from '@kbn/i18n';
-
-function fetchWatch(callWithRequest, watchId) {
-  return callWithRequest('watcher.getWatch', {
-    id: watchId
-  });
-}
-
-function saveWatch(callWithRequest, id, body) {
-  return callWithRequest('watcher.putWatch', {
-    id,
-    body,
-  });
-}
-
-export function registerSaveRoute(server) {
-  const isEsError = isEsErrorFactory(server);
-  const licensePreRouting = licensePreRoutingFactory(server);
-
-  server.route({
-    path: '/api/watcher/watch/{id}',
-    method: 'PUT',
-    handler: async (request) => {
-      const callWithRequest = callWithRequestFactory(server, request);
-      const { id, type, isNew, ...watchConfig } = request.payload;
-
-      // For new watches, verify watch with the same ID doesn't already exist
-      if (isNew) {
-        const conflictError = wrapCustomError(
-          new Error(i18n.translate('xpack.watcher.saveRoute.duplicateWatchIdErrorMessage', {
-            defaultMessage: 'There is already a watch with ID \'{watchId}\'.',
-            values: {
-              watchId: id,
-            }
-          })),
-          409
-        );
-
-        try {
-          const existingWatch = await fetchWatch(callWithRequest, id);
-
-          if (existingWatch.found) {
-            throw conflictError;
-          }
-        } catch (e) {
-          // Rethrow conflict error but silently swallow all others
-          if (e === conflictError) {
-            throw e;
-          }
-        }
-      }
-
-      let serializedWatch;
-
-      switch (type) {
-        case WATCH_TYPES.JSON:
-          const { name, watch } = watchConfig;
-          serializedWatch = serializeJsonWatch(name, watch);
-          break;
-
-        case WATCH_TYPES.THRESHOLD:
-          serializedWatch = serializeThresholdWatch(watchConfig);
-          break;
-      }
-
-      // Create new watch
-      return saveWatch(callWithRequest, id, serializedWatch)
-        .catch(err => {
-          // Case: Error from Elasticsearch JS client
-          if (isEsError(err)) {
-            throw wrapEsError(err);
-          }
-
-          // Case: default
-          throw wrapUnknownError(err);
-        });
-    },
-    config: {
-      pre: [ licensePreRouting ]
-    }
-  });
-}
diff --git a/x-pack/legacy/plugins/watcher/server/routes/api/watch/register_visualize_route.js b/x-pack/legacy/plugins/watcher/server/routes/api/watch/register_visualize_route.js
deleted file mode 100644
index ff9d8f9775d5e..0000000000000
--- a/x-pack/legacy/plugins/watcher/server/routes/api/watch/register_visualize_route.js
+++ /dev/null
@@ -1,62 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { callWithRequestFactory } from '../../../lib/call_with_request_factory';
-import { Watch } from '../../../models/watch';
-import { VisualizeOptions } from '../../../models/visualize_options';
-import { isEsErrorFactory } from '../../../lib/is_es_error_factory';
-import { wrapEsError, wrapUnknownError } from '../../../lib/error_wrappers';
-import { licensePreRoutingFactory } from'../../../lib/license_pre_routing_factory';
-
-function fetchVisualizeData(callWithRequest, index, body) {
-  const params = {
-    index,
-    body,
-    ignoreUnavailable: true,
-    allowNoIndices: true,
-    ignore: [404]
-  };
-
-  return callWithRequest('search', params);
-}
-
-export function registerVisualizeRoute(server) {
-  const isEsError = isEsErrorFactory(server);
-  const licensePreRouting = licensePreRoutingFactory(server);
-
-  server.route({
-    path: '/api/watcher/watch/visualize',
-    method: 'POST',
-    handler: (request) => {
-      const callWithRequest = callWithRequestFactory(server, request);
-      const watch = Watch.fromDownstreamJson(request.payload.watch);
-      const options = VisualizeOptions.fromDownstreamJson(request.payload.options);
-      const body = watch.getVisualizeQuery(options);
-
-      return fetchVisualizeData(callWithRequest, watch.index, body)
-        .then(hits => {
-          const visualizeData = watch.formatVisualizeData(hits);
-
-          return {
-            visualizeData
-          };
-        })
-        .catch(err => {
-
-          // Case: Error from Elasticsearch JS client
-          if (isEsError(err)) {
-            throw wrapEsError(err);
-          }
-
-          // Case: default
-          throw wrapUnknownError(err);
-        });
-    },
-    config: {
-      pre: [ licensePreRouting ]
-    }
-  });
-}
diff --git a/x-pack/legacy/plugins/watcher/server/routes/api/watches/register_delete_route.js b/x-pack/legacy/plugins/watcher/server/routes/api/watches/register_delete_route.js
deleted file mode 100644
index a0bbfb954b755..0000000000000
--- a/x-pack/legacy/plugins/watcher/server/routes/api/watches/register_delete_route.js
+++ /dev/null
@@ -1,58 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { callWithRequestFactory } from '../../../lib/call_with_request_factory';
-import { wrapUnknownError } from '../../../lib/error_wrappers';
-import { licensePreRoutingFactory } from '../../../lib/license_pre_routing_factory';
-
-function deleteWatches(callWithRequest, watchIds) {
-  const deletePromises = watchIds.map(watchId => {
-    return callWithRequest('watcher.deleteWatch', {
-      id: watchId,
-    })
-      .then(success => ({ success }))
-      .catch(error => ({ error }));
-  });
-
-  return Promise.all(deletePromises).then(results => {
-    const errors = [];
-    const successes = [];
-    results.forEach(({ success, error }) => {
-      if (success) {
-        successes.push(success._id);
-      } else if (error) {
-        errors.push(error._id);
-      }
-    });
-
-    return {
-      successes,
-      errors,
-    };
-  });
-}
-
-export function registerDeleteRoute(server) {
-  const licensePreRouting = licensePreRoutingFactory(server);
-
-  server.route({
-    path: '/api/watcher/watches/delete',
-    method: 'POST',
-    handler: async request => {
-      const callWithRequest = callWithRequestFactory(server, request);
-
-      try {
-        const results = await deleteWatches(callWithRequest, request.payload.watchIds);
-        return { results };
-      } catch (err) {
-        throw wrapUnknownError(err);
-      }
-    },
-    config: {
-      pre: [licensePreRouting],
-    },
-  });
-}
diff --git a/x-pack/legacy/plugins/watcher/server/routes/api/watches/register_list_route.js b/x-pack/legacy/plugins/watcher/server/routes/api/watches/register_list_route.js
deleted file mode 100644
index 2a617e275d1ee..0000000000000
--- a/x-pack/legacy/plugins/watcher/server/routes/api/watches/register_list_route.js
+++ /dev/null
@@ -1,79 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { get } from 'lodash';
-import { callWithRequestFactory } from '../../../lib/call_with_request_factory';
-import { fetchAllFromScroll } from '../../../lib/fetch_all_from_scroll';
-import { INDEX_NAMES, ES_SCROLL_SETTINGS } from '../../../../common/constants';
-import { Watch } from '../../../models/watch';
-import { isEsErrorFactory } from '../../../lib/is_es_error_factory';
-import { wrapEsError, wrapUnknownError } from '../../../lib/error_wrappers';
-import { licensePreRoutingFactory } from'../../../lib/license_pre_routing_factory';
-
-function fetchWatches(callWithRequest) {
-  const params = {
-    index: INDEX_NAMES.WATCHES,
-    scroll: ES_SCROLL_SETTINGS.KEEPALIVE,
-    body: {
-      size: ES_SCROLL_SETTINGS.PAGE_SIZE,
-    },
-    ignore: [404]
-  };
-
-  return callWithRequest('search', params)
-    .then(response => fetchAllFromScroll(response, callWithRequest));
-}
-
-export function registerListRoute(server) {
-  const isEsError = isEsErrorFactory(server);
-  const licensePreRouting = licensePreRoutingFactory(server);
-
-  server.route({
-    path: '/api/watcher/watches',
-    method: 'GET',
-    handler: (request) => {
-      const callWithRequest = callWithRequestFactory(server, request);
-
-      return fetchWatches(callWithRequest)
-        .then(hits => {
-          const watches = hits.map(hit => {
-            const id = get(hit, '_id');
-            const watchJson = get(hit, '_source');
-            const watchStatusJson = get(hit, '_source.status');
-
-            return Watch.fromUpstreamJson(
-              {
-                id,
-                watchJson,
-                watchStatusJson,
-              },
-              {
-                throwExceptions: {
-                  Action: false,
-                },
-              }
-            );
-          });
-
-          return {
-            watches: watches.map(watch => watch.downstreamJson)
-          };
-        })
-        .catch(err => {
-          // Case: Error from Elasticsearch JS client
-          if (isEsError(err)) {
-            throw wrapEsError(err);
-          }
-
-          // Case: default
-          throw wrapUnknownError(err);
-        });
-    },
-    config: {
-      pre: [ licensePreRouting ]
-    }
-  });
-}

From 248904ec87ed3dd69b5efd843ef698c3e7410ffe Mon Sep 17 00:00:00 2001
From: Robert Oskamp <robert.oskamp@elastic.co>
Date: Wed, 11 Dec 2019 11:05:36 +0100
Subject: [PATCH 20/24] [ML] API integration tests - initial tests for bucket
 span estimator (#52636)

This PR adds basic API integration tests for the bucket span estimator.
---
 x-pack/test/api_integration/apis/index.js     |  1 +
 .../apis/ml/bucket_span_estimator.ts          | 90 +++++++++++++++++++
 x-pack/test/api_integration/apis/ml/index.ts  | 15 ++++
 3 files changed, 106 insertions(+)
 create mode 100644 x-pack/test/api_integration/apis/ml/bucket_span_estimator.ts
 create mode 100644 x-pack/test/api_integration/apis/ml/index.ts

diff --git a/x-pack/test/api_integration/apis/index.js b/x-pack/test/api_integration/apis/index.js
index ed0e6488320d4..fd700b41df563 100644
--- a/x-pack/test/api_integration/apis/index.js
+++ b/x-pack/test/api_integration/apis/index.js
@@ -28,5 +28,6 @@ export default function ({ loadTestFile }) {
     loadTestFile(require.resolve('./short_urls'));
     loadTestFile(require.resolve('./lens'));
     loadTestFile(require.resolve('./endpoint'));
+    loadTestFile(require.resolve('./ml'));
   });
 }
diff --git a/x-pack/test/api_integration/apis/ml/bucket_span_estimator.ts b/x-pack/test/api_integration/apis/ml/bucket_span_estimator.ts
new file mode 100644
index 0000000000000..b5e5168621584
--- /dev/null
+++ b/x-pack/test/api_integration/apis/ml/bucket_span_estimator.ts
@@ -0,0 +1,90 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import expect from '@kbn/expect';
+
+import { FtrProviderContext } from '../../ftr_provider_context';
+
+const COMMON_HEADERS = {
+  'kbn-xsrf': 'some-xsrf-token',
+};
+
+const testDataList = [
+  {
+    testTitleSuffix: 'with 1 field, 1 agg, no split',
+    requestBody: {
+      aggTypes: ['avg'],
+      duration: { start: 1560297859000, end: 1562975136000 },
+      fields: ['taxless_total_price'],
+      index: 'ecommerce',
+      query: { bool: { must: [{ match_all: {} }] } },
+      timeField: 'order_date',
+    },
+    expected: {
+      responseCode: 200,
+      responseBody: { name: '15m', ms: 900000 },
+    },
+  },
+  {
+    testTitleSuffix: 'with 2 fields, 2 aggs, no split',
+    requestBody: {
+      aggTypes: ['avg', 'sum'],
+      duration: { start: 1560297859000, end: 1562975136000 },
+      fields: ['products.base_price', 'products.base_unit_price'],
+      index: 'ecommerce',
+      query: { bool: { must: [{ match_all: {} }] } },
+      timeField: 'order_date',
+    },
+    expected: {
+      responseCode: 200,
+      responseBody: { name: '30m', ms: 1800000 },
+    },
+  },
+  {
+    testTitleSuffix: 'with 1 field, 1 agg, 1 split with cardinality 46',
+    requestBody: {
+      aggTypes: ['avg'],
+      duration: { start: 1560297859000, end: 1562975136000 },
+      fields: ['taxless_total_price'],
+      index: 'ecommerce',
+      query: { bool: { must: [{ match_all: {} }] } },
+      splitField: 'customer_first_name.keyword',
+      timeField: 'order_date',
+    },
+    expected: {
+      responseCode: 200,
+      responseBody: { name: '3h', ms: 10800000 },
+    },
+  },
+];
+
+// eslint-disable-next-line import/no-default-export
+export default ({ getService }: FtrProviderContext) => {
+  const esArchiver = getService('esArchiver');
+  const supertest = getService('supertest');
+
+  describe('bucket span estimator', () => {
+    before(async () => {
+      await esArchiver.load('ml/ecommerce');
+    });
+
+    after(async () => {
+      await esArchiver.unload('ml/ecommerce');
+    });
+
+    for (const testData of testDataList) {
+      it(`estimates the bucket span ${testData.testTitleSuffix}`, async () => {
+        const { body } = await supertest
+          .post('/api/ml/validate/estimate_bucket_span')
+          .set(COMMON_HEADERS)
+          .send(testData.requestBody)
+          .expect(testData.expected.responseCode);
+
+        expect(body).to.eql(testData.expected.responseBody);
+      });
+    }
+  });
+};
diff --git a/x-pack/test/api_integration/apis/ml/index.ts b/x-pack/test/api_integration/apis/ml/index.ts
new file mode 100644
index 0000000000000..2e0521e2b8273
--- /dev/null
+++ b/x-pack/test/api_integration/apis/ml/index.ts
@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { FtrProviderContext } from '../../ftr_provider_context';
+
+export default function({ loadTestFile }: FtrProviderContext) {
+  describe('Machine Learning', function() {
+    this.tags(['mlqa']);
+
+    loadTestFile(require.resolve('./bucket_span_estimator'));
+  });
+}

From 9fcc93457f4ac382cbeb40777de369fe50c73eed Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alejandro=20Fern=C3=A1ndez?=
 <alejandro.fernandez@elastic.co>
Date: Wed, 11 Dec 2019 13:47:37 +0100
Subject: [PATCH 21/24] [Logs + Metrics UI] Add missing headers in Logs &
 metrics (#52405)

* Fix broken aria references

`EuiDescribedFormGroup` needs an actual header in its `title` for it to
make a correct `aria-labelledby`.

* Fix `aria-labelledby` references in settings page


Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
---
 .../fields_configuration_panel.tsx            | 50 +++++++++++--------
 .../indices_configuration_panel.tsx           | 22 ++++----
 .../name_configuration_panel.tsx              |  4 +-
 .../analysis_setup_indices_form.tsx           | 10 ++--
 .../analysis_setup_timerange_form.tsx         | 10 ++--
 5 files changed, 58 insertions(+), 38 deletions(-)

diff --git a/x-pack/legacy/plugins/infra/public/components/source_configuration/fields_configuration_panel.tsx b/x-pack/legacy/plugins/infra/public/components/source_configuration/fields_configuration_panel.tsx
index 771285e8ccee4..5f3d1a63e72eb 100644
--- a/x-pack/legacy/plugins/infra/public/components/source_configuration/fields_configuration_panel.tsx
+++ b/x-pack/legacy/plugins/infra/public/components/source_configuration/fields_configuration_panel.tsx
@@ -50,10 +50,12 @@ export const FieldsConfigurationPanel = ({
     <EuiDescribedFormGroup
       idAria="timestampField"
       title={
-        <FormattedMessage
-          id="xpack.infra.sourceConfiguration.timestampFieldLabel"
-          defaultMessage="Timestamp"
-        />
+        <h4>
+          <FormattedMessage
+            id="xpack.infra.sourceConfiguration.timestampFieldLabel"
+            defaultMessage="Timestamp"
+          />
+        </h4>
       }
       description={
         <FormattedMessage
@@ -95,10 +97,12 @@ export const FieldsConfigurationPanel = ({
     <EuiDescribedFormGroup
       idAria="tiebreakerField"
       title={
-        <FormattedMessage
-          id="xpack.infra.sourceConfiguration.tiebreakerFieldLabel"
-          defaultMessage="Tiebreaker"
-        />
+        <h4>
+          <FormattedMessage
+            id="xpack.infra.sourceConfiguration.tiebreakerFieldLabel"
+            defaultMessage="Tiebreaker"
+          />
+        </h4>
       }
       description={
         <FormattedMessage
@@ -140,10 +144,12 @@ export const FieldsConfigurationPanel = ({
     <EuiDescribedFormGroup
       idAria="containerField"
       title={
-        <FormattedMessage
-          id="xpack.infra.sourceConfiguration.containerFieldLabel"
-          defaultMessage="Container ID"
-        />
+        <h4>
+          <FormattedMessage
+            id="xpack.infra.sourceConfiguration.containerFieldLabel"
+            defaultMessage="Container ID"
+          />
+        </h4>
       }
       description={
         <FormattedMessage
@@ -185,10 +191,12 @@ export const FieldsConfigurationPanel = ({
     <EuiDescribedFormGroup
       idAria="hostNameField"
       title={
-        <FormattedMessage
-          id="xpack.infra.sourceConfiguration.hostNameFieldLabel"
-          defaultMessage="Host name"
-        />
+        <h4>
+          <FormattedMessage
+            id="xpack.infra.sourceConfiguration.hostNameFieldLabel"
+            defaultMessage="Host name"
+          />
+        </h4>
       }
       description={
         <FormattedMessage
@@ -230,10 +238,12 @@ export const FieldsConfigurationPanel = ({
     <EuiDescribedFormGroup
       idAria="podField"
       title={
-        <FormattedMessage
-          id="xpack.infra.sourceConfiguration.podFieldLabel"
-          defaultMessage="Pod ID"
-        />
+        <h4>
+          <FormattedMessage
+            id="xpack.infra.sourceConfiguration.podFieldLabel"
+            defaultMessage="Pod ID"
+          />
+        </h4>
       }
       description={
         <FormattedMessage
diff --git a/x-pack/legacy/plugins/infra/public/components/source_configuration/indices_configuration_panel.tsx b/x-pack/legacy/plugins/infra/public/components/source_configuration/indices_configuration_panel.tsx
index 57863d8d2df82..e779b35975ec3 100644
--- a/x-pack/legacy/plugins/infra/public/components/source_configuration/indices_configuration_panel.tsx
+++ b/x-pack/legacy/plugins/infra/public/components/source_configuration/indices_configuration_panel.tsx
@@ -42,12 +42,14 @@ export const IndicesConfigurationPanel = ({
     </EuiTitle>
     <EuiSpacer size="m" />
     <EuiDescribedFormGroup
-      idAria="matricIndices"
+      idAria="metricIndices"
       title={
-        <FormattedMessage
-          id="xpack.infra.sourceConfiguration.metricIndicesTitle"
-          defaultMessage="Metric indices"
-        />
+        <h4>
+          <FormattedMessage
+            id="xpack.infra.sourceConfiguration.metricIndicesTitle"
+            defaultMessage="Metric indices"
+          />
+        </h4>
       }
       description={
         <FormattedMessage
@@ -90,10 +92,12 @@ export const IndicesConfigurationPanel = ({
     <EuiDescribedFormGroup
       idAria="logIndices"
       title={
-        <FormattedMessage
-          id="xpack.infra.sourceConfiguration.logIndicesTitle"
-          defaultMessage="Log indices"
-        />
+        <h4>
+          <FormattedMessage
+            id="xpack.infra.sourceConfiguration.logIndicesTitle"
+            defaultMessage="Log indices"
+          />
+        </h4>
       }
       description={
         <FormattedMessage
diff --git a/x-pack/legacy/plugins/infra/public/components/source_configuration/name_configuration_panel.tsx b/x-pack/legacy/plugins/infra/public/components/source_configuration/name_configuration_panel.tsx
index 7129097cff160..130f30717268c 100644
--- a/x-pack/legacy/plugins/infra/public/components/source_configuration/name_configuration_panel.tsx
+++ b/x-pack/legacy/plugins/infra/public/components/source_configuration/name_configuration_panel.tsx
@@ -41,7 +41,9 @@ export const NameConfigurationPanel = ({
     <EuiDescribedFormGroup
       idAria="name"
       title={
-        <FormattedMessage id="xpack.infra.sourceConfiguration.nameLabel" defaultMessage="Name" />
+        <h4>
+          <FormattedMessage id="xpack.infra.sourceConfiguration.nameLabel" defaultMessage="Name" />
+        </h4>
       }
       description={
         <FormattedMessage
diff --git a/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/setup/initial_configuration_step/analysis_setup_indices_form.tsx b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/setup/initial_configuration_step/analysis_setup_indices_form.tsx
index 91662c49adace..35cad040323a6 100644
--- a/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/setup/initial_configuration_step/analysis_setup_indices_form.tsx
+++ b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/setup/initial_configuration_step/analysis_setup_indices_form.tsx
@@ -61,10 +61,12 @@ export const AnalysisSetupIndicesForm: React.FunctionComponent<{
     <EuiDescribedFormGroup
       idAria="indices"
       title={
-        <FormattedMessage
-          id="xpack.infra.analysisSetup.indicesSelectionTitle"
-          defaultMessage="Choose indices"
-        />
+        <h3>
+          <FormattedMessage
+            id="xpack.infra.analysisSetup.indicesSelectionTitle"
+            defaultMessage="Choose indices"
+          />
+        </h3>
       }
       description={
         <FormattedMessage
diff --git a/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/setup/initial_configuration_step/analysis_setup_timerange_form.tsx b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/setup/initial_configuration_step/analysis_setup_timerange_form.tsx
index 17f1aa48c87a2..02a25bf134fef 100644
--- a/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/setup/initial_configuration_step/analysis_setup_timerange_form.tsx
+++ b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/setup/initial_configuration_step/analysis_setup_timerange_form.tsx
@@ -63,10 +63,12 @@ export const AnalysisSetupTimerangeForm: React.FunctionComponent<{
     <EuiDescribedFormGroup
       idAria="timeRange"
       title={
-        <FormattedMessage
-          id="xpack.infra.analysisSetup.timeRangeTitle"
-          defaultMessage="Choose a time range"
-        />
+        <h3>
+          <FormattedMessage
+            id="xpack.infra.analysisSetup.timeRangeTitle"
+            defaultMessage="Choose a time range"
+          />
+        </h3>
       }
       description={
         <FormattedMessage

From 0cd62cabbbf402cda21b859fe526ffaef019eaa0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Felix=20St=C3=BCrmer?= <weltenwort@users.noreply.github.com>
Date: Wed, 11 Dec 2019 13:48:40 +0100
Subject: [PATCH 22/24] [Logs + Metrics UI] Remove eslint exceptions (#50979)

This removes the two eslint exceptions specific to the `infra` plugin introduced in #49244.

fixes #49563
---
 .eslintrc.js                                  |  7 --
 .../public/components/formatted_time.tsx      |  1 -
 .../log_entry_actions_menu.tsx                |  2 +-
 .../logging/log_highlights_menu.tsx           | 24 +++++--
 .../logging/log_text_stream/text_styles.tsx   |  2 +-
 .../components/metrics_explorer/metrics.tsx   | 33 ++++-----
 .../components/saved_views/create_modal.tsx   |  2 +-
 .../add_log_column_popover.tsx                |  2 +-
 .../source_configuration_form_state.tsx       |  2 +-
 .../waffle/waffle_inventory_switcher.tsx      | 27 ++++---
 .../log_analysis_capabilities.tsx             |  2 +-
 .../logs/log_analysis/log_analysis_module.tsx | 10 +--
 .../log_analysis/log_analysis_setup_state.tsx |  2 +-
 .../log_highlights/log_entry_highlights.tsx   |  2 +-
 .../log_highlights/log_summary_highlights.ts  | 10 ++-
 .../logs/log_highlights/next_and_previous.tsx |  2 +-
 .../logs/log_highlights/redux_bridges.tsx     |  6 +-
 .../containers/logs/with_stream_items.ts      |  2 +-
 .../use_metrics_explorer_data.ts              |  3 +
 .../use_metrics_explorer_options.ts           |  2 +-
 .../infra/public/hooks/use_saved_view.ts      | 61 ++++++++--------
 .../infra/public/hooks/use_track_metric.tsx   |  3 +
 .../public/pages/infrastructure/index.tsx     | 15 ++--
 .../infrastructure/metrics_explorer/index.tsx |  7 +-
 .../use_metric_explorer_state.ts              | 12 ++--
 .../logs/log_entry_rate/page_content.tsx      |  2 +-
 .../sections/anomalies/table.tsx              |  2 +-
 .../analysis_setup_indices_form.tsx           |  2 +-
 .../use_log_entry_rate_module.tsx             |  2 +-
 .../use_log_entry_rate_results_url_state.tsx  | 11 +--
 .../metrics/components/chart_section_vis.tsx  | 18 ++---
 .../metrics/components/node_details_page.tsx  | 10 +--
 .../pages/metrics/components/section.tsx      | 71 ++++++++++---------
 .../pages/metrics/components/sub_section.tsx  | 36 +++++-----
 .../metrics/containers/with_metrics_time.tsx  | 11 ++-
 .../infra/public/pages/metrics/index.tsx      | 42 +++++------
 .../infra/public/utils/cancellable_effect.ts  |  3 +
 .../public/utils/use_kibana_ui_setting.ts     |  7 +-
 .../infra/public/utils/use_tracked_promise.ts |  2 +
 .../infra/public/utils/use_url_state.ts       | 38 +++++++---
 .../public/utils/use_visibility_state.ts      |  2 +-
 41 files changed, 269 insertions(+), 231 deletions(-)

diff --git a/.eslintrc.js b/.eslintrc.js
index e01632815bc68..367ac892107ab 100644
--- a/.eslintrc.js
+++ b/.eslintrc.js
@@ -170,13 +170,6 @@ module.exports = {
         'react-hooks/rules-of-hooks': 'off',
       },
     },
-    {
-      files: ['x-pack/legacy/plugins/infra/**/*.{js,ts,tsx}'],
-      rules: {
-        'react-hooks/exhaustive-deps': 'off',
-        'react-hooks/rules-of-hooks': 'off',
-      },
-    },
     {
       files: ['x-pack/legacy/plugins/lens/**/*.{js,ts,tsx}'],
       rules: {
diff --git a/x-pack/legacy/plugins/infra/public/components/formatted_time.tsx b/x-pack/legacy/plugins/infra/public/components/formatted_time.tsx
index 78255c55df124..46b505d4fab52 100644
--- a/x-pack/legacy/plugins/infra/public/components/formatted_time.tsx
+++ b/x-pack/legacy/plugins/infra/public/components/formatted_time.tsx
@@ -37,7 +37,6 @@ export const useFormattedTime = (
 
   const dateFormat = formatMap[format];
   const formattedTime = useMemo(() => getFormattedTime(time, dateFormat, fallbackFormat), [
-    getFormattedTime,
     time,
     dateFormat,
     fallbackFormat,
diff --git a/x-pack/legacy/plugins/infra/public/components/logging/log_entry_flyout/log_entry_actions_menu.tsx b/x-pack/legacy/plugins/infra/public/components/logging/log_entry_flyout/log_entry_actions_menu.tsx
index 92c6ddd193609..d018b3a0f38ff 100644
--- a/x-pack/legacy/plugins/infra/public/components/logging/log_entry_flyout/log_entry_actions_menu.tsx
+++ b/x-pack/legacy/plugins/infra/public/components/logging/log_entry_flyout/log_entry_actions_menu.tsx
@@ -51,7 +51,7 @@ export const LogEntryActionsMenu: React.FunctionComponent<{
         />
       </EuiContextMenuItem>,
     ],
-    [uptimeLink]
+    [apmLink, uptimeLink]
   );
 
   const hasMenuItems = useMemo(() => menuItems.length > 0, [menuItems]);
diff --git a/x-pack/legacy/plugins/infra/public/components/logging/log_highlights_menu.tsx b/x-pack/legacy/plugins/infra/public/components/logging/log_highlights_menu.tsx
index 24a5e8bacb4f9..d13ccde7466cd 100644
--- a/x-pack/legacy/plugins/infra/public/components/logging/log_highlights_menu.tsx
+++ b/x-pack/legacy/plugins/infra/public/components/logging/log_highlights_menu.tsx
@@ -16,7 +16,7 @@ import {
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { debounce } from 'lodash';
-import React, { useCallback, useEffect, useMemo, useState } from 'react';
+import React, { useCallback, useMemo, useState } from 'react';
 
 import euiStyled from '../../../../../common/eui_styled_components';
 import { useVisibilityState } from '../../utils/use_visibility_state';
@@ -47,8 +47,25 @@ export const LogHighlightsMenu: React.FC<LogHighlightsMenuProps> = ({
   } = useVisibilityState(false);
 
   // Input field state
-  const [highlightTerm, setHighlightTerm] = useState('');
+  const [highlightTerm, _setHighlightTerm] = useState('');
+
   const debouncedOnChange = useMemo(() => debounce(onChange, 275), [onChange]);
+  const setHighlightTerm = useCallback<typeof _setHighlightTerm>(
+    valueOrUpdater =>
+      _setHighlightTerm(previousHighlightTerm => {
+        const newHighlightTerm =
+          typeof valueOrUpdater === 'function'
+            ? valueOrUpdater(previousHighlightTerm)
+            : valueOrUpdater;
+
+        if (newHighlightTerm !== previousHighlightTerm) {
+          debouncedOnChange([newHighlightTerm]);
+        }
+
+        return newHighlightTerm;
+      }),
+    [debouncedOnChange]
+  );
   const changeHighlightTerm = useCallback(
     e => {
       const value = e.target.value;
@@ -57,9 +74,6 @@ export const LogHighlightsMenu: React.FC<LogHighlightsMenuProps> = ({
     [setHighlightTerm]
   );
   const clearHighlightTerm = useCallback(() => setHighlightTerm(''), [setHighlightTerm]);
-  useEffect(() => {
-    debouncedOnChange([highlightTerm]);
-  }, [highlightTerm]);
 
   const button = (
     <EuiButtonEmpty color="text" size="xs" iconType="brush" onClick={togglePopover}>
diff --git a/x-pack/legacy/plugins/infra/public/components/logging/log_text_stream/text_styles.tsx b/x-pack/legacy/plugins/infra/public/components/logging/log_text_stream/text_styles.tsx
index 1d40c88f5d1d0..e95ac6aa7923b 100644
--- a/x-pack/legacy/plugins/infra/public/components/logging/log_text_stream/text_styles.tsx
+++ b/x-pack/legacy/plugins/infra/public/components/logging/log_text_stream/text_styles.tsx
@@ -63,7 +63,7 @@ export const useMeasuredCharacterDimensions = (scale: TextScale) => {
         X
       </MonospaceCharacterDimensionsProbe>
     ),
-    [scale]
+    [measureElement, scale]
   );
 
   return {
diff --git a/x-pack/legacy/plugins/infra/public/components/metrics_explorer/metrics.tsx b/x-pack/legacy/plugins/infra/public/components/metrics_explorer/metrics.tsx
index d59e709d9a19a..42df7c6915a0d 100644
--- a/x-pack/legacy/plugins/infra/public/components/metrics_explorer/metrics.tsx
+++ b/x-pack/legacy/plugins/infra/public/components/metrics_explorer/metrics.tsx
@@ -7,7 +7,7 @@
 import { EuiComboBox } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 
-import React, { useCallback, useState, useEffect } from 'react';
+import React, { useCallback, useState } from 'react';
 import { FieldType } from 'ui/index_patterns';
 import { colorTransformer, MetricsExplorerColor } from '../../../common/color_palette';
 import {
@@ -31,24 +31,19 @@ interface SelectedOption {
 
 export const MetricsExplorerMetrics = ({ options, onChange, fields, autoFocus = false }: Props) => {
   const colors = Object.keys(MetricsExplorerColor) as MetricsExplorerColor[];
-  const [inputRef, setInputRef] = useState<HTMLInputElement | null>(null);
-  const [focusOnce, setFocusState] = useState<boolean>(false);
+  const [shouldFocus, setShouldFocus] = useState(autoFocus);
 
-  useEffect(() => {
-    if (inputRef && autoFocus && !focusOnce) {
-      inputRef.focus();
-      setFocusState(true);
-    }
-  }, [inputRef]);
+  // the EuiCombobox forwards the ref to an input element
+  const autoFocusInputElement = useCallback(
+    (inputElement: HTMLInputElement | null) => {
+      if (inputElement && shouldFocus) {
+        inputElement.focus();
+        setShouldFocus(false);
+      }
+    },
+    [shouldFocus]
+  );
 
-  // I tried to use useRef originally but the EUIComboBox component's type definition
-  // would only accept an actual input element or a callback function (with the same type).
-  // This effectivly does the same thing but is compatible with EuiComboBox.
-  const handleInputRef = (ref: HTMLInputElement) => {
-    if (ref) {
-      setInputRef(ref);
-    }
-  };
   const handleChange = useCallback(
     selectedOptions => {
       onChange(
@@ -59,7 +54,7 @@ export const MetricsExplorerMetrics = ({ options, onChange, fields, autoFocus =
         }))
       );
     },
-    [options, onChange]
+    [onChange, options.aggregation, colors]
   );
 
   const comboOptions = fields
@@ -86,7 +81,7 @@ export const MetricsExplorerMetrics = ({ options, onChange, fields, autoFocus =
       selectedOptions={selectedOptions}
       onChange={handleChange}
       isClearable={true}
-      inputRef={handleInputRef}
+      inputRef={autoFocusInputElement}
     />
   );
 };
diff --git a/x-pack/legacy/plugins/infra/public/components/saved_views/create_modal.tsx b/x-pack/legacy/plugins/infra/public/components/saved_views/create_modal.tsx
index 8df479f36e2f9..9b8907a1ff9e1 100644
--- a/x-pack/legacy/plugins/infra/public/components/saved_views/create_modal.tsx
+++ b/x-pack/legacy/plugins/infra/public/components/saved_views/create_modal.tsx
@@ -36,7 +36,7 @@ export const SavedViewCreateModal = ({ close, save, isInvalid }: Props) => {
 
   const saveView = useCallback(() => {
     save(viewName, includeTime);
-  }, [viewName, includeTime]);
+  }, [includeTime, save, viewName]);
 
   return (
     <EuiOverlayMask>
diff --git a/x-pack/legacy/plugins/infra/public/components/source_configuration/add_log_column_popover.tsx b/x-pack/legacy/plugins/infra/public/components/source_configuration/add_log_column_popover.tsx
index 9b83f62e7856b..fc8407c5298e6 100644
--- a/x-pack/legacy/plugins/infra/public/components/source_configuration/add_log_column_popover.tsx
+++ b/x-pack/legacy/plugins/infra/public/components/source_configuration/add_log_column_popover.tsx
@@ -94,7 +94,7 @@ export const AddLogColumnButtonAndPopover: React.FunctionComponent<{
 
       addLogColumn(selectedOption.columnConfiguration);
     },
-    [addLogColumn, availableColumnOptions]
+    [addLogColumn, availableColumnOptions, closePopover]
   );
 
   return (
diff --git a/x-pack/legacy/plugins/infra/public/components/source_configuration/source_configuration_form_state.tsx b/x-pack/legacy/plugins/infra/public/components/source_configuration/source_configuration_form_state.tsx
index 3614a88c1e99e..262649e20709b 100644
--- a/x-pack/legacy/plugins/infra/public/components/source_configuration/source_configuration_form_state.tsx
+++ b/x-pack/legacy/plugins/infra/public/components/source_configuration/source_configuration_form_state.tsx
@@ -52,7 +52,7 @@ export const useSourceConfigurationFormState = (configuration?: SourceConfigurat
   const resetForm = useCallback(() => {
     indicesConfigurationFormState.resetForm();
     logColumnsConfigurationFormState.resetForm();
-  }, [indicesConfigurationFormState.resetForm, logColumnsConfigurationFormState.formState]);
+  }, [indicesConfigurationFormState, logColumnsConfigurationFormState]);
 
   const isFormDirty = useMemo(
     () => indicesConfigurationFormState.isFormDirty || logColumnsConfigurationFormState.isFormDirty,
diff --git a/x-pack/legacy/plugins/infra/public/components/waffle/waffle_inventory_switcher.tsx b/x-pack/legacy/plugins/infra/public/components/waffle/waffle_inventory_switcher.tsx
index 38e87038b7c4f..c8f03cef4d6ac 100644
--- a/x-pack/legacy/plugins/infra/public/components/waffle/waffle_inventory_switcher.tsx
+++ b/x-pack/legacy/plugins/infra/public/components/waffle/waffle_inventory_switcher.tsx
@@ -17,28 +17,33 @@ import {
 } from '../../graphql/types';
 import { findInventoryModel } from '../../../common/inventory_models';
 
-interface Props {
+interface WaffleInventorySwitcherProps {
   nodeType: InfraNodeType;
   changeNodeType: (nodeType: InfraNodeType) => void;
   changeGroupBy: (groupBy: InfraSnapshotGroupbyInput[]) => void;
   changeMetric: (metric: InfraSnapshotMetricInput) => void;
 }
 
-export const WaffleInventorySwitcher = (props: Props) => {
+export const WaffleInventorySwitcher: React.FC<WaffleInventorySwitcherProps> = ({
+  changeNodeType,
+  changeGroupBy,
+  changeMetric,
+  nodeType,
+}) => {
   const [isOpen, setIsOpen] = useState(false);
   const closePopover = useCallback(() => setIsOpen(false), []);
   const openPopover = useCallback(() => setIsOpen(true), []);
   const goToNodeType = useCallback(
-    (nodeType: InfraNodeType) => {
+    (targetNodeType: InfraNodeType) => {
       closePopover();
-      props.changeNodeType(nodeType);
-      props.changeGroupBy([]);
-      const inventoryModel = findInventoryModel(nodeType);
-      props.changeMetric({
+      changeNodeType(targetNodeType);
+      changeGroupBy([]);
+      const inventoryModel = findInventoryModel(targetNodeType);
+      changeMetric({
         type: inventoryModel.metrics.defaultSnapshot as InfraSnapshotMetricType,
       });
     },
-    [props.changeGroupBy, props.changeNodeType, props.changeMetric]
+    [closePopover, changeNodeType, changeGroupBy, changeMetric]
   );
   const goToHost = useCallback(() => goToNodeType('host' as InfraNodeType), [goToNodeType]);
   const goToK8 = useCallback(() => goToNodeType('pod' as InfraNodeType), [goToNodeType]);
@@ -68,10 +73,10 @@ export const WaffleInventorySwitcher = (props: Props) => {
         ],
       },
     ],
-    []
+    [goToDocker, goToHost, goToK8]
   );
   const selectedText = useMemo(() => {
-    switch (props.nodeType) {
+    switch (nodeType) {
       case InfraNodeType.host:
         return i18n.translate('xpack.infra.waffle.nodeTypeSwitcher.hostsLabel', {
           defaultMessage: 'Hosts',
@@ -81,7 +86,7 @@ export const WaffleInventorySwitcher = (props: Props) => {
       case InfraNodeType.container:
         return 'Docker';
     }
-  }, [props.nodeType]);
+  }, [nodeType]);
 
   return (
     <EuiFilterGroup>
diff --git a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_capabilities.tsx b/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_capabilities.tsx
index 35a3ac737ada3..bb01043b0db6e 100644
--- a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_capabilities.tsx
+++ b/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_capabilities.tsx
@@ -46,7 +46,7 @@ export const useLogAnalysisCapabilities = () => {
 
   useEffect(() => {
     fetchMlCapabilities();
-  }, []);
+  }, [fetchMlCapabilities]);
 
   const isLoading = useMemo(() => fetchMlCapabilitiesRequest.state === 'pending', [
     fetchMlCapabilitiesRequest.state,
diff --git a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_module.tsx b/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_module.tsx
index 189b58d7923f8..d7d0ecb6f2c8d 100644
--- a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_module.tsx
+++ b/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_module.tsx
@@ -125,23 +125,23 @@ export const useLogAnalysisModule = <JobType extends string>({
           dispatchModuleStatus({ type: 'failedSetup' });
         });
     },
-    [cleanUpModule, setUpModule]
+    [cleanUpModule, dispatchModuleStatus, setUpModule]
   );
 
   const viewSetupForReconfiguration = useCallback(() => {
     dispatchModuleStatus({ type: 'requestedJobConfigurationUpdate' });
-  }, []);
+  }, [dispatchModuleStatus]);
 
   const viewSetupForUpdate = useCallback(() => {
     dispatchModuleStatus({ type: 'requestedJobDefinitionUpdate' });
-  }, []);
+  }, [dispatchModuleStatus]);
 
   const viewResults = useCallback(() => {
     dispatchModuleStatus({ type: 'viewedResults' });
-  }, []);
+  }, [dispatchModuleStatus]);
 
   const jobIds = useMemo(() => moduleDescriptor.getJobIds(spaceId, sourceId), [
-    moduleDescriptor.getJobIds,
+    moduleDescriptor,
     spaceId,
     sourceId,
   ]);
diff --git a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_setup_state.tsx b/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_setup_state.tsx
index 275c0194be3b2..74dbb3c7a8062 100644
--- a/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_setup_state.tsx
+++ b/x-pack/legacy/plugins/infra/public/containers/logs/log_analysis/log_analysis_setup_state.tsx
@@ -140,7 +140,7 @@ export const useAnalysisSetupState = <JobType extends string>({
         ? [...errors, ...index.errors]
         : errors;
     }, []);
-  }, [selectedIndexNames, validatedIndices, validateIndicesRequest.state]);
+  }, [isValidating, validateIndicesRequest.state, selectedIndexNames, validatedIndices]);
 
   return {
     cleanupAndSetup,
diff --git a/x-pack/legacy/plugins/infra/public/containers/logs/log_highlights/log_entry_highlights.tsx b/x-pack/legacy/plugins/infra/public/containers/logs/log_highlights/log_entry_highlights.tsx
index 6ead866fb960a..2b19958a9b1a1 100644
--- a/x-pack/legacy/plugins/infra/public/containers/logs/log_highlights/log_entry_highlights.tsx
+++ b/x-pack/legacy/plugins/infra/public/containers/logs/log_highlights/log_entry_highlights.tsx
@@ -78,7 +78,7 @@ export const useLogEntryHighlights = (
     } else {
       setLogEntryHighlights([]);
     }
-  }, [highlightTerms, startKey, endKey, filterQuery, sourceVersion]);
+  }, [endKey, filterQuery, highlightTerms, loadLogEntryHighlights, sourceVersion, startKey]);
 
   const logEntryHighlightsById = useMemo(
     () =>
diff --git a/x-pack/legacy/plugins/infra/public/containers/logs/log_highlights/log_summary_highlights.ts b/x-pack/legacy/plugins/infra/public/containers/logs/log_highlights/log_summary_highlights.ts
index 34c66afda010e..874c70e016496 100644
--- a/x-pack/legacy/plugins/infra/public/containers/logs/log_highlights/log_summary_highlights.ts
+++ b/x-pack/legacy/plugins/infra/public/containers/logs/log_highlights/log_summary_highlights.ts
@@ -74,7 +74,15 @@ export const useLogSummaryHighlights = (
     } else {
       setLogSummaryHighlights([]);
     }
-  }, [highlightTerms, start, end, bucketSize, filterQuery, sourceVersion]);
+  }, [
+    bucketSize,
+    debouncedLoadSummaryHighlights,
+    end,
+    filterQuery,
+    highlightTerms,
+    sourceVersion,
+    start,
+  ]);
 
   return {
     logSummaryHighlights,
diff --git a/x-pack/legacy/plugins/infra/public/containers/logs/log_highlights/next_and_previous.tsx b/x-pack/legacy/plugins/infra/public/containers/logs/log_highlights/next_and_previous.tsx
index 95ead50119eb4..62a43a5412825 100644
--- a/x-pack/legacy/plugins/infra/public/containers/logs/log_highlights/next_and_previous.tsx
+++ b/x-pack/legacy/plugins/infra/public/containers/logs/log_highlights/next_and_previous.tsx
@@ -53,7 +53,7 @@ export const useNextAndPrevious = ({
       const initialTimeKey = getUniqueLogEntryKey(entries[initialIndex]);
       setCurrentTimeKey(initialTimeKey);
     }
-  }, [currentTimeKey, entries, setCurrentTimeKey]);
+  }, [currentTimeKey, entries, setCurrentTimeKey, visibleMidpoint]);
 
   const indexOfCurrentTimeKey = useMemo(() => {
     if (currentTimeKey && entries.length > 0) {
diff --git a/x-pack/legacy/plugins/infra/public/containers/logs/log_highlights/redux_bridges.tsx b/x-pack/legacy/plugins/infra/public/containers/logs/log_highlights/redux_bridges.tsx
index 2b60c6edd97aa..9ea8987d4f326 100644
--- a/x-pack/legacy/plugins/infra/public/containers/logs/log_highlights/redux_bridges.tsx
+++ b/x-pack/legacy/plugins/infra/public/containers/logs/log_highlights/redux_bridges.tsx
@@ -25,11 +25,11 @@ export const LogHighlightsPositionBridge = withLogPosition(
     const { setJumpToTarget, setVisibleMidpoint } = useContext(LogHighlightsState.Context);
     useEffect(() => {
       setVisibleMidpoint(visibleMidpoint);
-    }, [visibleMidpoint]);
+    }, [setVisibleMidpoint, visibleMidpoint]);
 
     useEffect(() => {
       setJumpToTarget(() => jumpToTargetPosition);
-    }, [jumpToTargetPosition]);
+    }, [jumpToTargetPosition, setJumpToTarget]);
 
     return null;
   }
@@ -41,7 +41,7 @@ export const LogHighlightsFilterQueryBridge = withLogFilter(
 
     useEffect(() => {
       setFilterQuery(serializedFilterQuery);
-    }, [serializedFilterQuery]);
+    }, [serializedFilterQuery, setFilterQuery]);
 
     return null;
   }
diff --git a/x-pack/legacy/plugins/infra/public/containers/logs/with_stream_items.ts b/x-pack/legacy/plugins/infra/public/containers/logs/with_stream_items.ts
index da468b4391e4e..9b20676486af2 100644
--- a/x-pack/legacy/plugins/infra/public/containers/logs/with_stream_items.ts
+++ b/x-pack/legacy/plugins/infra/public/containers/logs/with_stream_items.ts
@@ -35,7 +35,7 @@ export const WithStreamItems: React.FunctionComponent<{
             createLogEntryStreamItem(logEntry, logEntryHighlightsById[logEntry.gid] || [])
           ),
 
-    [logEntries.entries, logEntryHighlightsById]
+    [isAutoReloading, logEntries.entries, logEntries.isReloading, logEntryHighlightsById]
   );
 
   return children({
diff --git a/x-pack/legacy/plugins/infra/public/containers/metrics_explorer/use_metrics_explorer_data.ts b/x-pack/legacy/plugins/infra/public/containers/metrics_explorer/use_metrics_explorer_data.ts
index 1418d6aef67ac..c2a599ea1ae78 100644
--- a/x-pack/legacy/plugins/infra/public/containers/metrics_explorer/use_metrics_explorer_data.ts
+++ b/x-pack/legacy/plugins/infra/public/containers/metrics_explorer/use_metrics_explorer_data.ts
@@ -96,6 +96,9 @@ export function useMetricsExplorerData(
       }
       setLoading(false);
     })();
+
+    // TODO: fix this dependency list while preserving the semantics
+    // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [options, source, timerange, signal, afterKey]);
   return { error, loading, data };
 }
diff --git a/x-pack/legacy/plugins/infra/public/containers/metrics_explorer/use_metrics_explorer_options.ts b/x-pack/legacy/plugins/infra/public/containers/metrics_explorer/use_metrics_explorer_options.ts
index 278f3e0a9c17d..de7a8d5805ecc 100644
--- a/x-pack/legacy/plugins/infra/public/containers/metrics_explorer/use_metrics_explorer_options.ts
+++ b/x-pack/legacy/plugins/infra/public/containers/metrics_explorer/use_metrics_explorer_options.ts
@@ -102,7 +102,7 @@ function useStateWithLocalStorage<State>(
   const [state, setState] = useState<State>(parseJsonOrDefault<State>(storageState, defaultState));
   useEffect(() => {
     localStorage.setItem(key, JSON.stringify(state));
-  }, [state]);
+  }, [key, state]);
   return [state, setState];
 }
 
diff --git a/x-pack/legacy/plugins/infra/public/hooks/use_saved_view.ts b/x-pack/legacy/plugins/infra/public/hooks/use_saved_view.ts
index 8db0ed28d9b21..4b12b6c51ea0e 100644
--- a/x-pack/legacy/plugins/infra/public/hooks/use_saved_view.ts
+++ b/x-pack/legacy/plugins/infra/public/hooks/use_saved_view.ts
@@ -26,29 +26,32 @@ export const useSavedView = <ViewState>(defaultViewState: ViewState, viewType: s
   >(viewType);
   const { create, error: errorOnCreate, createdId } = useCreateSavedObject(viewType);
   const { deleteObject, deletedId } = useDeleteSavedObject(viewType);
-  const deleteView = useCallback((id: string) => deleteObject(id), []);
+  const deleteView = useCallback((id: string) => deleteObject(id), [deleteObject]);
   const [createError, setCreateError] = useState<string | null>(null);
 
-  useEffect(() => setCreateError(createError), [errorOnCreate, setCreateError]);
+  useEffect(() => setCreateError(errorOnCreate), [errorOnCreate]);
 
-  const saveView = useCallback((d: { [p: string]: any }) => {
-    const doSave = async () => {
-      const exists = await hasView(d.name);
-      if (exists) {
-        setCreateError(
-          i18n.translate('xpack.infra.savedView.errorOnCreate.duplicateViewName', {
-            defaultMessage: `A view with that name already exists.`,
-          })
-        );
-        return;
-      }
-      create(d);
-    };
-    setCreateError(null);
-    doSave();
-  }, []);
+  const saveView = useCallback(
+    (d: { [p: string]: any }) => {
+      const doSave = async () => {
+        const exists = await hasView(d.name);
+        if (exists) {
+          setCreateError(
+            i18n.translate('xpack.infra.savedView.errorOnCreate.duplicateViewName', {
+              defaultMessage: `A view with that name already exists.`,
+            })
+          );
+          return;
+        }
+        create(d);
+      };
+      setCreateError(null);
+      doSave();
+    },
+    [create, hasView]
+  );
 
-  const savedObjects = data ? data.savedObjects : [];
+  const savedObjects = useMemo(() => (data ? data.savedObjects : []), [data]);
   const views = useMemo(() => {
     const items: Array<SavedView<ViewState>> = [
       {
@@ -61,19 +64,17 @@ export const useSavedView = <ViewState>(defaultViewState: ViewState, viewType: s
       },
     ];
 
-    if (data) {
-      data.savedObjects.forEach(
-        o =>
-          o.type === viewType &&
-          items.push({
-            ...o.attributes,
-            id: o.id,
-          })
-      );
-    }
+    savedObjects.forEach(
+      o =>
+        o.type === viewType &&
+        items.push({
+          ...o.attributes,
+          id: o.id,
+        })
+    );
 
     return items;
-  }, [savedObjects, defaultViewState]);
+  }, [defaultViewState, savedObjects, viewType]);
 
   return {
     views,
diff --git a/x-pack/legacy/plugins/infra/public/hooks/use_track_metric.tsx b/x-pack/legacy/plugins/infra/public/hooks/use_track_metric.tsx
index 379b3af3f1063..c5945ab808202 100644
--- a/x-pack/legacy/plugins/infra/public/hooks/use_track_metric.tsx
+++ b/x-pack/legacy/plugins/infra/public/hooks/use_track_metric.tsx
@@ -57,6 +57,9 @@ export function useTrackMetric(
     const trackUiMetric = getTrackerForApp(app);
     const id = setTimeout(() => trackUiMetric(metricType, decoratedMetric), Math.max(delay, 0));
     return () => clearTimeout(id);
+
+    // the dependencies are managed externally
+    // eslint-disable-next-line react-hooks/exhaustive-deps
   }, effectDependencies);
 }
 
diff --git a/x-pack/legacy/plugins/infra/public/pages/infrastructure/index.tsx b/x-pack/legacy/plugins/infra/public/pages/infrastructure/index.tsx
index fe48fcc62f77d..9efbbe790abc1 100644
--- a/x-pack/legacy/plugins/infra/public/pages/infrastructure/index.tsx
+++ b/x-pack/legacy/plugins/infra/public/pages/infrastructure/index.tsx
@@ -24,6 +24,7 @@ import { MetricsExplorerPage } from './metrics_explorer';
 import { SnapshotPage } from './snapshot';
 import { SettingsPage } from '../shared/settings';
 import { AppNavigation } from '../../components/navigation/app_navigation';
+import { SourceLoadingPage } from '../../components/source_loading_page';
 
 interface InfrastructurePageProps extends RouteComponentProps {
   uiCapabilities: UICapabilities;
@@ -95,11 +96,15 @@ export const InfrastructurePage = injectUICapabilities(
                 {({ configuration, createDerivedIndexPattern }) => (
                   <MetricsExplorerOptionsContainer.Provider>
                     <WithMetricsExplorerOptionsUrlState />
-                    <MetricsExplorerPage
-                      derivedIndexPattern={createDerivedIndexPattern('metrics')}
-                      source={configuration}
-                      {...props}
-                    />
+                    {configuration ? (
+                      <MetricsExplorerPage
+                        derivedIndexPattern={createDerivedIndexPattern('metrics')}
+                        source={configuration}
+                        {...props}
+                      />
+                    ) : (
+                      <SourceLoadingPage />
+                    )}
                   </MetricsExplorerOptionsContainer.Provider>
                 )}
               </WithSource>
diff --git a/x-pack/legacy/plugins/infra/public/pages/infrastructure/metrics_explorer/index.tsx b/x-pack/legacy/plugins/infra/public/pages/infrastructure/metrics_explorer/index.tsx
index 63f5a81967618..4db4319b91d3c 100644
--- a/x-pack/legacy/plugins/infra/public/pages/infrastructure/metrics_explorer/index.tsx
+++ b/x-pack/legacy/plugins/infra/public/pages/infrastructure/metrics_explorer/index.tsx
@@ -11,22 +11,17 @@ import { IIndexPattern } from 'src/plugins/data/public';
 import { DocumentTitle } from '../../../components/document_title';
 import { MetricsExplorerCharts } from '../../../components/metrics_explorer/charts';
 import { MetricsExplorerToolbar } from '../../../components/metrics_explorer/toolbar';
-import { SourceLoadingPage } from '../../../components/source_loading_page';
 import { SourceQuery } from '../../../../common/graphql/types';
 import { NoData } from '../../../components/empty_states';
 import { useMetricsExplorerState } from './use_metric_explorer_state';
 import { useTrackPageview } from '../../../hooks/use_track_metric';
 
 interface MetricsExplorerPageProps {
-  source: SourceQuery.Query['source']['configuration'] | undefined;
+  source: SourceQuery.Query['source']['configuration'];
   derivedIndexPattern: IIndexPattern;
 }
 
 export const MetricsExplorerPage = ({ source, derivedIndexPattern }: MetricsExplorerPageProps) => {
-  if (!source) {
-    return <SourceLoadingPage />;
-  }
-
   const {
     loading,
     error,
diff --git a/x-pack/legacy/plugins/infra/public/pages/infrastructure/metrics_explorer/use_metric_explorer_state.ts b/x-pack/legacy/plugins/infra/public/pages/infrastructure/metrics_explorer/use_metric_explorer_state.ts
index 415a6ae89a8b1..57ea886169701 100644
--- a/x-pack/legacy/plugins/infra/public/pages/infrastructure/metrics_explorer/use_metric_explorer_state.ts
+++ b/x-pack/legacy/plugins/infra/public/pages/infrastructure/metrics_explorer/use_metric_explorer_state.ts
@@ -59,7 +59,7 @@ export const useMetricsExplorerState = (
       setAfterKey(null);
       setTimeRange({ ...currentTimerange, from: start, to: end });
     },
-    [currentTimerange]
+    [currentTimerange, setTimeRange]
   );
 
   const handleGroupByChange = useCallback(
@@ -70,7 +70,7 @@ export const useMetricsExplorerState = (
         groupBy: groupBy || void 0,
       });
     },
-    [options]
+    [options, setOptions]
   );
 
   const handleFilterQuerySubmit = useCallback(
@@ -81,7 +81,7 @@ export const useMetricsExplorerState = (
         filterQuery: query,
       });
     },
-    [options]
+    [options, setOptions]
   );
 
   const handleMetricsChange = useCallback(
@@ -92,7 +92,7 @@ export const useMetricsExplorerState = (
         metrics,
       });
     },
-    [options]
+    [options, setOptions]
   );
 
   const handleAggregationChange = useCallback(
@@ -109,7 +109,7 @@ export const useMetricsExplorerState = (
               }));
       setOptions({ ...options, aggregation, metrics });
     },
-    [options]
+    [options, setOptions]
   );
 
   const onViewStateChange = useCallback(
@@ -124,7 +124,7 @@ export const useMetricsExplorerState = (
         setOptions(vs.options);
       }
     },
-    [setChartOptions, setTimeRange, setTimeRange]
+    [setChartOptions, setOptions, setTimeRange]
   );
 
   return {
diff --git a/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/page_content.tsx b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/page_content.tsx
index e62164cb17b2c..e71985f73fbb8 100644
--- a/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/page_content.tsx
+++ b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/page_content.tsx
@@ -36,7 +36,7 @@ export const LogEntryRatePageContent = () => {
   useEffect(() => {
     fetchModuleDefinition();
     fetchJobStatus();
-  }, []);
+  }, [fetchJobStatus, fetchModuleDefinition]);
 
   if (!hasLogAnalysisCapabilites) {
     return <LogEntryRateUnavailableContent />;
diff --git a/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/sections/anomalies/table.tsx b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/sections/anomalies/table.tsx
index 2057d75f72354..86760cf2da7d6 100644
--- a/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/sections/anomalies/table.tsx
+++ b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/sections/anomalies/table.tsx
@@ -124,7 +124,7 @@ export const AnomaliesTable: React.FunctionComponent<{
         setItemIdToExpandedRowMap(newItemIdToExpandedRowMap);
       }
     },
-    [results, setTimeRange, timeRange, itemIdToExpandedRowMap, setItemIdToExpandedRowMap]
+    [itemIdToExpandedRowMap, jobId, results, setTimeRange, timeRange]
   );
 
   const columns = [
diff --git a/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/setup/initial_configuration_step/analysis_setup_indices_form.tsx b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/setup/initial_configuration_step/analysis_setup_indices_form.tsx
index 35cad040323a6..5a4c21670191e 100644
--- a/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/setup/initial_configuration_step/analysis_setup_indices_form.tsx
+++ b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/setup/initial_configuration_step/analysis_setup_indices_form.tsx
@@ -54,7 +54,7 @@ export const AnalysisSetupIndicesForm: React.FunctionComponent<{
           </div>
         );
       }),
-    [indices]
+    [handleCheckboxChange, indices]
   );
 
   return (
diff --git a/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/use_log_entry_rate_module.tsx b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/use_log_entry_rate_module.tsx
index ab6a6578601bf..d1efedb176aba 100644
--- a/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/use_log_entry_rate_module.tsx
+++ b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/use_log_entry_rate_module.tsx
@@ -31,7 +31,7 @@ export const useLogEntryRateModule = ({
       spaceId,
       timestampField,
     }),
-    [indexPattern]
+    [indexPattern, sourceId, spaceId, timestampField]
   );
 
   return useLogAnalysisModule({
diff --git a/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/use_log_entry_rate_results_url_state.tsx b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/use_log_entry_rate_results_url_state.tsx
index 017be6be49e16..6d4495c8d9e0f 100644
--- a/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/use_log_entry_rate_results_url_state.tsx
+++ b/x-pack/legacy/plugins/infra/public/pages/logs/log_entry_rate/use_log_entry_rate_results_url_state.tsx
@@ -8,7 +8,6 @@ import { fold } from 'fp-ts/lib/Either';
 import { constant, identity } from 'fp-ts/lib/function';
 import { pipe } from 'fp-ts/lib/pipeable';
 import * as rt from 'io-ts';
-import { useEffect } from 'react';
 
 import { useUrlState } from '../../../utils/use_url_state';
 
@@ -41,12 +40,9 @@ export const useLogAnalysisResultsUrlState = () => {
       pipe(urlTimeRangeRT.decode(value), fold(constant(undefined), identity)),
     encodeUrlState: urlTimeRangeRT.encode,
     urlStateKey: TIME_RANGE_URL_STATE_KEY,
+    writeDefaultState: true,
   });
 
-  useEffect(() => {
-    setTimeRange(timeRange);
-  }, []);
-
   const [autoRefresh, setAutoRefresh] = useUrlState({
     defaultState: {
       isPaused: false,
@@ -56,12 +52,9 @@ export const useLogAnalysisResultsUrlState = () => {
       pipe(autoRefreshRT.decode(value), fold(constant(undefined), identity)),
     encodeUrlState: autoRefreshRT.encode,
     urlStateKey: AUTOREFRESH_URL_STATE_KEY,
+    writeDefaultState: true,
   });
 
-  useEffect(() => {
-    setAutoRefresh(autoRefresh);
-  }, []);
-
   return {
     timeRange,
     setTimeRange,
diff --git a/x-pack/legacy/plugins/infra/public/pages/metrics/components/chart_section_vis.tsx b/x-pack/legacy/plugins/infra/public/pages/metrics/components/chart_section_vis.tsx
index 425b5a43f793f..309961cc39025 100644
--- a/x-pack/legacy/plugins/infra/public/pages/metrics/components/chart_section_vis.tsx
+++ b/x-pack/legacy/plugins/infra/public/pages/metrics/components/chart_section_vis.tsx
@@ -3,7 +3,7 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import React, { useCallback } from 'react';
+import React, { useCallback, useMemo } from 'react';
 import moment from 'moment';
 import { i18n } from '@kbn/i18n';
 import {
@@ -42,15 +42,15 @@ export const ChartSectionVis = ({
   seriesOverrides,
   type,
 }: VisSectionProps) => {
-  if (!metric || !id) {
-    return null;
-  }
   const [dateFormat] = useKibanaUiSetting('dateFormat');
   const valueFormatter = useCallback(getFormatter(formatter, formatterTemplate), [
     formatter,
     formatterTemplate,
   ]);
-  const dateFormatter = useCallback(niceTimeFormatter(getMaxMinTimestamp(metric)), [metric]);
+  const dateFormatter = useMemo(
+    () => (metric != null ? niceTimeFormatter(getMaxMinTimestamp(metric)) : undefined),
+    [metric]
+  );
   const handleTimeChange = useCallback(
     (from: number, to: number) => {
       if (onChangeRangeTime) {
@@ -73,7 +73,9 @@ export const ChartSectionVis = ({
     ),
   };
 
-  if (!metric) {
+  if (!id) {
+    return null;
+  } else if (!metric) {
     return (
       <ErrorMessage
         title={i18n.translate('xpack.infra.chartSection.missingMetricDataText', {
@@ -84,9 +86,7 @@ export const ChartSectionVis = ({
         })}
       />
     );
-  }
-
-  if (metric.series.some(seriesHasLessThen2DataPoints)) {
+  } else if (metric.series.some(seriesHasLessThen2DataPoints)) {
     return (
       <ErrorMessage
         title={i18n.translate('xpack.infra.chartSection.notEnoughDataPointsToRenderTitle', {
diff --git a/x-pack/legacy/plugins/infra/public/pages/metrics/components/node_details_page.tsx b/x-pack/legacy/plugins/infra/public/pages/metrics/components/node_details_page.tsx
index cc1f23d676448..933831c6ec87d 100644
--- a/x-pack/legacy/plugins/infra/public/pages/metrics/components/node_details_page.tsx
+++ b/x-pack/legacy/plugins/infra/public/pages/metrics/components/node_details_page.tsx
@@ -41,7 +41,7 @@ interface Props {
   isAutoReloading: boolean;
   refreshInterval: number;
   sideNav: NavItem[];
-  metadata: InfraMetadata | null;
+  metadata: InfraMetadata;
   addNavItem(item: NavItem): void;
   setRefreshInterval(refreshInterval: number): void;
   setAutoReload(isAutoReloading: boolean): void;
@@ -49,10 +49,6 @@ interface Props {
   setTimeRange(timeRange: MetricsTimeInput): void;
 }
 export const NodeDetailsPage = (props: Props) => {
-  if (!props.metadata) {
-    return null;
-  }
-
   const { parsedTimeRange } = props;
   const { metrics, loading, makeRequest, error } = useNodeDetails(
     props.requiredMetrics,
@@ -65,11 +61,11 @@ export const NodeDetailsPage = (props: Props) => {
 
   const refetch = useCallback(() => {
     makeRequest();
-  }, []);
+  }, [makeRequest]);
 
   useEffect(() => {
     makeRequest();
-  }, [parsedTimeRange]);
+  }, [makeRequest, parsedTimeRange]);
 
   if (error) {
     return <PageError error={error} name={props.name} />;
diff --git a/x-pack/legacy/plugins/infra/public/pages/metrics/components/section.tsx b/x-pack/legacy/plugins/infra/public/pages/metrics/components/section.tsx
index 32d2e2eff8ab9..2f9ed9f54df82 100644
--- a/x-pack/legacy/plugins/infra/public/pages/metrics/components/section.tsx
+++ b/x-pack/legacy/plugins/infra/public/pages/metrics/components/section.tsx
@@ -4,15 +4,15 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { EuiTitle } from '@elastic/eui';
 import React, {
-  useContext,
   Children,
-  isValidElement,
   cloneElement,
   FunctionComponent,
-  useMemo,
+  isValidElement,
+  useContext,
 } from 'react';
-import { EuiTitle } from '@elastic/eui';
+
 import { SideNavContext, SubNavItem } from '../lib/side_nav_context';
 import { LayoutProps } from '../types';
 
@@ -31,35 +31,42 @@ export const Section: FunctionComponent<SectionProps> = ({
   stopLiveStreaming,
 }) => {
   const { addNavItem } = useContext(SideNavContext);
-  const subNavItems: SubNavItem[] = [];
 
-  const childrenWithProps = useMemo(
-    () =>
-      Children.map(children, child => {
-        if (isValidElement(child)) {
-          const metric = (metrics && metrics.find(m => m.id === child.props.id)) || null;
-          if (metric) {
-            subNavItems.push({
-              id: child.props.id,
-              name: child.props.label,
-              onClick: () => {
-                const el = document.getElementById(child.props.id);
-                if (el) {
-                  el.scrollIntoView();
-                }
-              },
-            });
-          }
-          return cloneElement(child, {
-            metrics,
-            onChangeRangeTime,
-            isLiveStreaming,
-            stopLiveStreaming,
-          });
-        }
-        return null;
-      }),
-    [children, metrics, onChangeRangeTime, isLiveStreaming, stopLiveStreaming]
+  const subNavItems = Children.toArray(children).reduce<SubNavItem[]>(
+    (accumulatedChildren, child) => {
+      if (!isValidElement(child)) {
+        return accumulatedChildren;
+      }
+      const metric = metrics?.find(m => m.id === child.props.id) ?? null;
+      if (metric === null) {
+        return accumulatedChildren;
+      }
+      return [
+        ...accumulatedChildren,
+        {
+          id: child.props.id,
+          name: child.props.label,
+          onClick: () => {
+            const el = document.getElementById(child.props.id);
+            if (el) {
+              el.scrollIntoView();
+            }
+          },
+        },
+      ];
+    },
+    []
+  );
+
+  const childrenWithProps = Children.map(children, child =>
+    isValidElement(child)
+      ? cloneElement(child, {
+          metrics,
+          onChangeRangeTime,
+          isLiveStreaming,
+          stopLiveStreaming,
+        })
+      : null
   );
 
   if (metrics && subNavItems.length) {
diff --git a/x-pack/legacy/plugins/infra/public/pages/metrics/components/sub_section.tsx b/x-pack/legacy/plugins/infra/public/pages/metrics/components/sub_section.tsx
index f3db3b1670199..325d510293135 100644
--- a/x-pack/legacy/plugins/infra/public/pages/metrics/components/sub_section.tsx
+++ b/x-pack/legacy/plugins/infra/public/pages/metrics/components/sub_section.tsx
@@ -23,29 +23,25 @@ export const SubSection: FunctionComponent<SubSectionProps> = ({
   isLiveStreaming,
   stopLiveStreaming,
 }) => {
-  if (!children || !metrics) {
+  const metric = useMemo(() => metrics?.find(m => m.id === id), [id, metrics]);
+
+  if (!children || !metric) {
     return null;
   }
-  const metric = metrics.find(m => m.id === id);
-  if (!metric) {
+
+  const childrenWithProps = Children.map(children, child => {
+    if (isValidElement(child)) {
+      return cloneElement(child, {
+        metric,
+        id,
+        onChangeRangeTime,
+        isLiveStreaming,
+        stopLiveStreaming,
+      });
+    }
     return null;
-  }
-  const childrenWithProps = useMemo(
-    () =>
-      Children.map(children, child => {
-        if (isValidElement(child)) {
-          return cloneElement(child, {
-            metric,
-            id,
-            onChangeRangeTime,
-            isLiveStreaming,
-            stopLiveStreaming,
-          });
-        }
-        return null;
-      }),
-    [children, metric, id, onChangeRangeTime, isLiveStreaming, stopLiveStreaming]
-  );
+  });
+
   return (
     <div style={{ margin: '10px 0 16px 0' }} id={id}>
       {label ? (
diff --git a/x-pack/legacy/plugins/infra/public/pages/metrics/containers/with_metrics_time.tsx b/x-pack/legacy/plugins/infra/public/pages/metrics/containers/with_metrics_time.tsx
index 432725b6f62b0..64d2ddb67139d 100644
--- a/x-pack/legacy/plugins/infra/public/pages/metrics/containers/with_metrics_time.tsx
+++ b/x-pack/legacy/plugins/infra/public/pages/metrics/containers/with_metrics_time.tsx
@@ -59,13 +59,10 @@ export const useMetricsTime = () => {
 
   const [parsedTimeRange, setParsedTimeRange] = useState(parseRange(defaultRange));
 
-  const updateTimeRange = useCallback(
-    (range: MetricsTimeInput) => {
-      setTimeRange(range);
-      setParsedTimeRange(parseRange(range));
-    },
-    [setParsedTimeRange]
-  );
+  const updateTimeRange = useCallback((range: MetricsTimeInput) => {
+    setTimeRange(range);
+    setParsedTimeRange(parseRange(range));
+  }, []);
 
   return {
     timeRange,
diff --git a/x-pack/legacy/plugins/infra/public/pages/metrics/index.tsx b/x-pack/legacy/plugins/infra/public/pages/metrics/index.tsx
index 93253406aec2d..b330ad02f1022 100644
--- a/x-pack/legacy/plugins/infra/public/pages/metrics/index.tsx
+++ b/x-pack/legacy/plugins/infra/public/pages/metrics/index.tsx
@@ -112,26 +112,28 @@ export const MetricDetail = withMetricPageProviders(
                 })}
               />
               <DetailPageContent data-test-subj="infraMetricsPage">
-                <NodeDetailsPage
-                  name={name}
-                  requiredMetrics={filteredRequiredMetrics}
-                  sourceId={sourceId}
-                  timeRange={timeRange}
-                  parsedTimeRange={parsedTimeRange}
-                  nodeType={nodeType}
-                  nodeId={nodeId}
-                  cloudId={cloudId}
-                  metadataLoading={metadataLoading}
-                  isAutoReloading={isAutoReloading}
-                  refreshInterval={refreshInterval}
-                  sideNav={sideNav}
-                  metadata={metadata}
-                  addNavItem={addNavItem}
-                  setRefreshInterval={setRefreshInterval}
-                  setAutoReload={setAutoReload}
-                  triggerRefresh={triggerRefresh}
-                  setTimeRange={setTimeRange}
-                />
+                {metadata ? (
+                  <NodeDetailsPage
+                    name={name}
+                    requiredMetrics={filteredRequiredMetrics}
+                    sourceId={sourceId}
+                    timeRange={timeRange}
+                    parsedTimeRange={parsedTimeRange}
+                    nodeType={nodeType}
+                    nodeId={nodeId}
+                    cloudId={cloudId}
+                    metadataLoading={metadataLoading}
+                    isAutoReloading={isAutoReloading}
+                    refreshInterval={refreshInterval}
+                    sideNav={sideNav}
+                    metadata={metadata}
+                    addNavItem={addNavItem}
+                    setRefreshInterval={setRefreshInterval}
+                    setAutoReload={setAutoReload}
+                    triggerRefresh={triggerRefresh}
+                    setTimeRange={setTimeRange}
+                  />
+                ) : null}
               </DetailPageContent>
             </ColumnarPage>
           )}
diff --git a/x-pack/legacy/plugins/infra/public/utils/cancellable_effect.ts b/x-pack/legacy/plugins/infra/public/utils/cancellable_effect.ts
index bb7d253ea1557..a986af07f0c9a 100644
--- a/x-pack/legacy/plugins/infra/public/utils/cancellable_effect.ts
+++ b/x-pack/legacy/plugins/infra/public/utils/cancellable_effect.ts
@@ -27,5 +27,8 @@ export const useCancellableEffect = (
     effect(() => cancellationSignal.isCancelled);
 
     return cancellationSignal.cancel;
+
+    // the dependencies are managed externally
+    // eslint-disable-next-line react-hooks/exhaustive-deps
   }, deps);
 };
diff --git a/x-pack/legacy/plugins/infra/public/utils/use_kibana_ui_setting.ts b/x-pack/legacy/plugins/infra/public/utils/use_kibana_ui_setting.ts
index c48f95a6521cf..1b08fb4231243 100644
--- a/x-pack/legacy/plugins/infra/public/utils/use_kibana_ui_setting.ts
+++ b/x-pack/legacy/plugins/infra/public/utils/use_kibana_ui_setting.ts
@@ -28,10 +28,15 @@ import { useObservable } from './use_observable';
 export const useKibanaUiSetting = (key: string, defaultValue?: any) => {
   const uiSettingsClient = npSetup.core.uiSettings;
 
-  const uiSetting$ = useMemo(() => uiSettingsClient.get$(key, defaultValue), [uiSettingsClient]);
+  const uiSetting$ = useMemo(() => uiSettingsClient.get$(key, defaultValue), [
+    defaultValue,
+    key,
+    uiSettingsClient,
+  ]);
   const uiSetting = useObservable(uiSetting$);
 
   const setUiSetting = useCallback((value: any) => uiSettingsClient.set(key, value), [
+    key,
     uiSettingsClient,
   ]);
 
diff --git a/x-pack/legacy/plugins/infra/public/utils/use_tracked_promise.ts b/x-pack/legacy/plugins/infra/public/utils/use_tracked_promise.ts
index 366caf0dfb156..c23bab7026aaa 100644
--- a/x-pack/legacy/plugins/infra/public/utils/use_tracked_promise.ts
+++ b/x-pack/legacy/plugins/infra/public/utils/use_tracked_promise.ts
@@ -190,6 +190,8 @@ export const useTrackedPromise = <Arguments extends any[], Result>(
 
       return newPendingPromise.promise;
     },
+    // the dependencies are managed by the caller
+    // eslint-disable-next-line react-hooks/exhaustive-deps
     dependencies
   );
 
diff --git a/x-pack/legacy/plugins/infra/public/utils/use_url_state.ts b/x-pack/legacy/plugins/infra/public/utils/use_url_state.ts
index d03a5aaa9d697..79a5d552bcd78 100644
--- a/x-pack/legacy/plugins/infra/public/utils/use_url_state.ts
+++ b/x-pack/legacy/plugins/infra/public/utils/use_url_state.ts
@@ -5,10 +5,10 @@
  */
 
 import { Location } from 'history';
-import { useMemo, useCallback } from 'react';
+import { useCallback, useEffect, useMemo, useState } from 'react';
 import { decode, encode, RisonValue } from 'rison-node';
-
 import { QueryString } from 'ui/utils/query_string';
+
 import { useHistory } from './history_context';
 
 export const useUrlState = <State>({
@@ -16,21 +16,26 @@ export const useUrlState = <State>({
   decodeUrlState,
   encodeUrlState,
   urlStateKey,
+  writeDefaultState = false,
 }: {
   defaultState: State;
   decodeUrlState: (value: RisonValue | undefined) => State | undefined;
   encodeUrlState: (value: State) => RisonValue | undefined;
   urlStateKey: string;
+  writeDefaultState?: boolean;
 }) => {
   const history = useHistory();
 
+  // history.location is mutable so we can't reliably use useMemo
+  const queryString = history?.location ? getQueryStringFromLocation(history.location) : '';
+
   const urlStateString = useMemo(() => {
-    if (!history) {
+    if (!queryString) {
       return;
     }
 
-    return getParamFromQueryString(getQueryStringFromLocation(history.location), urlStateKey);
-  }, [history && history.location, urlStateKey]);
+    return getParamFromQueryString(queryString, urlStateKey);
+  }, [queryString, urlStateKey]);
 
   const decodedState = useMemo(() => decodeUrlState(decodeRisonUrlState(urlStateString)), [
     decodeUrlState,
@@ -44,27 +49,38 @@ export const useUrlState = <State>({
 
   const setState = useCallback(
     (newState: State | undefined) => {
-      if (!history) {
+      if (!history || !history.location) {
         return;
       }
 
-      const location = history.location;
+      const currentLocation = history.location;
 
       const newLocation = replaceQueryStringInLocation(
-        location,
+        currentLocation,
         replaceStateKeyInQueryString(
           urlStateKey,
           typeof newState !== 'undefined' ? encodeUrlState(newState) : undefined
-        )(getQueryStringFromLocation(location))
+        )(getQueryStringFromLocation(currentLocation))
       );
 
-      if (newLocation !== location) {
+      if (newLocation !== currentLocation) {
         history.replace(newLocation);
       }
     },
-    [encodeUrlState, history, history && history.location, urlStateKey]
+    [encodeUrlState, history, urlStateKey]
   );
 
+  const [shouldInitialize, setShouldInitialize] = useState(
+    writeDefaultState && typeof decodedState === 'undefined'
+  );
+
+  useEffect(() => {
+    if (shouldInitialize) {
+      setShouldInitialize(false);
+      setState(defaultState);
+    }
+  }, [shouldInitialize, setState, defaultState]);
+
   return [state, setState] as [typeof state, typeof setState];
 };
 
diff --git a/x-pack/legacy/plugins/infra/public/utils/use_visibility_state.ts b/x-pack/legacy/plugins/infra/public/utils/use_visibility_state.ts
index 5763834b1cc2a..f4d8b572e4f7f 100644
--- a/x-pack/legacy/plugins/infra/public/utils/use_visibility_state.ts
+++ b/x-pack/legacy/plugins/infra/public/utils/use_visibility_state.ts
@@ -20,6 +20,6 @@ export const useVisibilityState = (initialState: boolean) => {
       show,
       toggle,
     }),
-    [isVisible, show, hide]
+    [hide, isVisible, show, toggle]
   );
 };

From 489b39cfe7cc88dfc2ba77d2f8af93fdf08c36db Mon Sep 17 00:00:00 2001
From: Joe Reuter <johannes.reuter@elastic.co>
Date: Wed, 11 Dec 2019 14:14:25 +0100
Subject: [PATCH 23/24] Re-enable datemath in from/to canvas timelion args
 (#52159)

---
 .../canvas/public/functions/timelion.ts       | 31 ++++++++++++++++---
 1 file changed, 27 insertions(+), 4 deletions(-)

diff --git a/x-pack/legacy/plugins/canvas/public/functions/timelion.ts b/x-pack/legacy/plugins/canvas/public/functions/timelion.ts
index ee7dd981009d9..4377f2cb4d53b 100644
--- a/x-pack/legacy/plugins/canvas/public/functions/timelion.ts
+++ b/x-pack/legacy/plugins/canvas/public/functions/timelion.ts
@@ -5,7 +5,10 @@
  */
 
 import { flatten } from 'lodash';
+import moment from 'moment-timezone';
 import chrome from 'ui/chrome';
+import { npStart } from 'ui/new_platform';
+import { TimeRange } from 'src/plugins/data/common';
 import { ExpressionFunction, DatatableRow } from 'src/plugins/expressions/public';
 import { fetch } from '../../common/lib/fetch';
 // @ts-ignore untyped local
@@ -21,6 +24,26 @@ interface Arguments {
   timezone: string;
 }
 
+/**
+ * This function parses a given time range containing date math
+ * and returns ISO dates. Parsing is done respecting the given time zone.
+ * @param timeRange time range to parse
+ * @param timeZone time zone to do the parsing in
+ */
+function parseDateMath(timeRange: TimeRange, timeZone: string) {
+  // the datemath plugin always parses dates by using the current default moment time zone.
+  // to use the configured time zone, we are switching just for the bounds calculation.
+  const defaultTimezone = moment().zoneName();
+  moment.tz.setDefault(timeZone);
+
+  const parsedRange = npStart.plugins.data.query.timefilter.timefilter.calculateBounds(timeRange);
+
+  // reset default moment timezone
+  moment.tz.setDefault(defaultTimezone);
+
+  return parsedRange;
+}
+
 export function timelion(): ExpressionFunction<'timelion', Filter, Arguments, Promise<Datatable>> {
   const { help, args: argHelp } = getFunctionHelp().timelion;
 
@@ -64,8 +87,8 @@ export function timelion(): ExpressionFunction<'timelion', Filter, Arguments, Pr
       // workpad, if it exists. Otherwise fall back on the function args.
       const timeFilter = context.and.find(and => and.type === 'time');
       const range = timeFilter
-        ? { from: timeFilter.from, to: timeFilter.to }
-        : { from: args.from, to: args.to };
+        ? { min: timeFilter.from, max: timeFilter.to }
+        : parseDateMath({ from: args.from, to: args.to }, args.timezone);
 
       const body = {
         extended: {
@@ -79,8 +102,8 @@ export function timelion(): ExpressionFunction<'timelion', Filter, Arguments, Pr
         },
         sheet: [args.query],
         time: {
-          from: range.from,
-          to: range.to,
+          from: range.min,
+          to: range.max,
           interval: args.interval,
           timezone: args.timezone,
         },

From b6ea6990c0b679aa890ff87b161f78485f3b7200 Mon Sep 17 00:00:00 2001
From: Joe Reuter <johannes.reuter@elastic.co>
Date: Wed, 11 Dec 2019 14:19:28 +0100
Subject: [PATCH 24/24] Migrate url shortener service (#50896)

---
 .github/CODEOWNERS                            |   4 +-
 .../url_shortening/routes/create_routes.js    |   2 -
 .../server/url_shortening/routes/goto.js      |   8 +-
 .../routes/lib/short_url_lookup.js            |  24 ----
 .../routes/lib/short_url_lookup.test.js       |  37 ------
 src/plugins/share/kibana.json                 |   2 +-
 .../share/server/index.ts}                    |  20 +--
 src/plugins/share/server/plugin.ts            |  37 ++++++
 .../share/server/routes/create_routes.ts      |  32 +++++
 src/plugins/share/server/routes/goto.ts       |  64 +++++++++
 .../routes/lib/short_url_assert_valid.test.ts |  63 +++++++++
 .../routes/lib/short_url_assert_valid.ts      |  41 ++++++
 .../routes/lib/short_url_lookup.test.ts       | 125 ++++++++++++++++++
 .../server/routes/lib/short_url_lookup.ts     |  84 ++++++++++++
 .../share/server/routes/shorten_url.ts        |  48 +++++++
 .../apis/short_urls/feature_controls.ts       |   2 +-
 16 files changed, 504 insertions(+), 89 deletions(-)
 rename src/{legacy/server/url_shortening/routes/shorten_url.js => plugins/share/server/index.ts} (60%)
 create mode 100644 src/plugins/share/server/plugin.ts
 create mode 100644 src/plugins/share/server/routes/create_routes.ts
 create mode 100644 src/plugins/share/server/routes/goto.ts
 create mode 100644 src/plugins/share/server/routes/lib/short_url_assert_valid.test.ts
 create mode 100644 src/plugins/share/server/routes/lib/short_url_assert_valid.ts
 create mode 100644 src/plugins/share/server/routes/lib/short_url_lookup.test.ts
 create mode 100644 src/plugins/share/server/routes/lib/short_url_lookup.ts
 create mode 100644 src/plugins/share/server/routes/shorten_url.ts

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index c5e6768c17d46..338fbf2e359b7 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -5,6 +5,8 @@
 # App
 /x-pack/legacy/plugins/lens/ @elastic/kibana-app
 /x-pack/legacy/plugins/graph/ @elastic/kibana-app
+/src/plugins/share/ @elastic/kibana-app
+/src/legacy/server/url_shortening/ @elastic/kibana-app
 /src/legacy/server/sample_data/ @elastic/kibana-app
 
 # App Architecture
@@ -14,7 +16,6 @@
 /src/plugins/kibana_react/ @elastic/kibana-app-arch
 /src/plugins/kibana_utils/ @elastic/kibana-app-arch
 /src/plugins/navigation/ @elastic/kibana-app-arch
-/src/plugins/share/ @elastic/kibana-app-arch
 /src/plugins/ui_actions/ @elastic/kibana-app-arch
 /src/plugins/visualizations/ @elastic/kibana-app-arch
 /x-pack/plugins/advanced_ui_actions/ @elastic/kibana-app-arch
@@ -28,7 +29,6 @@
 /src/legacy/core_plugins/kibana/server/routes/api/suggestions/ @elastic/kibana-app-arch
 /src/legacy/core_plugins/visualizations/ @elastic/kibana-app-arch
 /src/legacy/server/index_patterns/ @elastic/kibana-app-arch
-/src/legacy/server/url_shortening/ @elastic/kibana-app-arch
 
 # APM
 /x-pack/legacy/plugins/apm/  @elastic/apm-ui
diff --git a/src/legacy/server/url_shortening/routes/create_routes.js b/src/legacy/server/url_shortening/routes/create_routes.js
index 091eabcf47c1f..c6347ace873f7 100644
--- a/src/legacy/server/url_shortening/routes/create_routes.js
+++ b/src/legacy/server/url_shortening/routes/create_routes.js
@@ -19,12 +19,10 @@
 
 import { shortUrlLookupProvider } from './lib/short_url_lookup';
 import { createGotoRoute } from './goto';
-import { createShortenUrlRoute } from './shorten_url';
 
 
 export function createRoutes(server) {
   const shortUrlLookup = shortUrlLookupProvider(server);
 
   server.route(createGotoRoute({ server, shortUrlLookup }));
-  server.route(createShortenUrlRoute({ shortUrlLookup }));
 }
diff --git a/src/legacy/server/url_shortening/routes/goto.js b/src/legacy/server/url_shortening/routes/goto.js
index 675bc5df50670..60a34499dd2d5 100644
--- a/src/legacy/server/url_shortening/routes/goto.js
+++ b/src/legacy/server/url_shortening/routes/goto.js
@@ -22,18 +22,12 @@ import { shortUrlAssertValid } from './lib/short_url_assert_valid';
 
 export const createGotoRoute = ({ server, shortUrlLookup }) => ({
   method: 'GET',
-  path: '/goto/{urlId}',
+  path: '/goto_LP/{urlId}',
   handler: async function (request, h) {
     try {
       const url = await shortUrlLookup.getUrl(request.params.urlId, request);
       shortUrlAssertValid(url);
 
-      const uiSettings = request.getUiSettingsService();
-      const stateStoreInSessionStorage = await uiSettings.get('state:storeInSessionStorage');
-      if (!stateStoreInSessionStorage) {
-        return h.redirect(request.getBasePath() + url);
-      }
-
       const app = server.getHiddenUiAppById('stateSessionStorageRedirect');
       return h.renderApp(app, {
         redirectUrl: url,
diff --git a/src/legacy/server/url_shortening/routes/lib/short_url_lookup.js b/src/legacy/server/url_shortening/routes/lib/short_url_lookup.js
index c4f6af03d7d93..3a4b96c802c58 100644
--- a/src/legacy/server/url_shortening/routes/lib/short_url_lookup.js
+++ b/src/legacy/server/url_shortening/routes/lib/short_url_lookup.js
@@ -17,7 +17,6 @@
  * under the License.
  */
 
-import crypto from 'crypto';
 import { get } from 'lodash';
 
 export function shortUrlLookupProvider(server) {
@@ -34,29 +33,6 @@ export function shortUrlLookupProvider(server) {
   }
 
   return {
-    async generateUrlId(url, req) {
-      const id = crypto.createHash('md5').update(url).digest('hex');
-      const savedObjectsClient = req.getSavedObjectsClient();
-      const { isConflictError } = savedObjectsClient.errors;
-
-      try {
-        const doc = await savedObjectsClient.create('url', {
-          url,
-          accessCount: 0,
-          createDate: new Date(),
-          accessDate: new Date()
-        }, { id });
-
-        return doc.id;
-      } catch (error) {
-        if (isConflictError(error)) {
-          return id;
-        }
-
-        throw error;
-      }
-    },
-
     async getUrl(id, req) {
       const doc = await req.getSavedObjectsClient().get('url', id);
       updateMetadata(doc, req);
diff --git a/src/legacy/server/url_shortening/routes/lib/short_url_lookup.test.js b/src/legacy/server/url_shortening/routes/lib/short_url_lookup.test.js
index 033aeb92926a5..7303682c63e0b 100644
--- a/src/legacy/server/url_shortening/routes/lib/short_url_lookup.test.js
+++ b/src/legacy/server/url_shortening/routes/lib/short_url_lookup.test.js
@@ -48,43 +48,6 @@ describe('shortUrlLookupProvider', () => {
     sandbox.restore();
   });
 
-  describe('generateUrlId', () => {
-    it('returns the document id', async () => {
-      const id = await shortUrl.generateUrlId(URL, req);
-      expect(id).toEqual(ID);
-    });
-
-    it('provides correct arguments to savedObjectsClient', async () => {
-      await shortUrl.generateUrlId(URL, req);
-
-      sinon.assert.calledOnce(savedObjectsClient.create);
-      const [type, attributes, options] = savedObjectsClient.create.getCall(0).args;
-
-      expect(type).toEqual(TYPE);
-      expect(Object.keys(attributes).sort()).toEqual(['accessCount', 'accessDate', 'createDate', 'url']);
-      expect(attributes.url).toEqual(URL);
-      expect(options.id).toEqual(ID);
-    });
-
-    it('passes persists attributes', async () => {
-      await shortUrl.generateUrlId(URL, req);
-
-      sinon.assert.calledOnce(savedObjectsClient.create);
-      const [type, attributes] = savedObjectsClient.create.getCall(0).args;
-
-      expect(type).toEqual(TYPE);
-      expect(Object.keys(attributes).sort()).toEqual(['accessCount', 'accessDate', 'createDate', 'url']);
-      expect(attributes.url).toEqual(URL);
-    });
-
-    it('gracefully handles version conflict', async () => {
-      const error = savedObjectsClient.errors.decorateConflictError(new Error());
-      savedObjectsClient.create.throws(error);
-      const id = await shortUrl.generateUrlId(URL, req);
-      expect(id).toEqual(ID);
-    });
-  });
-
   describe('getUrl', () => {
     beforeEach(() => {
       const attributes = { accessCount: 2, url: URL };
diff --git a/src/plugins/share/kibana.json b/src/plugins/share/kibana.json
index bbe393a76c5da..dce2ac9281aba 100644
--- a/src/plugins/share/kibana.json
+++ b/src/plugins/share/kibana.json
@@ -1,6 +1,6 @@
 {
   "id": "share",
   "version": "kibana",
-  "server": false,
+  "server": true,
   "ui": true
 }
diff --git a/src/legacy/server/url_shortening/routes/shorten_url.js b/src/plugins/share/server/index.ts
similarity index 60%
rename from src/legacy/server/url_shortening/routes/shorten_url.js
rename to src/plugins/share/server/index.ts
index 0203e9373384a..9e574314f8000 100644
--- a/src/legacy/server/url_shortening/routes/shorten_url.js
+++ b/src/plugins/share/server/index.ts
@@ -17,19 +17,9 @@
  * under the License.
  */
 
-import { handleShortUrlError } from './lib/short_url_error';
-import { shortUrlAssertValid } from './lib/short_url_assert_valid';
+import { PluginInitializerContext } from '../../../core/server';
+import { SharePlugin } from './plugin';
 
-export const createShortenUrlRoute = ({ shortUrlLookup }) => ({
-  method: 'POST',
-  path: '/api/shorten_url',
-  handler: async function (request) {
-    try {
-      shortUrlAssertValid(request.payload.url);
-      const urlId = await shortUrlLookup.generateUrlId(request.payload.url, request);
-      return { urlId };
-    } catch (err) {
-      throw handleShortUrlError(err);
-    }
-  }
-});
+export function plugin(initializerContext: PluginInitializerContext) {
+  return new SharePlugin(initializerContext);
+}
diff --git a/src/plugins/share/server/plugin.ts b/src/plugins/share/server/plugin.ts
new file mode 100644
index 0000000000000..bcb681a50652a
--- /dev/null
+++ b/src/plugins/share/server/plugin.ts
@@ -0,0 +1,37 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { CoreSetup, Plugin, PluginInitializerContext } from 'kibana/server';
+import { createRoutes } from './routes/create_routes';
+
+export class SharePlugin implements Plugin {
+  constructor(private readonly initializerContext: PluginInitializerContext) {}
+
+  public async setup(core: CoreSetup) {
+    createRoutes(core, this.initializerContext.logger.get());
+  }
+
+  public start() {
+    this.initializerContext.logger.get().debug('Starting plugin');
+  }
+
+  public stop() {
+    this.initializerContext.logger.get().debug('Stopping plugin');
+  }
+}
diff --git a/src/plugins/share/server/routes/create_routes.ts b/src/plugins/share/server/routes/create_routes.ts
new file mode 100644
index 0000000000000..bd4b6fdb08791
--- /dev/null
+++ b/src/plugins/share/server/routes/create_routes.ts
@@ -0,0 +1,32 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { CoreSetup, Logger } from 'kibana/server';
+
+import { shortUrlLookupProvider } from './lib/short_url_lookup';
+import { createGotoRoute } from './goto';
+import { createShortenUrlRoute } from './shorten_url';
+
+export function createRoutes({ http }: CoreSetup, logger: Logger) {
+  const shortUrlLookup = shortUrlLookupProvider({ logger });
+  const router = http.createRouter();
+
+  createGotoRoute({ router, shortUrlLookup, http });
+  createShortenUrlRoute({ router, shortUrlLookup });
+}
diff --git a/src/plugins/share/server/routes/goto.ts b/src/plugins/share/server/routes/goto.ts
new file mode 100644
index 0000000000000..7343dc1bd34a2
--- /dev/null
+++ b/src/plugins/share/server/routes/goto.ts
@@ -0,0 +1,64 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { CoreSetup, IRouter } from 'kibana/server';
+import { schema } from '@kbn/config-schema';
+
+import { shortUrlAssertValid } from './lib/short_url_assert_valid';
+import { ShortUrlLookupService } from './lib/short_url_lookup';
+
+export const createGotoRoute = ({
+  router,
+  shortUrlLookup,
+  http,
+}: {
+  router: IRouter;
+  shortUrlLookup: ShortUrlLookupService;
+  http: CoreSetup['http'];
+}) => {
+  router.get(
+    {
+      path: '/goto/{urlId}',
+      validate: {
+        params: schema.object({ urlId: schema.string() }),
+      },
+    },
+    router.handleLegacyErrors(async function(context, request, response) {
+      const url = await shortUrlLookup.getUrl(request.params.urlId, {
+        savedObjects: context.core.savedObjects.client,
+      });
+      shortUrlAssertValid(url);
+
+      const uiSettings = context.core.uiSettings.client;
+      const stateStoreInSessionStorage = await uiSettings.get('state:storeInSessionStorage');
+      if (!stateStoreInSessionStorage) {
+        return response.redirected({
+          headers: {
+            location: http.basePath.prepend(url),
+          },
+        });
+      }
+      return response.redirected({
+        headers: {
+          location: http.basePath.prepend('/goto_LP/' + request.params.urlId),
+        },
+      });
+    })
+  );
+};
diff --git a/src/plugins/share/server/routes/lib/short_url_assert_valid.test.ts b/src/plugins/share/server/routes/lib/short_url_assert_valid.test.ts
new file mode 100644
index 0000000000000..f83073e6aefe9
--- /dev/null
+++ b/src/plugins/share/server/routes/lib/short_url_assert_valid.test.ts
@@ -0,0 +1,63 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { shortUrlAssertValid } from './short_url_assert_valid';
+
+describe('shortUrlAssertValid()', () => {
+  const invalid = [
+    ['protocol', 'http://localhost:5601/app/kibana'],
+    ['protocol', 'https://localhost:5601/app/kibana'],
+    ['protocol', 'mailto:foo@bar.net'],
+    ['protocol', 'javascript:alert("hi")'], // eslint-disable-line no-script-url
+    ['hostname', 'localhost/app/kibana'],
+    ['hostname and port', 'local.host:5601/app/kibana'],
+    ['hostname and auth', 'user:pass@localhost.net/app/kibana'],
+    ['path traversal', '/app/../../not-kibana'],
+    ['deep path', '/app/kibana/foo'],
+    ['deep path', '/app/kibana/foo/bar'],
+    ['base path', '/base/app/kibana'],
+  ];
+
+  invalid.forEach(([desc, url]) => {
+    it(`fails when url has ${desc}`, () => {
+      try {
+        shortUrlAssertValid(url);
+        throw new Error(`expected assertion to throw`);
+      } catch (err) {
+        if (!err || !err.isBoom) {
+          throw err;
+        }
+      }
+    });
+  });
+
+  const valid = [
+    '/app/kibana',
+    '/app/monitoring#angular/route',
+    '/app/text#document-id',
+    '/app/some?with=query',
+    '/app/some?with=query#and-a-hash',
+  ];
+
+  valid.forEach(url => {
+    it(`allows ${url}`, () => {
+      shortUrlAssertValid(url);
+    });
+  });
+});
diff --git a/src/plugins/share/server/routes/lib/short_url_assert_valid.ts b/src/plugins/share/server/routes/lib/short_url_assert_valid.ts
new file mode 100644
index 0000000000000..2f120bbc03cd7
--- /dev/null
+++ b/src/plugins/share/server/routes/lib/short_url_assert_valid.ts
@@ -0,0 +1,41 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { parse } from 'url';
+import { trim } from 'lodash';
+import Boom from 'boom';
+
+export function shortUrlAssertValid(url: string) {
+  const { protocol, hostname, pathname } = parse(url);
+
+  if (protocol) {
+    throw Boom.notAcceptable(`Short url targets cannot have a protocol, found "${protocol}"`);
+  }
+
+  if (hostname) {
+    throw Boom.notAcceptable(`Short url targets cannot have a hostname, found "${hostname}"`);
+  }
+
+  const pathnameParts = trim(pathname, '/').split('/');
+  if (pathnameParts.length !== 2) {
+    throw Boom.notAcceptable(
+      `Short url target path must be in the format "/app/{{appId}}", found "${pathname}"`
+    );
+  }
+}
diff --git a/src/plugins/share/server/routes/lib/short_url_lookup.test.ts b/src/plugins/share/server/routes/lib/short_url_lookup.test.ts
new file mode 100644
index 0000000000000..87e2b7b726e59
--- /dev/null
+++ b/src/plugins/share/server/routes/lib/short_url_lookup.test.ts
@@ -0,0 +1,125 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { shortUrlLookupProvider, ShortUrlLookupService } from './short_url_lookup';
+import { SavedObjectsClientContract, Logger } from 'kibana/server';
+import { SavedObjectsClient } from '../../../../../core/server';
+
+describe('shortUrlLookupProvider', () => {
+  const ID = 'bf00ad16941fc51420f91a93428b27a0';
+  const TYPE = 'url';
+  const URL = 'http://elastic.co';
+
+  let savedObjects: jest.Mocked<SavedObjectsClientContract>;
+  let deps: { savedObjects: SavedObjectsClientContract };
+  let shortUrl: ShortUrlLookupService;
+
+  beforeEach(() => {
+    savedObjects = ({
+      get: jest.fn(),
+      create: jest.fn(() => Promise.resolve({ id: ID })),
+      update: jest.fn(),
+      errors: SavedObjectsClient.errors,
+    } as unknown) as jest.Mocked<SavedObjectsClientContract>;
+
+    deps = { savedObjects };
+    shortUrl = shortUrlLookupProvider({ logger: ({ warn: () => {} } as unknown) as Logger });
+  });
+
+  describe('generateUrlId', () => {
+    it('returns the document id', async () => {
+      const id = await shortUrl.generateUrlId(URL, deps);
+      expect(id).toEqual(ID);
+    });
+
+    it('provides correct arguments to savedObjectsClient', async () => {
+      await shortUrl.generateUrlId(URL, { savedObjects });
+
+      expect(savedObjects.create).toHaveBeenCalledTimes(1);
+      const [type, attributes, options] = savedObjects.create.mock.calls[0];
+
+      expect(type).toEqual(TYPE);
+      expect(Object.keys(attributes).sort()).toEqual([
+        'accessCount',
+        'accessDate',
+        'createDate',
+        'url',
+      ]);
+      expect(attributes.url).toEqual(URL);
+      expect(options!.id).toEqual(ID);
+    });
+
+    it('passes persists attributes', async () => {
+      await shortUrl.generateUrlId(URL, deps);
+
+      expect(savedObjects.create).toHaveBeenCalledTimes(1);
+      const [type, attributes] = savedObjects.create.mock.calls[0];
+
+      expect(type).toEqual(TYPE);
+      expect(Object.keys(attributes).sort()).toEqual([
+        'accessCount',
+        'accessDate',
+        'createDate',
+        'url',
+      ]);
+      expect(attributes.url).toEqual(URL);
+    });
+
+    it('gracefully handles version conflict', async () => {
+      const error = savedObjects.errors.decorateConflictError(new Error());
+      savedObjects.create.mockImplementation(() => {
+        throw error;
+      });
+      const id = await shortUrl.generateUrlId(URL, deps);
+      expect(id).toEqual(ID);
+    });
+  });
+
+  describe('getUrl', () => {
+    beforeEach(() => {
+      const attributes = { accessCount: 2, url: URL };
+      savedObjects.get.mockResolvedValue({ id: ID, attributes, type: 'url', references: [] });
+    });
+
+    it('provides the ID to savedObjectsClient', async () => {
+      await shortUrl.getUrl(ID, { savedObjects });
+
+      expect(savedObjects.get).toHaveBeenCalledTimes(1);
+      expect(savedObjects.get).toHaveBeenCalledWith(TYPE, ID);
+    });
+
+    it('returns the url', async () => {
+      const response = await shortUrl.getUrl(ID, deps);
+      expect(response).toEqual(URL);
+    });
+
+    it('increments accessCount', async () => {
+      await shortUrl.getUrl(ID, { savedObjects });
+
+      expect(savedObjects.update).toHaveBeenCalledTimes(1);
+
+      const [type, id, attributes] = savedObjects.update.mock.calls[0];
+
+      expect(type).toEqual(TYPE);
+      expect(id).toEqual(ID);
+      expect(Object.keys(attributes).sort()).toEqual(['accessCount', 'accessDate']);
+      expect(attributes.accessCount).toEqual(3);
+    });
+  });
+});
diff --git a/src/plugins/share/server/routes/lib/short_url_lookup.ts b/src/plugins/share/server/routes/lib/short_url_lookup.ts
new file mode 100644
index 0000000000000..0d8a9c86621de
--- /dev/null
+++ b/src/plugins/share/server/routes/lib/short_url_lookup.ts
@@ -0,0 +1,84 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import crypto from 'crypto';
+import { get } from 'lodash';
+
+import { Logger, SavedObject, SavedObjectsClientContract } from 'kibana/server';
+
+export interface ShortUrlLookupService {
+  generateUrlId(url: string, deps: { savedObjects: SavedObjectsClientContract }): Promise<string>;
+  getUrl(url: string, deps: { savedObjects: SavedObjectsClientContract }): Promise<string>;
+}
+
+export function shortUrlLookupProvider({ logger }: { logger: Logger }): ShortUrlLookupService {
+  async function updateMetadata(
+    doc: SavedObject,
+    { savedObjects }: { savedObjects: SavedObjectsClientContract }
+  ) {
+    try {
+      await savedObjects.update('url', doc.id, {
+        accessDate: new Date().valueOf(),
+        accessCount: get(doc, 'attributes.accessCount', 0) + 1,
+      });
+    } catch (error) {
+      logger.warn('Warning: Error updating url metadata');
+      logger.warn(error);
+      // swallow errors. It isn't critical if there is no update.
+    }
+  }
+
+  return {
+    async generateUrlId(url, { savedObjects }) {
+      const id = crypto
+        .createHash('md5')
+        .update(url)
+        .digest('hex');
+      const { isConflictError } = savedObjects.errors;
+
+      try {
+        const doc = await savedObjects.create(
+          'url',
+          {
+            url,
+            accessCount: 0,
+            createDate: new Date().valueOf(),
+            accessDate: new Date().valueOf(),
+          },
+          { id }
+        );
+
+        return doc.id;
+      } catch (error) {
+        if (isConflictError(error)) {
+          return id;
+        }
+
+        throw error;
+      }
+    },
+
+    async getUrl(id, { savedObjects }) {
+      const doc = await savedObjects.get('url', id);
+      updateMetadata(doc, { savedObjects });
+
+      return doc.attributes.url;
+    },
+  };
+}
diff --git a/src/plugins/share/server/routes/shorten_url.ts b/src/plugins/share/server/routes/shorten_url.ts
new file mode 100644
index 0000000000000..116b90c6971c5
--- /dev/null
+++ b/src/plugins/share/server/routes/shorten_url.ts
@@ -0,0 +1,48 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { IRouter } from 'kibana/server';
+import { schema } from '@kbn/config-schema';
+
+import { shortUrlAssertValid } from './lib/short_url_assert_valid';
+import { ShortUrlLookupService } from './lib/short_url_lookup';
+
+export const createShortenUrlRoute = ({
+  shortUrlLookup,
+  router,
+}: {
+  shortUrlLookup: ShortUrlLookupService;
+  router: IRouter;
+}) => {
+  router.post(
+    {
+      path: '/api/shorten_url',
+      validate: {
+        body: schema.object({ url: schema.string() }),
+      },
+    },
+    router.handleLegacyErrors(async function(context, request, response) {
+      shortUrlAssertValid(request.body.url);
+      const urlId = await shortUrlLookup.generateUrlId(request.body.url, {
+        savedObjects: context.core.savedObjects.client,
+      });
+      return response.ok({ body: { urlId } });
+    })
+  );
+};
diff --git a/x-pack/test/api_integration/apis/short_urls/feature_controls.ts b/x-pack/test/api_integration/apis/short_urls/feature_controls.ts
index 06fd971399ea3..db5e11ef367ad 100644
--- a/x-pack/test/api_integration/apis/short_urls/feature_controls.ts
+++ b/x-pack/test/api_integration/apis/short_urls/feature_controls.ts
@@ -107,7 +107,7 @@ export default function featureControlsTests({ getService }: FtrProviderContext)
               expect(resp.status).to.eql(302);
               expect(resp.headers.location).to.eql('/app/kibana#foo/bar/baz');
             } else {
-              expect(resp.status).to.eql(500);
+              expect(resp.status).to.eql(403);
               expect(resp.headers.location).to.eql(undefined);
             }
           });